3.1 Principle 1 - Accountability
IRVING OIL is responsible for all personal information under its control, including personal information disclosed to third parties for processing.
3.1.1 The Privacy Officer is responsible for compliance with this Policy, even though other individuals within IRVING OIL may be responsible for the day to day collection and processing of personal information, and may be delegated to act on behalf of the Privacy Officer.
3.1.2 The identity of the individuals designated by IRVING OIL to oversee compliance with this Policy will be made known internally and will be made available externally on request.
3.1.3 IRVING OIL will use contractual or other means to protect personal information that has been transferred to service providers for processing, for example, for merchant services.
3.1.4 IRVING OIL will implement policies and practices to give effect to this Policy, including:
184.108.40.206 establishing procedures to receive and respond to complaints and inquiries;
220.127.116.11 training staff to understand and adhere to our policies and practices; and
18.104.22.168 developing public information to explain IRVING OIL's policies and practices
3.2 Principle 2 - Identifying the purposes for personal information collection
IRVING OIL will identify the purposes for which personal information is collected, used or disclosed at or before the time the information is collected.
3.2.1 IRVING OIL collects, uses and discloses personal information for the following purposes:
22.214.171.124 establishing and administering customer accounts
126.96.36.199 where credit is requested by a customer or potential customer, , to obtain credit reports or credit histories for purposes of assessing applications for credit or account payment delinquencies;
188.8.131.52 to collect on outstanding accounts;
184.108.40.206 to understand customer needs and preferences and develop and enhance our products and services;
220.127.116.11 if customers do not opt out, to market our products and services;
18.104.22.168 to comply with legal requirements; and
22.214.171.124 to respond to inquiries, including inquiries by telephone to our Customer Service Centre or through the IRVING OIL web-site.
3.2.2 IRVING OIL will not disclose sensitive personal information (such as any customer's financial information) to third parties, or share sensitive personal information among its business units, for marketing purposes. Customers may opt-out of the use or disclosure of their personal information by or to IRVING OIL business units or third parties for marketing purposes (see section 3.3.7 below).
3.2.3 At the time that the information is collected, an individual will be advised of the purposes for which the information is collected. An individual may, at any time, request or be given an explanation of how their personal information is being used.
3.2.4 If IRVING OIL proposes to use or disclose personal information for a purpose not previously identified, the new purpose will be identified prior to the new use. Unless the new purpose is required or permitted by law, the consent of the individual is required before the information can be used or disclosed for that purpose.
3.3 Principle 3 - Obtaining consent
IRVING OIL will obtain the consent of individuals before or when it collects, uses or discloses personal information, except when inappropriate. IRVING OIL will make reasonable efforts when obtaining consent to ensure that individuals understand how IRVING OIL will use and disclose the personal information it collects.
3.3.1 All of the circumstances in which IRVING OIL may collect, use or disclose personal information without the knowledge or consent of an individual are as specified and permitted by legislation. For example, IRVING OIL may collect, use or disclose personal information about an individual if it is clearly in the interests of an individual and consent cannot be obtained in a timely way, such as when an individual is seriously ill or incapacitated or in cases of emergencies threatening life, health or security.
3.3.2 IRVING OIL will use reasonable efforts to ensure that an individual is advised of the identified purposes for which personal information will be used or disclosed. Purposes will be stated in a manner that can be reasonably understood by the individual
3.3.3 Generally, IRVING OIL will seek consent to use and disclose personal information at the same time it collects the information. However, IRVING OIL may seek consent to use and disclose personal information after it has been collected, but before it is used or disclosed for a new purpose.
3.3.4 IRVING OIL will require individuals to consent to the collection, use or disclosure of personal information as a condition of the supply of information or services to the individual only if such collection, use or disclosure is necessary to provide the information or services.
3.3.5 In determining the appropriate form of consent, IRVING OIL will take into account the sensitivity of the personal information and the reasonable expectations of its customers regarding the purposes for use or disclosure of the information by IRVING OIL.
3.3.6 A customer may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Customers may contact IRVING OIL for more information regarding the implications of withdrawing consent.
3.3.7 Customers or individuals may opt-out or refuse to consent to the use or disclosure of their personal information for marketing purposes by contacting the Customer Contact Centre at 1-800-IRVING-1.
3.4 Principle 4 - Limiting collection of personal information
IRVING OIL shall limit the collection of personal information to that which is necessary for the purposes identified by IRVING OIL. IRVING OIL will collect personal information by fair and lawful means
3.5 Principle 5 - Limiting use, disclosure and retention of personal information
IRVING OIL will not use or disclose personal information for purposes other than those for which it was collected, except with the consent of the individual, or as required or permitted by law. Personal information will be retained only as long as necessary for the fulfilment of those purposes.
3.5.1 IRVING OIL has a records retention policy that specifies the length of time that records are maintained. All personal information is accessible only by IRVING OIL's personnel, or service providers, who need access to that information for the performance of their duties or services.
3.5.2 IRVING OIL destroys, erases or makes anonymous, personal information that is no longer required to fulfill the identified purposes.
3.6 Principle 6 - Keeping personal information accurate
IRVING OIL will keep personal information as accurate, complete and up to date as necessary for the purposes for which it is to be used.
3.6.1 Information will be sufficiently accurate, complete and up to date so as to minimize the possibility that inappropriate information may be used to make a decision about an individual.
3.6.2 IRVING OIL will update personal information about customers on an on-going basis, when necessary to fulfill the purposes identified in this Policy, or upon notification by the individual.
3.7 Principle 7 - Safeguarding personal information
IRVING OIL will protect personal information with security safeguards appropriate to the sensitivity of the information.
3.7.1 IRVING OIL will protect personal information against loss or theft as well as unauthorized access, disclosure, copying, use or modification, regardless of the format in which the information is held, using appropriate security safeguards.
3.7.3 IRVING OIL will make its employees aware of the importance of maintaining the confidentiality of personal information. 3.7.4. IRVING OIL will dispose of personal information in a manner that prevents unauthorized parties from gaining access to the information.
3.8 Principle 8 - Being open about policies and procedures
IRVING OIL will make readily available to individuals specific information about IRVING OIL policies and procedures relating to the management of personal information.
3.8.1 IRVING OIL will be open about its policies and procedures with respect to the management of personal information. Individuals will be able to acquire information about our policies and procedures at minimal cost and without unreasonable effort. This information will be made available in a form that is generally understandable.
3.8.2 The information made available by IRVING OIL will include:
126.96.36.199 the name, title and address of the individual who is accountable for IRVING OIL's policies and procedures and to whom complaints or inquiries can be forwarded;
188.8.131.52 the means of gaining access to personal information held by IRVING OIL;
184.108.40.206 a copy of any documents that describe IRVING OIL's privacy policies, standards and/or codes.
3.9 Principle 9 - Providing access to personal information
On written request, and subject to the exemptions stipulated by law, IRVING OIL will inform individuals of the existence, use and disclosure of their personal information and provide access to that information. An individual will be able to challenge the accuracy and completeness of the information and have it amended as appropriate.
3.9.1 On written request, IRVING OIL will inform an individual whether or not IRVING OIL holds personal information about them, and will indicate the source of this information, if available. If IRVING OIL possesses such information, it will allow the individual or employee access to this information. In addition, IRVING OIL will provide an account of the use that has been made or is being made of this information and an account of the third parties, if any, to which it has been disclosed.
3.9.2 IRVING OIL may require an individual or employee to provide sufficient information to permit IRVING OIL to provide an account of the existence, use and disclosure of personal information. The information provided will only be used for this purpose.
3.9.3 In certain situations, IRVING OIL may not be able to provide access to all of the personal information that it holds about an individual. For example, access to information may not be provided if doing so would likely reveal personal information about a third party or could reasonably be expected to threaten the life or security of another individual. In addition, IRVING OIL may not provide access to information if disclosure would reveal confidential commercial information, if the information is protected by solicitor-client privilege, if the information was generated in the course of a formal dispute resolution process or if the information was collected in relation to the investigation of a breach of an agreement or a contravention of a federal or provincial law. If access to personal information cannot be provided, IRVING OIL will provide the reasons for denying access unless prohibited by law from doing so.
3.9.4 IRVING OIL will respond to an individual's request within a reasonable time and at minimal or no cost (provided IRVING OIL's out of pocket expenses are covered). The requested information will be provided or made available in a form that is generally understandable.
3.9.5 When an individual or employee successfully challenges the accuracy or completeness of personal information, IRVING OIL will correct, delete or add information as required. When appropriate, the amended information will be transmitted to any third parties having access to the information in question.
3.9.6 When a challenge to the accuracy or completeness of personal information is not resolved to the satisfaction of the individual, the unresolved difference will be noted in the individual's file. When appropriate, the existence of the unresolved difference will be transmitted to any third parties having access to the information in question.
3.10 Principle 10 - Challenging compliance
3.10.1 IRVING OIL will implement procedures to receive and respond to complaints or inquiries about its policies and procedures relating to the handling of personal information. The complaint process will be easily accessible and simple to use. IRVING OIL may ask a customer for a written form of complaint to ensure accuracy and obtain reasonable specifics.
3.10.2 IRVING OIL will investigate all complaints. If a complaint is found to be justified, IRVING OIL will take appropriate measures, including amending its policies and procedures if necessary.
3.10.3 IRVING OIL will inform individuals and employees who lodge complaints, or inquire about complaint procedures, about the existence of these procedures.
3.10.4 For more information on IRVING OIL's privacy practices, or to make a complaint contact: Privacy Officer, c/o Legal Affairs, P.O. Box 1421, Saint John, New Brunswick, E2L 4K1.
3.10.5 Individuals also have recourse to the Office of the Privacy Commissioner of Canada , at the address noted below, if they consider that IRVING OIL has not responded satisfactorily to their complaint or inquiry.