DISCOVER SURREY “PERSONAL INFORMATION PROTECTION POLICY” (STAKEHOLDERS AND PUBLIC) SCOPE OF THIS POLICY
This Personal Information Protection Policy sets out the principles which Surrey Tourism & Convention Association (“Discover Surrey”) observes regarding the collection, use and disclosure of personal information about any identifiable person, including Discover Surrey’s stakeholders, and members of the public who use Discover Surrey’s services and facilities, but excluding Discover Surrey’s employees and volunteers. This Personal Information Protection Policy is subject to all applicable laws.
If personal information is made anonymous by removing details so that an individual is not identifiable to the user or recipient of that information, it is not governed by this Policy but will still be treated with appropriate safeguards.
For the purposes of this Personal Information Protection Policy: “Contact information” means information to enable an individual at a place of business to be contacted and includes the name, position name or title, business telephone number, business address, business email or business fax number of the individual.
“Customers” and “stakeholders” includes current, past and prospective customers and stakeholders. This Policy is subject to all applicable laws; and “Personal information” means any information about an identifiable individual, whether it was collected before or after this Policy was first published, including but not limited to the individuals name, address, age, gender, identification numbers, income, employment, assets, liabilities, credit card numbers, credit ratings, financial plans and other finance-related information. “Personal information” may also include a physical description, habits, personality, character, marital history, immigration status, travel or movement details, lifestyle, leisure activities, professional or trade union memberships, and licenses and permits held. Personal information does not include contact information. With respect to any specific individual, Discover Surrey may or may not have personal information within these enumerated categories.
PRINCIPLE 1 – DISCOVER SURREY’S ACCOUNTABILITY
Discover Surrey is responsible for all personal information under its control. The Discover Surrey Privacy Officer (the “Privacy Officer”) is accountable for Discover Surrey’s compliance with the principles described in this Policy, and may be contacted at:
The Privacy Officer Discover Surrey
730 176 Street, Surrey, BC
Discover Surrey has established and implemented: (a) procedures to protect personal information; (b) procedures to receive and respond to complaints and inquiries; (c) employee and volunteer training and information programs to explain this Policy and related personal information protection procedures and practices; and (d) practices to ensure that clients and other individuals who contact Discover Surrey have access to this Policy and to other literature explaining Discover Surrey’s related personal information protection practices and procedures.
PRINCIPLE 2 – THE PURPOSES FOR (AND THE MANNER IN WHICH) DISCOVER SURREY MAY COLLECT, USE OR DISCLOSE PERSONAL INFORMATION
Subject to applicable law, Discover Surrey will identify the purposes for which personal information is collected, used or disclosed before that information is collected, used or disclosed, as the case may be.
The general purposes for which Discover Surrey may collect, use or disclose information concerning customers and stakeholders include the following: (a) to manage and promote Discover Surreys operations; (b) to better understand the needs of Discover Surrey’s customers and stakeholders, to provide promotional and other information about Discover Surrey and the Greater Vancouver area, and to respond to specific requests; (c) to fulfill requests for reservations, bookings or other arrangements with third parties; (d) to operate and fulfill contests; and; (e) to comply with legal and regulatory requirements.
Internet Specific Issues
Like many other websites, the Discover Surrey Website automatically collects certain non-personal information regarding Website users, such as the date and time the Website is accessed, the Internet address of the Website from which the Website is linked, the operating system that is being used, and the Website pages read and images viewed. This non-personal information is used for system administration purposes and to improve the Website. Non-personal information may be disclosed to other persons and permanently archived for future use.
The Discover Surrey Website may contain links to other Websites or Internet resources. When an individual clicks on one of those links, he or she is contacting another Website. Discover Surrey has no responsibility or liability for or control over those other Websites or this collection, use and disclosure of personal information.
Disclosure to Affiliates, Agencies and Service Providers
Discover Surrey may transfer personal information to a third party for processing or to provide services, including third parties for whom act as a advertising or marketing agent for Discover Surrey, but uses contractual or other means to provide a comparable level of protection while the information is in the custody of that third party.
From time to time, Discover Surrey may wish to use or disclose personal information for a purpose other than that for which it was initially collected. Discover Surrey will ensure that personal information is not used or disclosed for that new purpose unless the individual is informed of the new purpose and gives his or her consent.
PRINCIPLE 3 – CONSENT
Subject to applicable legal exceptions, Discover Surrey will make a reasonable effort to ensure that the individual is advised in advance of the purposes for which his or her personal information will be collected, used or disclosed, and that his or her consent to those activities is obtained. As required by applicable law, consent may be express or implied.
Discover Surrey does not, as a condition of the supply of products or services require an individual to consent to the collection, use or disclosure of personal information beyond that required to fulfill Discover Surrey’s explicitly specified, and legitimate purposes.
An individual may withdraw his or her consent to collection, use or disclosure at any time, subject to legal or contractual restrictions and the provision of reasonable notice to Discover Surrey. If an individual withdraws his or her consent to the collection, use or disclosure of personal information, he or she may be unable to access Discover Surrey’s products or services.
From time to time, Discover Surrey may also collect information from external sources such as credit reporting agencies, credit grantor’s and income sources and personal references identified to Discover Surrey for this purpose.
Discover Surrey may send to customers and stakeholders information which may be of interest to them. If a customer or stakeholder prefers not to receive this type of information, they may opt-out of receiving it by contacting Discover Surrey at firstname.lastname@example.org. Upon being notified of the preferences expressed by any customer or stakeholder, Discover Surrey will not send them such materials again. Please note that customers and stakeholders cannot opt-out of receiving information which Discover Surrey is required by law to send to them.
PRINCIPLE 4 – LIMITING COLLECTION
Discover Surrey limits the amount and type of personal information collected to that which is necessary for the purposes identified by Discover Surrey.
PRINCIPLE 5 – LIMITING USE, DISCLOSURE AND RETENTION
Discover Surrey does not use or disclose personal information for purposes other than those for which it was collected, except with the consent of the individual or as required or permitted by law. Personal information is retained only as long as necessary for the fulfillment of those purposes.
Personal information that has been used by Discover Surrey to make a decision about an individual will be retained long enough to allow the individual access to the information after the decision has been made.
PRINCIPLE 6 – ACCURACY
Discover Surrey aims to keep personal information as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used. However, Discover Surrey does not routinely update personal information, unless such updating is necessary to fulfill the purposes for which the information was collected.
Discover Surrey generally relies upon individual customers and stakeholders to provide up-dated information, such as changes to addresses and other contact information, and changed financial information.
If an individual successfully demonstrates to Discover Surrey that personal information is inaccurate, incomplete, out of date, or irrelevant, Discover Surrey will revise the personal information. If necessary, Discover Surrey will disclose the revised personal information to third parties which were provided with the wrong information to permit them to revise their records as well.
PRINCIPLE 7 – SAFEGUARDS
Discover Surrey has implemented appropriate security safeguards to protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification. The nature of the safeguards vary depending on the sensitivity of the personal information that has been collected, the amount, distribution, and format of the information, and the method of storage. The more sensitive personal information is safeguarded at a higher level of protection.
The methods of protection employed by Discover Surrey include: (a) physical measures, including locked filing cabinets and restricted access to offices; (b) organizational measures, such as security clearances and limiting access on a “need to know” basis; and (c) technological measures, such as the use of passwords and encryption.
Discover Surrey takes care to inform employees and volunteers about Discover Surrey’s policies and procedures for protecting personal information and emphasizes the importance of complying with them. Employees and volunteers are required to conform to Discover Surrey’s policies and procedures concerning the security of personal information.
Discover Surrey uses care in the disposal or destruction of personal information, to prevent unauthorized parties from gaining access to the information.
PRINCIPLE 8 – OPENNESS
Discover Surrey strives to be open about its policies and procedures with respect to management of personal information. Discover Surrey makes this information available in a form that is generally understandable. Copies of this Personal Information Protection Policy are by contacting the Privacy Officer.
PRINCIPLE 9 – INDIVIDUAL ACCESS
Upon an individuals request in writing, Discover Surrey will inform that individual of the existence, use, and disclosure of his or her personal information and the individual will be given access to that information, except where the law requires or permits Discover Surrey to deny access. Discover Surrey may require the individual to provide sufficient information to permit Discover Surrey to provide an account of the existence, use, and disclosure of personal information.
Discover Surrey will respond diligently to a proper request and in any case not later than 30 days after receipt of the request, unless that time is extended according to applicable law. As permitted by applicable law, certain charges may be applicable in respect of certain requests.
PRINCIPLE 10 – CHALLENGING COMPLIANCE
Any individual may direct a challenge concerning compliance with this Personal Information Protection Policy to the Discover Surrey Privacy Officer. Discover Surrey has established procedures to receive and to respond to complaints or inquiries about Discover Surrey’s policies and practices relating to the handling of personal information.
Discover Surrey investigates all complaints. If Discover Surrey finds that a complaint is justified, Discover Surrey will take appropriate measures, including, if necessary, amending its policies and practices.