Privacy Policy

View 1642 Capital’s policy

View Brightstone Trust Company’s policy

 

Privacy Policy — 1642 Capital

This personal information protection policy (the “Policy”) is evolving and subject to change. 1642 Capital Inc. (“1642 Capital”), an entity of Brightstone Financial Group, reserves the right to amend this Policy in order to respond as appropriately as possible to its changing needs.

Words in the singular include the plural, and vice versa, unless the context requires otherwise.

PURPOSE OF THE POLICY

1642 Capital attaches the utmost importance to protecting the personal information of its current, former and prospective clients and employees, as applicable (“you”). Accordingly, 1642 Capital seeks to ensure the accuracy, security and confidentiality of this personal information, in accordance with the laws, regulations and main guides and guidelines applicable in this area in Quebec and Canada (“Applicable Law”), where the head office of Brightstone Financial Group, of which 1642 Capital is a part, is located. Where the European Union’s General Data Protection Regulation (the “GDPR”) applies to the processing of certain personal information by 1642 Capital and the entities of Brightstone Financial Group, such processing is carried out in accordance with the GDPR.

This Policy describes how 1642 Capital collects, processes, uses, retains and communicates personal information. It applies to all divisions, subsidiaries and other entities of 1642 Capital and Brightstone Financial Group in Canada and abroad, to the extent permitted by Applicable Law. Accordingly, any reference to 1642 Capital is also a reference to each and every entity within Brightstone Financial Group, unless the context requires otherwise.

1. INTERPRETATION

Personal information means any information that concerns a natural person and allows that person to be identified, either on its own or in combination with other available information.

2. ACCOUNTABILITY FOR PERSONAL INFORMATION

1642 Capital is responsible for the personal information under its management, including personal information communicated to third parties for processing and administrative purposes.

Under the GDPR, 1642 Capital is the controller of personal information subject to the GDPR, for all processing carried out by the entities of Brightstone Financial Group.

Under the Act respecting the protection of personal information in the private sector (the “Private Sector Act”), 1642 Capital has delegated its role as the person in charge of the protection of personal information (the “Privacy Officer”) to its Legal Affairs and Human Resources department. The Privacy Officer is responsible for applying this Policy within 1642 Capital and must ensure that the following tasks are carried out:

(i) Approve the personal information policies and practices that 1642 Capital must establish and implement;

(ii) Where applicable, participate in privacy impact assessments (“PIAs”) concerning certain information systems or electronic service delivery systems, and suggest measures to ensure the protection of personal information processed through these systems;

(iii) Record any communication (made without consent) to a business or public body that could reduce the injury caused by a confidentiality incident, and take part in assessing the injury caused by a confidentiality incident;

(iv) Receive and respond to access and rectification requests, as well as requests relating to data portability and the right to be forgotten;

(v) Handle any other request to exercise individual rights provided for under applicable legislation.

The Privacy Officer’s contact information is set out in section 11 of this Policy.

3.CONSENT TO THE COLLECTION, USE AND COMMUNICATION OF PERSONAL INFORMATION

1642 Capital does not collect, use or communicate an individual’s personal information without their knowledge and without having duly obtained their consent, except where permitted or required by Applicable Law. By providing personal information to 1642 Capital, you authorize 1642 Capital to collect, use and communicate personal information about you in accordance with this Policy, and specifically for the purposes stated or implied in it or at the time of collection, as applicable. 1642 Capital will ask for your additional consent before using your personal information for purposes other than those covered by your initial consent.

You consent to this information being used and communicated by or to any division, subsidiary or other entity of Brightstone Financial Group, all of which are also subject to this Policy. Finally, you may change or withdraw your consent at any time, subject to legal restrictions, applicable contractual terms and reasonable notice. However, without consent, 1642 Capital may no longer be able to provide, or continue to provide, certain services, where applicable.

4.COLLECTION AND USE OF PERSONAL INFORMATION

a.GENERAL PRINCIPLES AND EXAMPLES OF INFORMATION COLLECTED

1642 Capital always collects personal information by lawful means. Wherever possible and appropriate, 1642 Capital collects personal information directly from the individual concerned and with their consent, but 1642 Capital may collect and use personal information about an individual from a third party where the individual concerned or Applicable Law permits. 1642 Capital may obtain information about you, with your consent, from sources such as financial institutions, insurance companies, government agencies or registries, accountants or other professional advisors, and credit bureaus. In all cases, 1642 Capital limits its collection of personal information to what is necessary for the purposes stated or implied in this Policy or at the time of collection.

The personal information collected by 1642 Capital includes, among other things, name, home or business address, home or business phone number, personal or business email address, financial information, billing and account information, and any other information necessary to provide the best possible advice and services based on the client’s requests, to establish, maintain and manage an employment relationship, or to achieve any other purpose stated or implied in this Policy or at the time of collection, as applicable.

b.PRIVACY IMPACT ASSESSMENT

1642 Capital conducts a privacy impact assessment (“PIA”) for any project to acquire, develop or overhaul an information system or electronic service delivery system involving the collection, use, communication, retention or destruction of personal information. The PIA is proportionate to the sensitivity of the information concerned, the purpose for which it is to be used, and its quantity, distribution and medium.

c.PURPOSES OF COLLECTING PERSONAL INFORMATION

Subject to Applicable Law, 1642 Capital always determines and informs you of the purposes for which it collects personal information, before or at the time of collection.

In the course of its activities, 1642 Capital collects personal information for purposes that include: administering and operating its business and managing its activities, including meeting contractual obligations and auditing its operations; serving its clients and providing wealth management advisory services, including administering client accounts, or other services that clients have agreed to receive from 1642 Capital; establishing, maintaining and managing business relationships; presenting service offers; recruiting subcontractors and employees; maintaining the security of its premises and of its clients, employees and third parties; detecting and preventing negligence, fraud and theft; processing and responding to requests for information; and complying with Applicable Law, including client identification and verification requirements.

1642 Capital also collects and uses personal information to send a monthly newsletter about the services it offers, announce special events, share general information of interest, and send invitations to social events related to its activities, all in accordance with Applicable Law.

With respect to hiring and employment, 1642 Capital may collect personal information before hiring in order to conduct a general background check, and then upon hiring to enable us to comply with our legal requirements as an employer. All such information is recorded in the employee’s file, along with the documents the employee completed upon joining 1642 Capital, as described in the Employee Handbook. 1642 Capital may use your information in connection with your employment relationship and for any other related legal requirements.

d.WEBSITE — COOKIES, CONTACT LIST AND MONTHLY NEWSLETTER

1642 Capital may also collect information from users of the section of Brightstone Financial Group’s website dedicated to 1642 Capital (brightstonefinancial.ca) through cookies or similar technologies, including during visits to the website.

Cookies are files that store information on your hard drive or web browser. They allow a website to identify a computer and collect certain information relevant to connecting to and browsing the site (such as the browser type, IP address and operating system used by a visitor) and, subsequently, to recognize and track that computer on the site, compile usage statistics and build browsing histories, including domain names and pages visited, emails read and other information.

1642 Capital collects and uses certain data, including IP addresses, the number of times the website has been viewed and the browsing habits of site users, to carry out its activities, promote its services, monitor the website’s performance, administer it more effectively and improve it as needed.

Unless the browser is set to block cookies, 1642 Capital’s system will save cookies on a user’s computer when they visit the website. By visiting the website, you consent to 1642 Capital’s use of cookies for the purposes described above.

By completing the subscription form for 1642 Capital communications on the website, you consent to the processing by 1642 Capital of the personal data you enter when registering. The email address or any other personal data you enter in the registration form will be stored on 1642 Capital’s servers in Canada and transmitted to the Cyberimpact online platform for the following purposes:

  • To be added to 1642 Capital’s contact list to receive communications relating to, among other things, events, activities or training sessions offered;
  • To be added to the distribution list for 1642 Capital’s monthly newsletter.

You may remove yourself from the contact list or unsubscribe from the monthly newsletter at any time.

5.COMMUNICATION OF PERSONAL INFORMATION

1642 Capital uses and communicates personal information only for the purposes for which it was collected, except with the required consent or in accordance with Applicable Law. 1642 Capital is also committed to limiting disclosure of and access to personal information to only those persons who need it for the intended purposes. 1642 Capital will disclose your personal information to third parties only for the purposes stated or implied in this Policy or at the time of collection, with your express consent, or otherwise where required or permitted by Applicable Law. 1642 Capital may share personal information with trusted third parties in order to:

  • Outsource one or more of the services offered by 1642 Capital;
  • Establish, maintain and manage the relationship between you and 1642 Capital (including managing an employment relationship between you and 1642 Capital and the related legal obligations, as applicable);
  • Confirm or update information previously provided;
  • Send mail and emails to communicate with you as an employee or client of 1642 Capital, as applicable. These may also include communications containing information about 1642 Capital’s products and services, events or other important topics, following a request from you or your consent to receive communications for this purpose;
  • Provide customer service and marketing services;
  • Fulfill any purpose identified in this Policy and any other purpose that 1642 Capital will identify no later than at the time the information is collected.

In accordance with its Policy, 1642 Capital will ensure that the third parties with which it does business and to which it provides personal or confidential information also guarantee, to a standard at least equivalent to that of 1642 Capital, that all technical and organizational measures ensuring the confidentiality, security and integrity of the information they hold on behalf of 1642 Capital have been taken.

a.SERVICE PROVIDERS

When 1642 Capital outsources or delegates the processing of personal information to third-party providers (“Service Providers”) on its behalf, it ensures that it does so in accordance with Applicable Law and, where applicable, the GDPR.

In addition, when an outsourcing project involves the acquisition, development or overhaul of an information system or electronic service delivery system involving the collection, use, communication, retention or destruction of personal information by a Service Provider on behalf of 1642 Capital, 1642 Capital will conduct a PIA.

The processing of personal information by a Service Provider is subject to a written contract setting out the measures the Service Provider must take to ensure:

  • the protection of the confidentiality of the personal information communicated by 1642 Capital;
  • that the information is used only for the performance of the contract;
  • that the Service Provider does not retain the personal information after the contract expires, unless otherwise required by legal or regulatory requirements applicable to it.

The categories of Service Providers are as follows:

  • Entities of Brightstone Financial Group.
  • Suppliers and service providers: IT and infrastructure service providers; finance, accounting and tax service providers; auditors; consultants who provide 1642 Capital with marketing support; and external providers or venues where 1642 Capital hosts conferences, events or other meetings. Your personal information is transmitted only for the purpose of carrying out specific tasks or functions entrusted by 1642 Capital to these recipients and in accordance with its instructions. 1642 Capital requires these Service Providers to provide reasonable security to protect the confidentiality of the personal information communicated to them, including against unauthorized access or use, and against accidental loss or deletion. In addition, access to client data is strictly limited, and the strictest confidentiality is applied to such data in accordance with the professional rules applicable to 1642 Capital and the entities of Brightstone Financial Group.
  • Financial institutions: banks, custodian banks, investment funds and fund managers. Personal information is transmitted only for the purposes of banking, accounting and payment transactions and/or to the extent necessary to provide our services to our clients.

b.INTERNATIONAL COMMUNICATION AND HOSTING

Personal information collected by 1642 Capital may pass through servers outside Quebec and Canada, and may be transmitted to and stored at a destination outside Quebec and Canada. This information may also be processed by personnel working outside Quebec and Canada for 1642 Capital, its partners or its suppliers. Please note that when the processing of personal information is outsourced to a company in another country, the information may be made available to the government of that country or its agencies under a lawful order issued in that country. By transmitting personal information, you consent to the transfer, storage and processing activities described herein.

In all cases, we will take all reasonably necessary measures to ensure that your personal information is processed securely and in accordance with this Policy and Applicable Law.

To this end, any transfer of personal information outside Quebec must first be the subject of a PIA by 1642 Capital, which considers the following factors:

  • the sensitivity of the information;
  • the purposes for which it is to be used;
  • the protection measures, including contractual measures, that will apply to it; and
  • the legal framework applicable in the receiving jurisdiction, including the personal information protection principles that apply there.

6. RETENTION OF PERSONAL INFORMATION

Personal information is kept in secure locations and on servers controlled by 1642 Capital at its offices in Montreal or Lausanne, or at the offices of 1642 Capital’s service providers, which have also made commitments regarding the security, integrity and confidentiality of the information entrusted to them, as set out in this Policy.

1642 Capital retains personal information for as long as it reasonably needs it for the purposes for which it was collected, or in accordance with Applicable Law and its Records Management Policy.

7.PROTECTION OF PERSONAL INFORMATION

1642 Capital uses administrative, technological, physical and organizational security measures appropriate to the sensitivity of the personal information and, in all cases, as required by the circumstances, to protect access to it and ensure its security, integrity and confidentiality at all times.

1642 Capital has put in place policies and procedures to protect personal information against loss and unauthorized access, modification or communication. In addition, its premises are secured, and 1642 Capital has implemented technological safeguards such as security software, passwords and firewalls to prevent unauthorized access to computers. 1642 Capital uses industry-standard network technologies, password protection systems and works with partners specializing in IT security to ensure this compliance and anticipate changes in these technologies.

However, even though 1642 Capital takes all reasonably necessary measures to ensure that personal information is processed securely and in accordance with this Policy, no method of transmitting or storing information is completely secure. Accordingly, 1642 Capital cannot guarantee the security, confidentiality and integrity of the information in its possession. Likewise, it cannot fully guarantee the security and confidentiality of electronic communications. Furthermore, to the extent that you consent to receiving electronic communications from 1642 Capital, you also consent to those communications potentially being unencrypted.

In the event of a confidentiality incident (as defined in the Private Sector Act), the Confidentiality Incident Response Procedure will be applied.

8.ACCESS TO PERSONAL INFORMATION

Subject to Applicable Law, upon an individual’s written request submitted in accordance with section 11, the Privacy Officer will inform the individual whether 1642 Capital holds personal information about them and, as applicable, will provide a summary of how the information has been or is being used, and will disclose the identity of any third parties to whom it may have communicated personal information about them and the purposes for which it was communicated. The specific requirements of the GDPR continue to apply.

The Privacy Officer will acknowledge receipt of the request in writing and may ask for proof of identity before providing any information. In principle, access to information will be provided free of charge; however, if the request requires documents to be copied or transmitted, the Privacy Officer may charge a reasonable fee, after informing the individual of the amount in advance and giving them the opportunity to withdraw the request. The Privacy Officer will provide access to the information within 30 days of receiving the request or will provide written notice that additional time is needed to respond.

1642 Capital may refuse access to the information in accordance with Applicable Law, in which case 1642 Capital will notify you in writing, explain the reasons for its refusal and inform you of the other recourses available.

Notwithstanding the foregoing, for 1642 Capital employees, access to their file will be provided in accordance with the procedure described in the Employee Handbook provided upon hiring.

9.ACCURACY, UPDATING AND RECTIFICATION OF PERSONAL INFORMATION

1642 Capital makes reasonable efforts to ensure that the personal information collected is as accurate and complete as required for the purposes for which it is used.

If the information you have provided to us changes, or if you notice an inaccuracy during the access process set out in section 8, please contact the Privacy Officer in accordance with section 11 (or in accordance with the procedure described in the Employee Handbook if you are an employee).

Where the GDPR applies to 1642 Capital’s processing of your personal information, you have the following specific rights: the right of access, the right to rectification, the right to erasure, the right to restriction of processing, the right to object, the right to data portability, and the right to lodge a complaint with the competent authority.

10.CHANGES AND UPDATES TO THE POLICY

If 1642 Capital amends this Policy, it will post the changes on Brightstone Financial Group’s website (brightstonefinancial.ca) and notify its employees and clients in writing. By continuing to provide your personal information, or to use 1642 Capital’s services or the website, you consent to the Policy as then in effect.

The Policy will be reviewed periodically to ensure that it remains compliant with Applicable Law and that it continues to be applied in the best interests of 1642 Capital, its employees and its clients.

11OUR CONTACT INFORMATION AND REPRESENTATIVES

For any questions about this Policy or 1642 Capital’s personal information management practices, to access or correct personal information, to change or withdraw any consent regarding the use or communication of personal information, to stop receiving electronic communications from us, to file a complaint, or to otherwise exercise your rights regarding the protection of personal information and privacy, please contact our Privacy Officer in writing at: dataprotection@1642capital.ca.

Privacy Policy — Brightstone Trust Company

This personal information protection policy (the “Policy”) is evolving and subject to change. Brightstone Trust Company Inc. (“Brightstone Trust Company”), an entity of Brightstone Financial Group, reserves the right to amend this Policy to respond as appropriately as possible to its changing needs.

Words in the singular include the plural, and vice versa, unless the context requires otherwise.

PURPOSE OF THE POLICY

Brightstone Trust Company attaches the utmost importance to protecting the personal information of its current, former and prospective clients and employees, as applicable (“you”). Accordingly, Brightstone Trust Company seeks to ensure the accuracy, security and confidentiality of this personal information, in accordance with the laws, regulations and main guides and guidelines applicable in this area in Quebec and Canada (“Applicable Law”), where the head office of Brightstone Financial Group, of which Brightstone Trust Company is a part, is located. Where the European Union’s General Data Protection Regulation (the “GDPR”) applies to the processing of certain personal information by Brightstone Trust Company and the entities of Brightstone Financial Group, such processing is carried out in accordance with the GDPR.

This Policy describes how Brightstone Trust Company collects, processes, uses, retains and communicates personal information. It applies to all divisions, subsidiaries and other entities of Brightstone Trust Company and Brightstone Financial Group in Canada and abroad, to the extent permitted by Applicable Law. Accordingly, any reference to Brightstone Trust Company is also a reference to each and every entity within Brightstone Financial Group, unless the context requires otherwise.

1. INTERPRETATION

Personal information means any information that concerns a natural person and allows that person to be identified, either on its own or in combination with other available information.

2. ACCOUNTABILITY FOR PERSONAL INFORMATION

Brightstone Trust Company is responsible for the personal information under its management, including personal information communicated to third parties for processing and administrative purposes.

Under the GDPR, Brightstone Trust Company is the controller of personal information subject to the GDPR, for all processing carried out by the entities of Brightstone Financial Group.

Under the Act respecting the protection of personal information in the private sector (the “Private Sector Act”), Brightstone Trust Company has delegated its role as the person in charge of the protection of personal information (the “Privacy Officer”) to its Legal Affairs and Human Resources department. The Privacy Officer is responsible for applying this Policy within Brightstone Trust Company and must, in particular, ensure that the following tasks are carried out:

(i) Approve the personal information policies and practices that Brightstone Trust Company must establish and implement;

(ii) Where applicable, participate in privacy impact assessments (“PIAs”) concerning certain information systems or electronic service delivery systems, and suggest measures to ensure the protection of personal information processed through these systems;

(iii) Record any communication (made without consent) to a business or public body that could reduce the injury caused by a confidentiality incident, and take part in assessing the injury caused by a confidentiality incident;

(iv) Receive and respond to access and rectification requests, as well as requests relating to data portability and the right to be forgotten;

(v) Handle any other request to exercise individual rights provided for under applicable legislation.

The Privacy Officer’s contact information is set out in section 11 of this Policy.

3. CONSENT TO THE COLLECTION, USE AND COMMUNICATION OF PERSONAL INFORMATION

Brightstone Trust Company does not collect, use or communicate an individual’s personal information without their knowledge and without having duly obtained their consent, except where permitted or required by Applicable Law. By providing personal information to Brightstone Trust Company, you authorize Brightstone Trust Company to collect, use and communicate personal information about you in accordance with this Policy, and specifically for the purposes stated or implied in it or at the time of collection, as applicable. Brightstone Trust Company will ask for your additional consent before using your personal information for purposes other than those covered by your initial consent.

You consent to this information being used and communicated by or to any division, subsidiary or other entity of Brightstone Financial Group, all of which are also subject to this Policy. Finally, you may change or withdraw your consent at any time, subject to legal restrictions, applicable contractual terms and reasonable notice. However, without consent, Brightstone Trust Company may no longer be able to provide, or continue to provide, certain services, where applicable.

4. COLLECTION AND USE OF PERSONAL INFORMATION

a.GENERAL PRINCIPLES AND EXAMPLES OF INFORMATION COLLECTED

Brightstone Trust Company always collects personal information by lawful means. Wherever possible and appropriate, Brightstone Trust Company collects personal information directly from the individual concerned and with their consent, but Brightstone Trust Company may collect and use personal information about an individual from a third party where the individual concerned or Applicable Law permits. Brightstone Trust Company may obtain information about you, with your consent, from sources such as financial institutions, insurance companies, government agencies or registries, accountants or other professional advisors, and credit bureaus. In all cases, Brightstone Trust Company limits its collection of personal information to what is necessary for the purposes stated or implied in this Policy or at the time of collection.

The personal information collected by Brightstone Trust Company includes, among other things, name, home or business address, home or business phone number, personal or business email address, financial information, billing and account information, and any other information necessary to provide the best possible advice and services based on the client’s requests, to establish, maintain and manage an employment relationship, or to achieve any other purpose stated or implied in this Policy or at the time of collection, as applicable.

b.PRIVACY IMPACT ASSESSMENT

Brightstone Trust Company conducts a privacy impact assessment (“PIA”) for any project to acquire, develop or overhaul an information system or electronic service delivery system involving the collection, use, communication, retention or destruction of personal information. The PIA is proportionate to the sensitivity of the information concerned, the purpose for which it is to be used, and its quantity, distribution and medium.

c.PURPOSES OF COLLECTING PERSONAL INFORMATION

Subject to Applicable Law, Brightstone Trust Company always determines and informs you of the purposes for which it collects personal information, before or at the time of collection.

In the course of its activities, Brightstone Trust Company collects personal information for purposes that include: administering and operating its business and managing its activities, including meeting contractual obligations and auditing its operations; serving its clients and providing trust administration and custody services, including administering client accounts, or other services that clients have agreed to receive from Brightstone Trust Company; establishing, maintaining and managing business relationships; presenting service offers; recruiting subcontractors and employees; maintaining the security of its premises and of its clients, employees and third parties; detecting and preventing negligence, fraud and theft; processing and responding to requests for information; and complying with Applicable Law, including client identification and verification requirements.

Brightstone Trust Company also collects and uses personal information to send a monthly newsletter about the services it offers, announce special events, share general information of interest, and send invitations to social events related to its activities, all in accordance with Applicable Law.

With respect to hiring and employment, Brightstone Trust Company may collect personal information before hiring to conduct a general background check, and then upon hiring to enable us to comply with our legal requirements as an employer. All such information is recorded in the employee’s file, along with the documents the employee completed upon joining, as described in the Employee Handbook. Brightstone Trust Company may use your information in connection with your employment relationship and for any other related legal requirements.

d.WEBSITE — COOKIES, CONTACT LIST AND MONTHLY NEWSLETTER

Brightstone Trust Company may also collect information from users of the section of Brightstone Financial Group’s website dedicated to Brightstone Trust Company (brightstonefinancial.ca) through cookies or similar technologies, including during visits to the website.

Cookies are files that store information on your hard drive or web browser. They allow a website to identify a computer and collect certain information relevant to connecting to and browsing the site (such as the browser type, IP address and operating system used by a visitor) and, subsequently, to recognize and track that computer on the site, compile usage statistics and build browsing histories, including domain names and pages visited, emails read and other information.

Brightstone Trust Company collects and uses certain data, including IP addresses, the number of times the website has been viewed and the browsing habits of site users, to carry out its activities, promote its services, monitor the website’s performance, administer it more effectively and improve it as needed.

Unless the browser is set to block cookies, Brightstone Trust Company’s system will save cookies on a user’s computer when they visit the website. By visiting the website, you consent to Brightstone Trust Company’s use of cookies for the purposes described above.

By completing the subscription form for Brightstone Trust Company communications on the website, you consent to the processing by Brightstone Trust Company of the personal data you enter when registering. The email address or any other personal data you enter in the registration form will be stored on Brightstone Trust Company’s servers in Canada and transmitted to the Cyberimpact online platform for the following purposes:

  • To be added to Brightstone Trust Company’s contact list to receive communications relating to, among other things, events, activities or training sessions offered;
  • To be added to the distribution list for Brightstone Trust Company’s monthly newsletter.

You may remove yourself from the contact list or unsubscribe from the monthly newsletter at any time.

5. COMMUNICATION OF PERSONAL INFORMATION

Brightstone Trust Company uses and communicates personal information only for the purposes for which it was collected, except with the required consent or in accordance with Applicable Law. Brightstone Trust Company is also committed to limiting disclosure of and access to personal information to only those persons who need it for the intended purposes. Brightstone Trust Company will disclose your personal information to third parties only for the purposes stated or implied in this Policy or at the time of collection, with your express consent, or otherwise where required or permitted by Applicable Law. Brightstone Trust Company may share personal information with trusted third parties in order to:

  • Outsource one or more of the services offered by Brightstone Trust Company;
  • Establish, maintain and manage the relationship between you and Brightstone Trust Company (including managing an employment relationship between you and Brightstone Trust Company and the related legal obligations, as applicable);
  • Confirm or update information previously provided;
  • Send mail and emails to communicate with you as an employee or client of Brightstone Trust Company, as applicable. These may also include communications containing information about Brightstone Trust Company’s products and services, events or other important topics, following a request from you or your consent to receive communications for this purpose;
  • Provide customer service and marketing services;
  • Fulfill any purpose identified in this Policy and any other purpose that Brightstone Trust Company will identify no later than at the time the information is collected.

In accordance with its Policy, Brightstone Trust Company will ensure that the third parties with which it does business and to which it provides personal or confidential information also guarantee, to an at least equivalent standard, that all technical and organizational measures ensuring the confidentiality, security and integrity of the information they hold on behalf of Brightstone Trust Company have been taken.

a.SERVICE PROVIDERS

When Brightstone Trust Company outsources or delegates the processing of personal information to third-party providers (“Service Providers”) on its behalf, it ensures that it does so in accordance with Applicable Law and, where applicable, the GDPR.

In addition, when an outsourcing project involves the acquisition, development or overhaul of an information system or electronic service delivery system involving the collection, use, communication, retention or destruction of personal information by a Service Provider on behalf of Brightstone Trust Company, Brightstone Trust Company will conduct a PIA.

The processing of personal information by a Service Provider is subject to a written contract setting out the measures the Service Provider must take to ensure:

  • the protection of the confidentiality of the personal information communicated by Brightstone Trust Company;
  • that the information is used only for the performance of the contract;
  • that the Service Provider does not retain the personal information after the contract expires, unless otherwise required by legal or regulatory requirements applicable to it.

The categories of Service Providers are as follows:

  • Entities of Brightstone Financial Group.
  • Suppliers and service providers: IT and infrastructure service providers; finance, accounting and tax service providers; auditors; consultants who provide Brightstone Trust Company with marketing support; and external providers or venues where Brightstone Trust Company hosts conferences, events or other meetings. Your personal information is transmitted only for the purpose of carrying out specific tasks or functions entrusted by Brightstone Trust Company to these recipients and in accordance with its instructions. Brightstone Trust Company requires these Service Providers to provide reasonable security to protect the confidentiality of the personal information communicated to them, including against unauthorized access or use, and against accidental loss or deletion. In addition, access to client data is strictly limited, and the strictest confidentiality is applied to such data in accordance with the professional rules applicable to Brightstone Trust Company and the entities of Brightstone Financial Group.
  • Financial institutions: banks, custodian banks, investment funds and fund managers. Personal information is transmitted only for the purposes of banking, accounting and payment transactions and/or to the extent necessary to provide our services to our clients.

b.INTERNATIONAL COMMUNICATION AND HOSTING

Personal information collected by Brightstone Trust Company may pass through servers outside Quebec and Canada, and may be transmitted to and stored at a destination outside Quebec and Canada. This information may also be processed by personnel working outside Quebec and Canada for Brightstone Trust Company, its partners or its suppliers. Please note that when the processing of personal information is outsourced to a company in another country, the information may be made available to the government of that country or its agencies under a lawful order issued in that country. By transmitting personal information, you consent to the transfer, storage and processing activities described herein.

In all cases, we will take all reasonably necessary measures to ensure that your personal information is processed securely and in accordance with this Policy and Applicable Law.

To this end, any transfer of personal information outside Quebec must first be the subject of a PIA by Brightstone Trust Company, which considers the following factors:

  • the sensitivity of the information;
  • the purposes for which it is to be used;
  • the protection measures, including contractual measures, that will apply to it; and
  • the legal framework applicable in the receiving jurisdiction, including the personal information protection principles that apply there.

6. RETENTION OF PERSONAL INFORMATION

Personal information is kept in secure locations and on servers controlled by Brightstone Trust Company at its offices in Montreal or Lausanne, or at the offices of Brightstone Trust Company’s service providers, which have also made commitments regarding the security, integrity and confidentiality of the information entrusted to them, as set out in this Policy.

Brightstone Trust Company retains personal information for as long as it reasonably needs it for the purposes for which it was collected, or in accordance with Applicable Law and its Records Management Policy.

7. PROTECTION OF PERSONAL INFORMATION

Brightstone Trust Company uses administrative, technological, physical and organizational security measures appropriate to the sensitivity of the personal information and, in all cases, as required by the circumstances, to protect access to it and ensure its security, integrity and confidentiality at all times.

Brightstone Trust Company has put in place policies and procedures to protect personal information against loss and unauthorized access, modification or communication. In addition, its premises are secured, and Brightstone Trust Company has implemented technological safeguards such as security software, passwords and firewalls to prevent unauthorized access to computers. Brightstone Trust Company uses industry-standard network technologies, password protection systems and works with partners specializing in IT security to ensure this compliance and anticipate changes in these technologies.

However, even though Brightstone Trust Company takes all reasonably necessary measures to ensure that personal information is processed securely and in accordance with this Policy, no method of transmitting or storing information is completely secure. Accordingly, Brightstone Trust Company cannot guarantee the security, confidentiality and integrity of the information in its possession. Likewise, it cannot fully guarantee the security and confidentiality of electronic communications. Furthermore, to the extent that you consent to receiving electronic communications from Brightstone Trust Company, you also consent to those communications potentially being unencrypted.

In the event of a confidentiality incident (as defined in the Private Sector Act), the Confidentiality Incident Response Procedure will be applied.

8. ACCESS TO PERSONAL INFORMATION

Subject to Applicable Law, upon an individual’s written request submitted in accordance with section 11, the Privacy Officer will inform the individual whether Brightstone Trust Company holds personal information about them and, as applicable, will provide a summary of how the information has been or is being used, and will disclose the identity of any third parties to whom it may have communicated personal information about them and the purposes for which it was communicated. The specific requirements of the GDPR continue to apply.

The Privacy Officer will acknowledge receipt of the request in writing and may ask for proof of identity before providing any information. In principle, access to information will be provided free of charge; however, if the request requires documents to be copied or transmitted, the Privacy Officer may charge a reasonable fee, after informing the individual of the amount in advance and giving them the opportunity to withdraw the request. The Privacy Officer will provide access to the information within 30 days of receiving the request or will provide written notice that additional time is needed to respond.

Brightstone Trust Company may refuse access to the information in accordance with Applicable Law, in which case Brightstone Trust Company will notify you in writing, explain the reasons for its refusal and inform you of the other recourses available.

Notwithstanding the foregoing, for Brightstone Trust Company employees, access to their file will be provided in accordance with the procedure described in the Employee Handbook provided upon hiring.

9. ACCURACY, UPDATING AND RECTIFICATION OF PERSONAL INFORMATION

Brightstone Trust Company makes reasonable efforts to ensure that the personal information collected is as accurate and complete as required for the purposes for which it is used.

If the information you have provided to us changes, or if you notice an inaccuracy during the access process set out in section 8, please contact the Privacy Officer in accordance with section 11 (or in accordance with the procedure described in the Employee Handbook if you are an employee).

Where the GDPR applies to Brightstone Trust Company’s processing of your personal information, you have the following specific rights: the right of access, the right to rectification, the right to erasure, the right to restriction of processing, the right to object, the right to data portability, and the right to lodge a complaint with the competent authority.

10. CHANGES AND UPDATES TO THE POLICY

If Brightstone Trust Company amends this Policy, it will post the changes on Brightstone Financial Group’s website (brightstonefinancial.ca) and notify its employees and clients in writing. By continuing to provide your personal information, or to use Brightstone Trust Company’s services or the website, you consent to the Policy as then in effect.

The Policy will be reviewed periodically to ensure that it remains compliant with Applicable Law and that it continues to be applied in the best interests of Brightstone Trust Company, its employees and its clients.

11. OUR CONTACT INFORMATION AND REPRESENTATIVES

For any questions about this Policy or Brightstone Trust Company’s personal information management practices, to access or correct personal information, to change or withdraw any consent regarding the use or communication of personal information, to stop receiving electronic communications from us, to file a complaint, or to otherwise exercise your rights regarding the protection of personal information and privacy, please contact our Privacy Officer in writing at: dataprotection@brightstonefinancial.ca.