Privacy Policy

DE VISSER GRAY LLP
CHARTERED ACCOUNTANTS
PRIVACY AND PERSONAL INFORMATION POLICY

1. INTRODUCTION

• 1.(a) De Visser Gray LLP is strongly committed to a “best practices” approach to information privacy, for the
  benefit of our clients, employees and others who interact with our organization.
• 1.(b) Our privacy commitment is an integral part of our commitment to our clients and our employees.
• 1.(c) In this privacy policy, “we”, “our” and “us” refers to De Visser Gray.

2. WHY WE COLLECT USE AND DISCLOSE PERSONAL INFORMATION

• 2.(a) We collect personal information about our individual clients for the purposes of providing professional
  advice and business services to them. Usually, the scope of advice and service is set out in detail in a formal
  engagement letter.
• 2.(b) As part of our client services these purposes include evaluating, monitoring and assessing the tax and
  accounting requirements of our clients, recommending changes to asset structures, recommending changes to liability
  provisions and risk management, recommending retainer of other consultants such as brokers, legal counsel and
  insurance agents, strategy consultations for items such as tax disputes and other arrangements.
• 2.(c) We also collect information about individual shareholders, employees and directors of organizations in the
  course of providing services to our clients which are organizations. This information is collected as necessary to
  properly evaluate and plan the structure and activities of these organizations. This information is not utilized to review
  or analyze the personal financial affairs of any of these individuals, unless that is the subject of a separate engagement.
• 2.(d) If an individual client also is involved in organizations for which we are separately retained to provide
  services, we will use their personal information for the purpose of coordinating the collective financial affairs of the
  individual and these organizations, as well as cross-checking and verifying the accuracy and consistency of information
  relevant to both retainers.

3. WHAT KINDS OF PERSONAL INFORMATION WE COLLECT

• 3.(a) We collect a wide variety of personal information in connection with our services. This information primarily
  relates to the financial, tax and business affairs of our clients.
• 3.(b) In connection with our consulting work we collect and analyze information on matters such as personal
  assets, family relationships, retirement savings, the financial affairs of family members and intended beneficiaries and
  the tax status of those personal and organizations who may be impacted by the plan.

4. HOW WE COLLECT PERSONAL INFORMATION

• 4.(a) Most of the personal information collected by us is provided directly by the individual.
• 4.(b) In some cases, information is provided to us by an organization with which the individual is associated as a
  director, officer or shareholder. In such circumstances, we are relying on that organization to have obtained any
  necessary or appropriate consents.
• 4.(c) In some instances, for example in tax planning, a client may provide us information about other individuals
  (eg. spouses). Again, we are relying on our client to have obtained any necessary or appropriate consent(s).
• 4.(d) Occasionally, we are provided information, with consent of our client, directly from other advisers or
  representatives of our client. Examples include legal counsel, brokers, bankers, insurance agents and predecessor
  accountants. In these circumstances, we infer that it is appropriate for us, in our best discretion, to disclose client
  information to these other advisers in the course of working directly with them on client projects, unless specific
  restrictions are imposed in the engagement letter.
• 4.(e) Information is collected from government and regulatory bodies on instruction of and with the consent of
  the client.
• 4.(f) Information is also collected from publicly available sources and as permitted by applicable law.

5. CONFIDENTIALITY

• 5.(a) As chartered professional accountants, we are concerned with the confidentiality of the personal
  information entrustedto us in our engagements. Our firm adheres to the highest standards of confidentiality and abides
  by the accountinginstitute standards and ethics applicable in British Columbia.
• 5.(b) Our employees have been instructed in client confidentiality. All staff are required to sign a specific pledge
  of secrecy and independence, a copy of which will be made available on request.

6. DISCLOSURE

• 6.(a) As a general rule, we only disclose personal information of our clients as instructed by them. However,
  there are a number of exceptions. Circumstances of disclosure without consent include:
  • (i) as permitted or required by applicable law (e.g. compulsion by court order; investigation of suspected fraud).
  • (ii) to defend our firm in proceedings arising from statements or opinions issued by us in the cause of our
    professional services (e.g. negligence claim on an audit letter).
  • (iii) to professional regulatory bodies, as required by legislation, rules, policies or codes governing our
    profession.

7. PERSONAL EMPLOYEE INFORMATION

• 7.(a) Where an individual is an employee or a candidate for employment, we consider that we have implicit
  consent to collect, use and disclose employee personal information in circumstances set out below.
• 7.(b) We will only collect, use and disclose personal employee information without express consent when it is
  reasonable for the particular purpose of the establishment, administration, management and termination of the
  employment relationship. Administration of the employment relationship will include interaction with benefit providers
  and others in the provision of our employee benefits and pension plans.
• 7.(c) We will disclose personal employee information without the individual’s consent to another organization in
  responding to a request for a reference only when you have provided specific consent for this to occur.
• 7.(d) Personal information of employees can also be collected, used and disclosed without the individual’s
  consent where required or permitted by applicable law.
• 7.(e) In other circumstances, the consent of the employee will be required for any use or disclosure of their
  personal information.

8. GIVING ACCESS TO AND CORRECTING PERSONAL INFORMATION

• 8.(a) Upon written request, we will give an individual or his or her authorized representative (an “applicant”)
  access to his or her personal information that is in our custody or under our control. We will also let the applicant know
  what the information we have on file is being used for and how and under what situations the information is being or has
  been disclosed by us.
• 8.(b) If we do not have an actual record of the persons or organizations that the applicant’s personal information
  has been disclosed to, we will tell them who or what organizations their information may have been disclosed to.
• 8.(c) We may require an applicant to give us evidence of his or her identity so we can ensure that the applicant
  has the right to access the individual’s personal information but we will only use such information for the purpose of
  identification and authentication.
• 8.(d) We will act reasonably in searching for an applicant’s personal information.
• 8.(e) We may charge an appropriate fee, when permitted, for processing the request. Information on applicable
  fees will be provided to an applicant.
• 8.(f) Clients and employees may seek access to their personal information by contacting the Privacy Officer of
  the firm. If you have questions, the firm’s Privacy Officer is James D. Gray. He can be contacted at
  jgray@devissergray.com or by phone at 604-687-5447 ext 226. Also see item 13.
• 8.(g) We may refuse access to all or part of an applicant’s personal information in the following situations:
  • (i) the information is protected by any legal privilege;
  • (ii) the disclosure of the information would reveal confidential business information and it is not unreasonable to
    withhold the information;
  • (iii) the information was collected for an investigation or legal proceeding;
  • (iv) the disclosure of the information might result in that type of information no longer being supplied and it is
    reasonable that the type of information be supplied; or
  • (v) the information was collected by a mediator or arbitrator.
• 8.(h) If we are reasonably able to sever the information contained in the above exceptions from a requested
  record, we will give access to the remainder of the information in the record.
• 8.(i) We are required by law to refuse access to all or part of an applicant’s personal information in the following
  situations:
  • (i) the disclosure of the information could reasonably be expected to threaten the life or security of another
    individual;
  • (ii) the information would reveal personal information about another individual; or
  • (iii) the information would identify the individual who gave an opinion about another individual and the individual
    giving the opinion does not consent to the disclosure of his or her identity.
• 8.(j) If we are reasonably able to sever the information contained in the above exceptions from a requested record,
  we will give access to the remainder of the information in the record.
• 8.(k) We will inform the applicant if he or she will be given access to all or part of his or her personal information. If
  access is to be given, we will inform the applicant of when access will be given. If access to all or part of the applicant’s
  personal information is refused, we will inform the applicant of the reasons for refusal and the specific exception(s) tothe
  right of access on which the refusal is based. We will also inform the applicant of the name of the person in our
  organization who can answer questions regarding the refusal, and of the applicant’s right to ask a Privacy Commissioner
  having jurisdiction for a review of our decision to refuse access.
• 8.(l) If an individual believes that his or her personal information in our custody or under our control has a mistake
  in it or is missing some information, he or she may request that we correct the information.
• 8.(m) If we decide that the information should be corrected, we will do so as soon as reasonably possible. As
  appropriate, we will also send the corrected information to every organization that our records show has received the
  wrong information.
• 8.(n) If we decide not to correct the information, we will make a note on the individual’s personal information
  indicating that a correction was requested.
• 8.(o) We will not correct or change an opinion, including a professional or expert opinion. We will make a note on
  the individual’s personal information indicating that a correction or change was requested.

9. ACCURACY

• 9.(a) We will ensure personal information used or disclosed by us will be sufficiently accurate, complete and up-
  to-date to minimize the possibility that inappropriate information may be used to make a decision about an individual.
• 9.(b) We will update personal information about clients and employees as and when necessary to fulfill the identified purposes or upon notification by the individual.

10. PROTECTION

• 10.(a) We will use reasonable security safeguards to protect personal information against such risks as loss or
  theft, unauthorized access, disclosure, copying, use, modification or destruction. We will protect personal information
  regardless of the format in which it is kept and used.
• 10.(b) We will protect personal information using physical, administrative and technical safeguards that are
  appropriate to the sensitivity of the information.

11. RETENTION

• 11.(a) We will keep personal information only as long as it remains necessary or relevant for the identified
  purposes, as required for normal business purposes, as required by law, or as otherwise stated in retainer letters with
  our client.
• 11.(b) Our current policy is to permit or consider our closed files to be destroyed any time after 10 years have
  passed since the file was closed, unless the nature of the file or the engagement circumstances would require otherwise,
  in our reasonable discretion.
• 11.(c) We will maintain reasonable and systematic controls, schedules and practices for information and records retention and destruction which apply to personal information that is no longer necessary or relevant for the identified
  purposes or required by law to be retained. We will destroy, erase or make such information anonymous.

12. PROCEDURE FOR HANDLING COMPLAINTS

• 12.(a) An individual who believes that our organization has not complied with this Policy has the right to make a
  written complaint about the matter to our organization. We will use our internal compliant handling procedure to
  investigate and attempt to resolve the matter. Our internal complaint handling procedure is as follows:
  § a complaint in writing is made to the firm’s Privacy Officer;
  § the firm’s Privacy Officer conducts an internal review, consulting with the engagement partner and
  other representative(s) as appropriate; and
  § the firm’s Privacy Officer will provide a written response to the individual within a reasonable time
  (usually 45 days).
• 12.(b) An individual always has the right to make a complaint to a Privacy Commissioner having appropriate
  jurisdiction or to ask the Commissioner to review a decision we have made. However, individuals are encouraged to use
  our internal complaint handling procedure first.
• 12.(c) We will provide the complainant with a copy of this Policy, together with any relevant explanatory materials,
  upon request.
• 12.(d) We may decide not to investigate a complaint if:
  • (i) the complaint relates to an act or practice that is not a possible breach of the privacy requirements;
  • (ii) the complaint relates to an act or practice that is no longer reasonably able to be investigated because of the
    length of time since it occurred;
  • (iii) the act or practice relates to an event which occurred prior to the organization being subject to this Policy;
  • (iv) the complaint is trivial, frivolous or vexatious; or
  • (v) the complaint relates to an act or practice that is the subject of court proceedings that have commenced or
    are intended to be commenced.
• 12.(e) With the exception of complaints that we have decided not to investigate we will investigate and respond to
  all complaints within a reasonable period of time (usually, within 30 days). If the complaint is found to be justified, we
  will take appropriate steps to resolve the complaint including, if necessary, amending our policies and procedures (or
  this Policy).
• 12.(f) A complainant will be expected to provide sufficient details of how the complaint arose, including the
  identification of the parties involved, if known, copies of any relevant documentation and reasons why the complainant
  believes his or her privacy may have been breached.
• 12.(g) A complainant may be represented by a legal practitioner or other advocate.
• 12.(h) We will inform the complainant of the outcome of our investigation regarding his or her complaint.

13. MONITORING/REVIEWING THE OPERATION OF THE CODE

• 13.(a) We will monitor compliance with this Policy.
• 13.(b) Our Privacy Officer will review this Policy annually to ensure that the Policy is still serving its stated
  purposes; that it is being complied with; that the internal complaint handling procedure is still effective; and to
  determine if there are any amendments that should be made to improve the operation of the Policy.
• 13.(c) Our Privacy Officer can be contacted as follows: