Privacy Policy | CSA Settlement

Revision Date: April 26, 2024

Exchange Solutions Inc.

PRIVACY STATEMENT

Introduction

Exchange Solutions Inc. and its related entities (hereafter the "Claims Administrator", "we", "us", or "our") respect your privacy rights. We are committed to meeting our privacy obligations at law. As a claims administrator, we have established this Privacy Statement to detail our privacy practices including, without limitation, to set out: the types of personal information that we may gather in connection with a claim; the purposes for which we use personal information; how personal information is maintained and safeguarded while under our custody and/or control; the purposes for which personal information may be disclosed to others; and to identify time limitations and destruction practices for personal information.

This Privacy Statement sets out your rights in respect of your personal information and provides contact information for the Exchange Solutions Inc. Privacy Officer should you have questions or require further information.

1. Personal information

This Privacy Statement applies to "personal information" only, namely information about an identifiable individual. This Privacy Statement does not apply to corporate information, or other information which does not meet the definition of "personal information" under applicable law, including without limitation under the Personal Information Protection and Electronic Documents Act (Canada). Anonymized information which cannot reasonably be connected to an individual, for example, will not be considered to be personal information.

2. Who this privacy statement applies to and what it covers

This Privacy Statement will apply to those individuals whose personal information is under our custody or control.

Our services through our website are intended for use by Canadian residents only in connection with identified Canadian claims. If you are resident outside of Canada, please contact our Privacy Officer directly prior to submitting personal information to us in order that we may confirm our privacy obligations in advance of any collection or receipt of your personal information and confirm our willingness to accept your personal information.

As a claims administrator, we reserve the right to reject the submission of personal information or to delete or destroy personal information that is no longer necessary or should no longer be retained on file by us subject to paragraph 10 (retention and removal) to ensure that we are properly retaining only necessary personal information in accordance with applicable laws.

(a) You, Your Personal Information and Consent

We collect personal information about you when: (i) you communicate with us or provide your personal information to us (whether through our website, via email, telephone or otherwise), (ii) from a third party where you consent to collection from same or where collection from a third party is permitted by law, and (iii) automatically on a limited basis when you use our website (see paragraph 8 below) through the use of cookies intended to improve your use of our site and to gather analytics information to improve our site and our services.

Personal information will only be used for the purpose for which it was collected. Should our usage requirements change and a new purpose arises, we will obtain your consent in advance of using your personal information for the new purpose (unless otherwise permitted or required by law).

We do not sell personal information and we do not share personal information with third parties except with your consent, where required or permitted by law, or as set out in this Privacy Statement.

(b) Personal Information Collected

As Claims Administrator, we limit the collection of personal information to information necessary for the evaluation (due diligence), registration and administration of a claim. We typically require the following personal information:

full legal name;
current home address;
current country of residence;
date of birth;
current email address;
current telephone number;
your CFS Agency in care placement history where relevant to your claim, including but not limited to CFS Agency, number months in care for each Class member, age of each Class member at time of each in care placement, and month and year of each month in care;
deposit banking information (name, bank, branch address, transit number, account number and otherwise);
Other information as requested on the Claim Registration Form.

The above information is used for the following purposes in respect of a claim:

full legal name, address and contact information are used to identify you, your CFS Agency in care placement history where relevant to your claim, other information as requested on the Claim Registration Form, for due diligence purposes, to register and administer your claim, and to communicate with you generally;
date of birth is required to confirm ability to contract and receive any potential compensation;
deposit banking information is used in connection with any potential compensation payment provided in connection with your claim;

In connection with identified claims/potential claims, you may also choose to provide us with certain personal information in addition to that which is required, which will be administered in the same manner as required personal information under this Privacy Statement.

As noted in this Privacy Statement, we may also automatically collect certain personal information about you when using our site as detailed in paragraph 8 below.

We collect and use your personal information for identified purposes only, which can be either express or implied, and which will be provided where reasonably possible at or prior to the time of collection. The purpose for the collection, use or disclosure of your personal information will be expressly stated where they are not obvious to the subject individual.

3. Use of Personal Information

(a) Claims and claims administration. As a claims administrator, we will use your personal information to provide you with requested information and/or requested services, including without limitation: (i) to answer your questions/inquiries, (ii) to conduct due diligence in respect of your registration/status as a claimant and in respect of your claim, (iii) to generally administer claims/your claim, (iv) to communicate with you, your authorized representatives, lawyers, or other third parties as reasonably necessary to administer the claim/your claim, and (v) to administer our records and as necessary for our operations and reporting obligations.

As a claims administrator, it may also be necessary for us to use your personal information to communicate with competent authorities in respect of the claim(s) or as necessary to comply with legal and/or regulatory requirements under applicable laws.

(b) Website. Information that we automatically collect through the use of cookies (see paragraph 8 below) will be used solely to gather analytics, facilitate your use of our site, and to improve our website and its functions.

4. Disclosure of Personal Information

Personal information will only be disclosed by or for us for the purpose for which it was originally collected and with your consent, unless otherwise required or permitted by law. Should additional disclosures be required than those originally contemplated at the time of collection, we will contact you to seek your further consent.

As part administering a claim, it may be necessary for us to disclose personal information to: (i) other members of Exchange Solutions Inc. to allow appropriate employees and contractors to complete their duties, (ii) to third parties that provide relevant services to us; (iii) to competent authorities (including courts and regulatory authorities as appropriate); (iv) to lawyers and other third parties that reasonably require access to personal data where the subject individual has consented (or where required or permitted by law).

Please note that some of recipients of personal information referenced in this Privacy Statement may be based in countries outside of Canada and whose laws may not provide the same level of data protection. Where Claims Administrator determines that such a disclosure is required in connection with the services, we will ensure by legal agreement that there are adequate safeguards in place to help protect your personal information.

NOTE: Claims Administrator may use and disclose de-identified and aggregated information, same no longer being considered to be personal information, for data analytics, research, submissions and promotional or other such purposes without consent and such use shall not constitute an unauthorized disclosure under this Privacy Statement.

5. Accuracy

We take steps to ensure that personal information continues to be accurate for the purposes for which it was collected. We have established processes to confirm/re-confirm your personal information with you and/or your authorized representatives where reasonably necessary to ensure your personal information remains current in the event that a decision will be made on the basis of same in respect of your claim.

You may choose to update your personal information by notifying us in writing of any change to your personal information prior to a decision being reached concerning your claim; any update after a decision has been made will be used to update your contact information only and will not be taken into account in respect of your claim except in the event of a permitted appeal and then only if permitted pursuant to the applicable appeal process.

6. Safeguarding Personal Information

Claims Administrator has in place reasonable security safeguards to help protect against unauthorized access, collection, use or disclosure of personal information. Our safeguards include organizational safeguards, physical safeguards and technological safeguards consistent with our privacy obligations and appropriate to the sensitivity of the personal information under our custody and/or control.

Our safeguard measures include, but are not limited to: (i) education and training to relevant staff to ensure they are aware of our privacy obligations when processing personal data; (ii) administrative and technical controls to restrict access to personal data on a ‘need to know’ basis; (iii) technological security measures, including firewalls, multi-factor authentication, encryption and anti-virus software; and (iv) physical security measures, such as staff security passes to access our premises.

Although we use appropriate security safeguards and measures once we have received your personal data, data transmitted or stored online may be subject to inherent risk. We endeavor to protect personal information stored or transmitted online, but we cannot guarantee the security of personal information stored through online or cloud means or transmitted to us or by us electronically. You assume the risk of electronic storage and transmission of personal information in respect of our services.

7. Openness

We will make information available to you about our privacy policies and practices and any changes to same. This Privacy Statement will feature a release date to allow you to identify amended versions.

8. Our Website, Cookies and Links

When we refer to “our website” or “this website” or the "site" in this Privacy Statement, we mean the webpages found at the URLs www.CSASettlement.com and www.exg.ca or such other URLs specified by Exchange Solutions Inc. from time to time.

Our website automatically collects certain personal information relevant to your use of the site, which is generally classed as: (i) visitorship information, and (ii) usage tracking.

(i) Visitorship information
We analyze the visitorship information for trends and statistics (e.g. so we know which are the most and least visited pages on the site). This information is used to improve the content and organization of this site based on our analysis of website traffic patterns in terms of visitorship preferences.

(ii) Usage Tracking
We use cookies and web beacons, small text files that are automatically placed on your computer’s hard drive when you access certain websites. Cookies allow us to store information, such as your internet protocol (IP) address that identifies your computer/location, your internet service provider, your browser, the date and time of access, the pages you visit or the types of searches you perform. We use this information to store your preferences and settings, help improve the content of our website, and to compile aggregated statistics to evaluate visitors’ use of our website or website activity.

You may adjust your cookie settings in your browser, however this may impact your use of our site or its features.

(iii) Links

Our site may contain links to other third-party websites which do not constitute an endorsement by us of the third-party site.We are not responsible for the privacy practices of third parties or the content of such third-party websites, notwithstanding any such links.

We strongly encourage you to review the privacy policies of all third-party websites, especially prior to submitting personal information and to exercise reasonable caution in disclosing your personal information.

9. Not Directed To Children

Please note that our site and our services are not designed for or targeted toward children.

10. Retention and Removal

We will retain your personal information for the longest of : (i) the period necessary for the relevant purpose (activity or services) to be completed and to give you a reasonable opportunity to review same; (ii) any retention period that is required by the court/law or professional standards; (iii) to allow for limitation periods in respect of the services or (iv) as directed by Exchange Solutions Inc.’s own internal retention policies or practices, the length of which may vary depending on the nature of the information that is held.

When personal information is no longer necessary, it will be securely destroyed in a manner that protect the confidentiality of the subject records.

Any copies of personal information stored in our electronic backups will be destroyed in accordance with that backup’s ordinary lifecycle.

11. Your rights

You have certain rights at law with respect to your personal information, and those listed below are not an exhaustive list of your rights. The rights afforded to you may vary depending on your geographic location and the applicable laws governing your personal information. To the extent prescribed by applicable law, or under the terms of the subject settlement agreement, you have a right to, without limitation:

obtain confirmation that we are processing your personal information and request a copy of same;
ask that we update the personal information under our custody or control if same is incorrect or incomplete;
object to our processing of your personal information.

To exercise any of your rights, or if you have any other questions about our use of your personal information, please email privacyofficer@exg.ca or write to us at the address Exchange Solutions Inc., 1 – 554 St. Mary’s Road, Winnipeg, MB R2M 3L5.

12. Complaints or Inquiries

You may also contact our Privacy Officer to make a complaint or voice an inquiry in respect of our privacy practices. Please email privacyofficer@exg.ca.

13. Changes to this privacy statement

We reserve the right to modify or amend this Privacy Statement from time to time without prior notice. To let you know when we make changes to this Privacy Statement, we will amend the revision date at the top of this page. We encourage you to periodically review this statement to be informed about how we are protecting your information.