Privacy Policy

Effective: October 24, 2019

Our Commitment

At EcoHome Financial Inc. (“EcoHome Financial”, “we”, “us”, “the Company”, etc.) we are committed to providing excellent service and to ensuring that our relationship with individuals with whom we interact, such as our customers or potential customers (“you”), is conducted with integrity and in a responsible, fair, honest and ethical manner. Consistent with these objectives we maintain high standards of confidentiality with respect to your personal information in our possession or control.

This Privacy Policy is based on the Personal Information Protection and Electronic Documents Act (Canada) including the privacy principles contained in Schedule 1 thereto (“PIPEDA”). It explains how we collect, use, disclose and otherwise handle your personal information.

If you have any questions about this Privacy Policy or wish to request access to personal information about you in our possession or control, please contact our Compliance Officer using the contact information set out below.

What Personal Information We Collect; How and Why We Collect It

As used in this Privacy Policy, personal information means information about an identifiable individual, whether or not in recorded form, within the meaning of applicable privacy laws.

The type of personal information we collect will depend on various factors such as the nature and purpose of our interaction, the type of products or services you may request or use, and any applicable legal and regulatory obligations. This information may include:

• contact information that allows us to communicate with or contact you (e.g., your address, telephone number, e-mail or other electronic address, and fax number)
• identification information that allows us to confirm your identity or to meet legal and regulatory obligations (e.g., your name, date of birth, occupation, and government-issued identification)
• financial information that allows us to determine your creditworthiness or eligibility for or appropriateness of our products or services (e.g., employment and financial history with others, income, assets, liabilities, net worth, and credit reports)
• transactional information about how you use our different products or services or otherwise do business with us (e.g., whether or not credit extended, amount of credited extended, purchase and payment history)
• relationship information that helps us to improve service and understand more about you (e.g., language and communication method preferences and/or what types of products, services or offers you may like).

Most of the personal information is collected directly from you, whether in person, over the telephone, by corresponding with you via email, fax, text message (SMS) or the Internet, or by other means. For instance, we may collect personal information from you: when you voluntarily make an application to or become a customer of the Company, when you create account using one of our mobile applications, when you request information from or otherwise communicate with us, and/or through your use of the products and services we provide. Some information may also be collected from other sources such as credit bureaus, financial institutions, law enforcement, media, social media, government agencies and registries, or public records.

We may monitor or record communications between you and our representatives (e.g., telephone calls) in order to enhance and maintain customer service quality, to protect you and the Company, to confirm your decisions and our discussions with you, and/or for training purposes.

Our Commitment to the Privacy Principles

Principle #1: Accountability – The Company is responsible for personal information under its control and has a designated Compliance Officer who is accountable for our compliance with this Privacy Policy and applicable privacy laws.

Our responsibility regarding personal information applies to personal information in our possession or custody, as well as personal information that we may transfer to a third party for processing or to provide services on our behalf. We use contractual or other appropriate means to require third parties who provide processing or other services on our behalf to maintain a level of privacy protection comparable to our own policies and practices.

Your personal information may be processed or stored in any country in which we, our service providers, and other parties with whom we share information under this Privacy Policy operate (which may include locations outside of Canada). In such event, your personal information may, while in another country, be subject to the laws of that country and may be accessible to courts, law enforcement and government or regulatory agencies in that country in accordance with such laws.

Principle #2: Identifying Purposes – We shall identify the purposes for which personal information is collected at or before the time of collection.

Why We Collect Your Personal Information – Unless additional purposes are identified to you before or at the time of collection, we may collect, use and disclose personal information about you throughout our relationship for some or all of the following purposes:

• to establish your identity
• to verify your identity and information provided by you, such as your employment or credit history
• to evaluate your credit-worthiness
• to process your application, determine your eligibility for products or services and to open, administer and operate your account and set up and manage those products and services
• to enable us and, as applicable, our third party vendors and service providers to provide you with products and ongoing services
• to understand your needs and what products or services may be of interest to you
• to respond to your requests for products, services or account information
• to communicate with you by various methods including email, text (SMS) and telephone
• to verify your instructions and decisions
• to manage and improve your relationship with us
• to protect against errors and criminal activity including the prevention, detection and investigation of fraud, money laundering, cyber threats and other such risks and threats
• to investigate complaints
• to comply with laws and regulations, including tax, regulatory and legal reporting requirements
• as otherwise permitted or required by law

In addition, when you apply for or accept any of our financial products or services, and as long as you have a loan or credit product or service with us, personal information may be exchanged with credit reporting agencies, credit bureaus, credit insurers, financial institutions and other entities with whom you may have financial dealings to assess and update creditworthiness, manage credit risk, determine eligibility for financial products and services, deter fraud, report defaults and maintain the integrity of the credit-granting process.

Joint Accounts – Where a customer holds a product or service jointly with another person (e.g., joint accounts, co-signed applications), we may share such customer’s information with such other person in connection with the product or service.

Business Transactions – If we enter into a business transaction involving personal information such as a sale or other disposition of all or part of our business or assets, we may share information with the other parties as required to fulfill the obligations of the transaction (e.g., as part of due diligence and/or on completion of the transaction). We will require that the other parties to the transaction protect this information by security safeguards appropriate to the sensitivity of the information and limit their use to the purposes of the transaction and, if the transaction is completed, the purposes as set out in this Privacy Policy. In the event the transaction is not completed, we will require that the other parties return or destroy, and confirm complete return or destruction of, such personal information.

New Purpose – If a new purpose for using your personal information should develop, we will identify that purpose to you and request your consent before using it for such purpose, unless the new purpose is required or permitted by law.

Principle #3: Consent – The knowledge and consent of an individual are required for the collection, use, or disclosure of personal information, except where permitted or required by law.

The Company will collect, use or disclose your personal information only with your knowledge and consent, except where required or permitted by law. Generally, we will seek your consent to use and disclose your personal information for identified purposes at the time of collection. In some circumstances, however, where we identify a new purpose after collection, we may seek your consent to use and disclose your personal information for such new purpose after it has been collected.

Consent may be express or, in some circumstances, implied, and may be given in writing (such as on an application), by using or not using a check off-box, electronically (via the internet), orally (in person or by telephone), or by your conduct, such as by voluntarily using a product or service. In determining the type of consent to obtain, we will consider all relevant factors, including the sensitivity of the information and your reasonable expectations.

Withdrawing Consent – Subject to certain legal or contractual restrictions, you may withdraw your consent to the collection, use or disclosure of your personal information at any time upon giving us reasonable notice. We will inform you of the implications of doing so. For instance, withdrawing your consent may limit or prevent us from being able to provide or continue to provide you with certain products or services.

In certain circumstances your consent cannot be withdrawn. For example, you may not withdraw your consent where our collection, use or sharing is required by law. Also, as long as you have a loan or credit product or service with us, you may not withdraw your consent to our ongoing collection, use or disclosure of your personal information in connection with such product or service. Further, in order to maintain the integrity of the credit reporting system, we may periodically update your information with credit bureaus as long as you have a loan or credit product or service with us. Your consent to this exchange of information cannot be withdrawn during this time.

Electronic Marketing Communications; Canadian Anti-Spam Legislation (CASL) – Subject to applicable law, from time to time, we may send you electronic communications notifying you of new and existing products or services, including special offers or promotions, that may be of interest to you. You may unsubscribe at any time from receiving our electronic marketing messages by clicking on the unsubscribe or opt-out link or following any other unsubscribe instructions included in any such message. Please allow up to 10 business days for the change to take effect. Please note that this will not limit our right to send you certain communications relating to your account or your existing products, services or transactions with us, or as otherwise permitted or required by applicable law, and these transactional account messages and other non-commercial electronic messages will not be affected by your choice to unsubscribe or opt-out from electronic marketing messages.

Principle #4: Limiting Collection – The collection of personal information shall be limited to that which is necessary for the purposes identified by the Company. Personal information shall be collected by fair and lawful means.

Principle #5: Limiting Use, Disclosure and Retention – The Company shall not use or disclose personal information for purposes other than those for which it was collected, except with the consent of the individual or as required or permitted by law. We shall retain personal information only for as long as necessary to achieve fulfillment of those purposes or as required by law. When your information is no longer required, we will destroy, erase or make it anonymous.

Principle #6: Keeping Personal Information Accurate – The Company shall keep personal information as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.

While we take care to keep your personal information in our records as accurate, complete and up to date as necessary for the purposes for which it is to be used, we also rely on you to notify us when your information changes. If you wish to verify the accuracy and completeness of your personal information in our records, you may contact our Compliance Officer using the contact information listed below.

Principle #7: Safeguarding Personal Information– The Company shall protect personal information by security safeguards appropriate to the sensitivity of the information.

We will safeguard personal information in our possession or control against loss or theft, as well as unauthorized access, disclosure, copying, use or modification. The safeguards used to protect personal information will vary depending on the sensitivity, amount, distribution, format and method of storage of the personal information. Such security measures include:

• physical security, such as locked filing cabinets and restricted access to offices;
• organizational security, such as security clearances, controlled entry in data centres and limiting access to relevant information on a “need to know” basis; and
• technological security, such as limiting application access to specific roles, the use of passwords, personal identification numbers and encryption.

The Company will use care when disposing of or destroying personal information in order to prevent unauthorized access to the information.

Where the Company uses service providers who may have access to personal information under our control, we use contracts and other measures to require them to have policies and practices in place comparable to our own in order to protect the privacy, confidentiality and security of your personal information and to prevent such information from being used or disclosed for unauthorized purposes.

Principle #8: Openness Concerning our Privacy Practices – The Company shall ensure that specific information about our policies and practices relating to the management of personal information is made readily available to individuals with whom we interact.

If you have any questions or concerns regarding this Privacy Policy or our privacy practices and procedures, please contact our Compliance Officer using the contact information below.

Principle #9: Access to Information – The Company shall, upon request, inform an individual of the existence, use, and disclosure of his or her personal information and shall give such individual access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.

Accessing Your Personal Information – Upon request, we will tell you what personal information we hold about you, how that information has been used or is being made and to whom it has been disclosed. We will also provide you, upon request, with a copy of records related to your personal information, except in certain situations (for example, if they contains references to other individuals, cannot be disclosed for legal, security or proprietary reasons, are subject to solicitor-client or litigation privilege, or in other circumstances prescribed by law). In order to verify that the information is being released to the proper individual, you may be asked to provide suitable identification or to otherwise identify yourself. If we are unable to provide a list of organizations to which we have actually disclosed your personal information, we will provide a list of organizations to which we may have disclosed your personal information. If we deny your request for access, we will advise you of the reason for the refusal. If there will be a charge to access your information, we will inform you of the approximate cost prior to providing access. Requests for access should be directed in writing to our Compliance Officer using the contact information below.

Accuracy of Your Personal Information – You may challenge the accuracy and completeness of the personal information we hold about you. If you demonstrate to us that your personal information is inaccurate, incomplete or out of date, we will amend or delete the personal information as appropriate. If necessary, we will send the amended personal information to any third parties to whom we have disclosed inaccurate, incomplete or outdated information in order to permit them to revise their records. If we do not agree to amend or delete the personal information as requested by you, you may challenge our decision. We will make a record of this challenge, and, if necessary, disclose the challenge to any third parties to whom we has disclosed the personal information. If you would like to verify the accuracy and completeness of your personal information in our records, contact our Compliance Officer using the contact information below.

Principle #10: Challenging Compliance – An individual shall be able to address a challenge concerning the Company’s compliance with this Privacy Policy or applicable privacy laws to our Compliance Officer.

The Company has policies and procedures with respect to receiving, investigating and responding to individuals’ questions and complaints relating to the handling of their personal information.

Third Party Services

EcoHome Financial uses Plaid Inc. (“Plaid”) to gather your data from financial institutions. By using the Service, you grant EcoHome Financial and Plaid the right, power, and authority to act on your behalf to access and transmit your personal and financial information from your relevant financial institution. You agree to your personal and financial information being transferred, stored, and processed by Plaid in accordance with the Plaid end user privacy policy.

Contact Us

If you wish to access your personal information, change your consent to the ways in which we may use or disclose your personal information, have a complaint about our Privacy Policy or the manner in which we may have handled your personal information, or if you have any questions about our Privacy Policy, please contact our Compliance Officer as follows:

Compliance Officer 4 King Street West Toronto, Ontario M5H 1A1 Email: [email protected]

The Company will investigate all complaints. If we find that a complaint is justified, we will take appropriate measures, including, if necessary, amending our policies and practices. If you are not satisfied with the way the Company has responded to your complaint, you may wish to contact the Office of the Privacy Commissioner of Canada:

Office of the Privacy Commissioner of Canada 30, Victoria Street Gatineau, Quebec K1A 1H3 1-800-282- 1376 www.priv.gc.ca

Changes to this Privacy Policy

In order to ensure that our Privacy Policy is kept up to date, we reserve the right to change it from time to time. If we make any changes to this Privacy Policy, we will change the effective date of this Privacy Policy as indicated above. Notice of changes to this Privacy Policy will be posted on the Company’s website, www.ecohomefinancial.com, and may also be distributed through statements, newsletters and/or other communications. Please review our website periodically for any changes to this Privacy Policy.

Visiting the EcoHome Financial Website

Cookies – A “cookie” is a piece of data that a web server creates when you visit a web site. This data is information about how and when you use a site. It is placed on your computer in the form of a small text file. The information cannot be used to identify you personally. Cookies do not collect personal information such as your name, address, telephone number, or email address.

We use session ID cookies on our website, www.ecohomefinancial.com. Session cookies identify a specific user session and allow the website to recognize you as you navigate between pages during a single browser session and allow you to use the website most efficiently. Session ID cookies are temporary cookies that expire at the end of the session when you leave the site.

We also use Google Analytics to help analyse how visitors engage with our website. Google Analytics uses cookies to collect standard Internet log information (e.g. IP address) and to track visitor behaviour information (e.g. the web address of the page you visit), in an anonymous form. The information generated by Google Analytics cookies about your use of the site is transmitted to Google and is processed to compile statistical reports on website activity for the site. We use these reports to evaluate aggregate visitor usage so that we can manage and improve the site and its content to better meet our visitors’ needs. You may opt out of Google Analytics – for more information on opting out of being tracked by Google Analytics across all websites you use, visit https://tools.google.com/dlpage/gaoptout. For further information about Google Analytics, please refer to https://www.google.com/policies/privacy/partners/.

Other Websites

Our website, www.ecohomefinancial.com, may contain links to other websites. EcoHome Financial is not responsible for the privacy practices of other web sites. We encourage users of our website to read the privacy statements of such other websites that collect your personal information.