InnPower's Privacy Policy
Protection of Privacy
InnPower is committed to maintaining the accuracy, confidentiality, security and privacy, of your personal information in accordance with the Canadian Standards Association (CSA) Model Code for the Protection of Personal Information. Furthermore, InnPower has created certain documents and procedures that align with the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA).
PRINCIPLE 1 – ACCOUNTABILITY
InnPower is accountable for all personal information in its possession or control and shall designate one or more persons who will be responsible for the company’s compliance with the following principles:
1.1 The President of InnPower has ultimate responsibility for the protection of personal information of customers. The President may delegate the day-to-day operational privacy responsibilities to another individual. All staff share responsibility for adhering to InnPower’s privacy policies and procedures.
1.2 InnPower has designated a Corporate Privacy Officer to oversee compliance with the InnPower Privacy Policy. InnPower shall provide, upon request, the name and contact information of the Corporate Privacy Officer.
1.3 InnPower is responsible for personal information in their possession or control, including any personal information that has been transferred to a third party for processing. InnPower will use contractual or other means to provide a comparable level of protection of personal information while such information is being processed by a third party.
1.4 InnPower shall implement policies and procedures to give effect to the InnPower Privacy Policy including:
a) implementing procedures to protect personal information and to oversee the company’s compliance with the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) as amended;
b) establishing procedures to receive and respond to inquiries or complaints with respect to an individual’s personal information; and
c) training staff and communicating to staff about the company’s privacy policies and practices.
PRINCIPLE 2 – IDENTIFYING PURPOSES
2.1 Identifying the purposes for which personal information is collected at or before the time of collection allows InnPower to determine the information needed to fulfill these purposes. InnPower collects personal information only for the following purposes: 4 a) to establish and maintain responsible commercial relationships with customers and to provide ongoing service; and b) to meet all of its legal and regulatory requirements.
2.2 InnPower shall specify, either orally, in writing or electronically, all identified purposes for the collection, use and disclosure of personal information to the customer at the time such personal information is collected.
2.3 Those responsible for collecting personal information should be able to explain to individuals the purposes for which the information is being collected. In certain circumstances, the customer may be referred to a designated person within InnPower who can explain those purposes in greater detail.
2.4 Unless required by law, InnPower shall not use or disclose, for any new purpose, personal information that has already been collected without first identifying and documenting the new purpose and obtaining the consent of the customer.
PRINCIPLE 3 –CONSENT
The knowledge and consent of a customer are required for the collection, use or disclosure of personal information, except where inappropriate.
3.1 In certain circumstances, personal information may be collected, used or disclosed without the knowledge and consent of the individual. For example, some legal, medical or security reasons may make it impossible or impractical to seek consent. InnPower may collect, use or disclose personal information without an individual’s knowledge or consent only in limited circumstances as permitted by law. InnPower may use or disclose personal information without the individual’s knowledge or consent if it is clearly in the individual’s best interests to do so and consent cannot be sought in a timely manner. An example of such circumstances is in the case of an emergency where the life, health or security of an individual is threatened.
3.2 This principle requires “knowledge and consent” of an individual for the collection, use or disclosure of their personal information. In obtaining consent, InnPower shall use reasonable efforts to ensure that a customer is advised of all the identified purposes for which personal information will be used or disclosed. These purposes shall be stated in a manner that can be reasonably understood by the customer.
3.3 Generally, InnPower shall seek an individual’s consent for use and disclosure of personal information before or when it collects, uses or discloses personal information. In certain circumstances, InnPower may seek an individual’s consent to use and disclose personal information after it has been collected but before it is used or disclosed for a purpose not previously identified.
3.4 InnPower may require customers to consent to the collection, use or disclosure of certain personal information in order to provide the individual with electricity services.
3.5 In determining an appropriate form of consent, InnPower shall take into account the sensitivity of the personal information and also the reasonable expectations of its customers with respect to the protection, collection, use and disclosure of their personal information.
3.6 A customer may refuse or withdraw consent at any time, subject to legal or contractual restrictions, and reasonable notice. Customers may contact InnPower for more information regarding the withdrawal of consent and any implications of such withdrawal.
PRINCIPLE 4 – LIMITING COLLECTION
InnPower shall limit the amount and type of personal information it collects to that which is necessary for the purposes identified by the company. InnPower shall collect personal information using procedures which are fair and lawful.
4.1 InnPower shall collect only the amount and type of information needed for the purposes documented by InnPower and identified to the individual.
4.2 The requirement that personal information be collected through fair and lawful means is intended to prevent InnPower from collecting information by misleading or deceiving individuals about the purposes for which the information is being collected.
PRINCIPLE 5 – LIMITING USE, DISCLOSURE AND RETENTION
InnPower shall not use or disclose personal information for purposes other than those for which it was collected, unless consent is given by the individual to use or disclose it for another purpose or as required by law. InnPower shall retain personal information only as long as necessary for the identified purposes.
5.1 If InnPower uses personal information for a new purpose, it will document this purpose.
5.2 With the consent of the customer, InnPower may disclose a customer’s personal information to the following:
a) an agent retained by InnPower in connection with the collection of the customer’s account;
b) credit grantors and reporting agencies;
c) a person who, in the reasonable judgment of InnPower, is seeking the information as an agent of the customer; and
d) any other third party or parties, where the customer has provided consent to such disclosure or disclosure as required by law.
5.3 InnPower shall maintain reasonable and systematic controls, schedules and practices for the protection of personal information. Record retention, which shall include minimum and maximum retention periods, and destruction shall apply to personal information. Information that is no longer necessary or relevant for the identified purposes for which it was collected or required by law to be retained shall be destroyed.
5.4 InnPower will keep personal information only as long as necessary for the identified purposes.
5.5 Personal information that is no longer required to fulfil the identified purposes will be destroyed, erased or made anonymous. InnPower will develop guidelines and implement procedures to govern the destruction of personal information.
5.6 Only those employees of InnPower who require access for business reasons or whose duties reasonably so require, are granted access to personal information about customers.
PRINCIPLE 6 – ACCURACY
InnPower will keep the Personal information in its possession or control accurate, complete current and relevant based on the most recent information provided to InnPower.
6.1 Personal information used by InnPower shall be sufficiently accurate, complete, current and relevant to minimize the possibility that inappropriate information may be used to make a decision about a customer.
6.2 InnPower shall update personal information about customers only if it is necessary for the purposes for which it was collected or upon notification by the individual requesting that their personal information be updated or amended.
PRINCIPLE 7 –SAFEGUARDS
InnPower shall protect personal information with security safeguards appropriate to the sensitivity of the information.
7.1 InnPower shall protect personal information from loss or theft, unauthorized access, disclosure, copying, use, modification or destruction through appropriate security measures. InnPower shall protect all personal information regardless of the format in which it is held.
7.2 The nature of the safeguards will vary depending on the sensitivity of the information, amount, distribution, format and the method of storage of the personal information. InnPower will give the highest level of protection to the most sensitive personal information.
7.3 The methods of protection should include:
- Physical security, such as locked filing cabinets and restricted access to offices;
- Organizational security, such as security clearances and limiting access on a “need to know” basis; and
- Password Standard Operating Procedure (SOP), as amended
- IT Security Policy , as amended
- Confidentiality Policy, as amended
7.4 InnPower will make all of its employees aware of the importance of maintaining the confidentiality of personal information.
PRINCIPLE 8 – OPENNESS
InnPower shall make readily available to customers specific information about its policies and practices relating to the management of personal information.
8.1 InnPower will be open about the policies and practices used to manage personal information. Individuals will have access to information about these policies and procedures. This information will be available in a format that is easy to understand.
8.2 InnPower shall make the following information about its privacy policies and practices available:
- the name, title and address of the Corporate Privacy Officer (or persons) accountable for InnPower’s privacy policies and practices and to whom inquiries or complaints can be forwarded;
- how to gain access to personal information held by InnPower;
- a description of the type of personal information held by InnPower including a general account of its use; and
- or other information that explains InnPower’s privacy policies, standards or codes.
8.3 InnPower may make information on its privacy policies and practices available in a variety of ways including online access.
PRINCIPLE 9 – INDIVIDUAL ACCESS
Upon request, an individual shall be informed of the existence, use, disclosure of his or her personal information in InnPower’s possession and shall be given access to that information. A customer shall be able to challenge the accuracy and completeness of the information and have it amended where necessary. In certain situations, InnPower may not be able to provide access to all the personal information it holds about an individual. However, such exceptions to the access requirement are limited and specific. Exceptions may include information that is prohibitively expensive to provide, information that contains references to other individuals and information that cannot be disclosed for legal, security or commercial proprietary reasons.
9.1 Upon request, InnPower shall inform an individual of the personal information that InnPower has in its possession or control about that individual.
9.2 Upon request, InnPower shall provide an account of the use and disclosure of such personal information and, where reasonable and possible, shall state the source of the information.
9.3 In order to safeguard personal information, a customer may be required to provide sufficient information to properly identify themselves to assure InnPower that they are providing information with respect to the existence, use and disclosure of personal information and authorizing access to an individual’s file to the right individual. Any information provided for identification purposes shall only be used for such purposes.
9.4 In providing a list of third parties that InnPower has disclosed personal information about a customer to, InnPower will provide as much information as possible to the customer. When it is not possible to provide a list of third parties to which it has actually disclosed information to about an individual, InnPower shall provide a list of third parties to which it may have disclosed information to about the individual.
9.5 InnPower shall promptly correct or complete any personal information found to be inaccurate or incomplete. Any unresolved differences as to accuracy or completeness shall be noted in the individual’s file. Where appropriate, InnPower may disclose or share with third parties who have access to such personal information any amended information and identify the existence of any unresolved differences.
PRINCIPLE 10 – CHALLENGING COMPLIANCE
A customer shall be able to challenge InnPower’s compliance with the above principles to the designated person or persons accountable for the compliance of the InnPower Privacy Policy.
10.1 InnPower shall maintain procedures for receiving, addressing and responding to all inquiries or complaints from its customers relating to its handling of personal information.
10.2 InnPower shall inform its customers about the existence of these procedures as well as the existence of complaint mechanisms.
10.3 The person or persons accountable for compliance with the InnPower Privacy Policy may seek external advice, where appropriate, before providing a final response to individual complaints.
10.4 InnPower shall investigate all complaints concerning compliance with the InnPower Privacy Policy. If a complaint is found to be justified, the company shall take appropriate measures to resolve the complaint including, if necessary, amending its privacy policies and procedures. A customer shall be informed of the outcome of the investigation regarding his or her complaint in a timely manner.
10.5 If individuals are not satisfied with the way InnPower has responded to their complaint, they can contact the Privacy Commissioner of Canada at 1-800-282-1376 (toll-free)
For more details on how we handle your personal information, please see InnPower’s Privacy Policy PDF