Privacy Statement
Effective Date: September 22, 2023
Last Updated: February 29, 2024
Our Commitment to Privacy
Haventree Bank is committed to maintaining the accuracy, confidentiality, and security of your personal information. We value the trust you have placed in us and wish to provide assurance that nothing is more important to us than the security and appropriate use of your personal information.
This Privacy Statement (the “Statement”) is designed to inform you of the policies and practices we have put in place to manage your personal information as well as the rights you have with regard to your personal information. We encourage you to read this Statement so that you can better understand how we collect, use, share, and protect your personal information and how you can exercise your rights.
Accountability
We have appointed a Chief Privacy Officer to oversee compliance with our privacy obligations and commitments. You may contact our Chief Privacy Officer, using any of the methods below, with any questions about our policies and practices with respect your personal information:
privacyofficer@haventreebank.com | |
Mailing Address | Haventree bank |
If you have any concerns about the handling of your personal information, you may follow the procedures outlined on our website to make a compliant - Complaints Handling | Haventree Bank.
You may also contact the relevant regulatory authority, e.g., the Office of the Privacy Commissioner of Canada if you have concerns about our adherence to applicable privacy legislation or the principles set out in this Statement.
What is Personal Information?
Personal information is any factual or subjective information relating to a natural person, including prospective, existing and former clients, business partners, and employees, which allows that person to be identified, either directly or indirectly.
Personal information does not include business contact information, such as name, title or business address or business telephone number of an employee, broker, other contracted distributor or an organization used for communicating with the individual in relation to their employment or business.
Examples of personal information include:
- Individual name, date of birth/age, mailing or residential address, phone number, email address, occupation, and marital status;
- Education and employment information, tax forms, health & safety records;
- Credit bureau information, Social Insurance Number, bank statements, void cheques and balances, assets and liabilities, income/compensation;
- Biometric information (e.g., voice recording, fingerprints, facial images, signature, etc.);
- Health information including disability;
- Behavioural information (e.g., click activity, apps used, etc.), dietary preferences religious beliefs, race or ethnicity, political affiliations, sexual orientation;
- Partial IP address, device location, browser activity (for details, please see the section on Cookies, below).
Obtaining Your Consent
We only use your information with your consent or as authorized by law. When obtaining consent for the collection, use, or disclosure of your personal information, we will clearly indicate which information is required (i.e., necessary for the provision of a product/service) and which information is optional. In either case, we will provide you with enough information to be able to give informed consent to the collection, use, or disclosure, as required by law. Specifically, we will obtain your consent when:
- you request a new product or service
- you apply for employment with the Bank
- we need to use your information for another purpose than the ones for which you have already provided your consent
However, we do not obtain your consent for every interaction with you. For example, if you have a mortgage with us, we may consider that you consent to be contacted for a renewal.
In addition, we do not obtain your consent in some situations provided by law, in order to:
- comply with a court order or other enforcement request
- to collect a debt
- investigate a breach or contract or law
- prevent, stop or detect fraud
How we Collect your Personal Information
Haventree Bank will not collect personal information unless it is necessary to fulfill the purposes set out in this Statement. See the sections below entitled “How We Use Your Personal Information” and “How We Transfer and Disclose Your Personal Information” for a full list of purposes of use and categories of third parties to whom we disclose personal information.
Personal information is collected primarily when you perform one of the following actions:
- Applying for a Haventree Bank product or service;
- Applying for a job with Haventree Bank;
- Responding to electronic surveys sent by or on behalf of Haventree Bank;
- Speaking with our representatives; and/or
- Visiting our website.
In some circumstances, we collect your personal information from third parties, namely when:
- Communicating with a broker or third party acting on your behalf;
- Obtaining credit history information from credit bureau reports; and
- Reviewing publicly available sources or records;
- Collecting supporting documentation during the underwriting process (e.g., where your personal information is listed on separation agreements or wills); and
- Validating your income and/or employment history by contacting previous and/or current employers.
If you are applying for a mortgage with us, we may need to request information about spouses, common law partners or dependents, authorized users of your account(s), intermediaries, or other parties as required by law or regulation. If you provide us with information about another individual, we will assume you have the authority to provide this information and have obtained their consent to its collection, use, and disclosure for the purposes set out in our Privacy Statement.
Personal information about you is also generated by Haventree Bank in setting up and servicing your account(s). For Haventree Bank employees, personal information is also generated in the form of performance reviews and cybersecurity risk assessments.
The Personal Information We Collect
The personal information we collect about you is summarized below, separated by relevant personas.
Site Visitors without Log-in | We collect only aggregated information (above a visitor threshold) that does not allow us to identify individual visitors, namely:
No information is gathered about other third-party sites the visitor has accessed. |
Site Visitors with Log-in |
No information is gathered about other third-party sites the visitor has accessed. |
Email Recipients |
|
Potential Borrowers |
|
Borrowers |
|
Donors – Down Payment |
|
GIC Client Name Depositors |
|
Officers/Directors, Trustees, and Beneficial Owners of Incorporated or Trust Depositors |
|
Third Parties to Client Accounts (including Power of Attorneys) |
Where applicable:
|
Mortgage Brokers |
|
Deposit Brokers, Signors of Proof of Employment Letters, and Representatives of Third-Party Vendors |
|
Job Applicants |
|
Employees |
|
Independent Contractors |
|
You are not required to provide the Social Insurance Number, (SIN) but it does facilitate your identification with a credit -reporting agency. In addition, it is required for tax purposes, especially if an account generates income.
We will also collect information regarding your reason for doing business with us and your language and communication preferences.
IMPORTANT: We limit the collection of your information to what is necessary to help us serve your properly.
How We Use Your Personal Information
Based on your relationship with Haventree Bank, your personal information may be used for the purposes outlined below. Before using your personal information for any optional purposes, we will seek your express and informed consent. For more information about how consent is obtained, see the section above entitled “Obtaining Your Consent”.
Personas | Necessary purposes | Optional Purposes |
---|---|---|
Site Visitors without Log-in | N/A | Determine which content is interesting to our audience and whether navigating our website is intuitive and easy. |
Site Visitors with Log-in | Provide access to our broker/borrower portals. | Determine which content is interesting to our brokers/borrowers and whether navigating our website and portals is intuitive and easy. |
Email Recipients | N/A | Personalized marketing. |
Potential Borrowers | Assess eligibility for our products and services. | N/A |
Borrowers |
|
|
Donors – Down Payment |
| N/A |
GIC Client Name Depositors |
| N/A |
Officers/Directors, Trustees, and Beneficial Owners of Incorporated or Trust Depositors |
| N/A |
Third Parties to Client Accounts (Including Power of Attorneys) |
| N/A |
Mortgage Brokers | Administer the broker relationship. |
|
Deposit Brokers | Administer the broker relationship. | Personalized marketing. |
Job Applicants |
| N/A |
Employees |
| Enrollment in health, dental, and other group benefits programs. |
Independent Contractors |
| N/A |
Signors of Proof of Employment Letters | Verify a potential borrower’s employment. | N/A |
Representatives of Third-Party Vendors | Administer the third-party vendor relationship. | N/A |
How We Transfer and Disclose Your Personal Information
In order to fulfil some of the necessary purposes outlined in the section above, we transfer or disclose your personal information to other parties including select service providers for legitimate purposes. For example, your personal information may be required by law, necessary to protect your interests in the event of fraud. At all times, we are committed to limiting the information to what is necessary and obtain your consent before disclosure, where required.
Service Providers are thoroughly vetted through privacy impact assessments and are committed to protecting your personal information to the same standards that we do and have sign a confidentiality agreement with the Bank and agree to use your information only for the purposes stated in the agreement.
Several of our service providers arrangements require that your personal information is transferred and stored outside of your province of residence. Where this is the case, an assessment of the relevant jurisdiction has been conducted and appropriate measures have been taken to ensure that your personal information will be held to the same standards applicable in the province you reside in.
You can select from the menu below to learn more about the categories of service providers to which we may transfer your personal information, and for what purposes.
How we Protect Your Personal Information
We endeavor to maintain physical, technical, and procedural safeguards that are appropriate to the sensitivity of your personal information. These safeguards are designed to prevent your personal information from loss and unauthorized access, copying, use, modification, or disclosure.
We will take every necessary step to ensure the protection of your personal information, including:
- Shredding of documents containing personal information;
- Providing regular training to our staff on the importance of protecting the confidentiality of your information;
- Physical security measures – restricted access to facilities and locked filing cabinets;
- Electronic security measures for computerized personal information – password protection, database encryption, personal identification numbers;
- Organizational processes and procedures including limiting access to your personal information to individuals on a need-to-know basis;
- Destroying, anonymizing, erasing, or masking your information in accordance with our records retention policy and applicable privacy laws; and
- Ensuring that third parties who are given access to your personal information protect and secure your personal information in a similar manner.
Despite our efforts to protect your personal information, there may be inherent consequences of its collection, use, or disclosure. Such consequences may include greater exposure to possible threat actors, increased likelihood of being involved in a privacy breach incident, and decreased confidentiality. For more information on how we protect your personal information, please contact our Chief Privacy Officer using the contact details found in the “Accountability” section above.
Retention of Sensitive Personal Information
We consider sensitive personal information to be any personal information (see definition provided in the “What is Personal Information” section above) that, either inherently, or depending on context, pose a higher risk of harm to the individual concerned when collected, used, disclosed, or transferred. Examples of sensitive personal information include financial information, medical records, government ID, information pertaining to minors, and equity and inclusion information (racial origins, political opinions, genetic and biometric data, an individual’s sex life or sexual orientation, and religious/philosophical beliefs).
We retain your information, in physical or digital format, for as long as necessary to fulfill the purposes for which the information was collected or as long as required or permitted by law. The purpose, nature and sensitivity of the information have been considered in determining retention periods. The chart below indicates the period for which the Bank will retain your sensitive personal information after your relationship with us has ended. Certain exceptions may apply requiring longer retention periods, for example in the case of disputes or claims.
Your Relationship to the Bank | Retention Period for Sensitive Personal Information |
---|---|
All clients | Seven Years |
Potential clients (where your application has been denied, cancelled, or voided | Two Years |
Donors – Down Payment | Seven Years |
Officers/Directors, Trustees, and Beneficial Owners of Incorporated or Trust Depositors | Seven Years |
Third Parties to Client Name Deposits (including Power of Attorney) | Seven Years |
Brokers and Representatives of Third-Party Vendors | Three Years |
Signors of Proof of Employment Letters | Seven Years |
Employees and Independent Contractors | Seven Years (Payroll information) Three years (Other records) |
Job Applicants | Six Months |
Voice recordings are retained for two years after the recording. If the recording is part of a customer complaint, we retain the recording for 7 years after the complaint has been resolved.
Automated Decision-Making
When we make an automated decision, prediction, or recommendation on the basis of your personal information, we will inform you about this fact no later than the time that we communicate this decision to you. Upon your request, we will inform you of the personal information that informed the decision, of the reasons, principal factors, and parameters that led to the decision, and of your right to have the personal information that was used to render the decision corrected. You will also have the opportunity to submit observations to an employee at Haventree Bank who can review the decision.
Individual Rights
Depending on where you reside, you may have one or more of the following rights relating to your personal information. Some of these rights will be subject to specific requirements or limitations under applicable law, such as the requirement to submit your request in writing. To exercise any of your rights, please contact our Chief Privacy Officer using the contact details found in the “Accountability” section above.
Right to Withdraw Consent
You may withdraw or amend your consent at any time to the collection, use, or disclosure of your personal information, subject to legal or contractual restrictions and reasonable notice. Depending on the circumstances, however, a withdrawal or amendment to your consent may prevent us from providing you, or continuing to provide you, with our services, business, or employment.
Consulting the table above under the “How We Use Your Personal Information” section, you can see which purposes for which we collect your personal information are optional. If you withdraw your consent to the collection of your personal information for those purposes, this will not have an adverse effect on the core services we provide you with, e.g., your mortgage, deposit, or employment. However, your consent withdrawal may still affect your enjoyment of the optional service we provide.
Right of Access, Rectification, or Deletion
You may request access to any personal information we hold pertaining to you. You may also request the rectification of any inaccurate or incomplete information related to you and/or the deletion of personal information that is obsolete or not justified by the purposes provided. For employees and job applicants, please direct your request to the Chief Human Resources Officer at TLC@haventreebank.com.
For all other individuals, please direct your request to the Chief Privacy Officer at privacyofficer@haventreebank.com.
We consult credit reports indicating the solvency of prospective and current borrowers which are prepared by either Equifax or TransUnion. You have the right of access and rectification in relation to the personal information held by Equifax and TransUnion about you. You can access and, where necessary, cause rectification of the personal information contained in the credit reports.
You can access your credit report by visiting the Equifax Canada or the TransUnion Canada website.
If your report contains inaccurate information, you can submit a dispute to Equifax and TransUnion. Click on these links for more information.
Information about our Website
In certain sections of www.haventreebank.com, Haventree Bank may invite you to contact us, request information, or complete a registration form. In these cases, we request contact and other related information. If you choose to provide this information, we will use it only to contact you as requested, or to register you to access certain sections of our website or for specified events.Cookies: Our website uses a technology called “cookies”. These cookies are generally a mix of first and third-party, session, and persistent cookies. A cookie is a tiny element of data that our website can send to your browser, which may then be stored on your hard drive so we can recognize you and your session history when you return as well as provide you with a consistent and efficient experience. You may set your web browser to notify you when you receive a cookie. However, if you decide not to accept cookies from our website, you may not be able to take advantage of all of the features of our website. Cookies cannot view or retrieve data from other cookies, or capture files or information stored on your computer. Only the website that sends you cookies is able to read them.
There are, however, cookies that we place without an opt-out being possible, namely essential cookies. Essential cookies are all the cookies without which our website could not perform basic functions. They may be set automatically when pages load, or as a result of a user request that cannot be fulfilled without the use of the cookie. On the other hand, for functionality and analytics cookies to be placed on your device, your active opt-in is required. Your choice not to accept these cookies will not prohibit your use of the Bank’s website.
Functionality cookies support site functionality that is visible or advantageous to the user or their experience of the site. This includes elements of persistent personalization (remembered on subsequent visits), and enhanced functionality like web chat services, surveys, commenting and rating systems, and user preferences. They are generally a mix of first and third party, session and persistent cookies.
Analytics cookies are used to better understand your interactions, improve our services, tailor our content, and personalize your experience. These cookies do not collect information that identifies you as a visitor. They collect information about how visitors use our website, for instance which pages visitors go to most often, and if they get error messages from web pages. All information these cookies collect is aggregated. We even partially mask your IP address, so no identification is possible.
All our cookies expire by default after 6 months, after which time we will ask you to confirm your choices again.
Tracer Tags & Web Beacons: Some areas of the www.haventreebank.com website may also use “web beacon” technologies. Web beacons work in conjunction with cookies and let us know what portions of our site are of interest to our visitors to help us provide you with tailored information from our website. If you turn off cookies, web beacon technologies will still detect anonymous visits, but the notices they generate cannot be associated with other information that is collected and are disregarded.
Third-party links: Our website may contain links to other sites that Haventree Bank does not own or operate. Also, links to our website may be featured on third-party websites on which we advertise. Except as described in this Privacy Statement, we will not provide any of your personal information to these third parties without your consent. We provide links to third-party websites as a convenience to the user. These links are not intended as an endorsement of or referral to the linked websites. The linked websites have separate and independent privacy statements, notices, and terms of use, which we recommend you read carefully. We do not have any control over such websites and therefore we have no responsibility.
Customer Testimonials/Case Studies/Reviews: We post customer testimonials/comments/reviews on our website, which may contain information about the customer. We obtain each customer’s consent via email prior to posting the customer's name and testimonial.
Legal Disclaimers
From time to time, Haventree Bank may make changes to our Privacy Statement to reflect changes in our legal or regulatory obligations, or in the manner in which we deal with your personal information. Any changes that affect your rights will be communicated to you via this Statement and posted on our website. We encourage you to refer to it on a regular basis.This Privacy Statement does not create or confer upon any individual any rights, or impose upon Haventree Bank any obligations outside of, or in addition to, any obligations imposed by Canada’s federal and provincial privacy laws, as applicable. Should there be, in a specific case, any inconsistency between this disclosure and Canada’s privacy laws, this Statement shall be interpreted, in respect of that case, to give effect to, and comply with, such laws.