When does this Privacy Notice apply?

This Privacy Notice explains how we collect, use, and disclose your personal information any time you communicate or interact with us or our employees. This includes when you inquire about or purchase our services or products that we offer, visit one of our offices, visit our Site, use an App or Tool, or subscribe to our newsletter or register for a webinar via one of our social media accounts. This Privacy Notice also explains how we collect, use and disclose your personal information when you apply for employment with us.

What personal information does CHES collect and how does it collect it?

Directly: We may collect personal information directly from you when you inquire about or purchase our services or products that we offer, or interact with us. Depending on the type of product or service that you are inquiring about or purchasing, we may collect the following information:

• Information establishing your identity (such as your name, address, email address, phone number, date of birth, gender, Social Insurance Number ("SIN") and in some cases copies of government-issued documents) (for instance, for licensed employees, we may need to collect this and submit it to the regulators in connection with license renewals);
• Information about your financial status, including your annual income, the value of your assets (such as your investments, or assets that you seek to insure such as your home, cottage, vehicle, RV, or horse), liabilities, and your creditworthiness;
• Information about your payment methods, including the information we need to process payments for the products and services, and in some cases, complete transactions for the products and services;
• Information about your family, including spouse, children, and dependents;
• Information about your vehicle, including make, model, proof of vehicle ownership and vehicle identification number (VIN);
• Information about your occupation, including your employer;
• Information related to your estate or financial planning, including your financial goals, plans for retirement, and identities of your designated beneficiaries and heirs;
• Information about your health, including and medical conditions or diseases affecting you, lifestyle habits that may affect your health, medications that you take, or any allergies that you may have;
• Information about your travel history; and
• Information about your driving or criminal record, including history of any insurance claims.

There are many reasons why we ask for your SIN.

We may be required to collect your SIN: As described below in Section 3 of this Privacy Notice, 'Why does CHES collect my personal information?', your SIN is required by law for tax-reporting requirements.

You may voluntarily provide your SIN for other purposes: With your consent, we use your SIN as a unique identifier to keep your information separate from other customers and people with similar names. For example, if we need to verify your credit history, we use your SIN to confirm that the credit information we ask for and receive is about you and not someone with the same or similar name. You can request that we not use your SIN unless we are required to by law.

If you send us an email, phone us or use the live chat feature on the Site, we may collect personal information you provide to us during those communications, such as the content of your comments, complaints, feedback or inquiries. When we do so, we may record your information in order to:

• Establish a record of the information you provide
• Take or verify instructions from you
• Confirm your identity
• Maintain quality service levels
• Help with staff training

If you don't want your calls recorded, you can communicate with us in writing instead.

If you attend one of our physical offices, we may collect personal information about whether you have been fully vaccinated against COVID-19, where permitted by law. Where we have CCTV cameras, we may collect images of you.

We may automatically collect certain technical information from any device that you use to access the Site, interact with us online or use an App or Tool. This includes:

• Your device information, including IP address, device model & manufacturer, web browser type and version, hardware model, time zone setting, browser plug-in types and versions, and operating system version, as well as your internet service provider.
• Information about how you use the Site, including the uniform resource locators ("URLs") of other websites that you click to and from our Site (including the date and time clicked), page response times, download errors, length of visits to certain pages on the Site, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the Site;
• Information related to emails that we send you, including the types of emails we send that you open and click; and
• Information about our product webinars and seminars, including your registration and attendance at such webinars.

We may collect some of the above technical information using cookies or similar technologies. See Cookies & Other Technologies below for more detail on how we collect and use this information.

In the case of individuals applying for employment with us, we may collect:

• Information about your education, employment and educational history, and qualifications, such as the contents of your resume or CV; and
• The result of criminal record or background checks.

Indirectly: We may also collect personal information about you from third parties, including:

• Information about the insurance, driving record and claims history of you and other drivers you seek to include under one of our automobile insurance policies, going back up to 25 years. We collect this information from credit bureaus, the Ministry of Transportation and/or motor vehicle registry in your province or territory or residence, other insurers, associations of insurers and insurance rating service providers.
• For some insurance products and services (e.g., group benefits, life or travel insurance), CHES and your insurers may collect additional information including health related information.

In the case of individuals applying for employment with us, we may collect: The result of criminal record or background checks; and Information provided to us from references that you identify to us.

Why does CHES collect my personal information?

We may use your personal information to:

• Assess your application and provide you with quotes for services and products that we offer;
• Determine your eligibility for insurance coverage:
  • We assess your "risk" and determine eligibility for products and services (including consulting and risk management) that we offer directly or through third parties. For instance, we use this information to:
    • underwrite insurance
    • determine the right product, premium or coverage
    • verify the information you provide in your application
    • detect and prevent fraud
  • When you modify or make a claim under certain specific insurance products, we will use it to:
    • process, assist with the investigation and examination of claims
    • verify the information you provide in your claim demand and proof of
    loss
    • Detect, investigate, and prevent fraud
• Help measure the probability and risk of future events (actuarial analysis).
• Process payments for the products and services, and in some cases, complete transactions for the products and services;
• Provide you with our services and products, including consulting, that we offer, including providing you with options so that you can decide which products and services to purchase and determine your financial and retirement goals;
• Investigate insurance claims submitted by you, where we have been authorized to do so;
• Protect you, us and third parties from errors, misrepresentations, fraud, and/or contravention of laws or criminal activity (including facilitating insurance fraud detection and prevention);
• Develop and enhance our services through data analysis;
• Maintain our customer service records;
• Respond to your comments, complaints, questions, or requests for information, and correspond with you generally as well as corresponding with third parties on your behalf. Where relevant, we may also pass information along to third parties to allow them to respond, at the request of or on behalf of the insurance carrier partners;
• Consider if there are other products or services you might be interested in, if you are eligible for those products or services, and sending you details about them;
• Provide you with relevant information, send you promotional communications or otherwise market our products to you;
• Satisfy any audit, insurance, self-regulatory or regulatory requirements applicable to us (including, know-your-client requirements, provincial and federal tax reporting, anti-money laundering, sanctions compliance, unclaimed property obligations and audits by our carrier partners);
• Maintain the health and safety of our personnel;
• Enforce our legal rights with respect to any agreement you may have with us, including to collect a debt or enforce an obligation owed to us by you;
• Better understand how visitors interact with our Site, and improve the Site; and
• Detect and prevent security threats to the Site.

In the case of individuals applying for employment, we use your personal information to assess your application, decide whether to offer you employment and contact you about your application.

We may use your personal information for marketing purposes, including to educate current and potential customers about our products, identify customers who may be interested in purchasing our products and reach out to them. If you do not want your personal information to be used for marketing purposes, you can withdraw your consent at any time by contacting us at: privacy@chesspecialrisk.ca.

Where does CHES keep my information?

CHES may share your information with its affiliates or service providers which are located outside Canada and/or outside Quebec (in some cases, while the information may stay in Canada, it may be accessed by affiliates or service providers outside of Canada or Quebec). We and they may use, store or access your information in any region in Canada and other countries. These countries may include the USA, UK, European states, India and Egypt, and others where we or our service providers have a business presence. We take steps to protect your information wherever it is handled, subject to requirements to disclose it in response to legal demands or requests from governments, regulators, courts and law enforcement authorities in other jurisdictions that we deem to be valid.

Cookies & Other Similar Technologies

We may use technologies such as cookies to automatically collect certain information about visitors to the Site. A "cookie" is a unique numeric code that we transfer to your computer that identifies your browser to our server when you visit the Site. We use cookies to recognize you as a return visitor to the Site and save any information you have may entered into a form, as well as to save your screen display choices. You can set your Internet browser settings to stop accepting new cookies, to receive notice when you receive a new cookie, or to disable existing cookies. Note that the opt-out will apply only to the browser that you are using when you decide to opt out of cookies. Without cookies though, the features described here will not function properly. Any cookie sent to your computer by CHES in connection with your use of the Site does not give us access to your computer.

Can I opt out of promotional emails?

If at any time you decide you no longer want to receive promotional emails from us, you can opt-out by clicking the 'unsubscribe' link located in the footer of the email or by contacting us at privacy@chesspecialrisk.ca. Please note that we may still send you emails concerning your account with us and information that may affect how you contact us to service your accounts. If you choose to unsubscribe from promotional communications.

How and why does CHES share my personal information?

In some cases we may transfer your information to our service providers who perform services on our behalf. In other cases, we may disclose your personal information to third parties for their own use.

Transfers

To fulfill the purposes described above at Section 3 of this Privacy Notice, 'Why does CHES collect my personal information?' we need to share your personal information with the following types of third party service providers:

• Cloud hosting, database and software providers who help us host, administer, maintain and operationalize our information systems, which include our broker management and customer relationship management systems, our telephony systems and the Site;
• Vendors, who help facilitate administrative processes for us such as sending documents to our customers;
• Client relationship managers, who help us build, maintain and strengthen our relationships with our customers; and
• Brokers and consultants, who help us assess your needs and provide you with our products and services.
• Credit card companies, issuers and processors, in order to process your payment for our goods and services;
• Finance companies, for processing of premiums;

When we allow a third party service provider to access your personal information, we only allow them to do so for the sole purpose of carrying out the above services on our behalf. In our service agreements with these service providers, we require them to treat your personal information as securely as we do.

Disclosures

We may need to provide your information to third parties in order for them to provide their own services. This may include:

• Our insurance carrier partners, in order to provide you with quotes for insurance and to bind insurance policies you may purchase from us;
• Insurance companies;
• Associations of insurance companies;
• Insurance intermediaries such as Managing General Agents;
• Reinsurers;
• Insurance rating service providers;
• Claims third party adjusters;
• Inspection companies;
• Third party lenders with an insurance interest in your property;
• Additional insureds;
• Regulators (such as motor vehicle registries, drivers' license authorities and other government regulators, in order to fulfill our regulatory obligations);
• Your professional advisors, as directed by you.
• Certain employees of the Broker, including client managers, brokers and consultants;

When you give us permission to disclose your personal information to these third parties, the information we provide to them is then handled by them in accordance with their own privacy policy. If you have concerns about their handling of your personal information, you should contact them directly.

Some third parties may compile, aggregate, store, extract, modify and transform your personal information to create anonymized statistical data sets to be used for analytics purposes. Anonymized statistical data sets are no longer considered to be personal information.

Automated decision making: Automated decision-making is the process of rendering a decision by automated means without any human involvement which may include the use of artificial intelligence or machine learning. Our service providers may use technologies that incorporate automated decision making. For example, they may use automated decision making to accelerate their underwriting process, which in turn may simplify and accelerate your insurance purchasing experience.

In certain narrow circumstances, the law permits us to disclose your personal information without your consent. For instance, we may disclose your personal information to government, regulatory or law enforcement agencies as requested by these agencies, if we have a good faith belief that the disclosure is required or permitted by law. We may also disclose your personal information in order to enforce our legal rights; to detect, prevent or address fraud or security issues; in connection with a court or regulatory proceeding; and to enforce ours or others' legal rights, property, or safety.

We may also transfer or assign your personal information to third parties because of, or in connection with a sale, merger, consolidation, change in control, transfer of assets, reorganization, or liquidation.

We do not trade, rent or sell your personal information.

How does CHES keep my personal information safe?

CHES uses reasonable technical, organizational and administrative measures to protect your personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification. These include:

• Implementing encryption, antivirus and firewall technology as necessary on all of our information systems;
• Training our employees on how to securely handle your personal information;
• Requiring personnel with access to our information systems to use strong passwords to protect their accounts; and
• Implementing policies requiring our personnel to treat mobile devices with access to your personal information securely.

We restrict access to your personal information to only those CHES employees, contractors and agents who require that information to carry out the purposes identified above at Section 3 of this Privacy Notice, 'Why does CHES collect my personal information?' Anyone with access to your personal information is subject to strict confidentiality obligations. However, you should be aware that no safeguard is 100% secure, and despite our best efforts, we cannot guarantee that your information will be secure, particularly while it is in transit over the Internet.

We only retain your personal information for as long as necessary to fulfill the purposes described in Section 3 of this Privacy Notice, 'Why does CHES collect my personal information?'

One or more of our service providers and our parent company, CHES Special Risks Inc. and other affiliates, are located in the United States or other locations outside Canada. This means that your personal information may be transferred to, stored, or processed in other jurisdictions, and may be accessible to regulatory authorities in accordance with the laws of those jurisdictions.

What rights do I have over my personal information?

Withdraw your consent: At any time, you may withdraw your consent for us to collect, use or disclose your personal information. However, this may affect our ability to offer you some of our products and services. For example, you would be unable to acquire or renew an insurance policy with us.

Access/correct your information: At your written request, we will let you know what information CHES has about you, what it is being used for, and with whom it has been shared. If you notice any inaccuracies or wish to update any of your personal information, we will make those changes if you request us to do so. If we disagree with your request, we will note that. In some cases, we aren’t able to correct your information ourselves, so we will forward the request to the insurance carriers to do so.

At your written request, we will also provide you with access to your personal information that is in our control, subject to certain exceptions. These include where:

• Personal information about another person might be revealed and the other person's personal information cannot be separated from yours;
• Commercially confidential information might be revealed, and the confidential information cannot be severed from yours;
• The requested information is subject to solicitor and client privilege;
• Someone's life or security might be threatened as a result of giving you access and the personal information about the other person cannot be separated from yours;
• The information was collected for purposes related to an investigation of a breach of an agreement or contravention of the law.

The way in which we will give you access to your personal information may vary, depending on the format in which we hold it and the amount of information. We may provide your information in physical or electronic format. In the case of an exceptionally large file, we may provide you a summary of the personal information.

To make a request to withdraw your consent, or access or correct your personal information, contact CHES's Privacy Officer at privacy@chesspecialrisk.ca. Please note that we may ask to verify your identity before we begin processing your request.

Data portability: In Quebec, you have the right to receive computerized personal information collected from you in a structured, commonly used and technological format and to have this information transferred directly to any person or body authorized by law to collect such information.

CONTACT US

If you have any questions or concerns about this Privacy Notice, you can contact CHES's Privacy Officer:

Privacy Officer
100 King Street West
Suite 5140
Toronto, Ontario M5X 1E1
226.780.8919
privacy@chesspecialrisk.ca