Privacy Policy

PURPOSE OF THIS PRIVACY POLICY

Canadian Exchange Traded Funds Association (“CETFA”, “we”, or “us”) may collect Personal Information in the course of its activities. CETFA is committed to ensuring compliance with the Personal Information Protection and Electronic Documents Act, SC 2000, c 5 (“PIPEDA”) as applicable.

The purpose of this Privacy Policy is to establish rules that govern the collection, use, disclosure, and retention of Personal Information by CETFA in a manner that recognizes the need to balance an individual’s right of privacy with respect to Personal Information and CETFA’s need to collect, use, and/or disclose that information in order to fulfill its purposes.

This Policy is a living document and is expected to change as the body of knowledge in this area grows and as the environment within which CETFA operates evolves. CETFA will post and explain any changes to this Privacy Policy as soon as they go into effect. CETFA is not responsible for the content or privacy policies of the websites to which CETFA’s website (where this Policy is available) may link.

DEFINITIONS

Personal Information – Personal information is any factual or subjective information, recorded or not, about an identifiable person (e.g. age, name, address, income, phone number, etc.). Personal information does not include the name, title, business address, or telephone number of an individual that identifies the individual in a business, professional, or official capacity.

SCOPE

This Privacy Policy applies to any Personal Information provided to or collected by us by any means (including, but not limited to, through our websites or by e-mail, facsimile, postal mail, hand delivery, or orally).

Personal Information will be collected by us directly from the individual to whom the Personal Information relates unless the individual authorizes, or legislation permits, another manner of collection.

While interacting or communicating with us, you do not need to provide any Personal Information about yourself. However, if you choose to provide Personal Information to us, we will take the necessary steps to safeguard it to the furthest extent possible.

OUR COMMITMENT AND PROCEDURES

We are committed to protecting the privacy of our members, stakeholders, and the general public by ensuring that all Personal Information gathered by us is kept confidential and is treated in a manner that a reasonable person would consider appropriate in the circumstances.

All Personal Information under our control or custody shall be regarded as confidential and available only to authorized users. Subject to specific limitations and exceptions, individuals (or their legal representatives) may access their own Personal Information contained in records under our custody or control following the process outline in this Policy.

We are accountable and transparent in how we treat Personal Information. We will not lend, sell, rent, or trade our mailing lists or other Personal Information.

This Policy applies to all individuals within CETFA (including staff, directors, officers, committee members, volunteers, and third-party merchandise/service providers). Only our employees and contractors are authorized to access Personal Information on a need-to-know basis for the purposes noted below.

The following are CETFA’s key privacy principles, codified as Schedule 1 of PIPEDA:

1. WE ARE ACCOUNTABLE FOR THE PERSONAL INFORMATION IN OUR CUSTODY.

We are responsible for the Personal Information in our custody or control, including Personal Information that has been transferred to a third party for processing. We use contractual or other means to ensure the protection of any Personal Information in the possession of a third party. Our employees and agents shall be responsible for any Personal Information that they have in their possession at all times.

We have a Privacy Officer who is accountable for our compliance with this Privacy Policy, although other individuals within CETFA may have responsibility for the day-to-day collection and processing of Personal Information and may be delegated to act on behalf of the Privacy Officer.

2. WE WILL LET YOU KNOW WHY WE ARE COLLECTING YOUR PERSONAL INFORMATION.

Disclosure and Consent.

When Personal Information is required to be collected from you, we will – either before or at the time of collection – identify and document the purpose for which it is being collected and explain how it will be used.

Use.

The Personal Information we collect will only be used to manage our operations and for various purposes associated with our activities. We collect, use, and disclose Personal Information only for purposes that a reasonable person would consider appropriate in the circumstances.

CETFA shall collect Personal Information for the primary purpose of providing updates on the activities of CETFA.

We reserve the right to expand our list of identified purposes upon notice. If Personal Information that has been collected is required to be used for a different purpose than originally disclosed, the new purpose will be identified to the relevant individual prior to use. Unless the new purpose is required or permitted by law, such individual’s consent will be obtained before the information is used for that new purpose.

3. WE WILL GET YOUR CONSENT FOR THE COLLECTION, USE, AND DISCLOSURE OF YOUR PERSONAL INFORMATION.

When Is Consent Necessary?

Consent is required for the collection, use, and disclosure of Personal Information. We will get your consent for the use and disclosure of your Personal Information either prior to or at the time of collection, unless the consent is implied.

What Type of Consent Will be Obtained?

In determining the form of consent to obtain when collecting Personal Information (e.g., implied or express consent, verbal or written consent), CETFA will take into account the sensitivity of the information and applicable legal requirements.

Regardless of the form of consent given, CETFA will ensure that the consent is knowledgeable, voluntary, related to the information in question, and given by the relevant individual.

In certain circumstances, obtaining your consent may be inappropriate. Applicable privacy laws provide for exceptions where it is impossible or impractical to obtain consent.

We are committed to obtaining meaningful consent and to using clear explanations and plain language to make sure that our consent processes are understandable and user friendly.

You Can Withdraw Your Consent.

Consent may be withdrawn at any time, subject to legal restrictions and reasonable notice. If you would like to withdraw consent to CETFA’s use of your Personal Information, you can do so by contacting our Privacy Officer. Withdrawals of consent only take effect from the date of cancellation. They cannot be retroactive. We will advise you if a withdrawal could have any consequences.

4. WE LIMIT THE COLLECTION OF PERSONAL INFORMATION.

We do not collect, use or disclose more Personal Information than is reasonably necessary to meet the identified purposes. We collect Personal Information only by fair and lawful means.

What Type of Information Will be Collected?

The types of information (including Personal Information) we may collect from you will depend on how and why you interact with us.

When you use our website, we may need to collect your name, e-mail address, and mailing address in order to process your requests.

We may also monitor web traffic patterns to help us better design our website to meet your needs. Device-specific information, such as your operating system version and device type, may be collected to enhance your app experience.

When Will Personal Information be Collected?

We collect Personal Information from you when you:

• subscribe to our website to receive information about our activities;
• submit questions, requests, or other communications to us via forms, e-mail, or other communication media;
• visit any of our webpages; or
• register for and/or participate in any of our events.

5. WE LIMIT THE USE, DISCLOSURE, AND RETENTION OF PERSONAL INFORMATION.

We collect, use, and/or disclose Personal Information only for the original purposes for which it was collected, unless we have consent to use it for a different purpose or if we are required to do so by law. If we want to use or disclose your Personal Information for a new purpose, we will advise you of this purpose in writing and obtain consent.

We keep Personal Information only as long as necessary to achieve the purposes for which it was collected, although we may retain certain Personal Information for a longer period of time if we are required to do so by a governmental agency (such the Canada Revenue Agency), applicable legislation, or by our insurers.

If you make a request to access your Personal Information, we will keep that Personal Information for as long as is necessary to allow you to fully seek any remedies (i.e., exhaust any recourse) that you may have under federal and provincial legislation across Canada.

When Personal Information no longer needs to be retained, it will be disposed of by means of shredding or another secure disposal method, with care taken to prevent unauthorized parties from gaining access to the Personal Information.

We may share Personal Information with the parties set out below for the following purposes:

• professional advisors, such as lawyers, auditors, bankers and insurers who provide us with legal, accounting, auditing, banking and insurance services;
• government, regulatory authorities, law enforcement, dispute resolution bodies, courts and similar entities to comply with any legal or regulatory obligation, to detect and prevent crimes, or to assert or defend legal rights and interests;
• any persons or entities where we have a legitimate business reason for doing so, such as to manage risk, to process payments to you or to someone on your behalf, or to perform or carry out the terms of any contract between us;
• to the transferee, if we transfer, sell or dispose of all or substantially all of our assets or operations;
• to anyone we reasonably believe is your agent; and
• to other third parties if you have given consent.

We require all third parties to respect the security of Personal Information and to treat it in accordance with all applicable legal requirements. All third-party service providers are required to enter into contractual agreements with us that prevent them from using your Personal Information for their own purposes and require them to use your Personal Information only for specific purposes in accordance with our instructions and all applicable legal requirements.

We will not lend, sell, rent, or trade your Personal Information to others without your consent.  However, we may provide aggregate and anonymized statistics about traffic patterns, website usage, and related information to trusted third parties. These aggregate statistics will include no personal identifying information.

6. REASONABLE STEPS MUST BE TAKEN BY US, AND BY YOU, TO ENSURE THE ACCURACY OF YOUR PERSONAL INFORMATION IN OUR CUSTODY.

Although we will use reasonable efforts to ensure that your Personal Information is as accurate, complete, and up-to-date as necessary for the purposes for which we collected the Personal Information, ultimately, you will be responsible for ensuring that we have your current and complete Personal Information in our records.

We will not routinely update Personal Information, unless such a process is necessary to fulfill the purposes for which the Personal Information was collected.

To change or modify your Personal Information previously provided to us, please contact our Privacy Officer.

7. WE USE SAFEGUARDS TO PROTECT PERSONAL INFORMATION.

We will use appropriate procedures and security measures to protect Personal Information in our custody or control against theft, loss, and unauthorized use, disclosure, modification, or disposal, regardless of the format in which the Personal Information is held.

We use security safeguards appropriate to the sensitivity of the Personal Information, as follows:

Physical measures – Physical protection measures, such as areas of restricted access and locked filing cabinets, are implemented.

Organizational measures –

• Security policies and procedures are prepared and security safeguards are reviewed on an ongoing basis.
• Training on privacy issues is provided to employees, agents, and any other individual granted access to Personal Information. We make all of our employees, as well as third party service providers, aware of the importance of maintaining the privacy and security of Personal Information.
• Access is limited to a "need-to-know" basis.
• Only our employees with security clearance (user ID and password) and authorized agents are granted access to Personal Information and only when the Personal Information is necessary for CETFA’s business purposes. All of our employees and authorized agents with access to Personal Information must sign a confidentiality/non-disclosure agreement.
• We require all third-party service providers to enter into contractual agreements that require them to respect the security of your Personal Information and to treat it in accordance with all applicable legal requirements.
• An employee or agent who knowingly violates this Privacy Policy shall have their relationship with us terminated. We take our privacy obligations very seriously.

Technological measures –

• We use technological protection measures such as passwords, encryption, firewalls, audits, passwords, and strong data security software and systems to protect the Personal Information in our custody from hackers and malicious intruders.
• Our software is routinely updated to maximize protection of Personal Information.
• Secure websites and password protocols are used to protect Personal Information collected when a donation is made on-line or an item, ticket or sponsorship is purchased on-line.

Although we are committed to protecting Personal Information, our security practices and technology measures cannot guarantee absolute security of Personal Information and we cannot ensure or warrant the security of any Personal Information provided to us. If you believe your Personal Information may not be secure for any reason, please contact us immediately.

If Personal Information is stolen, lost, or accessed by an unauthorized person, we will notify the relevant individual(s) and/or other third parties (such as the Privacy Commissioner) at the first reasonable opportunity, if required to do so by applicable law.

8. WE ARE TRANSPARENT ABOUT OUR PRIVACY POLICY.

If you have questions about this Privacy Policy, including how to exercise your legal rights, or if you would like specific information about how we manage your Personal Information, you can contact our Privacy Officer.

This Policy is expected to change as the body of knowledge in this area grows and as the environment within which we operate evolves. When we make amendments to this Privacy Policy, we will change the “Date Approved” date at the top of this Privacy Policy and post the amended version on our website. An individual’s continued use of our website after any changes are made signifies such individual’s agreement with the terms of the revised Privacy Policy.

By providing us with your Personal Information, you are consenting to the collection, use, disclosure, and retention, by us, of your Personal Information, as set out in this Policy.

9. YOU HAVE THE RIGHT TO ACCESS YOUR PERSONAL INFORMATION AND TO REQUEST THAT WE CORRECT OR UPDATE YOUR PERSONAL INFORMATION.

Upon the submission of a written request and proof of identification to our Privacy Officer, we will inform you whether or not we hold your Personal Information. We will allow you to access your Personal Information in accordance with applicable legislation.

Certain situations will prevent us from providing you with access to your Personal Information, including for legal, confidentiality, or security reasons. In such situations, we will give you written notice that states that the request for access is being refused, provide reasons for the refusal, and inform you that a complaint about the refusal can be made to the Office of the Privacy Commissioner of Canada. We will respond to a request for access within thirty (30) calendar days of receipt of the request, unless extensions are permitted under law and we have informed you of the length and reason for the extension.

If you inform us about the inaccuracy or incompleteness of your Personal Information, we will respond to the correction request, with the amendments, within thirty (30) days of receiving the request, unless extensions are permitted under law and we have informed you of the length and reason for the extension.

In certain circumstances, we will not correct a record of Personal Information, if prohibited from doing so under law. If a correction is refused, we will inform you of the refusal, the reasons for the refusal, your right to file a complaint regarding the refusal to the Office of the Privacy Commissioner of Canada, and your right to attach a statement of disagreement to our records (so that any other organization that has access to the Personal Information can view the statement).

We will not require you to pay a fee to access your Personal Information nor to have us correct or update your Personal Information.

10. YOU HAVE THE ABILITY TO ASK QUESTIONS AND CHALLENGE COMPLIANCE.

Our Privacy Officer acts as adjudicator on all Personal Information privacy and security matters. This Officer is authorized to assist in solving problems and implementing improvements with respect to the Personal Information privacy and security procedures of CETFA.

Our Privacy Officer, Eli Yufest, can be contacted at eli@cetfa.ca to answer any questions that you may have about our collection, use, disclosure, and retention of Personal Information, or to register a complaint. We are committed to investigating all complaints and taking appropriate action.

You also have the right to register a complaint with the Office of the Privacy Commissioner of Canada if you are not satisfied with the manner in which our Privacy Officer and/or CETFA has dealt with Personal Information or responded to a request or a complaint.

---

MINORS

Our marketing materials and websites are not designed and are not directed to children who are eighteen (18) years of age or younger. We are committed to protecting children’s privacy in an on-line environment. We do not intentionally collect or maintain Personal Information provided by children. By using our website(s), you represent that you are at least the age of majority in your jurisdiction of residence. If we or our vendors become aware that a child has provided us with Personal Information without parental consent, that Personal Information will be deleted from our databases.

WEBSITES

Our main website (listed below) will be governed by this Privacy Policy:

www.cetfa.ca

Even though links to third-party websites may be provided on our website, we do not guarantee, and are not responsible for, the information collection and privacy practices of such third-party websites, which may differ from our site’s policies. Every site we link to originally went through an investigation for illegal content and was deemed acceptable at that time. However, websites change over time and we are not able to monitor these sites on an ongoing basis. If you notice something wrong with a site that we have linked to, please let us know and we will consider removing such links immediately.

Please review our Website Terms of Use available at www.cetfa.ca.

COOKIES

Cookies (i.e., information that our website’s server transfers to your computer) are used to help us identify website usage and preferences of our visitors so that we may improve our offerings to you. We use cookies to recognize your device and provide you with a personalized experience. If you are using one of the common Internet web browsers, you can set up your browser to either let you know when you receive a cookie or to deny cookie access to your computer.

• We may also use automated tracking methods on our websites, in communications with you, and in activities, to measure performance and engagement.
• Please note that because there is no consistent industry understanding of how to respond to “Do Not Track” signals, we do not alter our data collection and usage practices when we detect such a signal from your browser.

WEB ANALYSIS TOOLS

We may use web analysis tools that are built into our website to measure and collect anonymous session information.