CIBC Privacy Policy

Your Privacy is Protected: Client Privacy Policy - Canada

Effective January 1, 2008

TABLE OF CONTENTS

1. Your Privacy Is Protected
2. Our Privacy Principles
3. Identifying Purposes and Obtaining Your Consent (Part 1)
4. Limiting the Collection, Use and Disclosure of Your Information (Part 2)
5. Keeping Your Information Accurate and Providing Access to Your Information (Part 3)
6. Protecting Your Information (Part 4)
7. Addressing Your Concerns (Part 5)
8. Important Terms Used in this Policy

Your Privacy Is Protected

At CIBC, an important part of our commitment to you is respect for your right to privacy. Keeping your information and affairs in strict confidence is a cornerstone of our business and an integral part of our commitment to service excellence.

This policy will help you better understand how CIBC protects, collects, uses and discloses your personal information and your right to access your information. This policy applies to CIBC's clients (including potential clients) in Canada. To understand the meaning of "personal information" and other terms used throughout this policy, please refer to the Important Terms section.

Copies of this policy are available in our branches and online under the Privacy & Security section of www.cibc.com. CIBC may amend this policy from time to time. For the most up to date version, please visit www.cibc.com.

Back to top

Our Privacy Principles

CIBC respects the following principles when collecting, using, disclosing and protecting your personal information.

1. Identifying Purposes and Obtaining Your Consent
• We identify the purposes for collecting personal information at or before the time it is collected.
• We obtain your consent before collecting, using or disclosing personal information, except where permitted or required by law.
2. Limiting the Collection, Use and Disclosure of Your Information
• We limit the personal information we collect to what is necessary for the purposes we have identified. We collect information only by fair and lawful means.
• We do not use or disclose personal information for purposes other than those for which it was collected, except with your consent, or where permitted or required by law. We retain personal information only as long as necessary for these purposes.
Keeping Your Information Accurate and Providing Access to Your Information
• We take care to keep personal information as accurate, complete and up-to-date as is necessary for the purposes for which it is to be used.
• Upon request, we provide you with access to your personal information. You can ask how your information is used or disclosed, can ensure it is accurate and complete, and can update it if necessary.
Protecting Your Information
• We safeguard the privacy of personal information through security measures appropriate to the sensitivity of the information.
5. Addressing Your Concerns
• We are responsible for personal information under our control. There are designated individuals within CIBC who are accountable for compliance with these privacy principles.
• We make available to you, information about our policies and practices related to managing your personal information.
• We address your concerns. We have steps you can follow if you have questions or concerns about your privacy.

Back to top

Identifying Purposes and Obtaining Your Consent (Part 1)

We identify why we collect personal information and how we use it

We collect, use and disclose personal information about you throughout our relationship so we can:

• establish your identity
• protect you and us from error and fraud
• understand your needs and eligibility for products and services
• recommend particular products and services to meet your needs
• provide ongoing service
• comply with legal and regulatory requirements

If we need your information for any other purpose, we will identify that purpose. We obtain most of your personal information directly from you and through the products and services you use. Some information may be obtained from other sources. For example, with your consent, we may verify some of the information you give us with your employer or your references. Generally, when we obtain information from someone other than you, such as a credit bureau, we record the source of that information.

We may review and analyze your applications, transactions and other personal information. We may do this to offer solutions that help meet your needs, and to develop new products and strategies to meet the needs of our clients. We may also do this to help us identify various types of risks such as credit, fraud, and money laundering.

We may monitor and record telephone calls
We may monitor and record telephone calls between you and our representatives to ensure service quality and security and to confirm our discussions with you.

Your information is collected, used or disclosed with your consent
When you apply for a product or service, we tell you about this policy and will obtain your consent. Depending on the product or service, this allows us to:

• check your employment
• obtain a credit report and exchange information with a credit bureau
• offer you other products and services
• send you information about products and services by means of direct marketing
• share your information in confidence within the CIBC group (provided it is legally permitted)
• obtain your information from, or disclose your information to, others that we tell you about

If you have a product or service where ownership or liability is shared with others (for example, you have a joint account or you have a guarantor for your loan), we may share your information with them in connection with the product or service. Also, if you authorize us, we may provide your information to your lawyer, accountant, or others you've identified. Except as explained in "There are exceptions to obtaining consent" under Part 2 of this policy, we don't disclose information about you to anyone outside of the CIBC group without your consent. Similarly, if we intend to use your information for a purpose we didn't tell you about previously, we will obtain your consent.

There are many ways we may obtain your consent
We may obtain your express consent in writing, through electronic means, or verbally.
Alternatively, your consent may be implied through an action you've taken or when you continue to use a product or service after we've notified you of a change. In some cases, we are required by law to obtain your express consent, in which case we ensure that we do so.

Examples of express consent:

• Written -
  You may sign an application that states "I agree to the Terms on the reverse."
• Electronic -
  You may be asked to electronically acknowledge that you will be bound by legal terms or agree to certain statements. Clicking "I Agree" is your electronic consent.
• Verbal -
  A CIBC representative asks whether you agree to us obtaining your credit bureau information. Saying you agree is your verbal consent.

Example of implied consent:

• Action you've taken - If you have a Visa* card and we inform you about revised conditions for the card, we can conclude that you agree to those conditions if you choose to continue using the Visa card.

Common consents and your options
There are several common consents that may apply in your relationship with us. They are described below to help you understand when you can refuse or withdraw your consent and when this right is limited.

Refusing or withdrawing your consent will generally not affect your eligibility for CIBC offers. However, if you refuse or withdraw your consent, we may not be able to provide you with a particular product or service. We'll explain the impact on you at the time, to help you with your decision.

You can choose not to receive direct marketing
From time to time, we may offer you products and services - including special promotions - that we believe will be of interest to you through direct mail, telephone, e-mail or other means. This consent is optional and you can decide to withdraw it at any time. If you withdraw your consent to receive direct marketing, this will not limit the information provided to you through discussions with a CIBC representative or information we may send you that is permitted or required by law or related to your existing products or services.

We share information within the CIBC group
We may share information about you within the CIBC group for legal and regulatory purposes, to manage credit risk and other business risks, and to ensure we have correct and up to date information about you, such as your current address, date of birth, etc. You may not withdraw consent for this sharing.

We may also share your information to better manage your total relationship with the CIBC group and enable other members of the CIBC group to bring suitable products and services to your attention, such as mutual funds and brokerage accounts. CIBC will share your information within the CIBC group for these purposes unless prohibited by law or you tell us not to.

We ask for your consent before using your Social Insurance Number
We are required by tax law to ask for your Social Insurance Number (SIN) when you open an account that earns income.

When we obtain a report and update your information with a credit bureau, your SIN is the best way to make sure that the information actually refers to you. Wrong information could lead us to draw wrong conclusions about you. You should be aware, though, that permitting us to use your SIN in this way is voluntary for you.

If you choose not to give us your SIN when its collection is optional, or tell us you do not want us to use it for credit bureau purposes, this by itself will not prevent you from getting any products or services.

We may exchange information with credit bureaus
When you apply for certain products and services, we obtain your consent to exchange information about you with credit bureaus. In order to maintain the integrity of the credit reporting system, we may periodically update your information with credit bureaus as long as you have the product or service with us and for a period of time afterwards. Your consent to the exchange of information cannot be withdrawn during that time.

We may share information with program partners
We may share information when product benefits are provided by others and are an automatic benefit of the product. For example, when you use a product or service with an affinity program such as Aeroplan®, we will share your information with the program partner, as this is necessary to administer the program. This also applies where a product has automatic insurance or other benefits such as Purchase Security/Guard & Extended Warranty on certain Visa cards. If you withdraw your consent for this sharing, we cannot provide you with the product.

To withdraw your consent:

• contact the branch or office where your account is held,
• talk to your CIBC representative, or
• If you are a CIBC banking client, call us at 1 800 465-CIBC (2422). For other CIBC clients, (e.g. clients of CIBC Private Investment Counsel or CIBC Wood Gundy), contact the branch or office where your account is administered.

When you withdraw your consent, we will update your file as quickly as possible. It may take some time for our records to reflect your choice as many records can only be changed during regular file updates and your choice may not be captured for a promotion already in progress.

Back to top

Limiting the Collection, Use and Disclosure of Your Information (Part 2)

We limit the personal information we collect
While we collect various types of personal information from you and other sources, we limit the information to what is necessary for the purposes we've identified.

The information we ask for depends on the product or service requested. For example, we may ask you different questions depending on whether you apply for a bank account, an investment product or lending product. As well, we may need to ask new questions because of changes in legal and regulatory requirements.

Types of personal information we collect
Here are some examples of information we are required to collect to provide our products and services:

"Know your client" information:
We require information to meet our various "know your client" legal and regulatory requirements. For example, we need your name, address, birth date, occupation, citizenship and identification for many products and services to meet anti-money laundering requirements. We may also be required to ask for information on how you use our products or services. In addition, for certain types of investment products and services, we are required to collect information about your investment profile, including your objectives, risk tolerance and investment knowledge.

Financial information:
We require financial information to assess your eligibility for products and services, and to assess credit and other limits, for example, access to deposited funds or ABM withdrawals. We also require it to ensure that the advice, products and services offered to you and the investments purchased by you (or by us on your behalf, in the case of mutual funds or brokerage investments) are appropriate for you. Financial information may include account records, tax returns, financial statements, employment income and credit information.

Social Insurance Number:
The Income Tax Act of Canada requires us to ask for your SIN when opening an account that earns income.

Health information:
Health information is required to confirm you are eligible for some insurance products offered through certain members of the CIBC group. We will not refuse you any product or service, other than insurance, on the basis of the health information you have given us. We will not share your health information within the CIBC group, other than to administer the insurance product.

Using, disclosing and retaining your personal information
We do not use or disclose personal information for purposes other than those for which it was collected, except with your consent, or as described below. We retain personal information only as long as necessary for these purposes.

There are exceptions to obtaining consent
There are exceptions where we may collect, use or disclose information without consent:

1. If we use an outside supplier to do work for us.
   At times we may use outside suppliers to do work for us involving some of your information. For example, we may use suppliers to print statements and chequebooks, conduct telemarketing, collect accounts or process transactions on our behalf. We select suppliers carefully and insist they have privacy and security standards that meet CIBC's strict requirements. Similarly, your payment transactions will be processed through payment systems or networks operated by others such as Visa, the Interac Association, or the Canadian Payments Association. We may share your information with these operators on a confidential basis to process transactions, provide customer service, promote the service and for other reasonable purposes.
2. If we are permitted or required by law.
   We may be compelled to release information by a court or other legal or regulatory authority. If so, our policy is to release information only to the extent that we are required to do so. We may also collect, use or disclose information without consent where permitted by law. For example, we may collect and use publicly available information like information in the telephone book for marketing or customer service purposes. Further, for legal, medical or security reasons, it may be impossible or impractical for us to obtain your consent.
3. If we have to protect the interests of CIBC.
   In certain circumstances, CIBC may have to collect, use or release information without consent for its protection. For example, we may do so when returning a cheque for "Non Sufficient Funds," when collecting an overdue account, when realizing on security pledged for a loan, or to detect or prevent fraud. If we cannot locate you, we may obtain contact information from other sources, including motor vehicle registries.

We may share information for business transactions
From time to time, we may sell parts of our business, sell or securitize assets, or merge or amalgamate parts of our business with other parties. Since client and account information will normally be a part of the transaction, we may disclose this information to other parties in the transaction, as part of due diligence and on completion of the transaction. We require that the other parties keep this information confidential and limit its use to the purposes of the transaction.

Information may be located outside of Canada
CIBC, its outside suppliers and other third parties to whom we disclose information under this policy (such as credit bureaus) may perform activities outside of Canada. As a result, your information may be securely used, stored or accessed in other countries and may be subject to the laws of those countries. For example, information may be disclosed in response to valid demands or requests from government authorities, courts, or law enforcement in these countries.

We retain your information
The length of time we keep your information will vary depending on the product or service and the nature of the personal information. We have retention standards that meet customer service, legal and regulatory needs. For these reasons, we may keep your information beyond the end of your relationship with us.

When your information is no longer required, we securely destroy it or delete personally identifiable information.

Back to top

Keeping Your Information Accurate and Providing Access to Your Information (Part 3)

We work with you to keep your information accurate
We take care to keep the information in our records as accurate, complete and up to date as necessary for the purposes for which it is used. However, we also rely on you to tell us when your personal information changes.

It is important to ensure your personal information at CIBC is accurate and complete. This allows us to continue to offer the highest quality service and to suggest products and services that best meet your needs.

To update your address and other personal information:

• contact the branch or office where your account is held,
• talk to your CIBC representative,
• sign on to CIBC Online Banking (where available) and edit your information under Customer Services, or
• If you are a CIBC banking client, call us at 1 800 465-CIBC (2422). For other CIBC clients, (e.g. clients of CIBC Private Investment Counsel or CIBC Wood Gundy), contact the branch or office where your account is administered.

You can access your information
Much of your personal information is available to you through your account statements or passbook updates, by visiting the branch or office you deal with, or by accessing your account online, or through Telephone Banking.

If you require other information, please request this by contacting the branch or office you deal with. We will ask that you put your access request in writing (usually, by completing a form) and that you provide us with details to help us understand your request and conduct our search for your information. We will need you to verify your identity before searching for or providing you with access to your information. We will respond to your access request within 30 days upon receiving all necessary information, or advise you in writing if we require additional time.

We may charge a fee to provide access to your information. We will let you know in advance if there is a charge.

If you have a sensory disability you may request your information to be made available in an alternative format. If we already have that format, we will provide it. Otherwise we will convert the information into the requested format if it is reasonable and necessary under legislation to enable access.

There may be limits on your right to access your information
It may not be appropriate for us to release certain types of information to you. For example, our records may contain information about other clients, information that is confidential or proprietary to CIBC, or information that is subject to legal privilege. Because we must protect everyone's confidentiality and legal rights, we cannot make this information available to you. However, where possible, we will suppress this information and provide you with access to the remaining records.

If we are unable to provide access or disclose information to you, we will explain why, subject to any legal or regulatory restrictions.

Your information and other parties
If we have obtained information about you from others, you can ask us for the source of that information.

On request, and where legally permitted, we'll provide you with the names of outside companies or organizations to whom we've given or may have given your personal information. However, this won't include outside suppliers we've used to do work for us, such as printing chequebooks, conducting telemarketing, or processing information for us. This also won't include reports to the Canada Revenue Agency, particulars of cheques returned for the reason "Non Sufficient Funds" or information that has been provided for legal or regulatory reasons.

You can have your information corrected
If you tell us that we have information about you that is obsolete or incorrect, we will update our records with the proper information. When appropriate, we'll correct any information which we may have given to an outside organization.

Accessing and correcting credit reports
If you request access to a credit report we obtained about you from a credit bureau, we will give you a copy if we still have it on file. We will provide you with the name and address of the credit bureau we used. They will have the most current information and they can provide you with information on how to read the report. You have the right to access and correct the credit report directly with the credit bureau.

Back to top

Protecting Your Information (Part 4)

How we protect your information
We limit access to your personal information and store it securely. Depending on the nature of the information, it may be stored in the branch or office you deal with, in various secure computer systems, or the record storage facilities of CIBC or our outside suppliers.

In addition to the physical and electronic security devices we use to protect your information, we have security standards to protect our computer systems and your information from unauthorized use or access.

Our systems also protect your information when it is electronically transmitted, for example, between our data processing centres, a branch or office you deal with or banking machines. We regularly audit our information security procedures and assess that they remain effective and appropriate.

Employees who have access to your information are made aware of how to keep it confidential. Each employee must sign an agreement stating that maintaining confidentiality is a condition of employment with CIBC. Also, each year employees undergo a review of our Code of Conduct and certify they will abide by CIBC's ethical and professional standards including the obligation of confidentiality and privacy.

We use contracts and other measures with our outside suppliers to maintain the confidentiality and security of your personal information and to prevent it from being used for any unauthorized purpose.

Access to your personal information is only given to those who require it to provide our products or services, or where permitted or required by law.

How you can protect your privacy

There are some simple yet very important steps you can take to protect your privacy:

Notify a CIBC branch, CIBC Telephone Banking at 1 800 465-CIBC (2422) or the branch or office where your account is held immediately if:

• your Convenience Card®1 or Visa card is lost, stolen or retained by a bank machine
• you believe someone has obtained your card number, PIN, password or answers to online personal verification questions
• you believe your personal or financial information has been compromised
• you believe you have been the victim of identity theft, or that someone is using your personal information fraudulently

Protect your PIN, Passwords and Online Personal Verification Answers
Your Personal Identification Number (PIN), passwords, and personal verification answers for online and telephone banking are the keys to your accounts. You are the only person who should know them.

Never disclose your current PIN, passwords or answers to online personal verification questions to anyone, or you could be liable for losses. No CIBC employee or agent will ever ask you verbally or through e-mail for this information. However, when using Telephone Banking, we may ask for a predetermined security word to identify you. When you conduct transactions at a bank machine or at a point-of-sale, use your hand or body to shield the keypad from onlookers.

Regularly monitor your account activities
Promptly check your statements or passbook to verify all transactions have been properly recorded. If entries do not accurately reflect your transaction activities (e.g. if there are missing or additional transactions), contact CIBC immediately.

Ensure your contact information is up-to-date
Making sure that CIBC has your most up-to-date address or contact information will help protect your personal information from being misdirected. In "We work with you to keep your information accurate" under Part 3 of this policy, we explain how to check and update your personal information.

Protect your privacy online
To protect your privacy online, you should clear your browser's cache after each session, use a firewall, and use up to date software to protect your computer from viruses and spyware. For details, see the Privacy & Security section of www.cibc.com.

As online privacy measures continue to evolve, we update the information in the Privacy & Security section of our web site. You'll find answers there to common questions about online security software, phishing and online fraud, web site activity (including cookies) and other steps you can take to protect yourself online.

Reduce your risk of identity theft:

• shred documents that contain personal or financial information before you throw them out
• request a copy of your credit bureau report periodically
• visit www.safecanada.ca and look for more identity theft information under the "Financial Safety" section
• don't give out personal information over the phone unless you have initiated the call or know who you are dealing with

If you receive a suspicious phone call, e-mail or letter, contact us.
If you think someone is impersonating CIBC, or believe you have been the victim of a fraud or attempted fraud through telephone, mail or e-mail, call CIBC Telephone Banking at 1 800 465-CIBC (2422) or e-mail

Back to top

Addressing Your Concerns (Part 5)

We are accountable for our compliance with this policy
We have procedures in place to assist our employees in complying with this policy, as well as the federal Personal Information Protection and Electronic Documents Act and applicable provincial privacy legislation.

We regularly monitor our procedures and security measures to ensure that they remain effective and that they are being properly administered. Our Privacy Office and Chief Privacy Officer are accountable for overseeing compliance with this policy.

If you have any questions about our policies and practices related to managing you personal information that have not been answered in this policy, please let us know so that we may provide further information.

Resolving your concerns is important to us
CIBC is committed to treating you with the greatest respect and consideration and providing the highest level of service. Even so, there may be a misunderstanding or times where you may feel you have been dealt with unjustly. Whatever the circumstances, our primary objective is ensuring your concerns are addressed.

How to resolve concerns and complaints at CIBC
We are committed to upholding this policy. If you have any questions or complaints about this policy or about how we are living up to this policy, let us know right away.

The following process applies to CIBC banking clients. For other CIBC clients, (e.g. clients of CIBC Private Investment Counsel or CIBC Wood Gundy), refer to the process provided to you when you opened your account, contact the branch or office where your account is administered, or speak to your CIBC representative.

Step 1: Talk to us
In most cases, a complaint or concern is resolved simply by talking to us about it. You should be able to get swift results by talking to a CIBC representative where you do business with us. You can speak with us in-branch or by calling Telephone Banking at 1 800 465-CIBC (2422).

Step 2: Call the CIBC Customer Care Centre
If the problem is not resolved to your satisfaction, you can contact the CIBC Customer Care Centre:
Telephone: 1 800 465-CALL (2255)
Fax: 1 877 861-7801
E-mail:

Write to: CIBC Customer Care
PO Box 70, Station T
Toronto, ON M6B 3Z9

Be sure to include:

• your name and contact information where you prefer to be reached
• the nature of your complaint
• details relevant to the matter and with whom you have already discussed the issue
  Please note: If you choose to send us an e-mail under Step 2 or Step 3, do not include sensitive information (for example, card or account numbers), as e-mail is not a secure method of communication.

Step 3: The CIBC Ombudsman
If your concerns have still not been resolved to your satisfaction, feel free to contact the CIBC Ombudsman:
Telephone: 1 800 308-6859 or (416) 861-3313 in Toronto
Fax: 1 800 308-6861 or (416) 980-3754 in Toronto
E-mail:

Write to: CIBC Ombudsman
P.O. Box 342
Commerce Court
Toronto, ON M5L 1G2

If you are not satisfied with the decision of CIBC's Ombudsman regarding your complaint
Should you not accept the conclusion of CIBC's Ombudsman, you can ask how your complaint can be further escalated.

If the above steps fail to resolve your concern you may also contact the Office of the Privacy Commissioner of Canada:
Place de Ville
112 Kent Street, 3rd Floor
Ottawa, ON
K1A 1H3
Call toll free at 1 800 282-1376
www.privcom.gc.ca

Back to top

Important Terms Used in This Policy

When reading this policy you should be aware of the meanings we give to the following terms.

When we refer to "personal information" or "information" it means information about an identifiable individual. This includes details such as your age, marital status, education, employment history, identification numbers, financial information and credit records. Personal information does not include most of the information that appears on a business card.

When we refer to "CIBC", "we", "our" or "us" it means each of Canadian Imperial Bank of Commerce and its subsidiaries that offer deposits, loans, mutual funds, securities trading, portfolio management, investment counseling, mortgages, credit cards, trust, insurance or other products and services. Together they are the "CIBC group". When we make reference to sharing information within the CIBC group it means disclosure by one member of the group to some or all of the others.

When we refer to "permitted or required by law", and "legal and regulatory" requirements, authority or restrictions, this includes law, regulation, rules or requests of the regulators or self-regulatory organizations which apply to CIBC (for example, the Office of the Superintendent of Financial Institutions or the Investment Dealers Association).

At CIBC, we are in the business to help our clients achieve what matters to them. Keeping your information and affairs in strict confidence is an integral part of our commitment to you.

Back to top

We hope this policy provides you with the information you need to understand our privacy practices.

Back to top

For more information
on client privacy
talk to a CIBC representative
visit your nearest branch
call 1 800 465-CIBC (2422)

"For what matters." is a TM of CIBC.
® Aeroplan is a registered trade-mark of Aeroplan LP. CIBC is an
authorized Licensee of the mark.
* Visa Int./CIBC licensed user.
®1 Registered TM of CIBC.

  Rates | Tools | FAQ | CDIC Deposit Insurance Information | Legal | Privacy & Security

Copyright® 2007 Canadian Imperial Bank of Commerce. All rights reserved.