Internal Trade Secretariat Corporation Privacy Policy

INTERNAL TRADE SECRETARIAT CORPORATION

PRIVACY POLICY

Last Revised: September 12, 2024,

In this Privacy Policy, "ITSC", "we", "us", "our" and "ours" means the Internal Trade Secretariat Corporation, and "you" means (and “your” refers to) anyone who provides personal information to us, and their successors, heirs, administrators, executors and assigns (as the case may be).

We have adopted this ITSC Privacy Policy (the "Privacy Policy") to explain how we will meet our responsibilities with respect to the information you provide to us.  This Privacy Policy applies to both individuals and organizations, from whom we collect personal information. ITSC services may be provided through our website, https://www.cfta-alec.ca/ (the "Website").

The principles that form the basis of this Privacy Policy are interrelated and ITSC adheres to all of the principles as a whole.  Each principle should be read in conjunction with the accompanying commentary. As permitted by Personal Information Protection and Electronic Documents Act ("PIPEDA"), the commentary in this Privacy Policy has been drafted to reflect privacy issues specific to ITSC. We will continue to review this Privacy Policy to make sure that it remains current with exceptions, changing technologies, industry standards and applicable laws.

1. Scope and Application

This Privacy Policy applies to personal information, in any form, collected, used or disclosed by ITSC while administering the application of the Canadian Free Trade Agreement (“CFTA”).

We collect and use several types of information from and about you, including:

• Personal information, that we can reasonably use to directly or indirectly identify you, which may include your: name; language(s) spoken; address; Internet protocol (IP) address used to connect your computer to the Internet, user name or other similar identifier, account and log-in information, and any other identifier we may use to contact you; information collected from ITSC’s employees and independent contractors for the purposes of administering our relationship with them; and feedback you submit through our Website from time to time ("personal information").
• Non-personal information, that does not directly or indirectly reveal your identity or directly relate to an identifiable individual, such as demographic information, or statistical or aggregated information. Statistical or aggregated data does not directly identify a specific person, but we may derive non-personal statistical or aggregated data from personal information. For example, we may aggregate personal information to calculate the percentage of users participating in a certain program or accessing a specific feature on our Website.
• Technical information, including your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, or information about your internet connection, the equipment you use to access our Website, and usage details.
• Non-personal details about your interactions with our Website, including the full Uniform Resource Locators (URLs), clickstream to, through and from our Website (including date and time), information you viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), methods used to browse away from the page, or any phone number used to contact us.

This Privacy Policy does not impose any limits on the collection, use or disclosure of the following information by ITSC:

• information about an individual that is publicly available and is specified by regulation pursuant to PIPEDA;
• personal information that is not collected, used or disclosed, for commercial purposes; and
• non-personally identifiable information, such as business information or information about businesses, that is not itself personally identifiable information.

The application of this Privacy Policy is subject to the requirements and provisions of PIPEDA, any successor or replacement legislation to PIPEDA, and any other applicable legislation or regulation. If you reside in British Columbia, Alberta or Québec, then the substantially similar provincial privacy law of your province will apply to our handling of your personal information, rather than PIPEDA.  In that case, reference in this Privacy Policy to PIPEDA shall be deemed to include your province's substantially similar privacy law.

ITSC shall use commercially reasonable efforts to provide you with whatever information it needs to ensure compliance with relevant Privacy Laws and CFTA and inform you if, in its opinion, your instructions would breach such laws.

2. Definitions

collection:  The act of gathering, acquiring, recording, or obtaining personal information from any source, including third parties, by any means.

consent:  Voluntary agreement for the collection, use and disclosure of personal information for defined purposes. The form of consent we seek may vary, depending upon the circumstances and the type of personal information.  In determining the form of consent, we take into account the sensitivity of the personal information and your reasonable expectations. Consent may be provided directly by you, or by your authorized representative, in accordance with applicable law.

disclosure:  Making personal information available to a third party.

employee:  An employee of, or an independent contractor to, ITSC. The inclusion of independent contractors within the definition of "employee" is for convenience of reference only, and should in no manner imply that such independent contractors are our employees within the meaning of employment legislation or are in an employee-employer relationship with us.

third party:  An individual or organization outside of ITSC.

use:  The treatment, handling, and management of personal information by and within ITSC or by a third party with the knowledge and approval of ITSC.

3. How We Collect Information About You

We use different methods to collect your information, including through:

• INFORMATION YOU PROVIDE TO US, for example, by:
  • Filling in forms, online polls, or questionnaires;
  • Registering for an account, program, or services;
  • Corresponding with us by phone, email, or otherwise. Records of correspondence, including copies of emails, may be kept by ITSC to assist us in delivering our programs and services to you;
  • Providing information for us to publish or display on public Website areas (hereinafter, "posted" or “posting”) or to transmit to other Website users or third parties (collectively, "User Contributions"), as and when such features are made available from time to time. Any User Contributions are posted and transmitted to others at your own risk. ITSC cannot control the actions of other users of the Website with whom you may choose to share your User Contributions. Therefore, we cannot and do not guarantee that unauthorized persons will not view your User Contributions.
• AUTOMATED TECHNOLOGIES OR INTERACTIONS. As you navigate through and interact with our Website, we may use cookies or other automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:
  • Details of your visits to our Website, including traffic data, and other communication data and the resources that you access and use on the Website.
  • Information about your computer and internet connection, including your IP address, operating system, and browser type.

The information we collect automatically is statistical data. It helps us to improve our Website and to deliver a better and more personalized service, including by enabling us to estimate our audience size and usage patterns, store information about your preferences, and recognize you when you return to our Website.

The technologies we use for this automatic data collection may include:

• Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your computer or stored temporarily in your computer’s memory. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting you may be unable to access certain parts of our Website. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you direct your browser to our Website.
• Web Beacons. Web Beacons (also known as pixel tags, Internet tags, clear GIFs, or single-pixel GIFs) are electronic images embedded into a website. Web Beacons permit an organization to count users who have visited those pages or opened an email and for other related website statistics (for example, recording the popularity of certain website content and verifying system and server integrity).

• THIRD PARTIES, including:
  • Service providers who are engaged for specific projects or services as part of ITSC’s programs. Where ITSC engages a service provider to collect or manage personal information on our behalf (either directly or indirectly) for a specific project, we will explain to you (in this Privacy Policy or otherwise) what personal information we are collecting, for what purposes it is being collected, and with whom that information will be shared (if anyone). Service providers who collect or manage personal information on ITSC's behalf are contractually obligated to keep personal information confidential, collect it only for the purposes for which we have engaged them, and to process the personal information with the same standards set out in this Privacy Policy. ITSC remains responsible for any personal information collected for us by service providers, as set out in this Privacy Policy.
  • Internal Trade Representatives (“ITRs”) from all 14 CFTA Parties, and their respective governments.

4. Use Of Your Information

We may use information that we collect about you or that you provide to us, including any personal information:

• to present our Website and its contents to you;
• to provide services as contemplated by the CFTA, including providing you with information or services that you request from us;
• to fulfill the purposes for which you provided the information or that were described when it was collected, or any other purpose for which you provide it;
• to carry out our obligations and enforce our rights arising from any contracts with you;
• to notify you about changes to the ITSC services, including changes to our Website;
• to improve the our services, including our Website, communications, relationships and experiences;
• to allow you to participate in interactive or similar features on our Website, including, but not limited to, any listservs or newsletters we may provide, as such features may be made available from time to time;
• to promote the successes of the CFTA;
• in any other way we may describe when you provide the information; and
• for any other purpose with your consent.

Further reference to “identified purposes” mean the purposes identified in this section of this Privacy Policy.

We will indicate the identified purposes to you, orally, electronically or in writing, at or before the time your personal information is collected. Persons collecting personal information may explain the identified purposes or refer individuals to a designated person within ITSC who can explain these identified purposes. You may contact the Managing Director of ITSC with any concerns at:

Attn: Managing Director

secretariat@its-sci.ca

5. Disclosure Of Your Information

ITSC will not disclose personal information for purposes other than those purposes for which it was collected, except with your consent, as disclosed in this Privacy Policy, or as required or permitted by law. ITSC may disclose your personal information:

• to provide ITSC’s services in the course of administering the CFTA;
• to ITRs, in order for ITRs to:
  • evaluate the success of any program in achieving its objectives; and
  • meet ITSC’s obligation of accountability by reporting on the results of its programs and administration of the CFTA and its success in achieving its objectives;

Information, when provided to ITRs is administered in accordance with the privacy laws which apply to each ITR (which will vary depending on the particular ITR’s jurisdiction);

• for any other purpose disclosed by use when you provide the information;
• to fulfill the identified purposes;
• when we have your consent, whether express or implied;
• to your authorized representatives;
• to meet legal and regulatory requirements;
• to enforce or apply the ITSC Terms of Use [LINK TO ITSC TERMS OF USE] and other agreements;
• if we believe disclosure is necessary or appropriate to protect the rights, property or safety of ITSC, our clients or others; and
• where required or permitted by law.

In such circumstances, we will not disclose more information than is required for the purpose for which the information is being disclosed.  We will also, whenever it is reasonable and practicable to do so, enter into privacy agreements with third parties with whom we share personal information.

We will retain personal information only as long as it remains necessary or relevant for the identified purposes or as required or permitted by law.  Where personal information has been used by us to make a decision about you, ITSC shall retain, for a period of time that is reasonably sufficient to allow for access by you, either the actual information or the rationale for making such decision.

Only our employees who require access for legitimate reasons or whose duties reasonably so require, are granted access to personal information.

We maintain reasonable controls, schedules and practices for personal information management retention and destruction. Personal information that is no longer necessary or relevant for the identified purposes, or is required by law to be retained, is destroyed, erased or made anonymous, as appropriate in the circumstances.

6. Accountability For Our Handling Of Personal Information

ITSC is responsible for all personal information under its control and has designated the Managing Director as the ITSC Privacy Officer to oversee privacy compliance. Other individuals within ITSC may be delegated to act on behalf of our Privacy Officer or to take responsibility for the day to day management of personal information. ITSC trains and communicates with employees about our privacy practices, including this Privacy Policy.

As appropriate, ITSC implements privacy policies and procedures to properly enforce this Privacy Policy, and we use contractual or other means to provide a comparable level of privacy protection while personal information is being processed or used by a third party. ITSC shall ensure that the personnel used for processing the data are subject to requirements to use procedural safeguards to protect the data in a manner which is commensurate to its sensitivity.

7. Consent For Us to Contact You About Our Services

If you send us User Contributions, you provide us your permission to contact you to discuss further your User Contributions.

8. Transferring Your Personal Information

We may transfer limited personal information that we collect or that you provide as described in this Policy to contractors, service providers, and other third parties we use to support the ITSC services (such as analytics and search engine providers that assist us with Website improvement and optimization) and who are contractually obligated to keep personal information confidential, use it only for the purposes for which we disclose it to them, and to process the personal information with the same standards set out in this Policy.

 

We may process, store, and transfer your personal information in and to a foreign country, with different privacy laws that may or may not be as comprehensive as Canadian law. In these circumstances, the governments, courts, law enforcement, or regulatory agencies of that country may be able to obtain access to your personal information through the laws of the foreign country. Whenever we engage a service provider, we require that its privacy and security standards adhere to this Privacy Policy and applicable Canadian privacy legislation.

You are welcome to contact us to obtain further information about ITSC policies regarding service providers outside of Canada. See the Contact Information section of this Privacy Policy.

By submitting your personal information to us or engaging with the ITSC services, you consent to this transfer, storage, or processing.

9. ITSC Website

Our Website may use various technologies, from time to time, to:

• help us customize your experience on our Website;
• track your use of our website for advertising, marketing, or promotional purposes;
• help us determine whether you opened an email message from us; or
• gather information to deliver advertisements about products and services we think may be of interest to you.

This information enables us to:

• customize the services we offer you, to improve our Website;
• estimate our audience size and usage patterns;
• store information about your preferences, allowing us to customize our Website according to your individual interests, including showing you advertisements that we think will be of interest to you;
• speed up your searches;
• recognize you when you return to our Website;
• show our advertisements on external sites; and
• assist us in providing a better customer experience by understanding consumer behaviour.

Your choices about how our Website collects your information

We strive to provide you with choices regarding the personal information you provide to us.

You can opt out of several third-party ad servers’ and networks’ cookies simultaneously by using opt out tools created by Google Advertising, the Digital Advertising Alliance of Canada or by the Network Advertising Initiative. You may also opt out of our use of Google Analytics by visiting the Google Analytics opt out page. We may have reporting of your aggregate interactions with our ads across the Google Display Network or DoubleClick for Advertisers in conjunction with activity on our website.

You can also access these websites to learn more about online behavioural advertising and how to stop websites from placing cookies on your device. Opting out of a network does not mean you will no longer receive online advertising. It does mean that the network from which you opted out will no longer deliver ads tailored to your web preferences and usage patterns.

10. Accuracy Of Personal Information

We make reasonable efforts to ensure that personal information we collect, use or disclose is as accurate, complete and up-to-date as necessary for the purposes for which it is to be used.

If you find any errors in our personal information holdings (including information generated by an algorithm), we should be informed so that we can make the appropriate corrections. We will convey these corrections to any third party that may have been provided inaccurate information. For personal information that remains in dispute, we will make note in our records of your opinion as to accuracy of the relevant personal information.

11. Security Of Personal Information

The security of your personal information is very important to us and we shall take appropriate measures to ensure the security of processing, including physical, electronic, and administrative safeguards. We use physical, electronic, and administrative measures designed to prevent any unauthorized access, disclosure, copying, use, or modification of personal information. Safeguards include securing physical documents and technological measures by way of secure access and encryption. We store all information you provide to us behind firewalls on our secure servers. Any payment transactions (if applicable) will be encrypted using TLS technology.

ITSC employees are authorized to access personal information based only on their need to deal with the information for the reason(s) for which it was obtained. Safeguards are in place to ensure that the information is not disclosed or shared more widely than is necessary to achieve the purpose for which it was gathered. We also take measures to ensure the integrity of this information is maintained and to prevent its being lost or destroyed.

We protect personal information disclosed to third parties by contractual agreements stipulating the confidentiality of the personal information and the purposes for which it is to be used.

We will keep records of our processing activities in accordance with applicable privacy law requirements.

Once ITSC no longer requires the personal information, ITSC shall delete or return all personal data as requested.

12. Openness Concerning Our Policies and Procedures

We are open about the policies, procedures and practices we use to protect your personal information. Information about these policies, procedures and practices will be made available to you either electronically or in writing.

13. Access To Your Personal Information

You may access any personal information that we have concerning you, and which has been collected, used or disclosed for a commercial purpose, by sending a written request to the ITSC Privacy Officer. ITSC may advise you in advance if there is a minimal charge to conduct a search of our records and will respond within 30 days, or advise that the request for access is subject to an extension as authorized by PIPEDA.

To protect your privacy, you may be required to provide sufficient identification, in order to permit us to account for the existence, use and disclosure of certain personal information and to authorize access to such information. Any such information will only be used for this purpose.

We may not be able to provide personal information to you if doing so would violate the privacy of a third party or if certain personal information is subject to legal privilege, contains information proprietary to us or a third party, is too costly to retrieve, or cannot be disclosed for other legal reasons.  If we are unable to provide access to all or part of your personal information, we will explain our reasons for such a decision.

Where you have been provided with access to your personal information, you shall be able to challenge the accuracy and completeness of your personal information and have it amended as appropriate.

Personal information that is disclosed to third parties by us will be subject to the general laws applicable in the jurisdiction in which the third party conducts business. As a result, and in certain limited situations, we may not be legally permitted to account for certain collections, uses or disclosures of personal information. In most circumstances, however, we shall provide an account of the collection, use and disclosure of personal information and, where reasonably possible, we shall state the source of the personal information. In providing an account of disclosure, we shall provide a list of organizations to which we may have disclosed your personal information when it is not possible to provide an actual list.

14. Challenging Compliance with Privacy Laws

All questions or concerns regarding our privacy practices should be directed to the ITSC Privacy Officer.

We will notify affected individuals or the controller of the personal information in question about any privacy breaches in accordance with applicable privacy laws. We will investigate all complaints concerning compliance with this Privacy Policy and if a complaint is found to be justified, we will take appropriate measures to resolve the complaint including, if necessary, amending our privacy policies and procedures. We will also cooperate with supervisory authorities in accordance with applicable privacy law requirements.

You and ITSC have requested and agree that this Privacy Policy and all documents related to this Privacy Policy be drawn up in English. Les parties ont demandé que cette convention ainsi que tous les documents que s'y rattachent soient rédigés en anglais.

15. Contact Us

If you have any questions or concerns about this Privacy Policy or about ITSC's information handling practices, please contact us at:

Attn: Managing Director

secretariat@its-sci.ca

Please also visit the Office of the Privacy Commissioner of Canada’s website at https://www.priv.gc.ca/en/.