CIBC Canada Client Privacy Policy

To help you understand our privacy policy, here are some important terms you should know.

• “Personal information” or “information” means information about an identifiable individual, such as contact information, account numbers, age, marital status, financial information, biometric information, photographs and signatures. This can also include information collected through your activities on CIBC Digital Channels, such as your phone or computer model, browser type and IP address.
• “CIBC”, “we”, “our” or “us” means collectively Canadian Imperial Bank of Commerce and our Canadian group of companies that offer credit cards, deposit accounts, insurance, investment counselling, loans, mortgages, mutual funds, portfolio management, securities trading, trust services and other financial products and services, including Simplii Financial.
• “CIBC Digital Channels” means our websites, mobile apps, social media accounts, virtual assistant, chatbot and other digital channels.
• “CIBC Foreign Affiliates” means CIBC’s businesses, related companies, subsidiaries and branches of CIBC located outside of Canada, such as CIBC Bank USA.
• “Program partners” means companies we have carefully selected to provide benefits, products or services under, or to participate in, a CIBC partner program.
• “CIBC partner program” means a program that offers specific benefits, products or services provided by, or in participation with, our program partners, such as affinity rewards, loyalty points, travel or credit insurance, purchase or credit protection programs and retailer offers or coupons.

This policy, the privacy terms of your agreements with us, and the privacy notices we give you for certain products and services describe CIBC’s privacy practices. This policy applies to the collection, use and sharing of any personal information collected by CIBC while doing business in Canada. This policy explains how we handle and protect personal information, including information collected through CIBC Digital Channels. It also gives you information about your privacy rights and choices.

This policy does not apply to information that is not personal information. For example, information about a business or company is generally not considered personal information.

This policy applies for as long as CIBC holds your information, including after the end of our business relationship. By giving us your information, you consent to the collection, use and sharing of your information as described in this policy.

We may update this policy and our other privacy-related documents. Any changes we make to this policy take effect when we post the updated policy on our websites and any other channels where this policy appears. In some cases, we also notify you of changes we make to the policy in accordance with applicable law — for example, by posting a notice of the changes on our websites or using other appropriate ways to reach you. When you continue to use our products and services after we post the modified version of the policy, you accept the changes to the policy. The date at the top of this policy indicates when it was last updated.

The type of personal information we collect depends on various factors, such as the type of products or services you use or apply for, any applicable legal and regulatory obligations, and the channel you use to communicate with us.

This information includes:

• Contact information that we use to communicate with you, such as your address, telephone number, email or other electronic address, social media account username and fax number.
• Credit and other financial information from credit bureaus that we use as described under “Credit bureaus” in section 6.
• Identity information that we use to establish and verify your identity, including government-issued identification, utility bills, name, date of birth and occupation.
• Biometric information that enables technology to verify your identity. This information includes your unique physical and behavioural details, such as your facial features and voice patterns. For example, we may collect a digital profile of your voice known as a voiceprint that allows us to verify your identity when you call us.
• Tax Identification Numbers such as a Social Insurance Number (SIN) that we collect to comply with legal or regulatory obligations. For example, the Income Tax Act (Canada) requires us to collect your SIN when you open a product that earns income. We may also ask for your SIN to help us verify your identity and make sure we get accurate information from credit bureaus, but giving us your SIN for this purpose is optional. Refer to section 11 “What are your privacy choices?”.
• Financial information that we use to determine if you are eligible for products or services and whether they are appropriate for you. This includes information such as employment and financial history, income, net worth, credit reports, investment knowledge and objectives and details of security given for loans.
• Transaction information that tells us how you use products or services, such as your purchase and payment history.
• Health and lifestyle information that we use to assess whether you’re eligible for life and health insurance. We also use this information to calculate appropriate premium rates, administer the insurance and make decisions about claims. Health and lifestyle information may include family health history, personal activities, behaviours and lifestyle choices such as smoking, travel plans, hazardous sports and leisure activities. Because this information is sensitive, we never use and share your health and lifestyle information for marketing or loan assessment purposes.
• Information about other people, such as beneficiaries or insured spouses, common-law partners, or dependents covered by an insurance product or named in a registered plan. It could also be information about an authorized user of your account, or contact information for someone you believe may be interested in a CIBC product or service. If you give us information about another person, we assume that you have the right to give us their information, and that you got their consent for CIBC to collect, use and share their information for the purposes set out in this policy.
• Information collected when you use CIBC Digital Channels, including:
  • Profile information, such as your digital IDs, passwords, and service preference, such as your language choice.
  • Web browser information, such as the type of web browser you use — for example, Microsoft Edge, Chrome, Safari or Firefox. We may also collect the address of the site where you clicked on a CIBC ad.
  • Device information, such as device ID, model, operating system, notification status, privacy settings and other device configurations or settings. We may also collect your device’s IP address, which is a number automatically assigned to your computer or device when you browse the internet. Based on the IP address, we can identify the general location of the device. Some services may also involve access to information on your device. For example, you can allow us to access your contact list to make it easier to use Interac e-Transfer® banking services, or your camera to help you complete a remote cheque deposit on your mobile device. Some services may allow your device and your wearable device to communicate with a CIBC app, such as for Apple Watch®.
  • Location information, such as general location information based on your IP address and geolocation information from your browser or mobile device, if you have allowed your devices to share this data.
  • Other information collected through web technology tools, such as cookies and web beacons. For example, we may use these tools to collect information that shows us how you use CIBC Digital Channels. This information also shows us how many people click on CIBC advertisements on our websites and mobile apps, and on third-party websites.

• Other information you give us by various means, such as when you fill out forms or surveys, or contact us by telephone, email or through CIBC Digital Channels. This information may include feedback on our services, questions about technical support and other information that helps us respond to your questions, concerns or requests.
• Information about your preferences and interests, such as language and communication preferences, demographics and interests that help us learn more about you, including how you like to do business with us, and what types of products, services or offers you may like or be interested in.

Directly from you

We may collect personal information directly from you, including when you:

• Communicate with us
• Apply for a product or service with us
• Use our products and services
• Subscribe to our communications, such as newsletters
• Fill out forms on CIBC Digital Channels or in a CIBC Banking Centre
• Complete a research survey for CIBC
• Post content on or directed at, CIBC’s social media, such as photographs, comments or tags

From third parties or public sources

We may collect personal information from third parties or public sources. We do so with your consent or as permitted or required by law. For instance, we may collect personal information from third parties or public sources such as:

• Credit bureaus. Refer to “Credit bureaus” in section 7
• Government institutions or regulatory authorities
• Insurance information bureaus, to assess insurance risk
• Program partners. Refer to “CIBC partner programs” in section 7
• Public sources such as telephone directories, newspapers, commercially available marketing lists, government agencies and registries such as land or property registries or driver’s license offices, and other public records as permitted by law
• Other financial institutions — for example, to protect against fraud
• Other organizations involved in business transactions or strategic partnerships with CIBC
• Third party identity verification and authentication service providers
• References you provide

Using technology

We may collect information by using technologies that monitor or record your interactions with CIBC and CIBC Foreign Affiliates, including interactions through telephone, video and CIBC Digital Channels to:

• Maintain and improve our quality of service
• Protect you and CIBC from security threats and criminal activities
• Confirm our discussions with you
• Conduct quality assurance and coaching, such as a manager and an agent listening to a call together to identify improvement opportunities
• Prevent or detect fraud — for example, by analyzing how you use our online services to help authenticate you

We may also collect information using cookies, pixels and other similar technologies when you use CIBC Digital Channels. We do this to:

• Serve you and maintain the security and integrity of CIBC Digital Channels
• Measure and improve the use and functionality of CIBC Digital Channels
• Evaluate the effectiveness of our digital communications and promotions
• Personalize your experience based on your browsing behaviour, preferences and location information
• Save your personal preferences, such as language
• Remember the information you enter in online tools, such as mortgage calculators, so you don’t have to re-enter it the next time you use the tool

You can read more about cookies under “Cookies and similar technologies” in section 7.

We also use technologies such as video recording and other surveillance tools in and around our banking centres, bank machines, offices and other locations to:

• Maintain the safety of our clients, employees and others
• Protect against illegal activity, such as theft, vandalism and fraud
• Maintain and improve client service quality

Provide you with products or services

• Establish and confirm your identity and determine if you are eligible for products and services
• Make sure the advice, products and services we offer to you are appropriate for you
• Set up and manage your products and services

Communicate with you

• Send communications to you by postal mail, email, text message, telephone, automated dialing-announcing device, fax, other telecommunication channels, social media or other methods
• These communications include marketing or service communications about benefits, features or other details about products or services
• You can choose to stop receiving marketing communications from us. Refer to section 11 “What are your privacy choices”

Provide you with value

• Personalize your experience with us by analyzing data. This includes reviewing and analyzing your product and service applications, transactions, and other information to:
  • Understand who you are, your financial needs and activities, and the products, services, promotions, offers and advice that may be of interest to you
  • Predict or generate insights about your banking needs and preferences
  • Find out if you are eligible for incentives, such as bonus interest, fee waivers and discounts, to encourage you to keep using your existing products and services or try new ones
  • Target or personalize products, services, promotions, offers, advice, tips and articles based on information that we have collected, including information collected through your activities on CIBC Digital Channels
  • Use de-identified data such as transaction data and demographics to help personalize ads and offers on third party websites or CIBC Digital Channels

• Promote and market products and services offered by CIBC and CIBC Foreign Affiliates, our program partners or other third parties we have carefully selected
• This includes marketing CIBC products, services or community initiatives on another company's site. For example, if you show interest in a specific CIBC product or service when using our website, we may present you with an ad for that product or service on another company’s website. This is sometimes called “remarketing.”
• We may tailor our marketing and promotions using information such as your browsing behaviour on CIBC sites and third-party sites with CIBC ads, your CIBC products and services, and the information you have given us. 
• For information on how to manage your marketing preferences, refer to section 11 “What are your privacy choices?”
• Better manage and improve your overall relationship with CIBC, including monitoring, reviewing, analyzing or improving client services and business processes to make it easier to do business with us

Manage our business

• Perform our everyday business and operations, such as meeting our contractual obligations, record-keeping and internal reporting.
• Understand and better manage our business.
• Use market research or analysis of data we hold about you to help us develop our products and services. Refer to “De-identification and analytics” in section 7.
• To conduct business transactions, such as acquisitions, divestitures, partnerships and joint ventures.
• Administer referral arrangements.
• Insure, reinsure or otherwise protect our interests in our product and services portfolio. For example, getting insurance for our mortgage loan portfolio, or reinsurance to manage our insurance risk.
• Manage our credit, business and other risks so that CIBC operates as an effective, efficient and financially prudent financial institution.
• Meet tax, legal and regulatory obligations.
• Protect you and us from error and criminal activity. This includes preventing, detecting and investigating fraud, money laundering, cyber threats and other such risks and threats. Refer to “Protecting you and CIBC, or where permitted by law” in section 7.

Within CIBC and with CIBC Foreign Affiliates

We share information within CIBC and with CIBC Foreign Affiliates to:

• Manage your relationship with us and with CIBC Foreign Affiliates, including opening and servicing your accounts and maintaining information about you
• Make doing business with us and with CIBC Foreign Affiliates easier, such as pre-populating forms with your name or contact information
• Manage and assess risks and operations, which could include collecting money you owe to us
• Prevent and detect fraud or other unauthorized activity
• Offer or promote products and services that suit you
• Analyze your activities with us
• Make it easier to operate, administer and support our internal processes and services
• Comply with legal or regulatory obligations

The information shared with CIBC Foreign Affiliates is subject to the privacy policies of those affiliates, and the laws of the countries where they are located.

With service providers

We may share information with service providers that perform services on our behalf. Service providers may assist us with printing cheques, statements and letters; information storage; cloud and web-hosting services; payment processing; marketing; advertising; human resources management; contact centre services; information technology services; and fraud prevention and detection, among other services. Refer to section 8 “How do we protect your information?”. 

With analytics and advertising partners

We share information with analytics and advertising partners to better understand how our clients use our products and services and to personalize advertising based on your preferences and interests. These partners also measure how well our marketing and ad campaigns are working and help us improve them. These partners may use web technologies, such as cookies, to collect information about your activities on CIBC sites and other third-party sites. For information on how to manage your marketing preferences, refer to section 11 “What are your privacy choices?”.

With other third parties

Depending on the circumstances and the products and services you hold, we may share information with other third parties, including:

• Payment card networks, such as Interac, or that support the products, services or accounts you have with us.
• Payment intermediaries, such as SWIFT or other banks, to make worldwide money transfers.
• Credit bureaus.  Refer to “Credit bureaus” in section 7.
• Insurance companies and other third parties relating to insurance services. Refer to “Insurance” in section 7.
• Governments, regulators, self-regulatory bodies, courts and law enforcement authorities. For example, this may be needed to meet tax, legal and regulatory requirements, to respond to orders or requests from these parties, or when we are involved with judicial, administrative or regulatory proceedings or investigations. Refer to “Protecting you and CIBC, or where permitted by law” in section 7.
• Other organizations — for example, to investigate, prevent, detect and suppress fraud, money laundering, financial abuse, cyber threats and other similar risks or illegal activity. Refer to “Protecting you and CIBC, or where permitted by law” in section 7.
• Mutual fund issuers.
• Our program partners. Refer to “CIBC partner programs” in section 7.
• Other parties to a business transaction. Refer to “Business transactions” in section 7.
• Joint account holders, representatives, beneficiaries and executors. Refer to “Joint accounts, representatives and beneficiaries” in section 7.
• Your next of kin, legal or governmental authorities, or other appropriate persons, such as a public guardian or trustee’s office, if we think you might be a victim of fraud, financial abuse or other illegal activity, or that we need to act to protect you. We only share information we believe is necessary to protect your interests.

Protecting you and CIBC, or where permitted by law

We collect, use and share information to protect you and your rights as well as to protect our rights and interests, including in the following circumstances:

• When we are involved in judicial, administrative or regulatory proceedings or investigations, or other similar processes.
• To enforce our rights, including to collect on a debt.
• To comply with legal and regulatory obligations, including:
  • any subpoena, warrant, judicial or administrative orders, or valid demands or requests from governments, regulators, courts and law enforcement authorities in Canada or other jurisdictions or countries
  • any rules, codes and guidelines that apply to our business, including expectations or guidance from regulators or self-regulatory organizations, or any codes, programs or principles we have publicly adopted.
• To investigate a breach of an agreement or law.
• To detect, suppress or prevent fraud. For example, when you apply for a product or service, or when we investigate a suspicious transaction, we may check for fraud by running your information through fraud databases used by CIBC and other organizations, such as other financial institutions, to detect, suppress and prevent fraud.
• To identify threats and risks such as credit, fraud and money laundering. This may involve reviewing and analyzing your applications, transactions and other information. We also may pool your information with data belonging to other individuals so we can analyze the combined data.
• To prevent you from becoming a victim of fraud, including by using or offering technologies that help us to:
  • Protect you on CIBC Digital Channels. For example, we may use session cookies that make sure that your session is secure while you are signed on. Refer to “Cookies and other similar technologies” in section 7.
  • Verify your identity when you apply for new products online or conduct high-risk transactions. For example, with your consent, we may use facial comparison technology to verify your identity online by comparing images of yourself and your identification document.
  • Authenticate you when you call us. For example, you can use our optional voiceprint authentication system for better security when you speak with us. These voiceprints cannot be used to reconstruct your voice. For more details, visit our Voice Verification page.
  • Authenticate you or your device when you sign on to online banking. For example, you can use your device’s authentication settings, such as face ID, to sign on more quickly to some of our mobile apps. If you choose to enable device-based authentication, we’re notified only of whether the authentication is successful. We don’t have access to the information your device collects to enable these settings.

We may also collect, use and share information without consent if we are allowed to do this under the laws that apply to us.

CIBC partner programs

We share information with our program partners, such as Aeroplan, Journie Rewards or Costco, to help decide if you are eligible for CIBC partner programs.

If you join a CIBC partner program, CIBC and the program m partner, will share information to administer, develop, manage and promote the program, including managing points or rewards, reporting on and analyzing the program’s performance, developing new benefits, products and services and doing market research.

If you withdraw your consent to this sharing, you may not be able to participate in the CIBC partner program, as the sharing may be necessary to receive the benefits and features of the program.

CIBC may provide you with a privacy notice that explains how your information is handled for a particular partner program.

Joint accounts, representatives and beneficiaries

When you share a product or service with another person, we may share your information with that person or their representative, which includes their estate representative, but only in connection with the product or service.

Shared products and services include:

• Joint accounts
• Products or services with added authorized users, such as a credit card
• Products or services with shared liability, such as a loan guaranteed by someone else

We may also share information with and take instructions from someone who has proper authorization to act as a representative for you, such as a legal guardian, person with power of attorney, estate representative, lawyer, accountant and, for minor children, parent or guardian. If representatives are jointly appointed, we share information as instructed by either representative.

Following your death, we may share your information with your beneficiaries or estate representatives where necessary to help administer your registered plans or insurance products, or your estate’s financial affairs.

If someone you hold an account with jointly dies, we may share information about the account with their representative, but only if the information was created or collected before the deceased joint account holder’s death.

Insurance

When we administer or sell insurance, we collect information on behalf of the insurance underwriter. We also share information with them as their service provider. We do this to help sell and administer the insurance, pay claims and resolve complaints.

When we are the insurance underwriter, we share information with people or organizations to provide you with insurance products and services, such as:

• Health care practitioners
• Medical facilities
• Insurance information bureaus

When we make an agreement with a reinsurer to manage our risk, we share information with the reinsurer. We require the reinsurer to keep this information confidential and limit its use to the purpose of reinsurance.

 Business transactions

If we enter into a business transaction involving personal information or are considering one, such as selling or securitizing assets, we may share information with the other organizations or people involved in the transaction. For example, we may share information so a purchaser can do their due diligence before the transaction. We may also share information when the transaction is completed. These other parties must keep this information confidential and limit its use to the purposes of the transaction.

When we buy information as part of a business transaction, this policy applies to our collection, use and sharing of the information, which may include information we continue to hold after the end of your relationship with us. If we sell assets, the purchaser may be allowed or required by law to keep some personal information for a defined length of time.

Credit bureaus

When you apply for a product that creates credit risk for CIBC, we run a credit check and exchange your information with credit bureaus. We continue to exchange information with them for as long as you hold the product and for a reasonable time after you close the product. We do this to assess your application, verify your identity and your creditworthiness, qualify you for products and services, protect against fraud and manage our risks. We may also validate your information with a credit bureau to verify your identity and protect against fraud. Other financial institutions also exchange information with credit bureaus in this way.

Products that create credit risk include:

• Credit cards
• Loans
• Lines of credit 
• Mortgages
• Deposit accounts with overdraft protection, or hold or withdrawal limits

The information we collect from credit bureaus may include information about your current and past credit accounts such as type, amount, payment history, debt collections, legal proceedings, or other information that the credit bureau has collected from your other lenders.

We may also periodically share credit, financial and other information about you with credit bureaus to help maintain the accuracy and integrity of the credit reporting system. The credit bureau incorporates the personal information we send them into its consumer reporting database. They then use the information to maintain the database and as permitted or required by applicable laws, which may include sharing this information with third parties.

If you consent to us giving your Social Insurance Number (SIN) to credit bureaus, the credit bureaus may use it to update their consumer reporting database and to help them match and verify future credit bureau requests.

We may also validate your information with a credit bureau to verify your identity, protect against fraud or to help us maintain accurate and up to date information about you where necessary.

We may exchange information about you, as described in this policy, with the following credit bureaus:

TransUnion Opens in a new window.
3115 Harvester Road
Burlington, ON
L7N 3N8

Equifax Opens in a new window.
National Consumer Relations
Box 190
Montreal, Quebec
H1S 2Z2

De-identification and analytics

We may de-identify your information by removing information that identifies you, such as your name, address, and account numbers. We may then combine this information with other information and use it for internal business purposes, such as:

• Analysis and reporting
• Developing and improving our products and services
• Understanding and predicting client needs and preferences
• Preventing and detecting fraud
• Identifying trends such as purchasing patterns or fraud trends
• Enhancing our marketing.

Refer to “Provide you with value” in section 5.

Automated decisions

We may use automated processes to make decisions using your personal information. These automated processes allow us to respond to your requests promptly and accurately, and to make informed, personalized decisions based on your unique needs and circumstances. For example:

• When you apply for a credit product, we may use automated credit adjudication tools to make a real-time decision on whether to approve your application, making the application process faster.
• We may also use automated credit adjudication tools to provide you with pre-approved credit limit increases. 

If you have any questions about automated decisions, or if you would like to raise a concern about a particular decision that affects you, contact us using the information in section 12 What if you have a privacy concern?”. 

Cookies and similar technologies

A cookie is a file with a unique identifier stored by a web browser. Cookies can be used to record your internet browsing activity and to personalize your online experience when you search for information. Tracking pixels can also be used to check if you have accessed content, monitor web traffic and provide metrics similar to cookies. Below, we describe how we use cookies and similar technologies. For information on how to manage your preferences for our use of these technologies, refer to section 10 “What are your privacy rights”.

Persistent cookies

We use persistent cookies to measure site and mobile app usage, including browsing behaviour. We do this to improve how our sites work and to measure the effectiveness of our sites, communications and promotional offers. For example, we use persistent cookies to track the CIBC web and mobile pages you visit, which CIBC online marketing ads you click and your response rate, and the keywords you searched to find our site. If the CIBC ad is on a third-party site, we may collect the address of the site where you click the ad, but we don’t track or create a profile of your activity on third-party sites.

We also use persistent cookies to save your CIBC digital banking personal preferences. You must allow persistent cookies if you want your browser to remember your preferences such as card number, language or default home page each time you sign on.

Session cookies

Software applications, such as videos, may create cookies to store configuration information on your computer. These cookies allow you to view videos or other rich media on our sites. Some of our online tools, such as mortgage calculators, use cookies to save the information you enter, such as mortgage amount and interest rate, so you don’t have to re-enter this information each time you use the tool.

Location information

We may collect general location information, such as the city you’re in, from the IP address of your browser or mobile device. We may also collect more specific location information, such as your GPS location, from your browser or mobile device if you allow your device to share this data. We use location information to personalize and improve your user experience — for example, helping you find the nearest banking centre, or offering travel tools if you leave Canada. We also use location information to protect you against fraud, for marketing, or to offer products and services. Refer to “Location information” in section 11.

We’re serious about protecting your personal information. We do what we can to prevent unauthorized use, sharing, loss and theft of information. We have strong policies and practices in place to protect your information, including our:

• Global Privacy Management Framework, which establishes a thorough approach to managing privacy and handling personal information. The policy applies throughout our organization, ensuring compliance with applicable privacy and data protection laws and regulations
• Data Management Lifecycle, Data Governance and Records Management Policy, which guides the handling, storage and secure disposal of your information throughout its life cycle, while maintaining data quality and integrity
• Record Retention Schedules, which define how long we keep different types of personal information, and help make sure we don’t keep it any longer than necessary
• Confidentiality and Privacy Policy and the Acceptable Use of CIBC Information and Information Systems Policy, which outline employees’ responsibilities for maintaining the security and privacy of your information and set the guidelines for how we use company information and systems
• Information/Cyber Security Risk Policy, which gives a framework for how to identify, assess and reduce information and cybersecurity risks, so we can ensure the ongoing security of your personal information and our digital infrastructure

Under these policies and practices, our efforts to protect your information include:

• Defining roles and responsibilities for handling your information from the moment we gather it until it is destroyed
• Limiting access to information based on employees’ roles and responsibilities
• Requiring all employees to complete annual mandatory training on privacy and information security
• Carefully selecting the service providers who handle information on our behalf, and making sure they have privacy and security standards that meet our requirements. We use contracts and other measures with our service providers to keep your information secure and to make sure it is only used for the intended purposes
• Protecting the security of your personal information and the financial transactions you conduct online, including implementing multiple layers of protection when you access any of our digital products or services, such as digital banking. For example:
  • Web browser encryption: All browsers supported by CIBC digital services offer industry standard encryption. This provides a high level of protection for transmitting confidential data over the Internet.
  • Monitoring: We monitor activity on CIBC Digital Channels to enhance security and to protect your personal information.
• Implementing other physical, technological and administrative security safeguards to protect your information
• Regularly auditing our security safeguards and assessing that they remain effective and appropriate

We also have policies and practices in place to handle privacy complaints. For details, refer to section 12, “What if you have a privacy concern?”.

You also have a role in protecting your information. For example, CIBC sites may contain links to non-CIBC sites, and CIBC is not responsible for the information and privacy practices of these third-party sites. We recommend that you read the privacy policies on all third-party sites to learn about their information and privacy practices before you provide any personal information. For more ways you can help protect your information, visit our Privacy and Security page.

How long we keep your information depends on the type of information and the product or service it relates to. We keep your information for as long as we reasonably need it for customer service, legal, regulatory, and business purposes. For these reasons, we keep your information beyond the end of your relationship with us. When we no longer need your information, we securely destroy it or make it anonymous, following all applicable laws, so the information can no longer identify you. We have record retention policies and schedules that set out retention periods depending on the type of information, and the process that must be followed when a retention period expires.

We may store information in the CIBC Banking Centre or office where you regularly do business, in computer systems, or in the record storage facilities of CIBC or our service providers.

We may store and process information in any country or region within the country where we have affiliates or service providers, including countries outside of Canada, such as the United States, which may have different data protection rules. CIBC, CIBC Foreign Affiliates, service providers and other third parties with whom we share information under this policy may perform activities outside of Canada. As a result, your information may be securely used, stored or accessed in other countries and be subject to the laws of those countries. For example, we may share information in response to valid demands or requests from government authorities, courts and law enforcement officials in those countries.

Right to update or correct your information

You have the right to update or correct personal information we hold about you if it is inaccurate, incomplete or outdated. We make every reasonable effort to keep the information in our records as accurate, complete, and up to date as necessary. However, we also rely on you to tell us when your information changes. Keeping your information accurate and up-to-date allows us to continue to offer you the highest-quality service.

If you want to update or correct any personal information we hold about you, contact the CIBC Banking Centre or office where your account is held, or talk to your CIBC representative. You can also sign on to CIBC Online Banking® or call us at 1-800-465-2422 Opens your phone app..

Right to access your information

You have the right to access personal information we hold about you. Much of your information is available to you:

• On your paper or electronic account statements
• At the banking centre or office where you regularly do business
• By checking your account online
• Through Telephone Banking

If you want access to additional personal information we may hold about you, contact the banking centre or office that holds your account, or talk to your CIBC representative.

You need to put your request in writing. We can give you a form. Give us enough details to help us understand the information that you want to access. We must verify your identity before we start our search, or before we give you access to your information. We’ll tell you if there is a fee to access your information. We may also ask you for more information to confirm the scope of your request, such as the time period or a more specific description of the information you want to access.

After we receive your written request, verify your identity and understand the scope of your request, we’ll give you a written response to your access request within the timeframe set by applicable privacy law.

If you have a sensory disability, you may ask for your information in an alternative format. If we already have this format, we will provide it. Otherwise, we’ll convert the information to the requested format if it is reasonable and in accordance with applicable privacy law.

There may be limits to your right to access your information. For example, if the information is subject to legal privilege, contains confidential commercial information, relates to an investigation of a breach of an agreement or law, or contains information about other individuals that cannot be separated.

If we have information about you that we got from others, you can ask us for the source of that information, subject to certain restrictions under applicable law. If you ask for it, and if legally permitted and required, we also give you certain details about how we handle your personal information, such as the types of third parties to whom we have, or may have, disclosed your information. However, this does not include service providers we have used to do work for us, reports to the Canada Revenue Agency, or information that has been provided for legal and regulatory obligations, except to the extent required by law.

If you ask for access to a credit report we got about you from a credit bureau, we’ll give you a copy if we still have it on file. We also give you the name and address of the credit bureau we used, as they have the most current information and can explain how to read the report. You have the right to access and correct the credit bureau report directly with the credit bureau. For contact information for the credit bureaus with whom CIBC exchanges information, refer to “Credit bureaus” in section 6.

Right to withdraw consent

You can withdraw your consent to our collection, use and sharing of information at any time by giving us reasonable notice, subject to legal, business, or contract requirements. However, withdrawing your consent may limit or prevent us from providing you with specific products and services. For example, if you don’t give us your Social Insurance Number (SIN), we can’t provide you with any product where the collection of a SIN is required under tax law, such as an RRSP or other registered product. If you withdraw your consent to exchange personal information with credit bureaus, we can’t provide you with certain credit products.

In some circumstances, you can’t withdraw your consent. For example, you can’t withdraw your consent if the collection, use and sharing of information without consent is:

• Permitted or required by law, or
• Required to ensure we have correct and up-to-date information about you, such as current address, or
• Necessary to manage our business, comply with legal and regulatory obligations, assign our rights to others for business transactions, or as otherwise described in “Manage our business” in section 5

During our relationship with you, we provide you with the following privacy choices:

Social Insurance Number (SIN)

Including your SIN in a credit bureau request is the best way to make sure we get accurate information about you from credit bureaus. This use of your SIN is optional and, if you choose not to give your permission, this by itself does not stop you from qualifying for products and services. We only use your SIN as part of credit bureau requests when qualifying you for products and services or reporting information to the credit bureaus. We don’t use your SIN during ongoing exchanges with credit bureaus. For more information, refer to “Credit bureaus” in section 7.

Marketing

Subject to applicable law, we may offer you products and services that may interest you, provided by CIBC or CIBC Foreign Affiliates, including special promotions. Your consent to receive marketing communications is optional and you can decide to withdraw it at any time.

Withdrawing your consent to receive marketing communications does not limit the information you receive through discussions with a CIBC representative or through general marketing or servicing communications, such as posters in CIBC Banking Centres and electronic messages on banking machines or our website.

We’ll also continue to send you information related to your existing products or services, and as permitted or required by law. From time to time, we may also ask if you wish to update your marketing preferences to help ensure that our records are up-to-date and reflect your current preferences.

If you wish to update your marketing preferences

Contact the banking centre or office that holds your account, or talk to your CIBC representative. You can also call us at 1-800-465-2422 Opens your phone app..

For other CIBC clients, such as CIBC Private Investment Counsel and CIBC Wood Gundy, refer to one of the contacts in section 12 "What if you have a privacy concern?”. We’ll update your file as quickly as possible. It may take some time for our records to reflect your choice. Also note that your choice may not be captured for a promotion already in progress. You can always opt out of marketing email communications by selecting the “unsubscribe” link at the end of each of our commercial electronic communications.

Interest-based advertising

Interest-based advertising uses information collected from your browsing behaviour to help predict what will interest you, and to present you with CIBC-related advertisements that are more relevant to you on CIBC Digital Channels.

If you wish to update your interest based-advertising preferences:

If you opt out of interest-based advertising, you may still get CIBC online advertising, but it won't be tailored to your preferences. The following are ways in which you can manage your preferences for interest-based advertising:

• AdChoices
  • We are a member of the Digital Advertising Alliance of Canada’s (DAAC) AdChoices program. AdChoices is a self-regulated program for companies participating in online interest-based advertising. The program aims to give Canadians more information and choices about the advertising they get. To learn more about this program, visit youradchoices.ca Opens in a new window..
  • To opt out of interest-based advertising from some or all AdChoices program participants, use the use AdChoices’ opt-out tool for browser data on their tools page Opens in a new window.. Use the WebChoices tool to scan all of the advertising cookies held on your browser. A check box appears under the opt-out column beside companies that are using cookies while you browse sites. To manage your preferences and opt out, check the boxes and select submit.
  • The AdChoices mobile AppChoices tool Opens in a new window. also lets you opt out of mobile data collection for interest-based advertisements.
• Adobe
  • We work with the Adobe Marketing Cloud to provide interest-based advertisements. To opt out of receiving these types of advertisements and from Adobe Analytics, visit the Adobe website and set your preferences directly through the “Adobe Privacy Choices” section Opens in a new window.. You can opt out of interest-based advertising, under the “Interest-based ads” section, and you can opt out of ad tracking through the “Adobe website preferences” section.
• Google Advertising
  • We work with Google Advertising to provide interest-based advertisements. To opt out of interest-based Google advertisements, set your preferences using Google Ad Settings Opens in a new window. You can also opt out of Google Analytics with Google Analytics Opt-out Browser Add-on Opens in a new window..
• Operating System
  • Depending on your operating system, you may be able to opt out of interest-based advertising by going into your settings, selecting the app in question, and turning off “Allow Tracking”. 
  • If your operating system does not have this option, you can opt out of interest-based advertising by visiting the individual sites or app of choice, such as TikTok or Facebook, for information on their privacy practices and opt-out settings. For example, we use Facebook and TikTok pixels on CIBC websites for interest-based advertising and website optimization.

Device information

If you wish to manage the data you share with us on your device

You can manage access to certain personal information through your device settings. For example, you may allow your device to share your camera, contacts and photos. Some services may not operate effectively without this access. Your device support will have instructions for how to manage these permissions.

If you wish to manage notifications and alerts on your device

If you have installed our mobile app and wish to stop receiving push notifications, set your preferences within the mobile app. You may also manage push notifications at the device level.

Login information

If you wish to manage your login IDs and passwords

Many browsers and devices allow you to store passwords and login credentials so you don’t have to re-enter this information each time you visit a site. To keep your information safe, we strongly recommend you don’t use this function when accessing CIBC digital sites.

Cookies

If you wish to manage cookies

You can block or disable third-party cookies in your browser settings so that your browser accepts only first party cookies, which are those cookies belonging to the site you are currently browsing, including cookies from CIBC when you’re on our site.

Location information

If you wish to manage your location information

You can manage access to your location information through your device settings. We collect and use location information from your mobile device only if the location services, such as GPS, geolocation or proximity technologies, are enabled. 

Call recording

Telephone calls with CIBC representatives may be recorded and monitored for coaching, training, quality and security. Refer to section 4 “How do we collect information?”

If you do not wish to have your telephone calls recorded

You have the option to do business with us at a banking centre, office or location, through our bank machines, our Internet banking services or by writing to us.

If you have any questions, concerns or complaints about this policy or our privacy practices, let us know right away. In most cases, you can resolve a question, concern or complaint simply by talking to us about it. If you choose to send us an email, don’t include sensitive information such as card or account numbers.

You may also ask for a printed copy of our privacy policy or more details about our privacy policy and practices. Refer to our CIBC Privacy Principles or Privacy FAQ.

Step 1: Talk to us

For CIBC Personal and Business Banking Centre clients:

You should be able to get swift results by talking to a CIBC representative where you do business.

• Talk to a CIBC representative 
• Visit your nearest banking centre 
• Call 1-800-465-2422 Opens your phone app.

For other CIBC clients, such as clients of CIBC Private Investment Counsel and CIBC Wood Gundy, refer to the escalation process given to you when you opened your account, contact the CIBC office where your account is administered, or speak to your CIBC representative.

CIBC Investor's Edge and Imperial Investor Service

• 1-800-567-3343 Opens your phone app.
• Email us at CIBCInvestorServicesInc@cibc.com Opens your email app.

CIBC Private Investment Counsel

• Contact your Investment Advisor.

CIBC Wood Gundy

• Contact your Investment Advisor or call Client Relations at 1-800-563-3193 Opens your phone app.

For Simplii Financial clients, if you need information about your privacy rights and how to exercise them, contact Simplii Financial:

• Telephone: 1-888-723-8881 Opens your phone app.
• TTY Service: 1-888-632-9022 Opens your phone app.
• Email: talktous@simplii.com Opens your email app.
• Write to:
  Simplii Financial
  PO Box 603, Stn. Agincourt
  Scarborough, Ontario
  M1S 5K9

Step 2: Contact the CIBC Client Care Centre

If we haven’t resolved your question, concern or complaint to your satisfaction, you can contact the CIBC Client Care Centre which handles privacy related matters and escalates to the Chief Privacy Officer when required:

Telephone: 1-800-465-2255 Opens your phone app.
Email: client.care@cibc.com Opens your email app.

Write to:
CIBC Client Care
Attention: Chief Privacy Officer
PO Box 15, Station A
Toronto, Ontario
M5W 1A2

Be sure to include your name and contact information where you prefer to be reached, the nature of your complaint, question or concern, details relevant to the matter and the names of any individuals whom you have already discussed the issue with.

Step 3: Contact the CIBC Client Complaint Appeals Office

If Client Care has not resolved your question, concern or complaint to your satisfaction, feel free to contact the CIBC Client Complaint Appeals Office:

Telephone: 1-888-947-5207 Opens your phone app.
Email: ClientComplaintAppeals@cibc.com Opens your email app.

Write to:
CIBC Client Complaint Appeals Office
P.O. Box 342
Commerce Court
Toronto, Ontario
M5L 1G2

If the previous steps do not resolve your concern, you may consider escalating the matter further.

Office of the Privacy Commissioner of Canada (OPC)
You may contact the OPC to help resolve your privacy concern:

Telephone: 1-800-282-1376 Opens your phone app.
Website: priv.gc.ca Opens in a new window.

Write to:
30 Victoria Street
Gatineau, Quebec
K1A 1H3

Depending on the nature of your concern, you may also contact Independent Consumer Support Agencies.

The CIBC logo is a trademark of CIBC.