Broadstreet Properties Ltd.
Personal Information Protection Policy

Introduction

This Privacy Policy (the “Policy”) describes the practices of Broadstreet Properties Ltd. and its subsidiaries (collectively, “Broadstreet”, “we”, or “us”) in relation to the collection, use, disclosure and protection of information about an identifiable individual (“Personal Information”). In particular, this Policy applies to Personal Information that Broadstreet collects about individuals who:

(a) are prospective, current or former residents, occupants, guarantors or third-party payors of rent;

(b) are prospective employees;

(c) are prospective, current or former vendors, suppliers, consultants, contractors, service providers or advisors, including providers of technology, customer service, security systems, tenant insurance, television, telephone, telecommunication, internet and internet connectivity, and utilities (collectively, “service providers”);

(d) visit Broadstreet’s properties or offices;

(e) request services from Broadstreet;

(f) visit Broadstreet websites, including https://www.broadstreet.ca and https://www.broadstreetcommercial.ca;

(g) use Broadstreet mobile or web applications; or

(h) otherwise interact with us.

This Policy was created to inform you of Broadstreet’s commitment to protecting your Personal Information and is based on applicable privacy laws.

By using Broadstreet’s goods/services (including our website(s)) or otherwise interacting with us, you are accepting the terms of this Policy. If you do not agree to the terms of this Policy, please do not use Broadstreet’s goods/services or interact with us. If you do not understand, or if you have questions about, this Policy, please contact our Privacy Officer before using, or continuing to use, Broadstreet’s goods/services or interacting with us.

Nothing contained in this Policy is intended to create a separate contract or agreement between Broadstreet and you.

How Broadstreet Collects Personal Information

Broadstreet may collect Personal Information (a) directly from you; (b) through automated means; and/or (c) from third-parties or other sources.

Directly from you

Broadstreet collects Personal Information you provide directly to Broadstreet:

(a) by mail, email, telephone, text or other electronic means;

(b) through websites, mobile or web applications;

(d) in any other direct manner (for example, when you apply for a lease, participate in a survey, submit a job application or submit a bid or quote to provide services).

Through automated means

Broadstreet may collect Personal Information using automated means, including when you visit our rental property, contact us over the phone, through video surveillance, video recordings, audio equipment, audio recordings, or cookies, pixels and similar technologies when you interact with Broadstreet’s website(s) or mobile or web applications.

From third party sources

Broadstreet may collect Personal Information from third parties.

Subject to your consent or if required or permitted by applicable law, Broadstreet may collect Personal Information from current and former employers, current and former landlords, personal references, background check services, credit reporting agencies, and financial institutions.

Broadstreet may also collect Personal Information from other third parties, including, but not limited to, Broadstreet-related companies, service providers, co-residents, occupants, guarantors, third-party payors of rent, business partners, brokers, recruiters, credit bureaus, and registrar and transfer agents.

Broadstreet may also collect Personal Information from publicly available sources of information or from authorities or public bodies.

Cookies and Similar Technologies

When you visit the Broadstreet website(s), Broadstreet may collect and use your internet protocol address to help diagnose problems with Broadstreet’s server and to administer our website(s), to understand how users interact with the Broadstreet website(s), and to gather broad demographic information. Broadstreet may also collect web page choices, information about your browser, device, platform, and operating system and versions, and time you spend on the website(s), to help Broadstreet improve your user experience. Although the Broadstreet website(s) may collect high-level information about your location (for example, the longitude and latitude associated with your municipality), they do not collect precise geolocation without your consent.

Broadstreet uses “cookies”, a technology that installs a small amount of information on a website user’s computer, to permit Broadstreet’s website(s) to recognize future visits using that computer and to avoid having to register your contact information at each visit. Cookies enhance the convenience and use of Broadstreet website(s). For example, the information provided through cookies is used to recognize you as a previous user of Broadstreet’s website(s), to track your activity on Broadstreet’s website(s) and obtain general information about other websites you have visited, to respond to your needs, and to otherwise facilitate your experience on Broadstreet’s website(s). You may choose to decline cookies if your browser permits, but doing so may affect your use of Broadstreet’s website(s) and your ability to access certain features of Broadstreet’s website(s) or engage in transactions through our website(s).

Broadstreet also uses web cookies and pixel tags to track user behaviour on Broadstreet’s website(s) and to compile reports regarding user demographics, and website tracking patterns. Within Broadstreet’s applications, Broadstreet may also use analytic tools and automated tracking technology or methods. Broadstreet uses these tools to analyze and enhance the user experience.

Broadstreet may use third-party advertising networks to display advertising on Broadstreet’s website(s) or other websites. These advertising networks use cookies or similar technologies to track your navigation habits on our website(s) and third-party websites in order to serve you advertising that is customized to your inferred interests and preferences. For example, a cookie may be placed on your computer when you visit a Broadstreet website, which is recognized and used by third-party advertising networks to serve you with a Broadstreet ad when you visit other websites within their advertising network. As described above, you may be able to set your browser to decline cookies. Where required by law, Broadstreet will ask for your consent before enabling such technologies. If you decline cookies, you may still receive online advertising; however, it may be less personalized. Some advertising networks participate in industry programs that include web pages to visit to opt-out. For example: http://youradchoices.ca/choices.

What Personal Information Broadstreet Collects

The Personal Information that Broadstreet may collect includes:

(a) lease application information, including name and contact information (such as your email address, residential address and telephone number) for prospective residents, occupants, guarantors or third-party payors of rent, income and other financial information, rental history, references, credit history (including credit score and credit report from credit reporting agencies) and employment-related information;

(b) tenancy information, including name and contact information for all residents, occupants, guarantors or third-party payors of rent, emergency contact information, emergency medical information, proof of insurance, vehicle related information, bank account information and ownership of pets;

(c) job application information, including name, contact information, resume, employment references, information in connection with credit checks and criminal record checks, education, recommendation letters, interview notes, employment history, eligibility to work in Canada and any additional information provided in the application form. Broadstreet sometimes works with recruitment agencies and job-board websites as part of its talent recruitment strategy. If you apply to a position with Broadstreet through these third parties, relevant Personal Information needed to process your job application may be passed on to Broadstreet in order to assess your candidacy. If you are offered employment Broadstreet will collect additional Personal Information pursuant to internal policies that will be communicated to you at that time;

(d) service provider information, including name, contact information, bids/quotes, customer references, proof of insurance and bank account information;

(e) website and applications data, including cookies, location data, web logs and internet protocol address; and

(f) other information that may be used for the purposes described below and as may be requested from you from time to time;

all of which is Personal Information only to the extent it can identify an individual.

How Broadstreet Uses the Personal Information

Unless otherwise consented by you in advance, or as may be permitted or required by law, Broadstreet will only use and disclose your Personal Information to fulfill the purposes for which it was collected (and in accordance with this Policy).

Broadstreet uses Personal Information for the following purposes:

(a) to determine your suitability for a lease, including creditworthiness;

(b) to schedule property viewings;

(c) to administer your lease agreement and tenancy or otherwise administer Broadstreet’s relationship with you; including to communicate with you, process rent payments, arrange for maintenance or repairs, to confirm payment of utility bills, to facilitate the set-up, switch-over or closing of utility accounts, to repay security deposits, to monitor and effect insurance and to collect debts;

(d) to enforce the terms of your lease agreement, including collection of any judgment that may be obtained against you as a consequence of a breach of your lease agreement (or other related agreement);

(e) to communicate with you regarding your job application and/or process information related to a job application or offer of employment;

(f) to communicate with employees and administer the employment relationship;

(g) to communicate with service providers and administer and enforce contracts;

(h) to communicate with you by email, phone or mail about Broadstreet’s services, events, surveys, and other information that may be relevant to you;

(i) to protect Broadstreet’s assets, business, properties, residents, occupants, employees and other individuals;

(j) to facilitate actual or potential business transactions, such as the sale of assets or any financing;

(k) for business planning purposes, internal control, business continuity and internal/external auditing;

(l) to respond to your request or inquiry;

(m) to document and investigate incidents;

(n) prevent fraud or the recurrence of fraud;

(o) to investigate, resolve or defend any complaint, dispute, claim or investigation;

(p) to comply with a legal obligation;

(q) to measure performance (such as our customer care interactions with you);

(r) to conduct surveys and research to better understand the preferences of our customers like you;

(s) to provide you with, and improve, relevant marketing offers or information from us or third parties;

(t) for other legitimate business activities;

(u) to assist in the event of an emergency;

(v) to otherwise provide you with, or maintain and improve, our services;

(w) for other purposes that may be communicated separately;

(x) as otherwise required or permitted by law; and

(y) as otherwise provided in this Policy.

In some cases, we may de-identify your Personal Information as soon as we collect it. In these cases, your information is non-personal information. We may use non-personal information for any legitimate business purpose.

Use of Video Surveillance, Recordings and Photographs

Video equipment may be installed and operating in common areas of Broadstreet’s rental buildings and offices and/or in Broadstreet’s company vehicles (outward facing). The video equipment may have capabilities such as zoom, or night-vision features. The video equipment may be operating at all times. Surveillance of the video recordings or the taking of photographs may occur at any time to: (a) ensure the safety, security and reasonable enjoyment of Broadstreet’s residents, occupants, employees, service providers and other visitors to Broadstreet’s rental properties and offices; (b) ensure you have access to the premises, equipment and services that Broadstreet has agreed to provide; (c) to preserve Broadstreet’s property and to deter crime; (d) to document and investigate incidents; (e) to investigate, resolve or defend any complaint, dispute, claim or investigation; and/or (f) to assist in administration of business operations.

Where required by law, visible signs will be posted informing you that video equipment is operating and recording Personal Information about you and the reasons for use of this equipment. Such recording will comply with all applicable laws, including privacy and security. You can contact Broadstreet’s Privacy Officer if you have questions regarding the video recordings.

Use of Audio Equipment and Recordings

Broadstreet may make audio recordings of its employees, service providers, residents or other individuals. There are several purposes for making the recordings, which include: situations where there are work-related performance issues in respect of Broadstreet’s role as employer, to ensure the safety of the workplace, for quality control, for training, and to prevent harassment.

Audio recordings may be made during meetings, interviews, or telephone calls between Broadstreet and its employees, service providers, residents and other individuals.

Such recordings will comply with all applicable laws, including privacy and security. You can contact Broadstreet’s Privacy Officer if you have questions regarding the audio recordings.

To Whom Broadstreet Discloses Your Personal Information

Except as set forth in this Policy, or as required or permitted by law, we do not disclose your Personal Information to any third parties other than to our service providers and our affiliates, and their respective directors, officers, employees, agents, consultants, advisors or other representatives that have a need to use your Personal Information to provide or improve our services, to legal or regulatory authorities, or for other purposes for which you have provided your consent. In no event will we sell or rent your Personal Information.

Broadstreet may disclose your Personal Information:

(a) to Broadstreet’s affiliates;

(b) to Broadstreet’s service providers, who may use Personal Information on Broadstreet’s behalf in connection with the purposes listed above, including to communicate with you directly. We will act in a reasonable manner, including by contractual or other means, to ensure that the third party service provider agrees to similarly be bound by this Policy or a privacy policy that provides substantially similar measures to those employed by us to protect the privacy and security of your Personal Information and to similarly comply with applicable privacy legislation with respect to your Personal Information, but we cannot guarantee such latter compliance by the third party;

(d) to external auditors;

(e) to any co-resident, occupant, guarantor or third-party payor of your rent if required under your lease agreement or related housing agreement;

(f) through public directories of residents maintained by Broadstreet (e.g., by the front door);

(g) to credit reporting agencies to evaluate your credit worthiness in connection with an application for lease;

(h) to former and current employers, former and current landlords, personal references, and present banking institution, all of whom are named by you in documents submitted to Broadstreet so that Broadstreet may contact them as part of the process of evaluating your lease or job application, as the case may be;

(i) to third parties to enforce the terms of your lease agreement (or any related agreement), including collection of any judgment that may be obtained against you as a consequence of a breach of your lease agreement (or any related agreement);

(j) to governmental authorities when required to comply with Broadstreet’s legal obligations (for example, Broadstreet may disclose your Personal Information to Canada Customs & Revenue Agency, to whose attention the T-5 interest income tax information return and/or the NR4 non-resident withholding tax information return is submitted (where applicable));

(k) to third-parties in connection with a disposition of your building, an assignment of your lease agreement (or other related agreement) or to obtain financing;

(l) to advisors or potential buyers or financiers in connection with an actual or potential business transaction, such as the sale of assets or any financing;

(m) to comply with your directions or any additional consent you have provided us;

(n) for the purpose of collecting a debt you owe to us;

(o) to other parties where we are under a duty to disclose your Personal Information to comply with any applicable legal obligation including a regulatory process, or an order of a government institution, investigative body, regulatory body or judicial authority of competent jurisdiction;

(p) where we transfer or are considering transferring control of any or all our assets, operations or services to a third party acquirer of all or substantially all of our assets, including our rights and obligations relating to the goods/services we provide, to a third party. The third party may continue to retain and use the Personal Information that you provided to us. We will act in a reasonable manner, including by contractual or other means, to ensure that the third party agrees to similarly be bound by this Policy or a privacy policy that provides substantially similar measures to those employed by us to protect the privacy and security of your Personal Information and to similarly comply with applicable privacy legislation with respect to your Personal Information, but we cannot guarantee such latter compliance by the third party acquirer; and

(q) where we merge, consolidate, or amalgamate with a third party, the merged, consolidated, or amalgamated entity may continue to use and disclose your Personal Information. We will use our best efforts to ensure that the merged, consolidated, or amalgamated entity agrees to similarly be bound by this Policy or a privacy policy that provides substantially similar measures to those employed by us to protect the privacy of your Personal Information and to similarly comply with applicable privacy legislation with respect to your Personal Information, but we cannot guarantee such compliance.

We disclose non-personal information to third parties as reasonably necessary to meet our business needs. We do not disclose your Personal Information to third parties for their own direct marketing purposes without your consent.

Transfers of Personal Information to Other Jurisdictions

Broadstreet may store your Personal Information within or outside of Canada. Some of Broadstreet’s service providers may also access, process or store your Personal Information outside the province where you reside. In that case, Broadstreet uses reasonable safeguards to ensure that Broadstreet’s service providers protect your Personal Information wherever it is used or stored. When your Personal Information is used or stored in a jurisdiction other than where you reside, it may be subject to the law of that foreign jurisdiction, including any law permitting or requiring disclosure of the information to the government, government agencies, courts and law enforcement in that jurisdiction.

Consenting to Broadstreet’s Collection, Use and Disclosure of Your Personal Information

We will obtain your express consent prior to or when collecting, using, or disclosing your Personal Information for any purpose not described in this Policy, or for a purpose that was not identified to you nor reasonably expected at the time of collection, unless we are required or permitted by law not to obtain your consent.

We may rely on your implied consent in certain circumstances, after considering factors such as the sensitivity of the Personal Information and your reasonable expectations. We will limit the collection, use, and disclosure of your Personal Information to only that which is necessary for the purposes identified, unless you have otherwise consented, or when such collection, use, and/or disclosure is permitted or required by law.

You can always refuse to provide your Personal Information, except that it may prevent you from using our goods/services or receiving responses to your inquiries or other information of interest.

Protection of your Personal Information

Broadstreet retains your Personal Information only for as long as it is reasonably required for business or legal purposes. Broadstreet will protect your Personal Information in a manner that is consistent with and appropriate to the sensitivity of that Personal Information. For example, Broadstreet employs physical, technical and organizational measures to ensure its security and confidentiality.

Depending on the volume and sensitivity of the Personal Information, the purposes for which it is used and the format in which it is stored, Broadstreet implements a combination of measures to protect your Personal Information, including:

• Internal practices that limit employee access to Personal Information;

• If information is collected or stored in electronic format, technical safeguards such as encryption, firewalls, antivirus software and similar measures;

• A designated Privacy Officer to monitor Broadstreet’s compliance with applicable privacy laws;

• Employee privacy and data security training; and

• Procedures for receiving, investigating and responding to complaints or inquiries regarding Broadstreet’s Personal Information handling practices, including any security incidents involving Personal Information.

An organization must protect Personal Information that is in its custody or under its control by making reasonable security arrangements against such risks as unauthorized access, collection, use, disclosure, copying, modification, disposal or destruction. We encourage you to review the privacy policies of our service providers and contractors for information on their privacy practices.

While Broadstreet takes all reasonable measures to safeguard your Personal Information, please note that no method of electronic transmission of Personal Information can be guaranteed to be completely secure. If you suspect an unauthorized use or security breach of your Personal Information, please contact our Privacy Officer as soon as possible.

Exercising your Right to Access or Update your Personal Information

On your reasonable written request, we will provide you, not later than thirty (30) days from our receipt of your request, or such additional time as required by law, with access to or information about your Personal Information (if any) under our custody or control, and the names of persons to whom, and any circumstances in which, your Personal Information has been and is being disclosed by us. You must provide sufficient information in your request to allow us to verify your identity and identify the information you are seeking.

If you request a copy of your Personal Information and the Personal Information can reasonably be reproduced, we will provide you with a copy of the Personal Information, or, if applicable, we will give you reasons for any delay in providing a copy of the requested Personal Information. All requests may be subject to minimal costs, in accordance with applicable privacy legislation.

We reserve all rights not to disclose Personal Information, in whole or in part, in certain circumstances permitted or required by law, including but not limited to where:

• the Personal Information is protected by any legal privilege;

• the disclosure of the Personal Information would reveal confidential commercial information;

• the disclosure could reasonably be expected to threaten the life or security of another individual;

• the Personal Information was generated during a formal dispute resolution process; or

• the Personal Information was collected by us without your knowledge and consent for reasonable purposes related to investigating a breach of an agreement or a contravention of the laws of Canada and/or a province/territory.

If access to your Personal Information is refused, in whole or in part, we will provide you with the reasons for the refusal, the provision of applicable privacy legislation on which the refusal is based, and the contact information of our Privacy Officer who can answer your questions about the refusal, and will inform you that you may ask for a review of the refusal in accordance with applicable privacy legislation.

The accuracy of the Personal Information we have about you is very important and we may rely on it to provide you with our services.

You must ensure this Personal Information remains accurate and current at all times. We are under no duty to detect any inaccurate, inconsistent, or incomplete Personal Information provided to us.

On your request, we will make every reasonable effort to correct outdated Personal Information, or errors or omissions in your Personal Information where that Personal Information is in our custody or control. Such request must be in writing, signed by you, and include sufficient detail to enable us to identify any Personal Information in our custody or control in relation to the request.

We will, as soon as reasonably practical and not later than thirty (30) days from our receipt of your request, or within such additional time as permitted or required by law, either correct the Personal Information and, if applicable and reasonable to do so, send correction notifications to any third party to whom we disclosed the incorrect Personal Information, or decide not to correct the Personal Information (i.e. if it is not shown to be factually inaccurate or incomplete), but we will annotate the Personal Information under our control to indicate that a correction was requested but not made.

We will inform you of the action that we have taken in response to your request for correction, the contact information of our Privacy Officer who can answer your questions about your request for correction, and that you may ask for a review of the action taken in accordance with applicable privacy legislation

Any questions with regard to your privacy rights, including requesting access to, or an update of, Personal Information, may be addressed to the Privacy Officer. Our security procedures mean that we may request proof of identity before we disclose your Personal Information to you.

Third Party Websites

Broadstreet may provide links to other websites that are not operated or controlled by Broadstreet. These websites are not governed by this Policy and Broadstreet does not have control over the collection, use and disclosure practices of these third parties. You should review the privacy policy associated with any linked website prior to visiting the site or providing any information.

Children’s Personal Information

Broadstreet’s website(s) are for those who are over the age of majority in the jurisdiction in which they reside. Broadstreet does not knowingly solicit or collect any Personal Information from children under the age of majority through Broadstreet’s website(s). If you are under the age of majority, please do not submit any Personal Information through the website(s) or otherwise. If Broadstreet is notified or discovers that a child under the age of majority has submitted Personal Information to us, Broadstreet will take reasonable steps to delete the information. If you think we have received Personal Information from children under the age of majority in the jurisdiction in which they reside, please contact our Privacy Officer immediately.

Changes to Broadstreet’s Privacy Policy

The date on which this Policy was last amended is indicated above. Broadstreet reserves the right to change this Policy from time to time. Broadstreet will display a prominent notice that this Policy has been amended on its website(s) for a period of thirty (30) days. The amended Policy is effective when posted. Your use of Broadstreet’s goods/services (including Broadstreet’s website(s)) after Broadstreet has made changes to the Policy will mean that you have accepted those changes.

Responsibility for Compliance with our Policy

Our Privacy Officer is responsible for overseeing Broadstreet’s compliance with this Policy and may be contacted at the following address:

privacy@broadstreet.ca

250.850.3347

100 St. Ann’s Rd.

Campbell River, BC

V9W 4C4

Please address any questions or concerns about our compliance with this Policy or our privacy practices generally to the Privacy Officer.

Privacy Policy & Terms of Use

Broadstreet Properties Ltd. Personal Information Protection Policy