Canada Privacy Policy

General

Kroll Consulting Canada Co. (“KCC”) is committed to maintaining the privacy of personal information collected by us in connection with our services. This Privacy Policy covers the personal information handling practices of KCC and describes the principles KCC follows with regard to personal information collected, used, and disclosed in connection with our provision of our services. All KCC personnel are obliged to adhere to the provisions of the Privacy Policy.

Personal information that KCC handles is subject to the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”). This Policy adopts the definition of personal information as set out in PIPEDA and is summarized as: any information about a reasonably identifiable individual, with the exception of business card information such as name, title, business address, and business telephone number.

Collection of Personal Information

KCC only collects personal information for the purposes of providing its services. KCC collects personal information in accordance with the law. Generally, KCC collects personal information directly from the individuals to which it relates. Such collection may be done at the start of our relationship with a client or during the course of our representation or retainer.

KCC may collect information about individuals from other sources including, for example:

• a government agency or registry;
• other professionals who serve our clients;
• information contained in publicly available sources;
• other parties or witnesses in the context of investigation or litigation files; or
• other parties or participants to a commercial transaction.

Personal information is collected for the purpose of processing and collecting payment for services rendered. Please see our website Privacy Policy for information about additional ways that we may use personal information collected via our website. KCC does not collect personal information for the purpose of marketing to clients/customers.

Consent

Before KCC engages in collection, use and/or disclosure of personal information, it obtains consent from the individual to which the personal information pertains, except if the information is publicly available, and/or as may be permitted or required by law. In some cases, written express consent is obtained, and, in other cases, consent may be implied or obtained orally (such as when a customer calls and asks about the status of a certain request).

In keeping with the principles set out in PIPEDA, and as a general rule for readers of this Policy, KCC determines the level of consent (written versus oral, and express versus implied) needed based on the sensitivity of the personal information at issue — the more sensitive the personal information, the more likely that the consent will be obtained on an express written basisConsent may, at any time, be withdrawn or varied. KCC requires that a request for withdrawal or variation of consent be provided in writing to KCC’s Privacy Officer.

As an internationally recognized provider of specialized services, KCC works with its related companies and uses some of the advanced information storage measures made available though Kroll, Inc. and its affiliates and service providers. In doing so, personal information may be transferred outside of Canada to be processed, stored, or maintained, including in the United States. Personal information transferred outside of Canada is subject to the laws of the receiving jurisdiction, including laws relating to disclosure of personal information.

Use, Disclosure and Retention of Personal Information

KCC does not use or disclose personal information for purposes other than those for which it was collected, except:

• with the express consent of individual;
• as required by a lawful order, subpoena, warrant or other request for disclosure;
• as may be required by law;
• in order to comply with the requirements of any regulatory body that governs any of our professional practices;
• when the services we are providing requires us to give a client's personal information to third parties — in such case, his or her consent will be implied, unless he or she tells us otherwise;
• where it is necessary to collect fees or disbursements;
• to anyone we reasonably believe is an agent of a client;
• where the disclosure is to a purchaser or prospective purchaser of all or a part of Kroll’s business;
• if we engage a third party to provide administrative services to us (such as computer back-up services, data processing, archival file storage, or insurance) and the third party is bound by privacy obligations that are consistent with this Policy; or
• if we retain other professional firms on behalf of a client that require disclosure of personal information.

In addition, where KCC is acting in the capacity of an investigative body, KCC may collect, use and disclose personal information when the disclosure is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada, a province or a foreign jurisdiction.

KCC only retains personal information for as long as reasonably necessary to fulfil the purposes for which it was collected and to comply with its legal and regulatory obligations

Accuracy

Personal information will be as accurate, complete and up-to-date as is reasonably possible and as is necessary for the purposes for which it is to be used. Although we acknowledge the importance of having accurate personal information, Kroll does not vouch for, and is not responsible for, the accuracy of personal information that may be supplied by third party sources of information.

Access

Pursuant to PIPEDA, and subject to certain exceptions, individuals may seek to access their personal information that is in the custody or control of KCC. To obtain access, an individual must submit a written request to KCC’s Privacy Officer setting out sufficient detail to enable, with reasonable effort, the identification of the personal information pertaining to such written request.

Minimal fees may be imposed to process the access request. If information is withheld, KCC will communicate its reasons for doing so.

Security

KCC uses physical, organizational, technological and other measures to to keep personal information secure from unauthorized access. KCC maintains secure office premises and work environments conducive to private discussions and enforces confidentiality obligations that are communicated and agreed to by all KCC employees. For information about personal information provided through our website, please consult our website Privacy Policy.

Accountability

KCC has appointed a Privacy Officer who is responsible for ensuring KCC’s compliance with the requirements of these privacy principles and applicable privacy laws. Should you have any questions regarding this Policy or concerns with respect to KCC’s compliance with these privacy principles and applicable privacy laws, please submit inquiries, in writing, to KCC’s Privacy Officer at 70 University Avenue, Suite 200, Mailbox 9, Toronto, ON, M5J 2M4, or via email at [email protected].

Changes to this Policy

We may amend this Policy at any time. We will post the Policy as amended on our website and will take reasonable steps to inform you of any amendments. We will obtain the necessary consents required under applicable privacy laws if we seek to collect, use or disclose your personal information for purposes other than those to which consent has been obtained unless otherwise required or permitted by law.