Each and every one of our employees is responsible for maintaining the confidentiality of all personal information to which they have access. As a condition of employment, our employees are required, on an annual basis, to sign a declaration of secrecy binding them to this responsibility which remains with them even if they leave or retire from Peace Hills Trust Company. We keep our employees informed about our policies and procedures for protecting personal information and reinforce the importance of complying with them. All employees are also required, as a condition of employment, to conform to these policies and procedures.

Personal information is information that identifies you as an individual. It includes not only your name and address, age and gender but also your personal financial records, identification numbers including your social insurance number, personal references, and employment records.

We want to work with you to help you achieve your goals, to provide you with value-added services on an ongoing basis, and to establish a lasting banking relationship with you that will grow and change to meet your needs as they grow and change. The better we know you, the better we are able to serve you. We therefore ask you for your personal information for the following purposes:

• to understand your needs

• to determine the suitability of our products and services for you

• to determine your eligibility for our products and services

• to comply with the law

In addition, there are some purposes, which are self-evident. For example, if you are applying for a loan, we ask for information concerning your credit history to help determine your credit worthiness and we also ask you for personal references, which we may use to verify the information you provide on your loan application.

In general, you can choose not to provide us with some or all of your personal information at any time. However, you must understand that if you make this choice we may not be able to provide you with the product, service, or information that you requested or that was or could be offered to you.

We will make sure you are aware of the purposes listed above when you apply for any of our products or services. Self-evident purposes should be clear but if you have any questions, just ask us.

We ask you for your SIN to comply with income tax reporting requirements under the Federal Income Tax Act. For example, when you open a deposit account, we ask you for your SIN as any interest earned must be reported.

There are other purposes for which we may ask you for your SIN. For example, if you are applying for a loan, we may ask you for your SIN to ensure an accurate match between your personal information and your credit bureau information.

We can ask a credit bureau to match your personal information with your credit bureau information without your SIN, but then the matching process is less accurate and we may not obtain the correct (or any) credit bureau report for you. In those cases we may be unable to render a decision on your credit application and may ask you again for your SIN to be able to respond to your credit request. Overall, it is more effective and efficient for us to make a credit determination on your loan. In general, we will not deny you credit just because you do not provide us with your SIN.

Another example of why we may ask you for your SIN, is to ensure the accuracy and integrity of your personal information by using your SIN as an internal identification number for you. This is especially important if your name is similar to that of another one of our clients. Using your SIN in this manner also allows us to ensure that any administrative requests you may make, such as change of address, or that we determine are necessary, are made for all your accounts with us.

We obtain personal information about you primarily from you. We may also obtain such information from other sources with your consent. For example, when you apply for a loan, we ask you to authorize us to obtain a credit bureau report on you, and to collect and verify your personal information with credit bureau, credit insurers, your employer, personal references, and other lenders. If you do not authorize us to obtain your credit bureau report, our standard lending practices may not allow us to provide you with a response to your loan request, whether it is for a personal loan or mortgage.

If you want to review or verify your personal information, or find out to whom we have disclosed it as permitted by the Personal Information Protection and Electronic Documents Act, contact your Regional Office. There are a few instances where we may not be able to provide the personal information you requested. Some of these may include, if:

• it is not readily available and may have to be retrieved from other sources

• it contains our own propriety information that is confidential to us

• it is unavailabe due to legal requirements or because we no longer need it for the puposes set out in this code

We will always explain the reason why if we are unable to provide you with access to your personal information.

We are committed to maintaining the accuracy of your personal information for as long as it is being used for the purposes set out in this Code, and you play an active role in keeping us up-to-date. Prompt notification of any changes, for example your address or telephone number, will help us provide you with the best possible service. Should you discover, that amendments are required to your personal information, please advise your Regional Office.

We also have a strict policy of not releasing personal information about our clients, subject to the important exceptions discussed below.

The most common reason for release of your personal information is that you have given your consent. For example, when you apply for a loan, you give your consent to the exchange of information about you with the credit bureau, credit insurers and other lenders.

Other reasons may include if we have a legal obligation, such as a court order, or if we need to protect our assets (e.g. collection of overdue accounts) or the public’s interest. For example, we may release personal information about a client to legal authorities in cases of money laundering or other criminal activity, or for the detection and prevention of fraud. If we release information for any of these reasons, we keep a record of what, when, why and to whom such information was released.

Any health information that you may provide for credit insurance purposes (e.g. mortgage life insurance) goes only to the insurer in question and is never used by us for any purpose.

Under no circumstances do we sell or distribute a list of our clients to third parties.

Your personal information is secure within Peace Hills Trust Company. We have comprehensive security controls to protect against unauthorized use, alteration, duplication, disclosure, loss or theft of, or unauthorized access to your personal information. For example:

• In many stores you now use your banking card and personal identification number (PIN), to pay for goods and services. Security controls scramble your PIN and only the minimum data necessary to check your account balance and verify your PIN is sent between Peace Hills Trust Company and the store. This data does not include your name, bank account number, or your PIN. The same security procedure applies whenever you use your banking card at an automated banking machine.

• We may use other companies to provide services to you on our behalf, such as the printing of personalized cheques, or to carry out banking functions on our behalf, such as data processing. In such cases, we have contracts in place holding these companies to the same high standards of confidentiality by which we are governed and requiring that any information provided by us must be kept strictly confidential and used only for the purposes of the contract.

• We ensure the physical, organizational and electronic security of your personal information through the use of secure locks on filing cabinets and doors, restricted access to our information processing and storage areas, limited access to relevant information by authorized employees only, through the use of passwords, PINs, and the encryption (i.e. scrambling) of electronically transmitted information.

• We ensure the physical, organizational and electronic security of your personal information through the use of secure locks on filing cabinets and doors, restricted access to our information processing and storage areas, limited access to relevant information by authorized employees only, through the use of passwords, PINs, and the encryption (i.e. scrambling) of electronically transmitted information.

We only keep your personal information for as long as we need it to meet the purposes set out in this code. The length of time we retain your personal information is also affect by: (1) the type of product or service you have with us, and (2) any legal requirements we may have to meet such as being able to respond to any concerns you may have, even if you are no longer a client of ours. We have retention policies in place, which govern the destruction of personal information.