Here are some of the specific ways we collect, use and share your information within CIBC or with CIBC Foreign Affiliates and other third parties:
Protecting you and CIBC, or where permitted by law
We collect, use and share information to protect you and your rights as well as to protect our rights and interests, including in the following circumstances:
- When we are involved in judicial, administrative or regulatory proceedings or investigations, or other similar processes.
- To enforce our rights, including to collect on a debt.
- To comply with legal and regulatory obligations, including:
- any subpoena, warrant, judicial or administrative orders, or valid demands or requests from governments, regulators, courts and law enforcement authorities in Canada or other jurisdictions or countries
- any rules, codes and guidelines that apply to our business, including expectations or guidance from regulators or self-regulatory organizations, or any codes, programs or principles we have publicly adopted.
- To investigate a breach of an agreement or law.
- To detect, suppress or prevent fraud. For example, when you apply for a product or service, or when we investigate a suspicious transaction, we may check for fraud by running your information through fraud databases used by CIBC and other organizations, such as other financial institutions, to detect, suppress and prevent fraud.
- To identify threats and risks such as credit, fraud and money laundering. This may involve reviewing and analyzing your applications, transactions and other information. We also may pool your information with data belonging to other individuals so we can analyze the combined data.
- To prevent you from becoming a victim of fraud, including by using or offering technologies that help us to:
- Protect you on CIBC Digital Channels. For example, we may use session cookies that make sure that your session is secure while you are signed on. Refer to “Cookies and other similar technologies” in section 7.
- Verify your identity when you apply for new products online or conduct high-risk transactions. For example, with your consent, we may use facial comparison technology to verify your identity online by comparing images of yourself and your identification document.
- Authenticate you when you call us. For example, you can use our optional voiceprint authentication system for better security when you speak with us. These voiceprints cannot be used to reconstruct your voice. For more details, visit our Voice Verification page.
- Authenticate you or your device when you sign on to online banking. For example, you can use your device’s authentication settings, such as face ID, to sign on more quickly to some of our mobile apps. If you choose to enable device-based authentication, we’re notified only of whether the authentication is successful. We don’t have access to the information your device collects to enable these settings.
We may also collect, use and share information without consent if we are allowed to do this under the laws that apply to us.
CIBC partner programs
We share information with our program partners, such as Aeroplan, Journie Rewards or Costco, to help decide if you are eligible for CIBC partner programs.
If you join a CIBC partner program, CIBC and the program m partner, will share information to administer, develop, manage and promote the program, including managing points or rewards, reporting on and analyzing the program’s performance, developing new benefits, products and services and doing market research.
If you withdraw your consent to this sharing, you may not be able to participate in the CIBC partner program, as the sharing may be necessary to receive the benefits and features of the program.
CIBC may provide you with a privacy notice that explains how your information is handled for a particular partner program.
Joint accounts, representatives and beneficiaries
When you share a product or service with another person, we may share your information with that person or their representative, which includes their estate representative, but only in connection with the product or service.
Shared products and services include:
- Joint accounts
- Products or services with added authorized users, such as a credit card
- Products or services with shared liability, such as a loan guaranteed by someone else
We may also share information with and take instructions from someone who has proper authorization to act as a representative for you, such as a legal guardian, person with power of attorney, estate representative, lawyer, accountant and, for minor children, parent or guardian. If representatives are jointly appointed, we share information as instructed by either representative.
Following your death, we may share your information with your beneficiaries or estate representatives where necessary to help administer your registered plans or insurance products, or your estate’s financial affairs.
If someone you hold an account with jointly dies, we may share information about the account with their representative, but only if the information was created or collected before the deceased joint account holder’s death.
Insurance
When we administer or sell insurance, we collect information on behalf of the insurance underwriter. We also share information with them as their service provider. We do this to help sell and administer the insurance, pay claims and resolve complaints.
When we are the insurance underwriter, we share information with people or organizations to provide you with insurance products and services, such as:
- Health care practitioners
- Medical facilities
- Insurance information bureaus
When we make an agreement with a reinsurer to manage our risk, we share information with the reinsurer. We require the reinsurer to keep this information confidential and limit its use to the purpose of reinsurance.
Business transactions
If we enter into a business transaction involving personal information or are considering one, such as selling or securitizing assets, we may share information with the other organizations or people involved in the transaction. For example, we may share information so a purchaser can do their due diligence before the transaction. We may also share information when the transaction is completed. These other parties must keep this information confidential and limit its use to the purposes of the transaction.
When we buy information as part of a business transaction, this policy applies to our collection, use and sharing of the information, which may include information we continue to hold after the end of your relationship with us. If we sell assets, the purchaser may be allowed or required by law to keep some personal information for a defined length of time.
Credit bureaus
When you apply for a product that creates credit risk for CIBC, we run a credit check and exchange your information with credit bureaus. We continue to exchange information with them for as long as you hold the product and for a reasonable time after you close the product. We do this to assess your application, verify your identity and your creditworthiness, qualify you for products and services, protect against fraud and manage our risks. We may also validate your information with a credit bureau to verify your identity and protect against fraud. Other financial institutions also exchange information with credit bureaus in this way.
Products that create credit risk include:
- Credit cards
- Loans
- Lines of credit
- Mortgages
- Deposit accounts with overdraft protection, or hold or withdrawal limits
The information we collect from credit bureaus may include information about your current and past credit accounts such as type, amount, payment history, debt collections, legal proceedings, or other information that the credit bureau has collected from your other lenders.
We may also periodically share credit, financial and other information about you with credit bureaus to help maintain the accuracy and integrity of the credit reporting system. The credit bureau incorporates the personal information we send them into its consumer reporting database. They then use the information to maintain the database and as permitted or required by applicable laws, which may include sharing this information with third parties.
If you consent to us giving your Social Insurance Number (SIN) to credit bureaus, the credit bureaus may use it to update their consumer reporting database and to help them match and verify future credit bureau requests.
We may also validate your information with a credit bureau to verify your identity, protect against fraud or to help us maintain accurate and up to date information about you where necessary.
We may exchange information about you, as described in this policy, with the following credit bureaus:
TransUnion Opens in a new window.
3115 Harvester Road
Burlington, ON
L7N 3N8
Equifax Opens in a new window.
National Consumer Relations
Box 190
Montreal, Quebec
H1S 2Z2
De-identification and analytics
We may de-identify your information by removing information that identifies you, such as your name, address, and account numbers. We may then combine this information with other information and use it for internal business purposes, such as:
- Analysis and reporting
- Developing and improving our products and services
- Understanding and predicting client needs and preferences
- Preventing and detecting fraud
- Identifying trends such as purchasing patterns or fraud trends
- Enhancing our marketing.
Refer to “Provide you with value” in section 5.
Automated decisions
We may use automated processes to make decisions using your personal information. These automated processes allow us to respond to your requests promptly and accurately, and to make informed, personalized decisions based on your unique needs and circumstances. For example:
- When you apply for a credit product, we may use automated credit adjudication tools to make a real-time decision on whether to approve your application, making the application process faster.
- We may also use automated credit adjudication tools to provide you with pre-approved credit limit increases.
If you have any questions about automated decisions, or if you would like to raise a concern about a particular decision that affects you, contact us using the information in section 12 What if you have a privacy concern?”.
Cookies and similar technologies
A cookie is a file with a unique identifier stored by a web browser. Cookies can be used to record your internet browsing activity and to personalize your online experience when you search for information. Tracking pixels can also be used to check if you have accessed content, monitor web traffic and provide metrics similar to cookies. Below, we describe how we use cookies and similar technologies. For information on how to manage your preferences for our use of these technologies, refer to section 10 “What are your privacy rights”.
Persistent cookies
We use persistent cookies to measure site and mobile app usage, including browsing behaviour. We do this to improve how our sites work and to measure the effectiveness of our sites, communications and promotional offers. For example, we use persistent cookies to track the CIBC web and mobile pages you visit, which CIBC online marketing ads you click and your response rate, and the keywords you searched to find our site. If the CIBC ad is on a third-party site, we may collect the address of the site where you click the ad, but we don’t track or create a profile of your activity on third-party sites.
We also use persistent cookies to save your CIBC digital banking personal preferences. You must allow persistent cookies if you want your browser to remember your preferences such as card number, language or default home page each time you sign on.
Session cookies
Software applications, such as videos, may create cookies to store configuration information on your computer. These cookies allow you to view videos or other rich media on our sites. Some of our online tools, such as mortgage calculators, use cookies to save the information you enter, such as mortgage amount and interest rate, so you don’t have to re-enter this information each time you use the tool.
Location information
We may collect general location information, such as the city you’re in, from the IP address of your browser or mobile device. We may also collect more specific location information, such as your GPS location, from your browser or mobile device if you allow your device to share this data. We use location information to personalize and improve your user experience — for example, helping you find the nearest banking centre, or offering travel tools if you leave Canada. We also use location information to protect you against fraud, for marketing, or to offer products and services. Refer to “Location information” in section 11.