|
Policies and Procedures
Updated as of January 2010
Our Philosophy on Privacy
Keeping our clients’ information in strict confidence is a cornerstone of Cash Money’s business. The range of products and services we offer our clients continues to expand, and the technology we use continues to change. However, no matter how our business changes, we will always protect our client’s privacy and any personal information disclosed to us. Canadian federal and provincial privacy laws are essentially about balance. On one hand, they respect an individual’s right to privacy while on the other, they recognizes the need for industry and organizations to collect, use, and disclose personal information. These laws, encompasses two primary objectives: (a) to establish rules that govern the collection, use and disclosure of personal information by private sector organizations; and
(b) to acknowledge the validity and legality of electronic documents. What is personal information?
Personal information includes any factual or subjective information, recorded or not, about an identifiable individual. This includes information in any form, such as: - age, name, ID numbers, income, ethnic origin, or blood type;
- opinions, evaluations, comments, social status, or disciplinary actions; and
- employee files, credit records, loan records, medical records, existence of a dispute between a consumer and a merchant, intentions (for example, to acquire goods or services, or change jobs).
Personal information does not include the name, title, business address or telephone number of an employee of an organization. For more information regarding this legislation, please visit the official Web site of the Privacy Commissioner of Canada at www.privcom.gc.ca. What are the ten privacy principles of fair information practices?
Developing a privacy policy statement, modeled after the ten privacy principles, is the key obligation in privacy law compliance. They include: - Accountability: An organization is responsible for personal information under its control and shall designate an individual or individuals who are accountable for the organization's compliance with the following principles.
- Identifying Purposes: The purposes for which personal information is collected shall be identified by the organization at or before the time the information is collected.
- Consent: The knowledge and consent of the individual are required for the collection, use or disclosure of personal information, except where inappropriate.
- Limiting Collection: The collection of personal information shall be limited to that which is necessary for the purposes identified by the organization. Information shall be collected by fair and lawful means.
- Limiting Use, Disclosure, and Retention: Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Personal information shall be retained only as long as necessary for the fulfillment of those purposes.
- Accuracy: Personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.
- Safeguards: Security safeguards appropriate to the sensitivity of the information shall protect all personal information.
- Openness: An organization shall make readily available to individuals specific information about its policies and practices relating to the management of personal information.
- Individual Access: Upon request, an individual shall be informed of the existence, use and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.
- Challenging Compliance: An individual shall be able to address a challenge concerning compliance with the above principles to the designated individual or individuals accountable for the organization's compliance.
The owners, management, and staff members of Cash Money are committed to meet and maintain all relevant, money service business compliance requirements set down under Canada’s privacy laws. We, at Cash Money have incorporated into our corporate privacy policy, the ten personal information privacy principles stated in the Canadian Standards Association (CSA) Model Code and subsequently reflected in the federal Personal Information Protection and Electronic Documents Act (PIPEDA). Our Privacy Code describes the principles Cash Money will use to protect the privacy of personal information in its possession or control. This Privacy Code does not apply to information about business clients who carry on business as corporations, partnerships or in other forms of association. Cash Money does, however, protect the confidentiality of such information in accordance with the law and Cash Moneys’ own policies. This Privacy Code does apply to information about business clients carrying on business in sole proprietorships. Specifically, the owners of Cash Money have implemented various practices to give effect to the CSA principles, including: - Appointment of a Privacy Officer;
- Procedures to protect personal information held by Cash Money or transferred to a third party for processing;
- Procedures to receive and respond to client concerns and inquiries;
- Training staff on an on-going basis to understand and follow Cash Moneys’ policies and procedures; and
- To undertake an annual review of the effectiveness of the policies and procedures to ensure compliance with the Model Code and consideration of any revisions as deemed appropriate.
Furthermore, at Cash Money Protecting Our Client’s Privacy Means: - We keep all personal information and the business the client does with us in strict confidence;
- Information is obtained from the client directly;
- The client has control over how we obtain, use, and give out their personal information;
- Client information is not sold;
- The client has access to their personal information upon making a formal request; and
- We respect our client’s privacy when we market our products and services.
Failure to comply with the CSA principles can result in penalties for non-compliance with the federal legislation. A person is liable to a fine up to $10,000 on summary conviction or up to $100,000 for an indictable offence. The following policies and associated procedures identify how these principles are put into practice so that our employees and subsequently, our clients are aware how we at Cash Money, collect, use, store, disclose, retain, secure, and dispose of client personal information in the course of our various business activities. We may change this policy as new services are added or old ones are changed. Such changes will be effective when a notice of the change is posted. Please check this Privacy Policy from time to time for updates by checking the date of the “Last Update” at the top of this document. 1. Accountability We are responsible for maintaining and protecting the client’s personal information under our control. We have appointed a Privacy Officer who is responsible for ensuring this mandate is met. | -
Ultimate accountability for our compliance with the privacy policy rests with the company owners. -
A full time employee has been appointed Privacy Officer for the company. -
Contact name: Paul Lawrie Telephone: 1-877-293-0311 Facsimile: (905) 602-0391 Email: privacy@cashmoney.ca -
A full time employee is responsible for staff Training of the company’s Privacy Regime. -
Contact name: Paul Lawrie Telephone: 1-877-293-0311 Facsimile: (905) 602-0391 Email: plawrie@cashmoney.ca -
Other employees within CASH MONEY, as part of their work responsibilities, may collect and process day-to-day personal information on behalf of the Privacy Officer. -
Cash Money shall identify to its employees the designated company Privacy Officer. -
Cash Money is responsible for all personal information, client and employee, under its control. -
Cash Money will use contractual agreements, or other means to provide a comparable level of protection, for information being processed by a Third Party. | The responsibilities of the Privacy Officer are as follows: - Development of Policies and Procedures to protect personal information.
- Authority to intervene in Privacy issues relating to any Cash Money’s operations.
- Respond to client inquires and requests for information.
- Analyze all personal information handling practices, including ongoing activities and new initiatives.
- Make information available explaining these policies and procedures to clients through marketing on our website at www.cashmoney.ca.
Responsibilities of the VP of Operations through the Regional Managers are as follows: - Implementation of policies and procedures to protect client personal information.
- Continuous in-branch follow-up to ensure that policies and procedures are adhered to.
Front-line Responsibilities: - Should a client request their personal information, refer them to the Privacy Officer. Always give the office number and extension. Never give an employee cell number or email address to a customer.
2. Identifying Purposes We will only collect information that is necessary for the purposes indicated to the client, either before or at the time the information is collected | - We collect and use personal information to: (a) meet legal and regulatory requirements; (b) authorize and process client transactions; (c) to detect and prevent fraud; (d) help safeguard the financial interests of Cash Money and its clients; (e) develop, offer, and manage the various products and services provided by our company; and (f) to send you information about products and services that may be of interest to you. You may opt out of receiving marketing information by contacting us at any time.
- We only collect and use information that we believe is necessary for the purposes indicated to the client, either before or at the time the information is collected.
- This collection is done in writing using the following forms:
- The “Commercial Cheque Cashing Application’ and ‘Client Registration’ forms (corporate or non-corporate) are used for financial transactions. The client must sign these forms.
- As agent for Western Union the following three forms are completed and signed by the client: (a) to send money; (b) to send a payment; and (c) to receive money.
- As agent for City Phone Service the ‘Service Application’ is completed and signed by the client.
- Additional information is collected for transactions involving: (a) the ‘Remittance Record’ for all sums equal to or greater than $3,000; and (b) the ‘Large Cash Transaction Record’ for cash sums equal to or greater than $10,000.
- Cash Money also takes a photo of each client that is subsequently placed in his or her file.
- Cash Money will make every reasonable effort to ensure that individuals are aware of the purposes for which their personal information is collected by: (a) posting our Code of Privacy statement for client review on our website and in each of our lobbies; and (b) providing a handout outlining our Code of Privacy.
- When personal information is to be used for purposes not previously identified, the new purpose shall be stated prior to use, unless the law requires it, and the consent of the client secured before said information is used for that purpose.
| | We will only collect, use, or disclose personal information with the client’s knowledge and consent, except where required or permitted by law. | - To make an individual’s consent meaningful, the purposes are stated in such a manner that the individual can reasonably understand how the information will be used or disclosed.
- Cash Money obtains expressed consent by obtaining the client signature either before or at the time the information is collected. For client information collected prior to January 1, 2004, Cash Money obtains implied consent by stating and clearly posting the identified purposes for the client to review.
- Cash Money will not, as a condition of the supply of a service, require a client to consent to the collection, use, or disclosure of information beyond that required to fulfill explicitly specified and legitimate purposes.
- Cash Money may be required to collect, use, or disclose personal information without the client’s consent for certain purposes, including legal or security reasons.
- The client is made aware that by withdrawing their consent to use their personal information Cash Money would no longer be able to provide service to the client.
- The client is made aware that they can withdraw their consent to the further use of their personal information at any time, subject to legal restrictions and upon reasonable notice to Cash Money. Reasonable notice is defined as ten (10) working days prior to stopping any further use of the personal information where allowed.
| Consent *: Express consent is given explicitly, either orally or in writing. Express consent is unequivocal and does not require any inference on the part of Cash Money. Implied consent arises where consent may reasonably be inferred from the action or inaction of the client. 4. Limiting Collection We will only collect information that is necessary for the purpose identified, unless we receive consent from the client to collect it for another appropriate purpose. Information shall be collected by fair and lawful means. | - Cash Money will not collect personal information indiscriminately.
- Cash Money will limit the amount and the type of information collected, to that which is necessary to fulfill the purposes identified, in accordance with our policies and procedures.
| 5. Limiting Use, Disclosure, and Retention We will only use or disclose information for the purposes for which it was collected unless the client has otherwise consented, or when it is required or permitted by law. Client information may only be retained for the period of time required to fulfill the purpose for which it was collected. | - Cash Money protects the interests of its employees and clients by taking reasonable steps to ensure that:
- Specific orders or demands for information comply with the laws under which they were issued;
- Casual requests for personal information are denied;
- Personal information is only disclosed with your consent or as permitted by law;
- All calls made to a client’s home or workplace will be done so in a manner that respects their privacy – When messages are left on an answering machine or with any individual other than our client staff will leave only an employee name and phone number. The following details will not be disclosed under any circumstance (even on a personalized voice mail)·
- Nature of the call
- Amount owing
- Except as provided below or as permitted by law, Personal information is only disclosed with your consent. The exception to third-party disclosure is: (a) to authorize and process client transactions; (b) to detect and prevent fraud; (c) in connection with a corporate re-organization, merger or amalgamation, or the sale of the business; and (d) to help safeguard the financial interests of Cash Money and its clients.
- We may transfer relevant information we collect, to our agents, where appropriate who perform services on our behalf.
- Prior to disclosing any personal information regarding a client, Regional Manager approval must be obtained and Duty of Confidential Disclosure must be adhered to.
| 6. Accuracy We will keep the client’s information accurate, complete and up-to-date as is necessary for the purposes for which it is to be used. | - The extent to which personal information shall be accurate, complete, and up-to-date will depend upon the uses of the information, and given the interests of the individual (client) concerned.
- Information shall be sufficiently accurate, complete, and up-to-date to minimize the possibility that inappropriate information may be used to make a decision about an individual (client).
- Cash Money relies on the client and employees, where appropriate, to keep certain personal information, such as address and telephone information, accurate, complete, and up-to-date. For example, a Cash Money teller asks the client at time of a financial transaction if his/her information is current.
- Personal information that is used on an ongoing basis, including information that is disclosed to Third Parties, will generally be accurate and up-to-date unless limits to the requirement for accuracy are clearly set out.
- Personal information that is received from Third Parties, will be the responsibility of the Third Party to ensure that the information is accurate and up-to-date unless limits to the requirement for accuracy are clearly set out.
- The teller or relevant employee at the time the information is collected from the client or a Third Party is responsible for ensuring and/or confirming that the information collected is sufficiently accurate, complete, and up to date to minimize the possibility that Cash Money might use inaccurate information.
| 7. Safeguards We will protect the client’s personal information with appropriate security safeguards. We require our employees to keep all personal information confidential and comply with security standards. | - Cash Money will protect personal information regardless of the format in which it is held.
- The security safeguards shall protect personal information against loss or theft, as well as unauthorized access, use, copying, modification, disclosure or disposal.
- The current methods of protection include:
- Physical measures include: restricted access to offices, alarm systems, and secure filing cabinets.
- Technological measures for electronic transfers include: email and point of sales systems both run on a VPN with a minimum of 128 encryption and a firewall, and the POS system also has several passwords including a sequel server.
- Organizational security measures include: security clearances, limiting access to a ‘need’ to know’ basis, staff training, and a signed confidentiality agreement.
- Investigative measures, should CASH MONEY have reasonable grounds to believe that personal information is being inappropriately collected, used or disclosed.
- Employees are individually required to sign an oath of ethical conduct, including a commitment to keep personal information in strict confidence. Failure to comply will be considered a breech of employment and upon review could result in dismissal.
- All Third Parties are required to safeguard personal information disclosed to them by Cash Money in a manner consistent with the policies of the company. No employee is permitted to remove any personal information regarding a client from the Cash Money premises.
- Care is used in the disposal or destruction of personal information, to prevent unauthorized parties from gaining access to the information.
- Cash Money will shred all personal information kept in paper format, when no longer required or for dormant files (e.g., after 7 years). Permanent deletion of electronic information requires the use of secure passwords by Administration personnel.
| 8. Openness We will make access to this Privacy Statement readily available to all existing and new clients. | - Cash Money is open about its privacy policies and procedures and shall make them available, when requested in a form that is both understandable and comprehensive.
- Cash Money policies and procedures are in both paper and electronic formats and explain the collection, use, disclosure, and disposal of client personal information. In addition, practices and procedures address how a client can:
- obtain their personal information
- correct their personal information
- make an inquiry
- make a complaint, including contacting the Privacy Commissioner of Canada
- Cash Money post their Code of Privacy in all office lobbies, as well as, have a handout for distribution to clients. In addition, the Code of Privacy is prominent and easy to find on the Cash Money website.
- The name of the Privacy Officer and contact information is identified in paper and electronic formats.
| 9. Individual Access We will respond promptly to a client’s request for access to their personal information. | - The client upon written notice, using our ‘Access Record’ may check their information to: verify it, challenge its accuracy and completeness, update and correct it, and to have any obsolete information removed.
- It can be expected that it will take 30 days to gather the information.
- Cash Money will advise the client of a $5.00 cost, associated with providing them a copy of their personal information held by the company.
- In certain situations, Cash Money may not be able to provide access to all the personal information it holds about a client. Exceptions to the access requirement will be limited and specific, and may include:
- the personal information that has been requested by a government institution for the purposes of enforcing any law of Canada, a province or a foreign jurisdiction;
- carrying out any investigation related to the enforcement of any law, the administration of any law, the protection of national security, the defence of Canada or the conduct of international affairs.
- Personnel can not:
- Destroy personal information that an individual has requested;
- Retaliate against a client or employee who has complained to the commissioner or who refuses to contravene Sections 5 to 10 of the Act;
- Obstruct a complaint investigation or an audit by the Commission or her delegate.
- When an individual successfully demonstrates the inaccuracy or incompleteness of personal information, Cash Money will amend the information as required. Depending upon the nature of the information challenged, amendment involves the correction, deletion, or addition of new information.
| Should a client request access to their personal information and is not willing to provide a copy of their ID, the client will be required to complete the Access Request form and send it in via the branch. Should this occur please follow the steps below: - The client must complete the access request form in full and present this to you in person
- The client must provide you with the $5.00 money order. (The money order does not have to be purchased at the branch)
- Request ID from the client
- Document the ID information on the back (see Identification procedures later in this policy)
- Return the ID to the client
- Send the form to Head Office Attn: Privacy Officer using normal procedures
10.Challenging Compliance CASH MONEY is committed to treating our clients with the greatest respect and consideration, and providing the highest level of service. Consequently, concerns about privacy issues will be dealt with directly and expeditiously. | - The client upon written notice, using our ‘Inquiry/Complaint Record’ may make an inquiry or file a complaint under the PIPEDA principles.
- It can be expected that the concern will be addressed directly and expeditiously, and will take up to 30 days to address.
- Any questions or complaints about Cash Money privacy principles or policies should be directed to our Privacy Officer:
- Contact name: Paul Lawrie
Telephone: (905) 219-1502
Facsimile: (905) 602-0391
Email: privacy@cashmoney.ca
Website: www.cashmoney.ca - If, for any reason, the client feels their concerns were not appropriately addressed, they must be made aware that they may then take the matter to the Office of the Privacy Commissioner in Ottawa (or applicable Provincial Privacy Commissioners).
| Prior to processing any transaction that requires identification, you must inform the customer that you will be collecting and copying their ID. Should a client refuse to allow you to photocopy their ID you can still perform the transaction; however you must document the following on the transaction documents instead: - Full Name (first, middle and last)
- Full Address including postal code
- Date of Birth
- Type of ID
- ID Number (unless the identification is a Health Card)*
- ID Issue Date
- Province/Country ID was issued in
- Expiry Date
This information is to be kept with the original transaction documents. *Note: A Health Card can not be accepted for ID under Canada’s Proceeds of Crime Act. For more information please refer to the Policies and Procedures guide section that applies to the product in your transaction. The following definitions apply to the use of the identified terms in this policy statement. - Personal Information is any information that is about or can be linked to an identifiable individual, but does not include the name, title or business address or telephone number of an employee of an organization.
We collect and use personal information to: (a) meet legal and regulatory requirements; (b) authorize and process client transactions; (c) to detect and prevent fraud; (d) help safeguard the financial interests of Cash Money and its clients; and (e) develop, offer, and manage the various products and services provided by our company. Personal Information Collected by Cash Money - Name
- Address
- Date of Birth
- Phone Number
- Government approved identification numbers, including social insurance number, citizenship, passport, or driver’s licence.
- Income
- Credit History
- Bank account number
- References
- For a ‘Payday advance’ a pay stub, bank statement and a personal cheque are also required.
This information is collected verbally and from the identification verifying information provided by the client in order to complete the appropriate form(s). The information is used for the following purposes: Name - To identify the client and ensure Cash Money is providing the product or service to the correct person
Address - To contact the client in the case of a returned item
- To mail the client collection letters
- To meet legal and regulatory requirements such as to provide this information to FINTRAC as required under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act
Date of Birth - To identify the client and ensure we are providing the product or service to the correct person
- To be able to distinguish between clients with the same or similar names
Phone Number - To contact the client in case of a returned item
Identification Numbers - To meet legal and regulatory requirements such as to provide this information to FINTRAC as required under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act
- To identify the client and ensure we are providing the product or service to the correct person
- To be able to distinguish between clients with the same or similar names
- To provide proof to makers of cheques in the case of returned items sent back with a statutory declaration
- To ensure the identification presented is authentic
Income - To determine if the customer meets the minimum income requirements for the pay day advance product
- To determine the maximum amount to advance the customer
- To assess overall risk
Credit History - To list delinquent accounts with the credit bureau
- To skip trace for collection purposes
Bank Account Number - To ensure that all previous advances clear the clients account prior to issuing them an additional advance in order to limit losses
- To ensure that the client is the owner of the account on which they are writing a cheques as repayment for their advance
References ‘Payday advance’ a pay stub, bank statement and a personal cheque - To ensure eligibility for the product service (e.g., employment, income)
- To prevent fraud
- To ensure the client has a current bank account
- is the act of gathering, acquiring, or obtaining personal information from any source, including Third Parties, by any means.
- is the voluntary agreement with what is being done or proposed. Consent can be either express or implied.
Express consent is given explicitly, either orally or in writing. Express consent is unequivocal and does not require any inference on the part of Cash Money.
Implied consent arises where consent may reasonably be inferred from the action or inaction of the client. -
refers to the person within Cash Money who is responsible for overseeing the collection, use, disclosure and protection of personal information, and the day-to-day compliance with the Model Code. -
is making personal information available to others outside of Cash Money. -
is the person who is a user of Cash Money services. -
is any person or organization other than Cash Money. -
refers to the treatment and handling of personal information within Cash Money.
|