| 1) | Direct collection of personal information |
| • | We never collect personal information without the consent of the individual, and we do so using only fair and legal methods. |
| • | We collection personal information, including that of customers and employees, only within the scope required for achieving specific objectives. |
| • | We never collect sensitive information entailing potential harm an individual's interests without that person's express consent or when we have a legal reason collecting it. |
| • | We collect personal information only within the scope required after informing the person about our customer inquiries team for personal-information matters. |
| 2) | Indirect collection of personal information (information collection for a client under an outsourcing agreement) |
| • | Personal information we collect on behalf of a client will be managed in strict compliance with all legal requirements and used within limitations set out in our service agreement with the client. |
| • | Strictly enforced service agreements provide for maintenance of confidentiality, renewal of contract, allocation of responsibility should unauthorized access or disclosure occur, and return or deletion of personal information on expiry of the service agreement. |
| 3) | Personal information collected by third parties (subcontractors) |
| • | Personal information collected by third parties (outsourced subcontractors) will be managed as needed to maintain privacy (e.g, prevent unauthorized disclosure) through binding privacy provisions in the outsourcing agreement. |
| 4) | Use of personal information and provision to third parties |
| • | We will not disclose or provide to any third party personal information that we have collected without the person's consent other than in highly exceptional circumstances.
|
