Privacy Policy

Introduction

Securegard Public Storage Inc. (hereinafter individually or collectively referred to as the “Building Owner”) has always been committed to keeping our tenants’ personal information accurate, confidential, secure and private. The Policy for the Protection of Personal Information (the “Policy) that follows builds on this commitment. The Policy is based on the Model Code for the Protection of Personal Information (CAN/CSA Q830-96) (the “Model Policy”) included as Schedule 1 of the Personal Information Protection and Electronic Documents Act. The Policy describes how the Building Owner subscribes to the principles set out in the Model Policy.

Summary of Principles

Ten interrelated principles form the basis of the Policy as it relates to the protection of Personal Information.

Accountability. The Building Owner is responsible for Personal Information under its control and has designated the “Designated Individual” to be accountable for Building Owner’s compliance with the Policy.
Identifying Purposes. The purposes for which Personal Information is Collected shall be identified by Building Owner when or before such Personal Information is Collected.
Consent. The knowledge and Consent of any individual are required for the Collection, Use, or Disclosure of his or her Personal Information, except in specific circumstances as described within the Policy or at law.
Limiting Collection. The Collection of Personal Information shall be limited to that which is necessary for purposes identified by Building Owner. Personal Information shall be Collected in a fair and lawful manner.
Limiting Use, Disclosure, and Retention. Personal Information shall not be Used or Disclosed for purposes other than those for which it was Collected, except with an individual’s Consent or as required or permitted by law. Personal Information shall be retained only as long as necessary to fulfill the purposes for which it was Collected.
Accuracy. Personal Information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be Used.
Safeguards. Personal Information in Building Owner’s possession shall be protected by security safeguards appropriate to the sensitivity of the information.
Openness. Building Owner shall make the Policy readily available the general public.
Individual Access. Upon request, an individual shall be informed of the existence, Use, and Disclosure of their own Personal Information, and shall be given access to that information. An individual is entitled to question the accuracy and completeness of their own Personal Information and have it amended if appropriate.
Compliance. Any individual can question Building Owner’s compliance with this Policy to the Designated Individual. Building Owner shall investigate all complaints. If a complaint is found to be justified, Building Owner shall take appropriate measures, including revision of the Personal Information and, if necessary, amendment of this Policy

Definitions

The following definitions apply in this Policy:

“Collection“. The act of gathering, acquiring, or obtaining Personal Information from any source, including Third Parties, by any means, and derivatives of “Collection” shall have a like meaning.

“Consent“. Voluntary agreement with what is being done or proposed, which can be either express or implied by the action or inaction of an individual or an individual’s authorized representative.

“Designated Individual“. The individual within Building Manager who is responsible for Building Owner’s day-to-day compliance with this Policy, being Andrea Lawrence and Doreen Meyer or such other person as may be designated or delegated to handle these functions.

“Disclosure“. Making Personal Information available to others outside Building Manager and Building Owner but does not include the transfer of Personal Information to a Third Party for processing purposes, and derivatives of “Disclosure” shall have a like meaning.

“Personal Information“. Any information about, or which can be linked to, an identifiable individual, but does not include the name, title or business address or telephone number of an employee of an organization.

“Third Party“. Any person other than Building Manager and Building Owner or the individual whose Personal Information is in question.

“Use“. The treatment and handling of Personal Information within or by Building Manager and Building Owner and derivatives of “Use” shall have a like meaning.

Policy Principles

Principle 1 – Accountability

Building Owner is responsible for Personal Information under its control and has designated the Designated Individual to be accountable for Building Owner’s compliance with this Policy.

1.1 Ultimate accountability for Building Owner’s compliance with the Policy rests with Building Owner’s Board of Directors, who have delegated day-to-day accountability to the Designated Individual or such other individual as may be designated or delegated. Other individuals may be accountable for the day-to-day Collection and processing of Personal Information, or to act on behalf of the Designated Individual.

1.2 Building Owner shall identify to its employees, its clients and the public, the Designated Individual.

1.3 Building Owner shall, through contractual or other means, provide a comparable level of protection where a Third Party is processing Personal Information on behalf of Building Owner.

1.4 Building Owner shall periodically review its policies and procedures that give effect to the Policy, including:

(a) procedures to protect Personal Information;

(b) procedures to receive and respond to concerns and inquiries;

(d) review of its policies and procedures to ensure compliance with the Policy and consideration of any revisions, as and when considered appropriate to do so in the opinion of the Board of Directors.

Principle 2 – Identifying Purposes

The purposes for which Personal Information is Collected shall be identified by Building Owner when or before such Personal Information is Collected.

2.1 Building Owner shall document the purposes for which Personal Information is Collected prior to Collection.

2.2 Building Owner shall make reasonable efforts to ensure that individuals are aware of the purposes for which Personal Information about them is Collected, including any Disclosures to Third Parties.

2.3 Building Owner may collect Personal Information for the following purposes:

to aid in understanding our tenants’ needs;
to transmit Personal Information to “tenant check” and/or credit or consumer report services to obtain credit information about tenants or prospective tenants and to otherwise determine an individual’s suitability as a tenant;
to contact a tenant or the tenant’s emergency contact to discuss matters pertaining to the tenant’s tenancy or in the event of an emergency;
to facilitate the orderly parking of vehicles;
to use or transmit such Personal Information to cable, telephone or other utility companies and municipalities to facilitate a tenant’s connection and use of their services;
to provide tenancy conduct information to other landlords in respect of a tenant’s application for a future tenancy;
to use and disclose Personal Information to agencies contracted by Building Owner to facilitate collection of debts owing;
to disclose existing tenancies to financial institutions who are lending or may lend money against any property owned by Building Owner; and
to meet legal and regulatory requirements.

2.4 When Personal Information is to be Used for a purpose not previously identified, the new purpose shall be identified prior to Use of the Personal Information. Unless a law requires the new purpose, the individual’s Consent is required before the Personal Information can be Used for that purpose.

Principle 3 – Consent

The knowledge and Consent of any individual are required for the Collection, Use, or Disclosure of Personal Information, except in specific circumstances as described within the Policy or at law.

Note: In certain circumstances Building Owner may Collect, Use or Disclose Personal Information without the knowledge and Consent of an individual. These circumstances may include:

where the Collection, Use or Disclosure is clearly in the interests of the individual and Consent cannot be obtained in a timely way;
to investigate a breach of an agreement or a contravention of the laws of Canada or a province;
where the information is considered by law to be in the publicly available;
to act in respect of an emergency that threatens the life, health or security of an individual; and
to investigate an offence under the laws of Canada, a threat to Canada’s security, to comply with a subpoena, warrant or court order or rules of court relating to the production of records, or otherwise as required by law.

3.1 In certain circumstances, Consent may be sought after the information has been Collected, but before Use (for example, when Building Owner wants to Use information for a purpose not previously identified).

3.2 Building Owner may Collect, Use, or Disclose Personal Information without an individual’s Consent for the Collection of overdue accounts and legal or security reasons.

3.3 Building Owner shall make a reasonable effort to ensure that the individual is aware of the purposes for which the Personal Information shall be Used. For Consent to be meaningful, the purposes must be stated so that the individual can reasonably understand how the information shall be Used.

3.4 Building Owner shall not, as a condition of the supply of a product or service, require an individual’s Consent to the Collection, Use, or Disclosure of Personal Information beyond that required to fulfill Building Owner’s identified purposes.

3.5 In determining the type of Consent required of an individual, Building Owner shall take into account the sensitivity of the Personal Information.

The individual’s reasonable expectations are also relevant when obtaining Consent. Building Owner will assume that the individual’s request for product or services constitutes Consent for that specific purpose.

3.7 The way in which Building Owner seeks Consent may vary, depending on the circumstances and the type of information Collected. Building Owner shall seek express Consent when the information is likely to be considered sensitive. Implied Consent shall generally be appropriate when the information is less sensitive.

3.8 Individuals can give their Consent in writing, through inaction, orally, at the time they obtain a product or use a service, and through an authorized representative (such as a legal guardian or a person having power of attorney).

3.9 An individual may withdraw Consent at any time, provided that:

(a) Building Owner is given reasonable notice of the withdrawal; and

(b) the withdrawal is in writing and includes an acknowledgment by the individual that a withdrawal of Consent could mean that Building Owner cannot provide a product or service to the individual or an entity that the individual represents.

Building Owner shall inform the individual of the implications of such withdrawal.

Principle 4 – Limiting Collection

The Collection of Personal Information shall be limited to that which is necessary for purposes identified by Building Owner. Personal Information shall be Collected in a fair and lawful manner.

4.1 Building Owner shall not collect Personal Information indiscriminately.

4.2 Building Owner shall not mislead or deceive individuals about the purpose for which Personal Information is being Collected.

Principle 5 – Use, Disclosure, and Retention

Personal Information shall not be Used or Disclosed for purposes other than those for which it was Collected, except with an individual’s Consent or as required or permitted by law. Personal Information shall be retained only as long as necessary to fulfill the purposes for which it was Collected.

5.1 Building Owner shall document all Uses of Personal Information.

5.2 Building Owner may disclose Personal Information without an individual’s Consent to protect the interests of Building Owner when required or permitted by law. For example, when Disclosure is requested:

(a) by subpoena or search warrant;

(b) by court or government order;

(d) by a Third Party acting in a confidential or professional relationship with Building Owner, such as an auditor or a solicitor.

5.3 Building Owner shall protect the individual’s interests by taking reasonable steps to ensure that:

(a) orders or demands comply with the laws under which they were issued;

(b) only the Personal Information that is legally required or necessary to be Disclosed is Disclosed; and

5.4 Building Owner shall make reasonable efforts to notify the individual that an order for Disclosure has been received, if not contrary to Building Owner’s security and if allowed by law.

Building Owner shall maintain guidelines and procedures for the retention of Personal Information. The guidelines shall include minimum and maximum retention periods. Personal Information that has been Used to make a decision, whether by Building Owner or a Third Party, about an individual shall be retained long enough to allow the individual access to the information. Building Owner is subject to legislative requirements with respect to certain record retention. At minimum, we shall retain Personal Information as long as is necessary to satisfy legislative requirements.

5.6 Subject to any requirement to retain records, Personal Information that is no longer required to fulfill the identified purposes shall be destroyed, erased, or made anonymous. Building Owner shall develop guidelines and implement procedures to govern the destruction of personal information.

Principle 6 – Accuracy

Personal Information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be Used.

6.1 Personal Information shall be sufficiently accurate, complete, and up-to-date as is necessary to minimize the possibility that inappropriate information may be Used to make a decision about or in respect of an individual. Building Owner relies on individuals to keep certain Personal Information accurate.

6.2 Building Owner shall not routinely update Personal Information, unless current information is necessary to fulfill the purposes for which it was Collected.

6.3 Personal Information Used on an on-going basis, including information that is Disclosed to Third Parties, shall be kept accurate and up-to-date.

Principle 7 – Safeguards

Personal Information in Building Owner’s possession shall be protected by security safeguards appropriate to the sensitivity of the information. In protecting Personal Information, Building Owner shall use the same standard of care as it uses to safeguard its own confidential information of a similar nature.

7.1 The security safeguards shall protect Personal Information against loss, theft and unauthorized access, Disclosure, copying, Use, or modification. In protecting the Personal Information, Building Owner shall protect Personal Information regardless of the format in which it is held.

7.2 Building Owner’s protection methods will include (where necessary):

(a) physical measures, for example, locked filing cabinets and restricted access to offices;

(b) organizational measures, for example, limiting access to information on a “need-to-know” basis;

(d) investigative measures, in cases where Building Owner has reasonable grounds to believe that Personal Information is being inappropriately Collected, Used or Disclosed.

7.3 Building Owner shall periodically remind employees, officers and directors of the need to keep Personal Information confidential.

7.4 Third Parties shall be required to safeguard Personal Information Disclosed or transferred to them in a manner consistent with Building Owner’s policies.

7.5 Care shall be taken in the disposal or destruction of Personal Information, to prevent unauthorized parties from gaining access to the information.

Principle 8 – Openness

Building Owner shall make the Policy readily available to the general public.

8.1 Building Owner shall make readily available specific, understandable information about its policies and procedures with respect to the management of Personal Information.

8.2 The available information shall include:

(a) the name of the Designated Individual to whom complaints or inquiries can be forwarded;

(b) the means of gaining access to Personal Information held by Building Owner;

(d) information about Building Owner’s Personal Information policies, procedures, and this Policy.

Principle 9 – Individual Access

Upon request, an individual shall be informed of the existence, Use, and Disclosure of their own Personal Information, and shall be given access to that information. An individual is entitled to question the accuracy and completeness of their own Personal Information and have it amended if appropriate.

Note: In certain situations, Building Owner may not be able to provide an individual with access to all of their Personal Information. Exceptions to access shall be limited and specific. Reasons for denying access may include the following:

providing access would reveal Personal Information about a Third Party, unless this information can be severed from the record or the Third Party Consents to its Disclosure, or the information is needed due to a threat to life, health or security;
the Personal Information has been requested by a government institution for the purposes of enforcing any law of Canada, a province or a foreign jurisdiction, carrying out any investigation related to law enforcement, the administration of any law, the protection of national security, the defense of Canada or the conduct of its international affairs;
providing access would reveal confidential commercial information, provided this information cannot be severed from the file containing other information requested by the individual;
providing access could reasonably threaten the life or security of another individual, provided this information cannot be severed from the file containing other information requested by the individual;
the information was Collected without the individual’s knowledge or Consent for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province;
providing access would reveal Building Owner’s own “proprietary information”; and
the information was generated in the course of a formal dispute resolution process.

9.1 Upon request, Building Owner shall inform an individual of the existence, Use, and Disclosure of Personal Information about such individual held by Building Owner, and allow the individual to access his or her Personal Information.

9.2 Building Owner shall be as specific as possible in providing an account to an individual of Third Parties to whom Building Owner has Disclosed Personal Information. This shall include providing the individual with a list of Third Parties or the kinds of Third Parties to whom Personal Information has been Disclosed.

9.3 Building Owner shall respond to an individual’s request for Personal Information within a reasonable time and at no cost to such individual. The requested Personal Information shall be provided or made available in a generally understandable form.

9.4 When an individual successfully demonstrates the inaccuracy or incompleteness of Personal Information, Building Owner shall amend the information as required. Depending upon the nature of the Personal Information, amendments could include the correction, deletion, or addition of Personal Information. Where appropriate, the amended Personal Information shall be transmitted to Third Parties having access to the Personal Information in question.

9.5 When a challenge is not resolved to an individual’s satisfaction, Building Owner shall record the substance of the unresolved challenge. When appropriate, the existence of the unresolved challenge shall be transmitted to Third Parties having access to the Personal Information in question.

Principle 10 – Compliance

Any individual can question Building Owner’s compliance with this Policy to the Designated Individual. Building Owner shall investigate all complaints. If a complaint is found to be justified, Building Owner shall take appropriate measures, including revision of the Personal Information and, if necessary, amendment of this Policy.

10.1 The Designated Individual shall be identified to the staff and tenants of Building Owner.

10.2 Building Owner shall have procedures to receive and respond to complaints or inquiries about its policies and procedures in relation to the handling of Personal Information. The complaint procedures shall be accessible and simple to use.

If the Designated Individual does not deal satisfactorily with a complaint, it may be taken to Building Owner’s Chief Executive Officer and/or the Board of Directors.

10.4 Building Owner shall investigate all complaints. If a complaint is justified, Building Owner shall take appropriate measures, including revision of the Personal Information and, if necessary, amending Building Owner’s policies and practices and this Policy.

Our Response to COVID-19

Privacy Policy