Alectra utilities

3.4.1 Personal information is any factual or subjective information, recorded or not, about an identifiable individual. This includes a customer’s name, address, phone number, e-mail address, account number and activity such as electricity usage, driver’s license details, date of birth, banking information, invoice and billing history, and any other information that can identify an individual directly or through other reasonably available means. Personal information does not include anonymized or aggregate information that cannot be linked to a specific individual.

3.4.2 Personal information does not include an individual’s business contact information nor information that has been aggregated or de-personalized, such that an individual’s information cannot be identified.

3.4.3 Personal information may be collected in a number of ways, including in person, over the phone, by mail, by fax, over the Internet, or from third parties who have been authorized to obtain it on Alectra’s behalf or disclose personal information to Alectra.

3.4.4 Personal information is often collected by Alectra with your knowledge and consent in several ways, such as when you create an account, contact Customer Service, engage in our energy saving programs, have your meter read, sign up for Alectra communications or pay a bill. See section 3.5 of this policy for a full list of purposes for collecting personal information.

3.4.5 Consent may be provided orally, in writing, electronically or may be implied. Subject to certain legal restrictions and reasonable notice, you can refuse to provide your consent or withdraw your consent to the collection, use and disclosure of your personal information but refusing to provide consent or withdrawing consent may limit Alectra’s ability to provide you with some of its products or services. Under the laws of Canada and Ontario, Alectra may have a duty or right to collect, use or disclose your personal information without your knowledge or consent.

3.5.1 Alectra collects, uses and discloses personal information about you for purposes which are permitted or required by law. Examples of such purposes are:

• delivering electricity, construction, and maintenance services; contacting customers;
• providing information to customers about Alectra rates, programs or services or the electricity industry;
• verifying a customer’s identity; managing any special needs of customers;
• monitoring or assessing quality of service by means such as recording telephone conversations;
• responding to customer inquiries;
• determining an account holder eligibility and creditworthiness;
• providing information to third party service providers;
• investigating, reporting or responding to government inquiries related to error, fraud or theft, dangerous use of power or other unlawful activities; protecting the rights, property, and safety of Alectra, its employees, customers and others;
• billing or collecting bills; conducting customer surveys, contests and consultations;
• promoting conservation and demand management programs; preparing financial records;
• facilitating a business transaction involving Alectra assets; and
• responding to requests in criminal investigations, legal or tax proceedings or pursuant to a court order, and meeting other legal, regulatory and electricity market operations authorization and requirements. Alectra limits collection of personal information to that information which is necessary for the purposes identified in this Policy, otherwise consented to by you, or permitted or required by law.

3.6.1 Alectra will only disclose your personal information to third parties if you have so consented or if required or permitted by law. Only the information specifically required by the third party is disclosed. Where a request for personal information is made by a governmental authority, Alectra will take steps to satisfy itself that the authority making the disclosure request has legitimate grounds to do so. Alectra never trades, rents or sells your personal information.

3.6.2 Alectra may disclose your personal information to third parties in connection with the proposed or actual financing, insuring, sale, securitization, assignment or other disposal of all or part of Alectra’s business or assets (including accounts) for the purposes of evaluating and/or performing the proposed transaction. These purposes may include, for example, permitting such parties to determine whether to proceed or continue with the transaction, fulfilling any reporting or audit requirements to such parties, and/or disclosing personal information as part of concluding a sale or transfer of an asset

3.6.3 If you believe that a third party has inappropriately disclosed your personal information to Alectra, please contact that third party directly. If the third party does not sufficiently respond to your inquiries, please let Alectra know immediately.

3.6.4 Alectra may perform activities outside of Canada through third parties and in such cases, your personal information may be processed, used, stored or accessed in other countries and will be subject to the laws of those countries. Such information may be provided to law enforcement or national security authorities of that jurisdiction upon request, in order to comply with foreign laws.

3.6.5 Alectra will retain personal information only for as long as is necessary to fulfill the purpose for which it was collected and to meet our legal and contractual obligations.

3.7.1 Alectra will make reasonable efforts to keep your personal information as accurate, complete and up to date as necessary. If desired, you may verify the accuracy and completeness of your personal information in Alectra’s records by making an access request.

3.7.2 Upon receipt of such a request, Alectra will inform you of the type of personal information it has collected about you, how it has been used and, where permitted by law, the names of any third parties to whom your personal information has been disclosed.

3.7.3 Alectra will provide you access to your personal information within a reasonable time and no later than 30 days after receipt of a written request and satisfactory identification. Alectra may charge a reasonable fee for producing the requested information and will notify you of the costs before processing the request.

3.7.4 Alectra may deny access to personal information where permitted or required by law. In this case, Alectra will provide in writing its reasons for the refusal. Such refusal may be challenged by a customer in accordance with law.

3.7.5 Customers can make their access requests by contacting Alectra by telephone at 1-833-253-2872, or in writing to Alectra Utilities (mailing address: 55 John Street North, Hamilton, Ontario, L8R 3M8), and our customer service representatives will assist you. Response to a customer's request will be made within a reasonable time provided the request is made in writing and the customer provides satisfactory proof of the customer's identity.

3.7.6 Despite Alectra’s best efforts, errors may occur. Should you identify any incorrect or out-of-date information about to you, Alectra will remedy any such errors on a timely basis upon receipt of notice from you of such incorrect or out-of-date information. In the event that inaccurate information is mistakenly sent to a third party, Alectra will communicate relevant changes to the third party where appropriate and possible.

3.8.1 Alectra employees understand the importance of keeping personal information private and are required to abide by Alectra’s privacy standards. All employees are required to agree to a code of conduct that prohibits employees from accessing or disclosing personal information without authorization and prohibits the disclosure of any personal information to unauthorized parties. The failure to comply with this code of conduct could result in appropriate disciplinary measures.

3.8.2 To ensure that your personal information is protected, Alectra utilizes physical, organizational and technical safeguards that are consistent with industry standards and best practices. Alectra uses modern technologies to avoid accidental loss, destruction, or unauthorized changes to your personal information. While no system is completely secure, the measures implemented by Alectra significantly reduce the likelihood of a data security breach.

3.8.3 Here are some examples of the security controls Alectra has in place:

• 3.8.3.1 Alectra’s server environment is well-maintained, and its security and privacy practices are reviewed/audited on a regular basis;
• 3.8.3.2 The use of encryption for data in transit and at rest, secure portals for document transfers and the use of a secure payment gateway that uses tokenization for payment card information (note however that users should be aware that personal information could be intercepted over the Internet, such as when sent by email). Alectra is not responsible for the interception, collection, use or alteration of information transmitted via regular e-mail;
• 3.8.3.3 Customers who call Alectra’s customer service centre are required to verify their identity.
• 3.8.3.4 Alectra keeps electronic customer files in a highly secured environment with restricted access. Paper-based files are stored in locked filing cabinets to which access is also restricted.
• 3.8.3.5 Security card access to premises;
• 3.8.3.6 Restriction of employee access to files on a “need to know” basis;
• 3.8.3.7 Confidentiality undertakings by all employees;
• 3.8.3.8 Securing personal information and not leaving it unattended or in plain view;
• 3.8.3.9 Firewalls that are regularly patched, antivirus, complex passwords, intrusion detection and other software solutions for technical security; and
• 3.8.3.10 Alectra requires its service providers and third-party partners to contractually commit to protecting personal information and have mature security controls in place.
• 3.8.3.11 All employees at Alectra are aware of their responsibility to protect personal information and are required to complete yearly mandatory cybersecurity and privacy training.

3.8.4 In addition, we recommend that you do your part in protecting yourself from unauthorized access to your personal information. Alectra is not liable for any unauthorized access to your personal information that is beyond our reasonable control. Keep your MyAccount password confidential and let us know right away if your account is compromised.

3.9.1 When you visit Alectra’s website, we automatically receive and record information from your browser or mobile platform, including the date and time of your visit, your IP address, unique device identifier, browser type and other device information (such as your operating system version and mobile network provider).

3.9.2 The usage data we collect when you visit Alectra’s website helps us analyze and improve the performance of our digital services. Alectra uses Google Analytics for web statistical analysis. We make no effort to personally identify you based on your visit to our site. If you wish, you may opt out of being tracked by Google Analytics by using the Google Analytics Opt-Out Browser Add-On (link to Google Analytics Opt-out Browser Add-on Download Page).

3.9.3 A cookie will be used here to mean a Web cookie, being a small text file stored on your device, in order to tailor the environment based on the user’s preferences and track the user’s behaviour.

3.9.4 Most web browsers can either alert you to the use of cookies or refuse to accept cookies entirely. You should be aware that if you elect not to accept cookies, some parts of our services may not function properly or permit access.

3.9.5 Alectra uses the following types of cookies for the purposes set out below:

3.9.6 Alectra also uses third party advertising partners to provide on-line visitors with relevant ads across the Internet. Pixel tracking also allows us offer targeted advertising. Dynamic search ads used by Alectra match ads to a user's searches. Other ad types, such as responsive search ads and geofencing ads target users based on their interests, previous searches and location. You may opt out of interest-based advertising by visiting the opt-out tool made available by the Digital Advertising Alliance of Canada at https://youradchoices.ca/choices/

3.10.1 Alectra’s takes privacy complaints very seriously and has a procedure in place for escalating and managing any privacy related concerns to ensure that they are responded to in a timely and effective manner. Alectra’s Privacy Officer oversees the containment, investigation and corrective actions for all privacy breach situations.

3.10.2 Alectra is prepared to respond to any enquiry or concern you may have regarding this Policy, or our information handling practices. Please direct all questions or enquiries about this Policy to the Privacy Officer as follows:

Christine E. Long, Vice President, Regulatory Affairs & Privacy Officer

Mailing Address: 2185 Derry Road West, Mississauga, ON L5N 7A6

E-mail: privacy.officer@alectra.com

Phone: 1-888-946-0950 (toll free); 647-598-7385

3.10.3 Alectra will investigate any privacy issue that is brought to its attention and provide you with its findings. Should you be unsatisfied with the response, you may contact the Office of the Privacy Commissioner of Ontario.