WE TAKE PRIVACY VERY SERIOUSLY

Privacy Statement

Our Commitment to Protecting Your Privacy: Your privacy is important to LOGITACTIC CANADA INC. We’ve developed this Global Privacy Statement that covers how LOGITACTIC CANADA INC. and its affiliates worldwide collect, use, disclose, transfer and store your information. To make sure your personal data is secure, we communicate our information security and privacy guidelines to all LOGITACTIC CANADA INC. employees and strictly enforce privacy safeguards within the company. In addition, we abide by the Canadian privacy law enforcement. We encourage you to read this Privacy Statement and to familiarize yourself with our privacy practices before submitting personal data, and please let us know if you have any questions.

Information you provide may be transferred or accessed by LOGITACTIC CANADA INC. affiliates or third party service providers we have retained to perform services on our behalf around the world as described in this Privacy Statement. LOGITACTIC CANADA INC. complies with the the Canadian privacy law regarding the collection, use, and retention of personal information.

Please visit: https://www.cippguide.org/2010/05/18/canadian-privacy-act/

Personal Data We Collect:

“Personal data” is information that can be used to uniquely identify or contact an individual and includes a variety of information such as your name, mailing address, phone number, e-mail address and contact preferences.
We collect your personal data for various business purposes. We only collect the information we need to fulfill the business purpose.
We may also ask you for specific identification information data, but only in limited circumstances such as when setting up an account with LOGITACTIC CANADA INC or when determining whether to extend commercial credit.
LOGITACTIC CANADA INC may share your personal data with other LOGITACTIC CANADA INC group companies or third party service providers we have retained to perform services on our behalf and use it consistent with this Privacy Statement. We may also combine it with other data to provide and improve our products, services, content and advertising.
In addition, we may also collect information relating to your use of our web sites through the use of various technologies, including cookies.

Notice and Choice:

We will notify you about the types of personal data we collect, the purposes for which we collect such information and the types of third parties to which we disclose such data. We will also notify you if LOGITACTIC CANADA INC intends to use or disclose the information collected for a purpose other than that for which was originally collected.
When we collect personal data from you, you may tell us that you do not want it used for further marketing contact. Alternatively, you can tell us now.
You may also turn off cookies in your web browser.

Uses of Your Personal Data:

We use your personal data for legitimate business purposes only including:

To fulfill your requests by us or by others involved in fulfilling your transaction requests;
To personalize your experience while you are on our sites, make navigation easier and for web site usage data;
To support products or services you have obtained from us;
For marketing purposes by LOGITACTIC CANADA INC. and selected organizations if you have permitted such use;
To contact you for customer satisfaction surveys, market research or in connection with certain transactions;
In connection with a job application or inquiry;
To monitor or record call, chats and other interactions; and
To run our business operations and manage our risks, including protecting the rights and property of LOGITACTIC CANADA INC and others, legal and internal compliance, and audit and security purposes.

Collection and Use of Non-Personal Data:

We also collect “non-personal data”, which is information in a form that does not permit direct association with any specific individual. We may collect, use, transfer, and disclose non-personal data for any purpose.
Aggregated data is considered non-personal data for the purposes of this Privacy Statement.
If we combine non-personal data with personal data the combined information will be treated as personal data for as long as it remains combined.

Integrity and Retention of Personal Data:

LOGITACTIC CANADA INC. makes it easy for you to keep your personal data accurate, complete, and up to date by providing you access to your data. LOGITACTIC CANADA INC. will retain your personal data for the period necessary to fulfill the purposes described in this Privacy Statement unless a longer retention period is permitted by law.

Access to Your Personal Data:

You can help ensure your online contact information and preferences are accurate, complete and up to date by logging in to your account with us.
For other personal data we make good faith efforts to provide you with access so you can request that we correct the data if it is inaccurate or delete the data if LOGITACTIC CANADA INC. is not required to retain it by law or for legitimate business purposes.
We may decline to process requests that are unreasonably repetitive, require disproportionate technical effort, violate the privacy of others, or for which access is not otherwise required by local law.
If you wish to make requests to access, correct, or delete personal data please contact the Chief Privacy Officer at info@LogiTactic.com

Transfers to LOGITACTIC CANADA INC. Affiliates and Authorized Third Parties:

LOGITACTIC CANADA INC may share your personal data with other LOGITACTIC CANADA INC affiliates worldwide or authorized third party service providers who process your personal data for LOGITACTIC CANADA INC. for the purposes described in this Privacy Statement. For example, LOGITACTIC CANADA INC. shares your personal data with companies who provide services such as information processing, fulfilling customer orders, delivering products to you, managing and enhancing customer data, providing customer services, performing compliance reviews, assessing your interest in our products and services, and conducting customer research or satisfaction surveys.
Personal data will not be shared with third parties for their marketing purposes.
These companies may be located wherever LOGITACTIC CANADA INC. operates and are not permitted to use your personal information for other purposes, are obligated to act consistently with this Privacy Statement and must use appropriate security measures to protect your information.

Transfers to Others:

LOGITACTIC CANADA INC. may disclose personal data if necessary by law such as litigation, or request or subpoena from public and governmental authorities within or outside your country of residence. We may also disclose information about you if we determine that for purposes of national security, law enforcement, legal compliance, or other issues of public importance, disclosure is necessary or appropriate.

LOGITACTIC CANADA INC. may disclose information about you if we determine that disclosure is reasonably necessary to enforce our terms and conditions, or other contractual or legal rights, or to protect our operations or employees. Additionally, we may disclose your personal data to a third party if we file bankruptcy, or there is a transfer of assets or ownership in connection with proposed or consummated corporate reorganizations, such as merger, acquisition, sale or other disposition of business units.

Security:

There are always risks with providing personal data, whether in person, by phone, via the Internet or otherwise, and no technology is completely safe or “hacker” proof. LOGITACTIC CANADA INC. takes appropriate technical, administrative and organizational informational security measures to prevent and minimize such risks.

Such measures include, where appropriate, the use of firewalls, secure server facilities, encryption, implementing proper access rights management systems and processes, careful selection of processors and other technically reasonable measures to provide appropriate protection for your personal data against unauthorized access or disclosure. Where appropriate, we may also take backup copies and use other such measures to prevent accidental damage or destruction to your personal data. If a particular part of a LOGITACTIC CANADA INC. website supports online transactions, we will use an industry standard security measure, such as the one available through “Secure Sockets Layer” (“SSL”), to protect the confidentiality and security of online transactions.

Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential. We ask you not to share a password with anyone. You are responsible to inform us immediately if you become aware of any unauthorized use of your information or password.

Cookies and Other Technologies:

When you visit our websites, our server may attach a small text file to your hard drive – a cookie. Typically they enable collection of certain information about your computer including your Internet protocol (IP) address, your computer’s operating system, your browser type and the address of any referring sites. Cookies help us deliver a better website experience to you. Your unique cookie tells us that it is you whenever you revisit our site, so we can recall where you have previously been on our site, eliminate the need for you to enter your password frequently during a visit and what, if anything, you have in your shopping cart if you do not finish a transaction in a single visit. Cookies are also used for website traffic analysis and anonymous demographic profiling so that we may improve our services.
LOGITACTIC CANADA INC. may also use web beacons (also known as “clear gifs” or “pixel tags”) in connection with some websites. However, we do not use them to identify individual users personally. Web beacons are tiny graphics embedded on a website to count visitors to a website, to access certain cookies and/or to help us measure the effectiveness of particular content. We may also include web beacons in marketing e-mail messages or our newsletters in order to determine whether messages have been opened and links contained within clicked on. Again this information is used to improve our services.
You have a choice with respect to cookies. By modifying your Internet browser preferences, you have the ability to accept all cookies, to be notified when a cookie is set, or to reject all cookies. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you log on to our site. Please understand that if cookies are turned off, you may not be able to view certain parts of a LOGITACTIC CANADA INC. site that may enhance your visit. If you turn off cookies, the web beacon will no longer be able to track your specific activity. The web beacon may, however continue to collect information of visits from your IP address, but such information will no longer be unique. Please note that some of our business partners whose content is linked to a LOGITACTIC CANADA INC. site may also use cookies or web beacons. However, we have no access to or control over these cookies.

Links to Non- LOGITACTIC CANADA INC. Sites and Services:

LOGITACTIC CANADA INC. websites, products and services may contain links to third-party websites, products and services. Our products and services may also offer products or services from third parties, including our authorized business partners. Information collected by third parties is governed by their privacy practices. We recommend that you read the privacy policies of those third parties as LOGITACTIC CANADA INC. is not responsible for their privacy practices or the content of their websites.

Children:

We do not knowingly collect any information from children under 13. If we discover that we have collected such information we delete the information as soon as we can.

Privacy Questions:

If you have a question about this Privacy Statement or LogiTactic’s handling of your information you can contact LogiTactic’s Chief Privacy Officer at info@LogiTactic.com

Changes to our Privacy Statement:

LOGITACTIC CANADA INC. may update this Privacy Statement from time to time. When we change the statement in a material way, a notice will be posted on our website along with the updated Privacy Statement. You are bound by any such revisions and should, therefore, periodically visit this Privacy Statement to review the most current version.

Published Jan2, 2017

Freedom of Information and Protection of Privacy Guide to Using Surveillance Cameras in Public Areas

1.ACKNOWLEDGMENTS

This Guide is based upon and imports many of the policies and guidelines outlined in the British Columbia Office of the Information and Privacy Commissioner’s Public Surveillance System Privacy Guidelines, OIPC Policy 00-01, June 21, 2019. That contribution is gratefully acknowledged. Input and advice on the content of the Guide was also received from the Office of the Information and Privacy Commissioner of Alberta. The contribution of that Office is also gratefully acknowledged.

1. INTRODUCTION Surveillance cameras can be an effective technique to protect public safety and detect or deter criminal activity. Surveillance cameras are increasingly being installed inside and outside of public buildings (in elevators, hallways, entrances, etc.), on streets, highways, in parks and public transportation vehicles. Public bodies subject to the Freedom of Information and Protection of Privacy Act (the FOIP Act) must balance the benefits to the public against the rights of individuals to be left alone. A key issue in privacy protection is the regulation of the collection of personal information, thereby preventing unnecessary surveillance of individuals. This guide is intended to assist public bodiesin deciding whether collection of personal information by means of a surveillance camera is both lawful and justifiable and, if so, in understanding how privacy protection measures can be built into the use of a surveillance system.The guidelines do not apply to covert or overt surveillance cameras being used by a public body as a case-specific investigation tool for law enforcement purposes, where there is statutory authority and/or the authority of a search warrant to conduct the surveillance. They are also not intended to apply to workplace surveillance systems installed by a public body employer to conduct surveillance of employees. Other considerations may apply to this type of surveillance and will not be covered in this guide.

2. DEFINITIONS

In this guide: “Covert Surveillance” refers to “the secretive continuous or periodic observation of persons, vehicles, places or objects to obtain information concerning the activities of individuals, which is then recorded in material form, including notes and photographs”. 1“Personal Information” is defined in section 1(n) of the FOIP Actas recorded information about an identifiable individual, including: the individual’s race, colour, national or ethnic origin; the individual’s age or sex; the individual’s inheritable characteristics; information about an individual’s physical or mental disability; and any other identifiable characteristics listed in that section. “Surveillance System” refers to a mechanical or electronic system or device that enables continuous or periodic video recording, observing or monitoring of personal information about individuals in open, public spaces (including streets, highways, parks), public buildings (including provincial and local government buildings, libraries, health care facilities, public housing and educational institutions) or public transportation, including school

and municipal transit buses or other similar vehicles.“Reception Equipment” refers to the equipment or device used to receive or record the personal information collected through a public surveillance system, including a camera or video monitor. “Record” is defined in section 1(q) of the FOIP Actas a record of information in any form and includes notes, images, audio-visual recordings, x-rays, books, documents, maps, drawings, photographs, letters, vouchers and papers and any other information that is written, photographed, recorded or stored in any manner, but does not include software or any mechanism that produces records. In the context of this Guide, “record” includes digitally recorded or stored media such as images on videotape. “Storage Device” refers to a videotape, computer disk or drive, CD ROM or computer chip used to store the recorded visual images captured by a surveillance system.

3. COLLECTING PERSONAL INFORMATION USING SURVEILLANCE CAMERAS

Any record of the image of an identifiable individual is a record of personal information. Since surveillance systems collect personal information about identifiable individuals, public bodies must determine if they have the authority to collect personal information under section 33 of the FOIP Act. Under that section, no personal information may be collected by or for a public body unless the collection is expressly authorized by an enactment of Alberta or Canada (section 33(a)); the information is collected for the purposes of law enforcement (section 33(b)); or the information relates directly to and is necessary for an operating program or activity of the public body (section 33(c)). Public bodies must be able to demonstrate to the Information and Privacy Commissioner that any proposed or existing collection of personal information by surveillance cameras is authorized under one of the above sections of the Act.

4. CONSIDERATIONS PRIOR TO USING SURVEILLANCE CAMERAS

In order to comply with Part 2 of the FOIP Act, the FOIP Guidelines and Practices publication recommends that public bodies consider the following before deciding to use surveillance: •Surveillance cameras should be used only where conventional means for achieving the same objectives are substantially less effective than surveillance and the benefits of surveillance substantially outweigh any reduction of privacy in the existence and use of the system.

The use of a surveillance camera should be able to be justified on the basis of verifiable, specific reports of incidents of crime (e.g. vandalism, theft), safety concerns or other compelling circumstances. •A Privacy Impact Assessment (PIA) should be completed to assess the effects that the proposed surveillance system may have on privacy and the ways in which any adverse effects can be mitigated (see Chapter 9). In Investigation Report F2003-IR-005, the Commissioner referred to the PIA previously submitted by the local public body as a basis for his findings. •Consultations may be conducted with relevant stakeholders as to the necessity, and acceptability to the public, of the proposed surveillance. •Ensure that the proposed design and operation of the system creates no greater privacy intrusion than is absolutely necessary to achieve its goals. •Prior to deciding to use covert surveillance for a purpose other than a case-specific law enforcement activity, public bodies should conduct a comprehensive PIA and provide it, together with the case for implementing covert surveillance to the Office of the Information and Privacy Commissioner. The purpose of the PIA is to ensure that covert surveillance is the only available option and that the benefits derived from the personal information obtained would far outweigh the violation of privacy of the individuals observed. A public body that regularly uses covert surveillance as a case-specific investigation tool for lawenforcement purposes may, as part of sound privacy protection practices, consider developing a protocol that establishes how the decision is made to use covert surveillance in a given case. The protocol could also include privacy protection practices for the operation of the system.

5. DEVELOPING A SURVEILLANCE SYSTEM POLICY

Once a decision has been made to use a surveillance system, a public body should consider developing and implementing a policy for the operation of the system. Such a policy should be written and should include: •the use of the system’s equipment, including the location of recording equipment, which personnel are authorized to operate the system, the times when surveillance will be in effect, and the location of reception equipment. Where the system creates a record, the policy should also deal with the access, use, disclosure, retention and destruction of those records (see Chapter 7); •the designation of a senior person to be responsible for the public body’s privacy obligations under the Actand the policy. Any delegation of theindividual’s responsibilities should be limited and should include only other senior staff; •a requirement that employees and contractors review and comply with the policy in performing their duties and functions related to operation of the surveillance system. Employees should be subject to discipline if they breach the policy or the provisions of the FOIP Actor other relevant statute. Where a contractor fails to comply with the policy or the provisions of the Act, it would be considered a breach of contract leading to penalties up to and including contract termination. Employees and contractors (and their employees) should sign written agreements regarding their duties under the policy; •the incorporation of the policy into personnel (and contractor’s employee) training and orientation programs. Public body and contractor personnel should periodically have their awareness of the policy and Actrefreshed. The policy should be reviewed and updated regularly, ideally once every two years.

6. DESIGNING AND INSTALLING SURVEILLANCE EQUIPMENT

In designing a surveillance system and installing equipment, the following guidelines should be kept in mind: •Recording equipment such as video cameras should be installed in identified public areas where surveillance is a necessary and viable detection or deterrence activity. •Recording equipment should not be positioned, internally or externally, to monitor areas outside a building, or to monitor other buildings, unless necessary to protect external assets or to ensure personal safety. Cameras should not be directed to look through the windows of adjacent buildings. •Equipment should not monitor areas where the public and employees have a reasonable expectation of privacy (e.g. change rooms and adult washrooms). Note that there may be situations where surveillance equipment may need to be installed close to or at an entry to a children’s washroom in a public building to monitor or deter potential criminal activity against children. •The use of surveillance should be restricted to periods when there is a demonstrably higher likelihood of crime being committed and detected in the area under surveillance. The Commissioner considered the reporting of increased criminal activity in a specified area in Investigation Report F2003-IR-005. The Commissioner weighed this in relation to a predetermined and specific geographical area and timeframe. •The public should be notified, using clearly written signs prominently

displayed at the perimeter of surveillance areas, of surveillance equipment locations, so the public has ample warning that surveillance is or may be in operation before entering any area under surveillance. The signs should identify someone who can answer questions about the surveillance system and include an address or telephone number for contact purposes. •Only authorized persons should have access to the system’s controls and to its reception equipment. •Reception equipment should be in a controlled access area. Only the controlling personnel, or those properly authorized in writing by those personnel according to the policy of the public body, should have access to the reception equipment. Video monitors should not be located in a position that enables public viewing.

7. ACCESS, USE, DISCLOSURE, RETENTION AND DESTRUCTION OF SURVEILLANCE RECORDS

If the surveillance system creates a record by recording visual information that is personal information, the following policies and procedures should be implemented by public bodies and should form part of the policy discussed in Chapter 5: •All tapes or other storage devices that are not in use should be stored securely in a locked receptacle located in a controlled access area. All storage devices that have been used should be numbered and dated. •Access to the storage devices should only be by authorized personnel. Logs should be kept of all instances of access to, and use of, recorded material. •Written policies on the use and retention of recorded information should cover: −who can view the information and under what circumstances? (e.g. because an incident has been reported or is suspected to have occurred); −how long the information should be retained where viewing reveals no incident or no incident has been reported? (e.g. information should be erased according to a standard schedule). In Investigation Report F2003-IR-005, the Commissioner referred to a 21-day retention period. −how long the information should be retained if it reveals an incident? (e.g. if the personal information is used to make a decision that directly affects the individual, section 35 of the Actrequires the recorded information to be kept for at least one year after the decision is made).

If the surveillance system has been installed for public safety or deterrence purposes but detects possible criminal activity or non-compliance with or breach of a statute that could lead to a penalty or sanction under an enactment of Alberta or Canada, the storage devices required for evidentiary purposes should be retained andstored according to standard procedures until law enforcement authorities request them. A storage device release form should be completed before any storage device is disclosed to such authorities. The form should state who took the device and when, under what authority, and if it will be returned or destroyed after use.•An individual who is the subject of the information has a right of access to his or her recorded information under section 6 of the Act. Policies and procedures should accommodate this right.Access may be granted in full or in part depending upon whether any of the exceptions in Division 2, Part 1 of the Actapply and whether the excepted information can reasonably be severed from the record. •Old storage devices must be securely disposed of by shredding, burning or magnetically erasing the information. Breaking open the storage device is not sufficient

8. AUDITING THE USE OF SURVEILLANCE SYSTEMS

Public bodies should: •ensure that their employees and contractors are aware that their operations are subject to audit and that they may have to justify their surveillance interest in any individual. An audit clause should be added to any contract for the provision of surveillance services; •ensure that they appoint a review officer to periodically audit, at irregular intervals, the use and security of surveillance equipment, including cameras, monitors and storage devices. The results of each review should be documented and any concerns addressed promptly and effectively.

9. ROLE OF THE INFORMATION AND PRIVACY COMMISSIONER

The personal information recorded by a public body’s surveillance system, and the public body’s practices respecting the personal information, are subject to the privacy protection provisions in Part 2 of the Act. The Information and Privacy Commissioner can monitor and enforce compliance with those provisions. The Commissioner may also conduct audits of the surveillance systems of public bodies to ensure

compliance with the provisions of Part 2 of the Act.The Commissioner’s methodology and process for Privacy Impact Assessments can be found at www.oipc.ab.ca. Also, see the FOIP Guidelines and Practices publication for information on conducting PIAs.The completed PIA, together with the case for implementing a surveillance system, as opposed to other measures, should be sent to the Office of the Information and Privacy Commissioner for review and comment early in the process and certainly prior to making a final decision to proceed with surveillance. Details of the security measures to be implemented for a proposed surveillance system may be placed in an appendix or attachment to the PIA so that they can be kept confidential if the PIA is published by the Commissioner. If the public body intends to significantly modify or expand the surveillance system, consult with the Office of the Information and Privacy Commissioner. The Commissioner may conduct a site visit to assess the impact of the proposed modification. For general information and background material, the Office of the Information and Privacy Commissioner has released a literature review on privacy surveillance as it affects social behaviour. It is available on the

Commissioner’s website at www.oipc.ab.ca.