PRIVACY CODE

View our updated Privacy Code, taking effect on February 8, 2021.
Introduction

Tangerine Bank (“Tangerine”) is committed to keeping personal information accurate, confidential, secure and private. The Tangerine Privacy Code is an embodiment of this commitment.

This Privacy Code is based on the Personal Information Protection and Electronic Documents Act (PIPEDA). It describes how Tangerine subscribes to the principles of the PIPEDA. A copy of the PIPEDA is available at privcom.gc.ca

The Scope Of This Privacy Code

This Privacy Code describes the principles Tangerine will use to protect the privacy of personal information in its possession or control. This Privacy Code does not apply to information about business customers who carry on business as corporations, partnerships or in other forms of association. Tangerine does, however, protect the confidentiality of such information in accordance with the law and Tangerine’s own policies. This Privacy Code does apply to personal information of individual owners of sole proprietorships.

Changes To This Privacy Code

In order to ensure that this Privacy Code is kept up to date, we reserve the right to change this Privacy Code from time to time. Any changes will be communicated to you at least 30 days before they take effect. Notice of changes to the Privacy Code may be distributed by email, through Tangerine statements, letters and/or posted on the Tangerine web site, through your online Inbox or any other electronic method used by Tangerine to communicate with you. If you access or choose to continue to be serviced by Tangerine after the effective date of the change, you automatically accept the change.

DEFINITION OF TERMS USED IN THIS PRIVACY CODE


Associates

The client services representatives at Tangerine to whom the public is encouraged to address their initial questions and concerns about a Tangerine product or service. Associates may be reached by telephone at 1-888-826-4374.

Direct Marketing

Promotions targeted to individuals whose personal information indicates that a certain product may be of interest to them. This includes mail, email and telemarketing initiatives, communications through our Mobile Banking app and other electronic methods provided by us. This does not include statements, statement inserts, and messages in banking machines, bank machine receipts, and announcements in electronic bulletin boards, through personal bankers or customer relationship management.

Independent Mortgage Broker

The individual and/or company through which you have been referred to Tangerine under a referral arrangement between such Independent Mortgage Broker and Tangerine. The Independent Mortgage Broker is not an agent, employee, partner or joint venture of Tangerine.

Tangerine

“Tangerine” is the operating name of Tangerine Bank.

Personal Information

Information about an identifiable individual, but does not include the name, title or business address or business telephone number of an employee of an organization for the purpose of communicating with the individual in relation to their work.

Privacy Office

The department at Tangerine that is responsible for ensuring the protection of individuals’ personal information. The Privacy Office may be contacted by mail at:
PRIVACY OFFICE
Tangerine
3389 Steeles Ave E
Toronto, ON M2H 0A1
theprivacyofficer@tangerine.ca

THE TEN PRINCIPLES OF PRIVACY IN SUMMARY


These ten principles of privacy are interrelated and must be read in conjunction with the accompanying commentary.

1. Tangerine’s Accountability

Tangerine is accountable for all personal information in its possession or control, including any personal information transferred to third parties for processing. Tangerine has established policies and procedures to comply with this Privacy Code, and has designated one or more persons accountable for compliance.

2. Identifying The Purposes Of Collecting Personal Information

Tangerine will inform individuals of the purpose for which personal information will be used before or when they consent to its collection.

3. Obtaining Consent

Tangerine will obtain consent before or when it collects, uses or discloses personal information about an individual.

An individual can provide consent to the collection, use and disclosure of personal information about them expressly, implicitly, or through an authorized representative. An individual can withdraw consent at any time, with certain exceptions.

Tangerine will collect, use or disclose personal information without an individual’s consent only in limited circumstances as permitted by law.

4. Limits For Collecting Personal Information

Tangerine limits the amount and type of personal information it collects. Tangerine will collect personal information only for the identified purposes or as otherwise permitted by law.

5. Limits For Using, Disclosing And Keeping Personal Information

Tangerine will use or disclose personal information only for the reasons it was collected, unless an individual gives consent to use or disclose it for another reason.

Under certain circumstances, Tangerine may have a legal duty or right to disclose personal information without consent. Tangerine will keep personal information only as long as necessary for the identified purposes.

Tangerine will keep personal information only as long as necessary for the identified purposes.

6. Keeping Personal Information Accurate

Tangerine will keep the personal information in its possession or control accurate, complete, current and relevant, based on the most recent information available to Tangerine.

Individuals may challenge the accuracy and completeness of personal information about them and have it amended as appropriate.

7. Safeguarding Personal Information

Tangerine protects personal information with safeguards appropriate to the sensitivity of the information.

8. Making Information About Policies And Procedures Available

Tangerine will be open about the procedures used to manage personal information. Individuals will have access to information about these procedures through this Privacy Code, by contacting our Associates or by contacting the Privacy Office. The information will be available in a format that is easy to understand.

9. Providing Access To Personal Information

When an individual requests it, when possible, Tangerine will advise the individual what personal information Tangerine has in its possession or control about the individual, what it is being used for, and to whom it has been disclosed.

When an individual requests it, Tangerine will give an individual access to personal information about them which is in the possession or control of Tangerine. In certain situations, however, Tangerine may not be able to give individuals access to all of their personal information. Tangerine will not give access to information that is considered proprietary, business or trade secret. For greater certainty, Tangerine will not provide access to notes, internal communications, or information/data generated in the course of its business activities that may relate to an individual.

10. Handling Complaints And Questions

Individuals may challenge Tangerine’s compliance with this Privacy Code. Complaints and inquiries should be directed to our Associates or sent to the Privacy Office.

PRINCIPLE 1


Tangerine’s Accountability

Tangerine is accountable for all personal information in its possession or control, including any personal information transferred to third parties for processing. Tangerine has established procedures to comply with this Privacy Code, and has designated one or more persons to be accountable for compliance.

  1. Senior management of Tangerine will have ultimate accountability for protecting personal information. Senior management has delegated the day-to-day management of procedures involving personal information protection to one or more persons.

  2. Tangerine’s Privacy Office is responsible for overall personal information protection and Tangerine’s compliance with this Privacy Code. In addition, Associates are able to respond to most inquiries about the protection of personal information.

  3. Tangerine will allow the following categories of Tangerine employees to access individuals’ personal information in Tangerine’s control: Sales and Service Personnel; Finance Personnel; Marketing Personnel; Security Personnel; Audit Personnel; IT Personnel; Operations Personnel; Legal and Compliance Personnel; Risk Management Personnel; and Credit and Lending Personnel. Human Resources Personnel will have access to information about Tangerine’s employees.

  4. Tangerine is also accountable for personal information that has been transferred to a third party for processing. Tangerine’s policies for safeguarding personal information transferred to third parties are set out in sections 7.4 and 7.5 of this Privacy Code.

  5. To practise the principles of this Privacy Code, Tangerine:

    • has established procedures to protect the privacy of personal information;

    • has established procedures to receive and respond to questions and complaints;

    • gives the public access to this Privacy Code; and

    • has trained Tangerine staff to understand and follow Tangerine’s privacy procedures.


Tangerine also oversees compliance with this Privacy Code through regular audits and other compliance procedures. Senior management reports to a committee of Tangerine’s Board of Directors regarding compliance with this Privacy Code.

PRINCIPLE 2


Identifying The Purposes of Collecting Personal Information

Tangerine will identify the purposes of collecting personal information, before or when consent is provided.

  1. Except as noted below, when an individual applies for a product or service, Tangerine will make the individual aware of the purposes for which Tangerine is requesting the personal information. If Tangerine identifies other purposes for which the personal information may be used, Tangerine will seek the individual’s consent prior to starting these uses. Tangerine will explain that it is the individual’s right to refuse permission for Tangerine to use personal information for any such other purposes. In some cases Tangerine will not explain those purposes or obtain the individual’s consent. (See section 3.4 and section 5.1 for details).

  2. Tangerine will clearly identify the purposes for which it is collecting personal information in writing, verbally (either in person or over the telephone), or by any other means it communicates with individuals.

  3. Individuals can ask for information about the purposes for which Tangerine collects personal information when they phone or visit Tangerine, or write to the Privacy Office.

  4. Unless additional purposes are identified to an individual before or at the time of collection, Tangerine will collect personal information (which may include credit, employment and other financially related information) for the following purposes:

    • to help identify new clients;

    • to determine the suitability of products or services for an individual or the eligibility of an individual for products and services;

    • to set up and manage Tangerine’s products and services offered by approved distributors that meet an individual’s needs;

    • to offer products and services to meet those needs;

    • to provide ongoing service; and

    • to meet legal and regulatory requirements, such as requirements under the Income Tax Act and credit reporting requirements.

  5. Tangerine takes care to explain purposes which are not as obvious as others. The purposes for collecting a name or address are obvious and do not need to be explained, but the purposes for collecting other information may not be as self-evident.


Tangerine may collect, disclose and use personal information for some or all of the following purposes:

  • references are used to verify information on an application;

  • an individual’s date of birth and other identifying information may be collected and used to verify the identity of a Client, and to protect the Client and Tangerine from error or fraud. Tangerine may also collect and use personal information obtained from credit bureaus, credit reporting agencies, credit insurers and other financial institutions in order to help verify a new Client’s identity;

  • a Social Insurance Number is collected because the Income Tax Act and other national or international regulations related to the taxing of nationals require it for an individual’s income tax reporting. In addition, a Social Insurance Number may be used to match credit bureau information and/or protect the Client and Tangerine from reporting errors and/or fraud;

  • personal information is exchanged with credit bureaus, credit reporting agencies, credit insurers, and other financial institutions, to maintain the integrity of the credit-granting process and to determine eligibility for financial products and services. In certain cases, individuals have a right to access their personal information in the control of these institutions. Individuals should contact our Associates to find out how to access their personal information in the control of these institutions;

  • personal information, including credits or debits to any Account, product or service offered by Tangerine, is used by Tangerine to determine initial and ongoing eligibility for financial products and to notify the Clients of such products by website, mail, email, our Mobile Banking app or any other electronic method offered by Tangerine and used by a Client;

  • personal information, including account details, may be collected from or disclosed to an individual’s Independent Mortgage Broker to allow account administration by the Independent Mortgage Broker;

  • Subject to 7.4, personal information may be disclosed to investors or potential investors, lenders and government guarantors in order for us to process and fund your mortgage;

  • personal information may be collected, used and disclosed to investigate specific transactions or patterns of transactions for the purpose of detecting unauthorized or illegal activities;

  • personal information may be collected and used to ensure that a Client’s instructions can be properly verified;

  • personal information may be collected, used and disclosed to investigate Client complaints;

  • should you open an Account to be operated on behalf of a third party, personal information of that third party will be collected from you in accordance with money laundering legislation;

  • personal information may be used by Tangerine and disclosed to its parent or affiliates to satisfy regulatory reporting requirements and international banking standards, including tax reporting;

  • personal information may be collected, used and disclosed for the purpose of legal, regulatory and/or governmental requirements in accordance with law;

  • personal information may be collected, used and disclosed for the purpose of conducting risk assessments;

  • personal information may be collected, used and disclosed to provide specific products or services associated with an Account; and

  • personal information may be disclosed to a Joint Account holder to provide Joint Account services.


PRINCIPLE 3


Obtaining Consent

Tangerine will obtain consent before or when it collects, uses or discloses personal information about an individual. An individual can provide consent to the collection, use and disclosure of personal information about them expressly, implicitly or through an authorized representative.

Tangerine will collect, use or disclose personal information without an individual’s consent only in limited circumstances as permitted by law.

Subject to certain legal and contractual restrictions and reasonable notice, an individual can refuse or withdraw their consent to the collection, use or disclosure of personal information about them at any time.

  1. Tangerine will obtain consent before or when it collects, uses or discloses personal information. Generally, Tangerine will seek consent to use and disclose personal information at the same time it collects the information. In some circumstances, Tangerine may identify a new purpose and seek consent to use and disclose personal information after it has been collected.

  2. Tangerine will explain to individuals in plain language how personal information will be used or disclosed before they give their consent.

  3. Consent to the collection, use and disclosure of personal information can be expressed, implied, or given through an authorized representative of the individual.

    • Individuals can express consent verbally, such as when information is collected over the telephone, in writing, such as when completing and signing an application, or electronically, such as when applying through a computer.

    • individuals can imply their consent, for example, by using a Tangerine product or service. In such a case, Tangerine may assume that the individual consents to the use of the personal information.

    • By applying for a Tangerine product through an Independent Mortgage Broker, individuals consent to the disclosure of their Account information and other related personal information to the Independent Mortgage Broker(s) by Tangerine.

    • Individuals can also give consent through an authorized representative, such as a legal guardian or a person with a Power of Attorney. This may be necessary, for example, if Tangerine cannot obtain express consent from an individual who is a minor, seriously ill, or mentally incapacitated. Authorized representatives may also include an individual’s Independent Mortgage Broker.


  1. Tangerine may collect, use or disclose personal information without the individual’s knowledge and consent only in limited circumstances as permitted by law. For example,

    • Tangerine may collect, use and disclose personal information without the individual’s knowledge or consent if it is clearly in the individual’s best interests to do so and consent cannot be sought in a timely manner. An example of such a circumstance is when an individual is seriously ill.

    • Tangerine may collect, use and disclose personal information without individual's knowledge or consent in certain circumstances where the information is publicly available. An example would be the name, address and phone number of a subscriber to a telephone directory that is available to the public where the subscriber can refuse to have their personal information appear in the telephone directory.

    • Tangerine may collect, use and disclose personal information without the individual’s knowledge or consent in accordance with law or upon the lawful request of a government institution or part of a government institution. An example would be when a government institution lawfully requests the information for the enforcement of any law of Canada, a province or a foreign jurisdiction.

  2. Subject to certain legal or contractual restrictions and reasonable notice, an individual may refuse or withdraw consent at any time.

    • Tangerine will inform individuals of the consequences of refusing or withdrawing consent when individuals seek to do so. Refusing or withdrawing consent for Tangerine to collect, use or disclose personal information could mean that Tangerine cannot provide the individual with a product, service or information of value to the individual.
      For example, if an individual does not allow Tangerine to obtain a credit history report, Tangerine may not be able to lend money to the individual due to prudent lending practices, or other regulations.

    • Tangerine, however, will not unreasonably withhold products, services or information from individuals who refuse to give consent or who withdraw consent.

    • Tangerine is required by law to collect certain types of personal information in order to verify the identity of its Clients. If an individual does not allow Tangerine to collect and use this information, or if the Client later attempts to withdraw their consent, Tangerine may not be able to open an Account or maintain the Account on behalf of that Client.

    • Withdrawal of consent is not permitted in relation to a credit product where Tangerine must collect and report information after credit has been granted. This is to maintain the integrity of the credit system.

    • Tangerine will not deny credit to an individual solely because the individual does not provide a Social Insurance Number for this purpose, but Tangerine may be unable to open a Savings Account or sell an individual a GIC or other interest-bearing instrument unless a Social Insurance Number is provided.


PRINCIPLE 4


Limits On The Collection Of Personal Information

Tangerine limits the amount and type of personal information it collects. Tangerine will collect personal information only for purposes it has already identified to the individual or as permitted by law. Tangerine will collect personal information using procedures which are fair and lawful.

  1. Tangerine will collect only the amount and type of information needed for the purposes documented by Tangerine and identified to the individual.

  2. Tangerine will collect personal information about an individual primarily from that individual. Except as permitted by law, Tangerine will only collect personal information from external sources if individuals have consented to such collection.


PRINCIPLE 5


Limits On Using, Disclosing And Keeping Personal Information Tangerine will use or disclose personal information only for the reasons it was collected, unless consent is given to use or disclose it for another reason.

Under certain exceptional circumstances, Tangerine may have a legal duty or right to disclose personal information without the individual’s knowledge or consent.

Tangerine will keep personal information only as long as necessary for the identified purposes.

  1. Tangerine may disclose personal information without consent when required or permitted by law. Examples of such disclosure include:

    • subpoenas, search warrants and other court and government orders;

    • debt collection or demands from other parties who have a legal right to personal information; and

    • disclosure of personal information to a lawyer (or, in Quebec, a notary or an advocate) who represents Tangerine.

  2. In any of the circumstances referred to in Principle 5.1, Tangerine will protect the interests of its Clients by making sure that:

    • orders or demands appear to comply with the laws under which they were issued, and

    • Tangerine does not comply with casual requests for personal information from government or law enforcement authorities. When permitted by law, Tangerine may notify individuals that an order or demand has been received.

    • Tangerine may notify individuals by telephone, or by letter to the Client’s usual address.

  3. Tangerine may want to use personal information in its possession or control to market products and services to individuals, either directly through Tangerine or through its existing subsidiaries or affiliates or approved network of Independent Mortgage Brokers. Tangerine will obtain the individual’s consent before using or disclosing personal information for this purpose.
    When an individual applies for a product or service and provides personal information, Tangerine will advise the individual that his/her personal information may be used by Tangerine to market other products and services to the individual.

  4. Tangerine will collect health records only for specific purposes explained to Clients, such as establishing the effective date of an individual’s Power of Attorney document or for Mortgage insurance purposes. Subject to anything herein, it will not disclose health records to subsidiaries or affiliates, and vice versa. For example, Tangerine will not use an individual’s health records collected by a subsidiary to help assess a loan application.

  5. If personal information has been used to make a decision about an individual, Tangerine will keep the personal information long enough for the individual to have access to it after the decision has been made.

  6. In the event Tangerine provides personal information to a third party service provider for processing located in a foreign jurisdiction, Tangerine is bound by the laws of the jurisdiction and may disclose personal information in accordance with those laws.

  7. Tangerine will destroy, erase or make anonymous any personal information no longer needed for its identified purposes or for legal requirements.


PRINCIPLE 6


Keeping Personal Information Accurate

Tangerine will keep the personal information in its possession or control accurate, complete, current and relevant, based on the most recent information available to Tangerine.

Individuals may challenge the accuracy and completeness of personal information about them and have it amended as appropriate.

  1. Tangerine will make reasonable efforts to minimize the possibility of using inaccurate, incomplete or outdated personal information to make a decision about the individual.

  2. Tangerine will update personal information only if it is necessary for the purposes for which it was collected.

  3. Tangerine will make reasonable efforts to keep personal information in its possession and control accurate and current if the information is used on an ongoing basis, unless limits on the need for accuracy are clearly set out by Tangerine.

  4. Tangerine will also rely on individuals to keep certain personal information relating to them accurate, complete and current. If an individual demonstrates to Tangerine that personal information relating to them is inaccurate, incomplete, out of date or irrelevant, Tangerine will revise or delete the personal information. If necessary, Tangerine will disclose the revised personal information to any third parties to whom Tangerine disclosed wrong or outdated information in order to permit them to revise their records.

  5. If Tangerine does not agree to revise personal information as requested by the individual, the individual may challenge Tangerine’s decision. Tangerine will make a record of this challenge, and, if necessary, disclose the challenge by the individual to any third parties to whom Tangerine has disclosed the personal information.

PRINCIPLE 7


Safeguarding Personal Information

Tangerine will protect personal information with safeguards appropriate to the sensitivity of the information.

  1. Tangerine will safeguard personal information in its possession or control from loss or theft and from unauthorized access, disclosure, duplication, use or modification.

  2. The safeguards employed by Tangerine to protect personal information will vary depending on the sensitivity, amount, distribution, format and storage of the personal information. Tangerine stores most of your information electronically. Recent paper records containing individuals’ personal information are stored in files kept onsite at our Toronto head office, and older records containing individuals’ personal information may be stored at an offsite storage facility. Tangerine will give the highest level of protection to the most sensitive personal information.

  3. Tangerine will safeguard personal information in its possession or control through security measures.
    For example:

    • orders or demands appear to comply with the laws under which they were issued, and

    • physical security, such as secure locks on filing cabinets and restricted access to offices;

    • organizational security, such as controlled entry in data centres and limited access to relevant information; and

    • electronic security, such as passwords, personal identification numbers and encryption.

  4. Tangerine may transfer personal information to third parties for processing, including printing cheques, market research, data processing services, collection, government guarantors, service agents or for other goods and services. Tangerine will require these third parties to safeguard all personal information in a way that is consistent with Tangerine’s measures and/or as regulated by law.
    When Tangerine contracts with third parties, they are given only the information necessary to perform the services as set out in the contract. The third parties are prohibited from storing, analyzing or using the personal information transferred by Tangerine for any other purpose. The third parties are required to protect personal information transferred by Tangerine in a manner that is consistent with privacy policies and practices established by Tangerine.

  5. Tangerine may disclose personal information to businesses such as credit bureaus, credit insurers and lenders with the individual’s consent. Tangerine relies on the added protection of credit reporting legislation to ensure that credit bureaus protect personal information which is disclosed to them.

  6. Tangerine will use care when disposing of or destroying personal information in order to prevent unauthorized access to the information.


PRINCIPLE 8


Making Information About Policies And Procedures Available To Individuals

Tangerine will be open about the procedures used to manage personal information. Individuals will have access to information about these procedures through Tangerine’s Privacy Code, by contacting our Associates or by writing to the Privacy Office. The information will be available in a format that is easy to understand.

  1. Tangerine will make this Privacy Code available to the public.

    • Copies of this Privacy Code will be provided to all new Clients; and/or

    • an electronic version of this Privacy Code is available on Tangerine’s website at tangerine.ca.

  2. Information about this Privacy Code will be available in a format that is easy to understand.

    • Tangerine has produced a summary of this Privacy Code. The summary is available at tangerine.ca and at the beginning of this document.

    • The contact information of the Associates and the Privacy Office are provided in the summary as in this Privacy Code, so individuals know where to address complaints and questions about Tangerine’s personal information policies and procedures.

  3. Tangerine may make information about its procedures available in a variety of ways, depending on the nature of the services individuals are using and the sensitivity of the personal information.

    • Tangerine may make brochures available on premises, mail, or email information to its Clients, establish a toll-free telephone service or provide online access.


PRINCIPLE 9


Access To Personal Information

When an individual requests it, Tangerine will advise what personal information Tangerine has in its possession or control about the individual, what it is being used for and to whom it has been disclosed.

When an individual requests it, Tangerine will give the individual access to personal information about them which is in the possession or control of Tangerine. In certain exceptional situations, Tangerine may not be able to give individuals access to all of the personal information about them.

  1. An individual has the right to know, on request, what personal information about the individual Tangerine has in its possession or control, a right to access that personal information and to know to which third parties Tangerine has disclosed that information, subject to the requirements of any law, regulation or contract limiting same. Individuals may direct their requests by telephone to the Associates or, in writing, to the Privacy Office.

  2. Tangerine has established procedures for responding to requests for access to personal information. Tangerine will respond to requests within a reasonable period of time. Individuals must be specific about the personal information that may be in Tangerine’s possession or control. In the unlikely event that Tangerine determines that there will be a cost to the individual in granting such access, Tangerine shall inform the individual of the costs permitted by law prior to granting such access.

  3. Subject to any limitation contained in this Code or Tangerine’s Account Terms and Conditions, Tangerine will identify from whom it collected the personal information, to whom it has disclosed the personal information, and how and when the information was disclosed. Tangerine will take this data from its records, and will provide it to the individual.

  4. In some cases, Tangerine may not provide access to personal information that is in its possession or control. For example, this may occur when:

    • providing access to personal information would be likely to reveal personal information about a third party;

    • providing the personal information could result in a threat to the security of another individual;

    • disclosing the information would reveal confidential commercial information;

    • the personal information is protected by solicitor-client privilege;

    • the information is the result of arbitration or other formal dispute resolution process; or

    • the information has been collected for the purposes of a legal investigation.

  5. Tangerine will not record in individual files when personal information was disclosed to third parties for routine purposes.
    For example:

    • reporting to the Canada Revenue Agency (T5 and other reports);

    • regular updating of credit information to credit bureaus;

    • indicating to third parties when cheques are returned for NSF (not sufficient funds).

  6. Tangerine denies the individual’s request for access to personal information, Tangerine will advise the individual of the reason for the refusal. The individual may then appeal Tangerine’s decision to the Privacy Commissioner of Canada.


PRINCIPLE 10


Handling Individuals’ Complaints And Questions

Individuals may challenge Tangerine’s compliance with this Privacy Code. Tangerine has policies and procedures to receive, investigate, and respond to individuals’ complaints and questions.

  1. Tangerine has policies and procedures to receive, investigate, and respond to individuals’ complaints and questions relating to privacy. Individuals are advised to direct their complaints and questions by telephone to the Associates or in writing to the Privacy Office.

  2. Tangerine will investigate all complaints. If it finds a complaint justified, Tangerine will attempt to resolve it. If necessary, Tangerine will modify its policies and procedures to ensure that other individuals will not experience the same problem.

  3. If individuals are not satisfied with the way Tangerine has responded to their complaint, they can contact the Office of the Superintendent of Financial Institutions, the external ombudsman for Tangerine Bank - ADR Chambers Banking Ombudsman or the Federal Privacy Commissioner.


Back to Top

Updated Privacy Code in effect as of February 8, 2021.

A word about your privacy

We respect your privacy. Not only do we respect it, but we also protect it. We only share your personal information in circumstances that we will describe in this Code and that align with our privacy principles. We have provided this document to explain our privacy principles and procedures. This Code reflects both the importance of the issue and the legal and regulatory requirements for privacy protection. If you want more information regarding our privacy principles and procedures, please read on.

To request access to, or correction of, your personal information, or to make other inquiries regarding your personal information, you may write to our Privacy Office at theprivacyofficer@tangerine.ca or by mail to: Privacy Office, 3389 Steeles Ave E, Toronto, ON M2H 0A1.

Introduction

Tangerine Bank (“Tangerine” or “we”) is committed to keeping personal information of our Clients and prospective Clients (“you” or “your” personal information) accurate, confidential, and secure. The Tangerine Privacy Code reflects this commitment.

This Privacy Code is based on the Personal Information Protection and Electronic Documents Act (PIPEDA). It describes how Tangerine complies with the principles of PIPEDA. A copy of PIPEDA is available at priv.gc.ca.

The scope of this Privacy Code

This Privacy Code describes the principles Tangerine will use to protect the personal information in its possession or control. This Privacy Code does not apply to information about business Clients who carry on business as corporations, partnerships or other forms of association. We do, however, protect the confidentiality of such information in accordance with the law and our policies. This Privacy Code applies to any personal information that we collect about individual owners of sole proprietorships or personal information about officers, directors, employees or partners of a business Client.

Changes to this Privacy Code

In order to ensure that this Privacy Code is kept up to date, we will change this Privacy Code from time to time. Notice of any significant changes to the Privacy Code may be distributed by email, through Tangerine statements, letters, posted on the Tangerine website, through your online Inbox or any other electronic method used by Tangerine to communicate with you.

EXPLANATION OF TERMS USED IN THIS PRIVACY CODE

Associates

The Client services representatives at Tangerine who will address any questions and concerns about a Tangerine product or service. Associates may be reached by telephone at 1-888-826-4374 or email at info@tangerine.ca.

Personal information

Personal information is information that identifies you or can be used to identify you. Examples of personal information include: first and last name, mother’s maiden name, mailing address, telephone number (including mobile), email address, date of birth, social insurance number (SIN), government-issued identification, credit history, information about your employment and education, annual income, assets and liabilities and financial transactions.

Privacy Office

The department at Tangerine that is responsible for the protection of your personal information. The Privacy Office may be contacted by mail or email at:

PRIVACY OFFICE Tangerine 3389 Steeles Ave E Toronto, ON M2H 0A1 theprivacyofficer@tangerine.ca

Tangerine

“Tangerine” is the operating name of Tangerine Bank. Tangerine is a wholly owned subsidiary of The Bank of Nova Scotia (“Scotiabank”).

SECTION 1

Principle – Tangerine’s accountability

We are accountable for all personal information in our possession or control, including any personal information transferred to third parties for processing. We have established procedures to comply with this Privacy Code and have designated one or more persons to be accountable for compliance.

  1. Our Privacy Office is responsible for protecting the privacy of our Clients’ personal information and our compliance with this Privacy Code.

  2. We are also accountable for personal information that has been transferred to a third party for processing (for example, cheque clearing services). Our policies for safeguarding personal information transferred to third parties are set out in Section 7.4 of this Privacy Code.

  3. To ensure compliance with the principles of this Privacy Code, we:

    • have established procedures to protect personal information;

    • have established procedures to receive and respond to questions and complaints;

    • published this Privacy Code; and

    • have trained our staff to understand and follow our privacy procedures.

We also oversee compliance with this Privacy Code through regular audits and other compliance procedures. Senior management reports to a committee of Tangerine’s Board of Directors regarding compliance with this Privacy Code.

SECTION 2

Principle – Identifying the purposes of collecting personal information

We will identify the purposes of collecting personal information.

  1. We take care to explain purposes which are not as obvious as others. While the purposes for collecting a name or address may be obvious and do not need to be explained, the purposes for collecting other information may not be as self-evident.

  2. We will clearly identify the purpose for which we are collecting your personal information either through writing, verbally when we are speaking with you or through any other means we use to communicate with you. There are some cases where we are not required to obtain your consent (See Section 3 and Section 5.1 for details).

  3. You can ask for information about the purposes for which we collect personal information when you phone us or write to our Privacy Office.

  4. In addition to any purposes identified to you before or at the time of collection, we will collect personal information (which may include credit, employment and other financially related information) for the following purposes:

    • to help identify you;

    • to determine your suitability or eligibility for our products or services;

    • to set up and manage Tangerine’s products and services;

    • to offer, set up and manage products and services, including those of our affiliates or trusted business partners;

    • to provide ongoing service; and

    • to meet legal and regulatory requirements, such as requirements under the Income Tax Act and credit reporting requirements.

    Examples of additional purposes for which we may collect, disclose or use your personal information:

    1. references are used to verify information on an application;

    2. your date of birth and other identifying information may be collected and used to verify your identity, and to protect you and Tangerine from error or fraud. We may also collect and use personal information obtained from credit reporting agencies and other financial institutions in order to help verify your identity when you are a new Client;

    3. a Social Insurance Number (SIN) is collected because the Income Tax Act and other national or international regulations related to the taxing of nationals require it for income tax reporting. In addition, a SIN may be used to match credit bureau information or protect you and Tangerine from reporting errors or fraud. Providing your SIN for these identity verification purposes is optional. To withdraw your consent for the use of your SIN for identity verification purposes, you may contact us as set out below; see Section 3.5 and Section 3.6;

    4. personal information is exchanged with credit reporting agencies, credit insurers (including health information), and other financial institutions, to maintain the integrity of the credit-granting process and to determine eligibility for financial products and services including creditor insurance products. In certain cases, you have a right to access your personal information in the control of these institutions. You should contact our Associates to find out how to access the personal information in the control of these institutions. Associates may be reached by telephone at 1-888-826-4374 or email at info@tangerine.ca;

    5. personal information, including transaction details for any product or service offered by Tangerine, is used by us to determine your eligibility for products and services or to identify products or services that may be of interest to you, and we will use your contact and other information to notify you of such products including by website, mail (including statement inserts), email, phone, SMS text messages, our Mobile Banking app or any other electronic method offered by Tangerine and used by you. If you do not wish to receive marketing communications, you can opt out as described in Section 3.6;

    6. subject to Section 7.4, personal information may be disclosed to investors or potential investors, lenders and government guarantors in order for us to process, fund and securitize your mortgage;

    7. personal information may be collected, used and disclosed to investigate specific transactions or patterns of transactions for the purpose of detecting unauthorized, fraudulent or other illegal activities;

    8. personal information may be collected and used to ensure that your instructions can be properly verified and to prevent errors;

    9. personal information may be collected, used and disclosed to investigate your complaints;

    10. should you open an Account to be operated on behalf of a third party, personal information of that third party will be collected from you in accordance with anti-money-laundering legislation;

    11. we may share personal information with members of the Scotiabank group of companies and other service providers who provide operational, administrative and support services on our behalf, to meet legal and regulatory obligations, for fraud prevention purposes, and to perform analytics;

    12. members of the Scotiabank group of companies and our service providers may be located outside of Canada and may access and process your personal information from the United States or other jurisdictions. For a list of Scotiabank’s principal affiliates and subsidiaries enterprise-wide, please refer to the most recent Annual Report;

    13. we may share your personal information with other members of the Scotiabank group of companies and our service providers so that they may contact you for the purposes of marketing, including telemarketing, or to help you manage your credit responsibly. You can withdraw your consent to the disclosure of your personal information to other Scotiabank companies for marketing at any time; see Section 3.5 and Section 3.6;

    14. personal information may be collected, used and disclosed for the purpose of legal or, regulatory requirements;

    15. personal information may be collected, used and disclosed if you participate in a contest, survey or promotion to administer your participation in the contest or promotion and as otherwise described to you when you enter. Information obtained through our surveys is used in an aggregated form. We use this information to help us understand our Clients and to improve our products and services;

    16. personal information about a joint Account and any transactions on that Account may be disclosed to any Account holder; and

    17. personal information may be disclosed to a representative (such as a legal guardian, Power of Attorney, estate representative or lawyer) where reasonably necessary to administer the estate.

SECTION 3

Principle – Obtaining consent

We will collect, use or disclose personal information without your consent only in limited circumstances as permitted by law.

Subject to certain legal, regulatory and contractual obligations and reasonable notice, an individual can refuse or withdraw their consent to the collection, use or disclosure of personal information about them at any time. In certain instances, that means we may not be able to offer you certain products and services.

  1. Generally, we will seek consent to use and disclose personal information at the time of collection. In some circumstances, we may identify a new purpose and seek consent to use and disclose personal information after it has been collected.

  2. We will explain to you in plain language how personal information will be used or disclosed before requesting your consent.

  3. Consent to the collection, use and disclosure of personal information can be expressed, implied, or given through your authorized representative.

    • You can express consent verbally, such as when information is collected over the telephone, in writing, such as when completing and signing an application, or electronically, such as when applying online.

    • Your consent can be implied, for example, by using a Tangerine product or service.

    • You can also give consent through an authorized representative, such as a legal guardian or a person with a Power of Attorney. This may be necessary, for example, when we cannot obtain express consent from a minor, or an individual who is seriously ill.

  4. We may collect, use or disclose personal information without your knowledge and consent only in limited circumstances as permitted by law. For example:

    • We may collect, use and disclose personal information without your knowledge or consent if it is clearly in your best interest to do so and consent cannot be sought in a timely manner. An example of such a circumstance is when an individual is seriously ill.

    • Tangerine may collect, use and disclose personal information without your knowledge or consent in accordance with law or upon the lawful request of a government institution or part of a government institution. An example would be when a government institution lawfully requests the information for the enforcement of federal or provincial Canadian law or laws of a foreign jurisdiction.

  5. You can refuse to consent to our collection, use or disclosure of personal information, or you may withdraw your consent to our further collection, use or disclosure of your personal information at any time by giving us reasonable notice, subject to limited exceptions. This includes withdrawing your consent for the use of your SIN for identity verification purposes.

    • We will inform you of the consequences of refusing or withdrawing consent. Refusing or withdrawing consent for Tangerine to collect, use or disclose personal information could mean that we cannot provide you with a product and/or service. For example, if you do not allow us to obtain a credit report, we may not be able to lend money to you.

    • We may have legal, regulatory or contractual obligations to collect, use or disclose certain of your personal information, in which case you may not withdraw your consent. For example, during the term of a loan, you may not withdraw your consent to our ongoing collection, use or disclosure of your personal information in connection with the loan you have with us or have guaranteed.

    • We will not unreasonably withhold products, services or information from individuals who refuse to give consent or who withdraw consent.

    • Tangerine is required by law to collect certain types of personal information in order to verify your identity. If you do not allow us to collect and use this information, or if you later attempt to withdraw your consent, we may not be able to open or maintain an Account for you.

    • Withdrawal of consent is not permitted in relation to a credit product where we must collect and report information after credit has been granted. This is to maintain the integrity of the credit reporting system.

    • We will act on your instructions as quickly as possible but there may be certain uses of your information that we may not be able to stop immediately.

  6. You can opt out and withdraw consent

    • If you wish to withdraw your consent or update your marketing communication preferences, contact us toll-free at 1-888-826-4374.

    • To opt out of email communications, click on the “unsubscribe” link included in each of our communications.

    • To opt out of receiving SMS text messages, respond to any message by texting “STOP”.

    • To opt out of the sharing of your personal information with trusted partners, contact us using the contact information set out above.

    • To opt out of direct mail and phone marketing communications, contact us using the contact information set out above.

SECTION 4

Principle – Limits on the collection of personal information

Tangerine limits the amount and type of personal information it collects. We will collect personal information only for purposes that have been already identified to you or as permitted by law.

  1. We will only collect the amount and type of information needed for the purposes documented by us and identified to you.

  2. We will collect personal information about you primarily from you. Except as permitted by law, Tangerine will only collect personal information from external sources if you have consented to such collection (for example, a Refer-a-Friend Program).

SECTION 5

Principle – Limits on using, disclosing and keeping personal information

We will use or disclose personal information only for the reasons it was collected, unless consent is given to use or disclose it for another purpose. Under certain exceptional circumstances, we may have a legal duty or right to disclose personal information without your knowledge or consent.

We will keep personal information only as long as necessary for the identified purposes.

  1. We may disclose personal information without consent when required or permitted by law. Examples of such disclosure include:

    • subpoenas, search warrants and other court and government orders;

    • debt collection or demands from other parties who have a legal right to personal information; and

    • disclosure of personal information to a lawyer (or, in Quebec, a notary or an advocate) who represents Tangerine to protect Tangerine’s interests.

  2. In any of the circumstances referred to above, we will protect your interests by making sure that:

    • orders or demands appear to comply with the laws under which they were issued;

    • when permitted by law, we may notify you that an order or demand has been received.

  3. We will collect health records only for specific purposes explained to you, such as establishing the effective date of a Power of Attorney or for creditor insurance purposes, as insurance providers require this personal information to assess insurance risk and to establish and administer the insurance coverage.

  4. In the event we provide personal information to a third party service provider for processing located in a foreign jurisdiction, we will be bound by the laws and regulations of that jurisdiction and may disclose personal information in accordance with those laws and regulations.

  5. We will destroy, erase or make anonymous any personal information no longer needed for its identified purposes or for legal requirements, in accordance with our records retention policies.

SECTION 6

Principle – Keeping personal information accurate

We will keep the personal information in our possession or control accurate and complete based on the most recent information available to us. From time to time, Tangerine may contact you to ask you to confirm your contact information and your marketing communication preferences.

You may challenge the accuracy and completeness of your personal information and have it amended as appropriate.

  1. We will make reasonable efforts to minimize the possibility of using inaccurate, incomplete or outdated personal information to make a decision about you.

  2. We will make reasonable efforts to keep personal information in our possession and control accurate and current if the information is used on an ongoing basis.

  3. We will rely on you to keep your personal information accurate, complete and current. If you demonstrate to us that personal information relating to you is inaccurate, incomplete, or out of date, we will revise or delete the personal information. If necessary, we will disclose the revised personal information to any third parties to whom we had disclosed wrong or outdated information in order to permit them to revise their records.

  4. If we do not agree to revise the personal information as requested by you, you may challenge our decision. We will make a record of this challenge, and, if necessary, disclose the challenge by you to any third parties to whom we have disclosed the personal information.

SECTION 7

Principle – Safeguarding personal information

We will protect personal information with safeguards appropriate to the sensitivity of the information.

  1. We will safeguard personal information in our possession or control from loss or theft and from unauthorized access, disclosure, duplication, use or modification.

  2. The safeguards employed by Tangerine to protect personal information will vary depending on the sensitivity, amount, distribution, format and storage of the personal information. We store most of your information electronically.

  3. We will safeguard personal information in our possession or control through security measures. For example:

    • physical security, such as secure locks on filing cabinets and restricted access to offices;

    • organizational security, such as controlled entry in data centres and limited access to relevant information; and

    • electronic security, such as passwords, personal identification numbers and encryption.

  4. We may transfer personal information to third parties for processing. We will require these third parties to safeguard all personal information in a way that is consistent with our principles and as required by law. When we contract with third parties, they are given only the information necessary to perform the services as set out in the contract. The third parties are prohibited from storing, analyzing or using the personal information transferred by Tangerine for any other purpose. The third parties are required to protect personal information transferred by Tangerine in a manner that is consistent with our privacy principles.

  5. We will use care when disposing of or destroying personal information in order to prevent unauthorized access to the information.

SECTION 8

Principle – Making information about policies and procedures available to you

We will be open about the procedures used to manage personal information. Individuals will have access to information about these procedures through Tangerine’s Privacy Code, by contacting our Associates or by writing to the Privacy Office. The information will be available in a format that is easy to understand.

  1. We will make this Privacy Code available to the public.

    • An electronic version of this Privacy Code is available on Tangerine’s website at tangerine.ca or a copy can be requested by calling one of our Associates.

  2. Information about this Privacy Code will be available in a format that is easy to understand.

    • The contact information of the Associates and the Privacy Office are provided at the beginning of this document in the “Explanation of Terms” section, so you can inquire about Tangerine’s personal information practices.

  3. We may make information about our procedures available in a variety of ways, depending on the nature of the services you are using and the sensitivity of the personal information.

    • We make information available on premises, by mail, or email, by a toll-free telephone number or provide online access.

SECTION 9

Principle – Access to personal information

When you request it, Tangerine will advise what personal information we have in our possession or control about you, what it is being used for and to whom it has been disclosed.

In certain exceptional situations, we may not be able to give individuals access to all of the personal information about them.

  1. You have the right to know, on request, what personal information we have in our possession or control about you, a right to access that personal information and to know to which third parties we have disclosed that information, subject to legal and regulatory exceptions. Individuals may direct their requests by telephone to our Associates or, in writing, to the Privacy Office.

  2. We have established procedures for responding to requests for access to personal information. In the unlikely event that we determine that there will be a cost to the individual in granting such access, we shall inform the individual of the reasonable costs permitted by law prior to granting such access.

  3. To process your request, we may ask you for information to validate your identity and confirm the scope of your request, such as your branch and Account number, and clarification on the specific information or time period you are requesting.

  4. If you have a sensory disability, you may request that your personal information be made available in an alternative format.

  5. If we are prohibited from providing a request for access to personal information, we will advise of the reason for the refusal. An appeal of that decision can then be made to the Office of the Privacy Commissioner of Canada.

  6. We may not be able to provide you with access to your personal information in certain circumstances, such as where your request includes personal information about a third party that cannot be removed, or when the information you are requesting is protected by legal privilege.

  7. Tangerine may charge you a nominal access fee depending on the nature of your request. We will advise you of the fee, if any, prior to proceeding with your request.

SECTION 10

Principle – Handling complaints and questions

Individuals may challenge Tangerine’s compliance with this Privacy Code. We have policies and procedures to receive, investigate, and respond to individuals’ complaints and questions relating to privacy.

  1. Individuals are advised to direct their complaints and questions by telephone to the Associates or in writing to the Privacy Office.

  2. We will investigate all complaints. If we find a complaint to be justified, then we will attempt to resolve it.

  3. If you have an inquiry about Tangerine’s privacy practices or how we and our service providers treat your personal information, please contact an Associate or office you deal with or call us toll-free at 1-866-677-0546. If we are not able to resolve your concern to your satisfaction, you can contact the Privacy Office:

    PRIVACY OFFICE Tangerine 3389 Steeles Ave E Toronto, ON M2H 0A1 theprivacyofficer@tangerine.ca

  4. Tangerine has policies and procedures to receive, investigate, and respond to your privacy complaints and questions. We will investigate all complaints we receive and if we find a complaint justified, we will try to resolve it.

  5. If you are not satisfied, you may file a complaint with the Office of the Privacy Commissioner of Canada:

    Office of the Privacy Commissioner of Canada 30, Victoria Street Gatineau, Quebec K1A 1H3 Toll-free: 1-800-282-1376 Phone: (819) 994-5444 TTY: (819) 994-6591 priv.gc.ca