Policy on confidentiality and use of personal and business information

1. Our commitment for the confidentiality of your personal and business information

Because protecting your personal and business information is important to us, we at BDC have adopted strong principles in that respect.

1. We don’t sell your personal or business information to anyone.
2. We tell you why we use your personal or business information, and we don’t use it for anything else.
3. We limit how much personal or business information we collect, use, communicate and store to what is necessary for our purposes.
4. Sometimes, our service providers need access to your personal or business information. They are only allowed to use your personal and business information to provide services on our behalf or to process the information as per our instruction. The only exception is when they have a legal obligation to disclose your personal or business information to the authorities.
5. We give you the option to control your personal and business information. For example, we offer you tips on how to control the personal and business information we collect. We also have a Privacy Coordinator who responds to your privacy or confidentiality concerns, gives you access to your personal and business information and implements the corrections that you have requested, when appropriate.
6. We may communicate your personal or business information to the authorities without your consent where permitted or required by law.

2. Types of information we collect

2.1 Personal information

Personal information is information about an identifiable individual.

The personal information we collect includes:

• Identification information: Like your name, ID card with or without photo, date of birth, gender, citizenship status
• Family information: Like marital status, number of dependents
• Contact information: Like your phone numbers, personal address, email addresses
• Financial information about you: Like your income, employment situation, salary, personal assets and liabilities, financial statements
• Interactions and preferences information: Like data which relates to your use of our products and services, data from your interactions with us, our website, our apps
• Education and employment information: Like résumé, level of education, employment, interview notes, remuneration, references
• Client Space activities information: About your activities when you are logged in to your Client Space

2.2 Data considered to be personal information

We collect information about how you use our website. Even though this information is not linked to your identity, it can be in certain circumstances by using cookies. This is why we consider this data to be personal information as well when linked to your identity. The data we collect includes:

• The pages of our website viewed
• The date and time when those pages were viewed
• The region where you are connecting from (geolocation)
• How long each page was viewed
• The web browser used (Chrome, Edge, Firefox, Internet Explorer, Opera, etc.), browser settings and the type of device used (Mac or PC, mobile or desktop, etc.), AdWords used and references from which websites, applications or social media you come from before your visit

2.3 Business information

Business information is information about your business.

The business information we collect includes:

• Identification information: Like name and trade name of your business,
• Contact information: Like positions, names, titles, business addresses, business phone numbers and business email addresses
• Structure information: Like your business corporate structure, the name of your shareholders, directors or guarantors
• Financial and commercial information: Like your business revenue, assets and liabilities, financial statements, market and industry, business plans, and information allowing us to meet our requirements (know your client, environment);
• Interactions and preferences information: Like data which relates to the use by your business of our products and services, data from your interactions with us, our website, our apps

3. When and how we collect your personal and business information

3.1 We collect personal or business information when you give it to us directly

For example:

• When you apply for a loan or advisory services
• When you use one of our mobile applications
• When you apply for a job (only personal information)
• When you fill in an online form
• When you subscribe to one of our email publications
• Whenever you use online tools and give information about yourself or your business

3.2 We also collect personal or business information obtained from sources other than yourself

For example:

• From credit reporting agencies, corporations, government, authorities, institutions or agencies by making inquiries as part of our due diligence when you apply for a loan or advisory services and for the continuing administration of your loan or the advisory services
• From our service providers for web analytics or ads
• From websites/social media pages containing information made public by you or your business
• From data services or databases made publicly available by third parties or that we have an agreement with

3.3 When you are logged in to your Client Space or in one of our mobile applications, we record your activities

We keep an electronic log of your activities so that we can detect and review any suspicious activity on your account or interact with you.

3.4 When you browse our website, we use cookies that track your activities

How we track your activities

When you browse our website, we track your activities to infer your interests based on pages you have visited. We may match this information to your specific user profile as soon as you identify yourself on our website by using cookies. We may do so to know what your interests are, to promote our products and services to you or your business, and to offer you or your business products or services that are more relevant to you or your business.

What cookies are and what we can do with them

Cookies are files that a website automatically creates and stores on your computer to collect information on your web browsing activities. We use first-party cookies to improve your user experience (most websites do).

Our website creates first-party cookies that allow us to:

• Recognize you the next time you visit our website
• Personalize our website, application, email publications and emails for you or your business

For example, we can know if you have already completed a survey so we do not ask you to do it again. These cookies are called persistent cookies, because they stay in your browser after you have closed your session.

We also use Google Ads, DoubleClick and other third-party cookies for marketing purposes. With cookies, we can:

• Automatically create lists about our users' interests based on pages they have visited, not only within the BDC website, but also with other websites
• Use this information to target users with specific ads
• Analyze how well our ads perform for a specific audience

For example, if you visit a page about business loans, an alphanumeric code that identifies you will be added to a list of users who are interested in financing solutions. This code will also be stored in a cookie on your computer. As a result, you may see a BDC ad about financing solutions on a different website.

You can disable cookies

You can disable cookies in your browser’s settings. You will still be able to access our website, although some features may not work optimally.

3.5 We use Google Analytics to collect data about how you use our website (web analytics)

We use Google Analytics to analyze how users utilize our website.

Google Analytics makes your data anonymous by removing part of your IP address.

Google Analytics relies on cookies to collect information. Cookies used by Google Analytics will expire two years after your last visit to our website. For more information, consult the Google Analytics website and its privacy policy.

You can opt out of Google Analytics by installing this add-on on your browser.

3.6 This policy does not cover personal or business information you or your business give to social media companies or online payment providers

When you interact with us through social media, for example on our Facebook page, you give information to social media companies and not to us. This information is covered by their own privacy policy. Keep in mind that information you publish on social media can be made public.

When you pay online for our services, you give your payment information to an online payment provider. This information is processed by the online payment provider and it is covered by its own privacy policy.

4. Why we collect and use your personal or business information

We only collect your personal or business information if it relates directly to operating programs or BDC’s activities and for the following purposes:

4.1 For business purposes

To identify you or your business

We use your personal or business information to identify you or your business.

To register you or your business

We use your personal or business information to register you, notably for an event.

To communicate with you or your business

We use your personal or business information to communicate with you and to answer your questions.

To determine if you or your business are eligible for a loan or specific services

When you apply for a loan or request a specific service from BDC or if an offer could be available, we use your personal and business information as part of our due diligence to determine if you or your business meet the conditions to receive the loan or service you or your business have applied for or requested. This may include the validation of your credit worthiness, your identity, your age, your or your business assets and liabilities, and other financial information.

To decide if you are eligible for a loan or a service

We use your personal or business information to decide if your business is eligible for a loan or service and, thereafter, to manage the loan until it is repaid, or the service until it is completed.

To get deeper knowledge, make predictions, or generate recommendations through advanced analytics

We use your personal or business information to perform advanced analytics. We examine this information using sophisticated techniques and tools to get deeper knowledge, make predictions, or generate recommendations.

To develop new products and services

We may use your personal or business information to help develop new products and services.

To develop new internal tools and models

We use your personal and business information to develop new tools and models, so that BDC can improve its operating programs or activities for the benefit of its client.

To advise you or your business when you or your business request our products or services and to improve your experience

We use your personal or business information to provide tailored advice and direct you towards the most appropriate resources, products and services upon request. This way, we make sure our advice, resources, products and services are best suited to you or your business profile.

For example, we could direct you to our productivity benchmarking tool if you wish to find out where your business stands compared to other Canadian businesses in your sector.

To evaluate your application for BDC awards or recognition programs

If you or your business apply for a BDC award or recognition program, we use your personal and business information to evaluate your application and to select and contact the winners.

To protect you and us against errors or fraud

When you use your Client Space, we keep a log of all your activities. This allows us to detect suspicious activity on your account.

4.2 For web analytics purposes

To analyze how you use our website and improve your experience

We collect and analyze data about web traffic and visits on our website. This is called web analytics. Web analytics allow us to:

• Understand how users utilize our website
• Improve our website
• Further develop our business and operations

4.3 For marketing purposes

To promote our products and services to you

We send you promotional emails only if you have specifically agreed to receive them. For example, if you have subscribed to one of our newsletters.

Whenever you have specifically given your consent, you can revoke your consent at any time. For example, you can always opt out of one of our newsletters.

To offer you products and services that meet your needs

We use your personal or business information to offer you or your business personalized advice and financing opportunities.

4.4 For hiring purposes (only personal information)

To allow you to apply for jobs

We use your personal information to evaluate your job application and to contact you if needed.

5. How we store your personal and business information

5.1 Where we store it

Your personal or business information can be stored outside Canada because we use third-party service providers to store and process your personal or business information.

5.2 How we keep it secure

We take stringent measures to ensure that your personal and business information is protected and handled properly.

5.3 How long we store it for

We do not store your personal or business information forever. Hence, we will destroy, erase or dispose your personal and business information in accordance with BDC’s retention period that complies with the Privacy Act and banking industry requirements.

6. To whom we communicate your personal or business information

6.1 Our employees or representatives may view your personal or business information on a need-to-know basis

Our employees or representatives may view your personal or business information for their work for BDC’s programs and activities.

They will not view your personal information for any other reason.

6.2 Other financial institutions or financial partners may view your personal or business information

Other financials institutions or financial partners may view your personal or business information if we partner with them in a common loan request. Credit agencies may view your personal or business information for credit history analysis by BDC and other financial institutions. We may also share your personal or business information with financial institutions to prevent or control fraud or when you are in breach of a financing agreement with BDC.

6.3 Our service providers may process your personal or business information

Our service providers may need to access or process your personal or business information. They are not authorized to disclose your personal or business information for any reason other than providing the services we ask from them, or if they have a legal obligation to do so.

We obtain the following services from our service providers:

• Processing background checks
• Processing credit verification and credit history analysis
• Conducting analytics
• Processing your payments
• Advertising our products and services
• Managing email delivery
• Distributing useful content
• Performing legal services

Some of our service providers are based outside Canada and some in the United States. They may store or process your personal and business information on our behalf. For instance, under the USA Patriot Act, they might be forced to disclose your personal or business information to U.S. authorities if they suspect that it is linked to terrorism or money laundering activities.

6.4 We may share your personal or business information in cases of fraud, suspected fraud

We may share your personal or business information with authorities in case of fraud or suspected fraud.

6.5 We may communicate your personal or business information in certain circumstances

In exceptional cases, we may communicate your personal or business information to others without your consent:

1. If we are legally required to do so. For example, if we receive a court order to communicate your personal or business information.
2. If it is impossible to get your consent and privacy laws allow us to communicate your personal information. For example, if it is necessary for the protection of public interest or to collect money you owe us (overdue accounts).

7. Things you can do to control how we process your personal and business information

7.1 You can access your personal or business information and ask us to correct any error

You can access your personal information at any time

To do so, please contact our Privacy Coordinator.

You can ask us to correct any error or omission

You can ask us to make corrections to personal or business information that we have that is not accurate. If we do not make these corrections, you can ask us to add annotations to your personal information to explain why certain corrections you asked were not made. Finally, you can ask us to notify certain persons about these corrections or annotations. To do so, please contact our Privacy Coordinator.

7.2 You can express your privacy concerns and file a complaint

You can express your privacy concerns by calling us or writing to us.

To do so, please contact our Privacy Coordinator.

To file a privacy complaint, you must send an email to our privacy coordinator

This ensures that we keep a record of your complaint. Our Privacy Coordinator will respond to you as soon as possible.

Note that your complaint must be about your privacy or about how we deal with your personal information.

If you are not satisfied with how we respond to your complaint, you can contact the Office of the Privacy Commissioner of Canada.

8. Congratulations for getting so far!

We did our best to make this policy as easy to read and understand as possible. Here are a few more things you should know:

8.1 We may change this policy at any time

Because privacy concerns, business and legal requirements continually evolve, we may need to change this policy in the future. We will provide notice of material changes to this policy, for example, by posting a notice on our website, or on your Client Space, or by sending you an e-mail explaining that the privacy policy has been updated.

What if the policy has changed?

If this policy has changed, you will be governed by the updated version of the policy.

8.2 How to read and interpret this Policy on confidentiality and use of personal and business information

This policy is governed by the laws of Quebec and Canada. This policy complies with the Privacy Act of Canada.

8.3 Did you understand everything? Contact us with any question

Feel free to contact us:

• For questions or comments about this policy
• For more information about how we deal with your personal information
• To access or modify your personal information

Here is how you can contact us:

• Send us a message
• Call us at 1-877-232-2269
• Mail us a letter:Business Development Bank of CanadaPrivacy Coordinator5 Place Ville Marie, Suite 100Montreal, Quebec H3B 5E7