PRIVACY STATEMENT

Industrial and Commercial Bank of China (Canada) ("we", "us", “our” or "the Bank") is committed to respecting your privacy and the confidentiality of your personal information. We prepared this Privacy Statement to inform you of why we collect and use your personal information, how your information is shared, retained and protected, and how you can exercise your personal choices and individual rights.

We may revise this Privacy Statement from time to time. We will post the revised Privacy Statement to our website and in our branches.

We will treat personal information in a manner consistent with the Privacy Statement under which it was collected, unless we have your consent to treat it differently. This Privacy Statement applies to any information we collect or receive about you, from any source.

COLLECTING YOUR PERSONAL INFORMATION

“Personal information” means any information, in any form, about an identified individual or an individual whose identity may be reasonably inferred or determined from such information. Most of the information we collect is collected when you interact directly with us in the course of commercial activities, for example when you apply for a product or service; or communicate, interact, transact with or through us. We also collect financial and other information about you from third parties including credit bureaus and publicly available sources such as internet news, social media sites, government agencies, registries, or public records. Information we collect may include:

• Identification information such as name, home address, telephone, personal email address, date of birth, social insurance number, marital status; identification documents such as driver’s license;
• Employment information such as salary, job title;
• Financial information such as credit score, source of income and assets held;
• If you choose to use the Bank’s QR Code application, information such as card number, transaction amount, transaction date, time and location; and
• Other information necessary for the Bank’s purposes, which will be collected with your consent in the course of your relationship with the Bank, or as otherwise permitted or required by law.

The personal information we ask for depends on the product or service you obtain.

USE OF YOUR PERSONAL INFORMATION

If you apply for or have obtained a product or service from us, we will collect, use and may disclose your personal information for the purposes of:

• Understanding your needs and determining the suitability of particular financial products or services for you, including creating and maintaining credit scoring models about you;
• Determining your eligibility for financial products and services, including identifying you, assessing your applications and conducting initial and periodic credit checks on you;
• Providing you with the relevant financial product, service or information promotions or other opportunities in which you may be interested, and responding to your inquiries about applications, accounts or other services;
• Where circumstances require, collecting amounts outstanding from you and those providing security for you;
• Protecting against fraud;
• Meeting our legal and regulatory requirements, including reporting requirements; or
• Such other purposes for which you provide your consent, from time to time.

Personal information will be collected, to the extent possible, directly from you. We may collect from, use and disclose to external sources, including references you have provided, credit bureaus, personal information agents, law enforcement representatives, private investigators, and other groups or companies where collection is necessary for the purposes described above. For example, to know your credit worthiness for credit products, we may contact other lenders or credit bureaus to obtain information on your credit history. We may also contact employer or other personal references to verify the information you have given us. We will not do this without your consent.

We do not knowingly collect personal information from anyone under age of 13 except with parental or guardian consent, and will delete any such information if we discover that it has been provided by a person under that age without the consent of a parent or guardian.

YOUR CONSENT

We collect, use and disclose your personal information with your consent, except as permitted or required by law (for example, to comply with a court order, to comply with local or federal regulations or a legally permitted inquiry by a government agency, or to collect a debt owed to us).

You may provide your consent to us either orally, electronically or in writing. The form of consent that we seek, including whether it is express or implied, will largely depend on the sensitivity of the personal information and the reasonable expectations you might have in the circumstances.

You can withdraw your consent to our collection, use and disclosure of personal information at any time, subject to legal or contractual restrictions and reasonable notice (for example, during the term of a loan, you may not withdraw your consent to our ongoing collection, use or disclosure of your personal information in connection with the loan you have or had with us). Note that if you withdraw your consent to certain uses of your personal information, we may no longer be able to provide certain products or services to you. You may not be permitted to withdraw consent to certain necessary uses and disclosures (for example, maintaining reasonable business and transaction records, disclosures to Canadian and foreign government entities as required to comply with laws, and reporting on credit information after credit has been granted). You can withdraw your consent at any time by contacting the branch where your account is held.

DISCLOSURE OF YOUR PERSONAL INFORMATION

We may disclose your personal information in a number of circumstances, including:

• To credit bureaus, credit reporting agencies and to your current or future creditors for the purpose of maintaining your credit history and providing credit references;
• To financial institutions for payment processing purposes;
• To third parties as reasonably necessary:
      To enforce your contracts with us and collection or payment of a debt owed to us;
      To detect and prevent fraud;
      In connection with audits or to meet legal, regulatory, and risk management requirements;
• Unless you have opted out, to our affiliates, partners or other select third parties to enable them to offer you additional products and services; or
• Any other purpose to which you consent or that is permitted or required by privacy law or other applicable law.

We may transfer personal information to service providers or to our affiliates, some of whom may make use of technology including artificial intelligence technology. Our service providers perform services on our behalf such as statement preparation, mailing, risk assessments, strategic business advice, collections, information technology and/or data hosting or processing services or similar services, or otherwise to collect, use, disclose, store or process personal information on our behalf for the purposes described in this Privacy Statement.

Some of these service providers or affiliates may be located outside of Canada, including in the People’s Republic of China. Your personal information may be collected, used, disclosed, stored and processed in the People’s Republic of China or elsewhere outside of Canada for the purposes described in this Privacy Statement. Reasonable contractual or other measures we may take to protect your personal information are subject to legal requirements in Canada, the People’s Republic of China or elsewhere outside of Canada, therefore your personal information may be accessible to law enforcement or government authorities of those countries.

RETAINING YOUR PERSONAL INFORMATION

We take reasonable steps to ensure that your personal information is kept as accurate, complete and up-to-date as possible. We will not routinely update your personal information unless such a process is necessary. We expect you, from time to time, to supply us with written updates to your personal information, when required.

We keep your personal information only as long as it is required for to fulfill the purposes which it was collected. The length of time we retain information varies, depending on the product or service and the nature of the information. This period may extend beyond the end of your relationship with us but it will be only for so long as it is necessary for us to have sufficient information to respond to any legal issues that may arise at a later date.

When your personal information is no longer needed for the Bank's purposes, we have procedures to securely destroy, delete, or convert it into an anonymous form. We reserve the right to use such anonymous and de-identified data for any legitimate business purpose without your consent or further notice to you.

PROTECTING YOUR PERSONAL INFORMATION

We have administrative, technological, and physical safeguards to protect the security of the personal information we have under our control against unauthorized access, disclosure, use or modification.

We restrict access to personal information to employees and authorized service providers who need access to fulfil their job requirements. We train our employees on the importance of protecting your personal information, and reinforce the importance of confidentiality, customer privacy and security obligations in the Bank’s Code of Conduct.

We ensure that service providers and affiliates with access to your personal information agree to use and disclose such personal information solely for the purposes indicated by the Bank and, with respect to that information, to act in a manner consistent with the relevant principles articulated in this Policy Statement.

We audit our procedures and security measures from time to time to ensure that they remain effective and appropriate.

COOKIES AND WEBSITES

We provide customers with access to public websites and restricted access to sub-sites to provide electronic banking services. In the course of your use of these sites, we may collect information directly from you via e-mail or by on-line submission.

If you use our mobile app, we collect and use your personal information to authenticate you and prevent fraud, manage our mobile app services, and understand how users use the app.

Our web servers may track general information about visitors such as domain name and time of visit. Our web servers also collect and aggregate information regarding which pages are being accessed as well as information volunteered by visitors through online surveys or subscriptions to electronic newsletters. Consent for marketing, promotional and other electronic communications is optional. You can withdraw your consent at any time by contacting the branch where your account is held. This information is used internally, only in aggregate form, to better serve visitors by helping us to manage our websites, diagnose any technical problems, and improve the content of our websites.

When you visit our websites, we may collect information about your visit including your IP address, your geographic region (as determined from IP address), clickstream through our website, the date and time or your visit, information about your device and network such as the browser you use and its configuration, your connection speed, the pages you view or search for on our website, what links you click, what you download, our page response times, any download or other errors, and the length of your visit.

Our websites use cookies only for session management purposes. These cookies expire when the session is closed. You should be aware that if you set your browser to disable cookies, you may not be able to access services offered by us.

We do not use technology that includes functions allowing individuals to be identified, located or profiled. We do not use personal information to render a decision based exclusively on automated processing of your personal information.

ACCESSING OR CORRECTING YOUR PERSONAL INFORMATION

You can request access to your personal information in our custody or control by sending a written request to the Privacy Officer at the contact information below. We will respond within a reasonable time and no later than 30 days following the request, except where otherwise permitted by law. We will advise you in writing if we cannot meet your requests within this time limit. We will advise you if there will be a nominal fee, in advance of proceeding with your request.

You can request access to computerized personal information collected from you, and not created or inferred using personal information concerning you, in a structured, commonly used technological format. You can also request such computerized personal information be communicated to any person or body authorized by law to collect such information.

You can challenge the accuracy or completeness of your personal information in our custody or control. If you successfully demonstrate that your personal information in our records is inaccurate or incomplete, we will amend the personal information as required. Where appropriate, we will transmit the amended information to third parties with access to your personal information.

To process your request, we may ask you to verify your identity and confirm details of your request.

CONTACTING US

To request access to, or correction of, your personal information, to ask questions about this Privacy Statement or our privacy practices, or to refuse or withdraw your consent to use your personal information for the purposes outlined in this Privacy Statement, write to:

Privacy Officer
Industrial and Commercial Bank of China (Canada)
Bay Adelaide Centre, West Tower, Unit 3710
333 Bay Street, Toronto, ON M5H 2R2

If you have a privacy complaint, please follow our Complaint Resolution Procedures provided to you when you opened your account and available at our branch locations and on our website www.ICBK.ca.

If you are not satisfied with the outcome of your privacy complaint, you can contact the Office of the Privacy Commissioner of Canada investigates complaints related to the Personal Information Protection and Electronic Documents Act.

Office of the Privacy Commissioner of Canada
30 Victoria Street, Gatineau, QC K1A 1H3
Website:       www.priv.gc.ca
Phone:         1-800-282-1376

Residents of Alberta, British Columbia and Québec can contact their provincial privacy regulator.

Office of the Information and Privacy Commissioner of Alberta
Website:       https://oipc.ab.ca/
Email:           generalinfo@oipc.ab.ca
Phone:         1-888-878-4044

Office of the Information & Privacy Commissioner of British Columbia
Website:       https://www.oipc.bc.ca/
Email:           info@oipc.bc.ca
Phone:         1-250-387-5629

Commission d’accès à l’information du Québec
Site :             https://www.cai.gouv.qc.ca/
Courriel :     renseignements@cai.gouv.qc.ca
Sans frais : 1-888-528-7741