Privacy Policy
-
Purpose and Objective
Your privacy is important to Plaza Retail REIT (collectively, “Plaza”, “we”, “us” and “our”). This Policy describes the practices used by Plaza and its subsidiaries in relation to the collection, use, retention, disclosure, and protection of information about identifiable individuals (“personal information”). This Policy applies to all individuals whose personal information (as hereinafter described) is collected, used, shared, and managed by Plaza in the course of doing business.
-
Definition of Personal Information
Personal information includes but is not limited to identity data such as name, date of birth and personal address; financial data such as banking information and credit history information; data regarding your education and employment history; and audio and visual data such as your voice and likeness as captured in photographs or video/audio recordings.
Personal information does not include information such as your employer, job title, business address, business email address, business telephone or business fax number for the individual, or any information that is publicly available. Nor does it include any information that cannot be used on its own to trace or identify a person (e.g. IP address, device ID, cookies). This Policy does not apply to non-personal information; however, if we collect non-personal information and link it to an identifiable individual, that information will become personal information and will be subject to this Policy. -
Purpose of Collection and Use
From time to time, Plaza receives and retains personal information from and about individuals including trustees, executive officers, employees, investors, tenants, suppliers, business contacts and partners. Our use of personal information is limited to those purposes specified at or before the time of collection; uses that would be reasonable in the circumstances, such as communicating with you and managing our business and operations; it may be used with your consent; or as required by law, professional or regulatory requirements. For instance, personal may be used for the purposes of:
(a) verifying your identity (b) to meet our business and legal obligations, including auditing, regulatory and statutory requirements, and compliance with associated processes; (c) processing payments received by Plaza, as well as payments to you from Plaza; (d) providing investor relations and services to unitholders and other investors; (e) providing security and safety on the properties we own; (f) recruiting for positions at Plaza and its affiliates; (g) administering compensation, benefits and payments and fulfilling taxation and other legal requirements in respect of same; (h) employment related matters; (i) administrating Plaza’s computer systems, including remote access from home and providing technical support for personnel and providing and managing our other programs and services; (j) to facilitate the financing, procurement, or disposition of properties; (k) for the purpose of performing contracted functions; (l) communicating with individuals regarding scheduling, meetings and other information; (m) marketing and promoting of Plaza, including the use of personnel photographs and biographies on Plaza’s website or otherwise; and (n) public relations promotions. From time to time, Plaza may also share/disclose personal information in the context of a corporate transaction. If your personal information is required in connection with any such transactions, we will require that the parties involved, including advisors or other service providers, agree to protect your personal information with policies meeting standards equivalent to those set out in this Policy both during and after completion of the transaction. Plaza does not sell, trade, or share personal information with third parties for financial or other benefits.
-
Collection and Consent
Personal information is primarily collected directly from you. Personal information may also be collected through automated means such as video surveillance and recordings at our properties, as well as cookies and similar technologies when you visit our website when linked to an identifiable individual as previously noted. Personal information may also, with your consent, be collected from third party sources such as government agencies, law enforcement agencies, creditor and financial institutions, references, and employers.
-
Limiting Collection and Disclosure
We do not collect personal information indiscriminately. Plaza limits both the amount and the type of personal information collected to that which is necessary to fulfill the purposes identified. At all times, we collect personal information only through fair and lawful means.
Plaza will not collect, use, or disclose your personal information without your knowledge and consent, except in circumstances permitted or required by law. Consent may be express or implied. Express consent is given either verbally or in writing. Consent is implied when it can be reasonably understood by the action or inaction of the individual. -
Protection of your Personal Information
We will always strive to protect the privacy of personal information, subject to applicable laws and any consent an individual has provided for its collection, use, or disclosure, in a manner that is consistent with and appropriate to the sensitivity of the information. For example, we employ physical, technical, and organizational measures to ensure your personal information receives an adequate level of protection while it is in our possession. Our handling of your personal information will respect its confidential nature at all times from the time of its collection until its ultimate disposal or destruction. Our personnel are required to protect the confidentiality of personal information and access to personal information is restricted to those who require it to do their job.
In the unlikely event of a cybersecurity breach, Plaza will follow the procedures set out in our Cybersecurity Policy & Incident Response Plan and all applicable legal disclosure requirements, including those under the Personal Information Protection and Electronic Documents Act (also known as PIPEDA) and substantially similar provincial legislation, as applicable to Plaza, including Quebec’s Act Respecting the Protection of Personal Information in the Private Sector (Law 25). -
Breach Notification
If it is determined that personal information is involved in a data breach and it is reasonable to believe the breach creates a “real risk of significant harm” to any individual, management may be required to report the incident to the Privacy Commissioner of Canada or Quebec’s Commission d’acces a l’information (CAI), as applicable, and notify affected individuals of the breach as soon as feasible. Further guidance on this matter for employees can be found in the Incident Response Plan forming part of Plaza’s Cybersecurity Policy. While that plan is primarily oriented around cyber-related incidents and breaches, it can also be utilized for data breaches that are not related to computer systems.
-
Retention and Destruction
We retain personal information only as long as reasonably necessary to fulfil our legitimate business, employment, and administrative purposes and for a period of 7 years after a matter or file is closed or concluded, unless a longer retention period is required or permitted by law. Once no longer required, we will dispose of or destroy personal information in a safe and secure manner in accordance with our internal data retention policies.
Some of our measures to securely dispose of personal information include shredding physical documents containing personal information and securely deleting electronic files from our systems. These practices are designed to prevent unauthorized access to personal information and to protect the privacy and confidentiality of individual’s data. -
Individual Access and Accuracy of Personal Information
You have the right to request access to personal information that we hold about you, and to request corrections to that information if you believe there is an error or omission, with some exceptions. Access is not automatic and may be refused, if permitted or required by law. We may not respond to unreasonable requests based on how the information is to be used, the nature of the information, and the frequency of the requests.
We will endeavour to keep all personal information accurate and up to date, and update personal information as it is made available. If you find that personal information we have collected is not accurate, please advise us. You are responsible for providing accurate, complete, and up-to-date information about yourself.Plaza Retail REIT Plaza Retail REIT Attention: General Cousnel & Secretary Attention: Privacy Officer 98 Main Street 106 gun Avenue Fredericton, NB E3A 9N6 Pointe-Claire, QC H9R 3X3 Telephone: 506-460-8289 Telephone: 514-268-8615 -
Changes to Policy
This Policy will be reviewed annually and we will assess our practices as necessary to ensure that individual privacy is respected. As such, this Policy may be updated from time to time. If we make a material change, this Policy will be updated accordingly. So that you are aware of any changes, we recommend that you periodically review this Policy, which will be available on Plaza’s website or upon request to the General Counsel & Secretary and, for employees, on Plaza’s company-wide intranet (also known as the P: Drive) under Plaza Retail REIT / Properties / Human Resources & Policies. Your use of our website following the posting of any changes to this Policy shall constitute your acceptance of these changes.
-
Non-Compliance
Any employee who violates this Policy may be subject to disciplinary action, up to and including termination of their employment.