A. Introduction

1. At Candid Management Group Ltd (“Candid Management”), we are committed to collecting, using, and disclosing the information of individuals in an appropriate manner. We have developed this privacy policy (“Privacy Policy”) to be able to communicate our privacy practices to our employees, clients, those that we do business with, and members of the public.

2. This Privacy Policy is developed in compliance with British Columbia’s Personal Information Protection Act (“PIPA”). PIPA is British Columbia’s legislation that governs the collection, use, and disclosure of Personal Information. This Privacy Policy is available to the public.

3. We are also bound by our professional obligations under the Real Estate Services Act and the Real Estate Council Rules and we will be fulfilling our professional obligations under this legislative framework.

B. Definitions

1. “Personal Information” means information about an identifiable individual, such as the person’s name, home address, social insurance number, sex, income, or family status.

2. “Employee Personal Information” is information collected, used, or disclosed solely for the purposes reasonably required to establish, maintain, manage, or terminate an employment relationship between an employee (including a volunteer), and an organization. This may include information about the employee concerning their name, home address, educational history, and employment history. It does not include Contact Information or Work Product Information.

3. “Contact Information” means information that allows an individual to be contacted at work. It includes the name, position, name or title, business telephone number, business address, business e-mail, and business fax number for the individual. Contact Information is not included in the definition of “Personal Information”.

4. “Privacy Officer(s)” are the individual(s) primarily responsible at Candid Management to set policies with respect to the collection, use, and disclosure of Personal Information and the person(s) appointed to deal with any correspondence regarding it.

5. “Work Product Information” means information that is prepared or collected by an employee as part of that individual’s work responsibilities but does not include information about an individual who did not prepare or collect the information. Work Product Information is not included in the definition of “Personal Information”.

C. Organizations to Which the Policy Applies

1. This Privacy Policy pertains to Candid Management Group Ltd (“Candid Management”).

D. Why we Collect and use Personal Information

1. We collect, use, and disclose Personal Information in order to run our business and serve our clients. As strata agents, we collect, use, and disclose Personal Information necessary to fulfill our statutory and contractual obligations. This Personal Information may include, but is not limited to the following:

   • Names, addresses, and phone numbers;

   • Banking or credit card information;

   • Emergency contact information;

   • Names of family members living with an owner or occupying the strata lot;

   • Debts owed to the strata corporation by an owner; and

   • Debts owed to the strata corporation by an owner.

E. Limits on the Collection, Use, and Disclosure of Personal Information

1. It is our policy to only collect, use, and disclose Personal Information that is necessary to fulfill our purposes as a property management company. We will not collect, use, or disclose information except for the identified purposes unless we seek further consent from the individual or it is otherwise allowed by law.

2. If we retain another organization to do work for us that involves providing them with Personal Information, we will ensure that the other organization commits to providing services that adhere to this Privacy Policy.

3. We will disclose Personal Information where authorized to do so by PIPA and where required by law.

4. We will not sell or rent Personal Information to anyone.

F. How Candid Management obtains Consent to Collect, Use and Disclose Personal Information

1. We will obtain the consent of individuals to collect, use, or disclose their Personal Information, except when we are legally authorized or required by law to do so without consent.

2. Pursuant to section 12 of PIPA, we will collect, use, and/or disclose Personal Information without consent from the individual if:

   • Doing so is clearly in the interests of the individual and consent cannot be obtained in a timely way;

   • Doing so is necessary for the medical treatment of the individual and the individual is unable to give consent;

   • It is reasonable to expect that obtaining the consent of an individual would compromise the availability or the accuracy of the Personal Information and the collection is reasonable for an investigation or a proceeding, such as bylaw enforcement proceedings by a strata corporation;

   • It is necessary in order to collect a debt owing to Candid Management or one of its clients or for Candid Management or one of its clients to repay an individual money owed to them by Candid Management or one of its clients;

   • The Personal Information is available to the public from a source prescribed for the purposes of section 12 of PIPA;

   • The disclosure is made under an enactment of Canada or a province;

   • The disclosure is to a public body or a law enforcement agency in Canada, concerning an offence under the laws of Canada or a province, to assist in an investigation, or in the making of a decision to undertake an investigation to determine whether the offence has taken place, or to prepare for the laying of a charge or the prosecution of an offence;

   • There are reasonable grounds to believe that compelling circumstances exist that affect the health or safety of any individual and if notice of disclosure is mailed to the last known address of the individual to whom the Personal Information relates;

   • The disclosure is for the purpose of contacting next of kin or a friend of an injured, ill, or deceased individual;

   • The disclosure is to a lawyer who is representing Candid Management or one of its clients;

   • The disclosure is authorized by law; or

   • The collection, use, or disclosure of Personal Information was without consent, but allowed for under one of the exceptions under PIPA.

3. Candid Management may collect Personal Information on behalf of strata corporations and other clients without the consent of the individual to whom the Personal Information relates if:

   • The individual previously consented to the collection of the Personal Information by one of our clients, (including but not limited to a strata corporation); and

   • The Personal Information is disclosed to or collected by Candid Management solely

     • For the purpose for which the information was previously collected; and

     • To assist Candid Management carry out work on behalf of the other organization.

4. Individuals can consent orally, in writing, or electronically to the collection, use, and disclosure of their Personal Information.

5. Individuals are considered to have given implied consent when the purpose for us collecting, using, or disclosing Personal Information is obvious and the individual voluntarily provides Personal Information for that obvious purpose.

6. We will tell individuals the purpose for collecting Personal Information and give them a chance to refuse to give us their Personal Information or the chance to withdraw their consent later.

7. Individuals may withdraw their consent at any time by giving our organization reasonable notice. Individuals cannot withdraw consent when doing so will frustrate performance of a legal obligation, such as a contract between the individual and our organization. An example of frustrating legal performance would be an owner withdrawing use of their financial information when the strata corporation is involved in collection proceedings.

8. If an individual withdraws their consent for use of his or her Personal Information we will advise them of the likely consequences of withdrawing their consent. For instance, withdrawing consent to the use of emergency contact information would leave us unable to contact their relatives or friends in the event of an emergency.

G. Employee Information

1. With respect to Employee Personal Information, PIPA allows our organization to collect use or disclose employee Personal Information without consent if it is reasonable for the purposes of establishing, managing, or terminating an employment relationship between our organization and the individual.

2. Candid Management will not disclose Employee Personal Information without the consent of the individual except if the disclosure is reasonable for the purposes of establishing, managing, or terminating an employment relationship between Candid Management and the individual; or

   • Doing so is clearly in the interests of the individual and consent cannot be obtained in a timely way;

   • Doing so is necessary for the medical treatment of the individual and the individual is unable to give consent;

   • It is reasonable to expect that obtaining the consent of an individual would compromise the availability or the accuracy of the Personal Information and the collection is reasonable for an investigation or a proceeding, such as bylaw enforcement proceedings by a strata corporation;

   • It is necessary in order to collect a debt owing to Candid Management or one of its clients or for Candid Management or one of its clients to repay an individual money owed to them by Candid Management or one of its clients;

   • The Personal Information is available to the public from a source prescribed for the purposes of section 12 of PIPA;

   • The disclosure is made under an enactment of Canada or a province;

   • The disclosure is to a public body or a law enforcement agency in Canada, concerning an offence under the laws of Canada or a province, to assist in an investigation, or in the making of a decision to undertake an investigation to determine whether the offence has taken place, or to prepare for the laying of a charge or the prosecution of an offence;

   • There are reasonable grounds to believe that compelling circumstances exist that affect the health or safety of any individual and if notice of disclosure is mailed to the last known address of the individual to whom the Personal Information relates; and

   • The disclosure is necessary to determine the suitability of an employee to receive an honor, award, or similar benefit.

H. Transfer of Personal Information in the Sale of an Organization or its Business Assets

1. Candid Management may disclose Personal Information pursuant to section 20 of PIPA, regarding its employees, clients, customers, officers, and shareholders without their consent. This disclosure would take place if a business transaction is being considered or undertaken.

I. How long will Candid Management Retain Personal Information?

1. Candid Management will keep Personal Information used by Candid Management to make a decision that directly affects individuals for at least one year after Candid Management makes that decision.

2. Subject to the one-year retention requirement, Candid Management will only retain Personal Information for as long as necessary to fulfill a legal or business purpose. Candid Management takes instructions from its clients, such as strata corporations, when it is deciding how long to retain documentation on behalf of the client.

J. How we keep Personal Information Secure

1. Personal Information in Candid Management’s custody will be kept secure. We have security arrangements to prevent against risks such as unauthorized access, collection, use, disclosure, copying, modification, or disposal of Personal Information. The main ways that we keep Personal Information secure are as follows:

   • Locking file cabinets and offices;

   • Leaving a clean desk;

   • Allowing only authorized persons to access files;

   • Taking steps to ensure that portable storage devices, such as laptops, cannot be easily stolen;

   • Ensuring that email addresses used for business purposes are only accessible by the appropriate individuals;

   • Ensuring that confidential information is not left in a vehicle or gym locker where it can be easily stolen;

   • Ensuring that only the minimum number of people have access to certain documentation and only for a proper purpose (such as employee files);

   • Physically destroying memory storage devices or properly erasing them when destroying computers or other electronic devices;

   • Destroying information after it is no longer required;

   • Shredding papers; and

   • Ensuring that all third parties hired to collect, use, or disclose Personal Information are aware of and bound by Candid Management’s Privacy Policy.

2. We also take steps to keep Personal Information secure when it is being destroyed, including hiring a third-party company to remove and destroy confidential materials.

K. How we Ensure that Personal Information is Accurate and Request for Correction

1. We take reasonable steps to ensure that the Personal Information we collect, use, and disclose is accurate. At times, we may write to individuals to ask them to correct any errors or omissions in their Personal Information that is under Candid Management’s control.

2. Pursuant to section 24 of PIPA, an individual has the right to request that Candid Management correct an error or omission in his or her Personal Information if that Personal Information is about the same individual and in the control of Candid Management. If Candid Management is satisfied that an individual’s request for correction is reasonable, we will correct the Personal Information as soon as reasonably possible. Candid Management will, as soon as reasonably possible, send an individual’s corrected Personal Information to each organization it was disclosed to during the year before it was corrected.

3. If Candid Management does not correct an individual’s Personal Information, we will note the requested correction on copies of the Personal Information under our custody or control.

L. How we Provide Individuals with Access to Their Personal Information Under Our Control or Custody

1. Individuals have the right to access their Personal Information under our custody or control. A request for access must be made in writing. Candid Management may require individuals to prove their identity before giving them access to their Personal Information.

2. Candid Management, upon specific request, will give individuals their Personal Information under our control, information about the ways in which their information is or has been used, and the names of the individuals and organizations to which their Personal Information has been disclosed.

3. PIPA allows a minimal fee to be charged for the disclosure of information. Our fee for disclosure of information is $75.00 per hour of access, and/or 25 cents per page. These fees will not be charged for disclosure of Personal Information that we retain as the agent of a strata corporation. Fees charged for this disclosure will be charged pursuant to the strata corporation’s policy on same. We may require a deposit or payment in full of the minimal fee prior to providing access to the Personal Information.

4. Candid Management will provide the requested Personal Information within 30 business days after it is requested or will give the individual written notice if we need more time to respond.

5. In certain circumstances, in accordance with PIPA, our organization may refuse an individual access to his or her Personal Information. If we do refuse access to a request, we will tell the applicant why in writing, stating the reasons for Candid Management’s refusal and outlining further steps that are available to the applicant, including applying to Candid Management for an internal review of the decision and the right to ask the Office of the Information and Privacy Commissioner of British Columbia to review the decision.

M. How Individuals Can Ask Questions, Complain, or Ask for Access

1. Individuals can complain about Candid Management’s treatment of their Personal Information, how to ask for access to their own Personal Information and they can ask questions.

2. Candid Management’s Privacy Officer(s) can be reached by writing to the following e-mail address: info@candidgroup.ca

3. If individuals are not satisfied with Candid Management’s response, they can complain to the Office of the Information and Privacy Commissioner for British Columbia and request a review. There are time limits to request a review under PIPA and individuals wanting a review should seek legal advice.