Our commitment to privacy
At Echo Aviation Leasing Corporation Inc. (“Echo”), we take the issue of safeguarding privacy seriously. We respect and are committed to protecting the confidentiality and security of Personal Information entrusted to us, and ensuring that all Personal Information we hold is collected, used and disclosed in compliance with all applicable federal and provincial privacy laws (“Privacy Legislation”).
1.4 Echo’s privacy practices
- Echo is responsible for safeguarding Personal Information in its possession or control. Echo will use appropriate means to provide a comparable level of protection when Personal Information is being processed by a third party.
B. Identifying Purposes for Collection
- Echo will document the purposes for which Personal Information is collected, and will only collect Personal Information for the identified purposes.
- Echo collects Personal Information as part of obtaining financing for its corporate clients. This Personal Information includes, but is not limited to:
- Personal identification (such as a drivers’ licence or other government issued ID)
- Date of birth
- Social Insurance Number (where a personal guarantee is required)
- Personal tax return (where a personal guarantee is required)
- Company banking information
- Personal net worth information
- E-mail address
- Echo will specify to the individual, orally, electronically or in writing, the identified purposes at or before the time Personal Information is collected typically through the use of standard commercial credit application forms. Upon request, persons collecting Personal Information will explain these identified purposes or refer the individual to the Privacy Officer of Echo who will explain the purposes.
- In accordance with Privacy Legislation, Echo will identify and document any new purposes for which previously collected Personal Information may need to be used and disclosed, and obtain the consent of the individual where applicable.
C. Obtaining Consent for Collection, Use or Disclosure
- Echo will seek consent, where required, to use and disclose Personal Information when it collects the information or in accordance with Privacy Legislation.
- In obtaining consent, Echo will ensure that an individual is advised of the identified purposes for which Personal Information will be used or disclosed. Purposes will be stated in a manner that can be reasonably understood.
- Examples of when Echo may collect, use and disclose Personal Information are to
(a) verify an individual’s identity;
(b) carry out human resources functions such as training, administering employee contracts, evaluating employees, implementing employment-related actions and obligations and providing employment benefits and related benefits;
(c) administer compensation, bonus and benefit plans and other employment matters;
(d) process a payment or invoice;
(e) provide a product or service that Echo offers; or
(f) provide an individual with promotional/marketing materials as it relates to Echo’s business.
- In determining the appropriate form of consent, Echo will take into account the sensitivity of the Personal Information, the reasonable expectations of the individuals involved, and the requirements of Privacy Legislation.
D. Limiting Collection of Personal Information
- Echo will collect, use and disclose Personal Information in accordance with Privacy Legislation and will limit the amount and type of Personal Information collected to that which is necessary to fulfill identified purposes.
- Echo collects Personal Information primarily from its employees, but Echo may also collect Personal Information from other sources to meet the requirements of its business.
E. Retention and Destruction
- Echo will keep Personal Information only as long as it remains necessary or relevant for the identified purposes or as required by law. In hard copy this most often means that the Personal Information is only kept in a locked and secure area until such time as the application process has been completed. Personal Information is kept in electronic form on Echo’s secure server for the life of the loan or lease and in accordance with any statutory requirements.
- Echo will maintain reasonable and systematic controls, schedules and practices for information and records retention and destruction which apply to Personal Information that is no longer necessary or relevant for the identified purposes or required by law to be retained. Such information will be destroyed, erased or made anonymous.
F. Accuracy of Personal Information
- Echo will employ reasonable efforts to keep Personal Information relevant to its intended use, accurate, complete and current. Echo relies on individuals to notify it if there is a change to their Personal Information.
- Echo will take reasonable steps to permit individuals to correct, amend or delete Personal Information that it demonstrated to be inaccurate or incomplete. These requests may be made in writing by contacting the Privacy Officer.
- Those individuals who are party to any Echo benefit plans or receive other benefits from Echo shall ensure that their Personal Information, particularly information that deals with benefit entitlement or status, is kept current, and accurately reported.
- Echo will update Personal Information as and when necessary to fulfill the identified purposes or upon notification by the individual.
G. Security Safeguards
- Echo will use reasonable commercial efforts to protect Personal Information against loss or theft, as well as unauthorized access, disclosure, use, modification or destruction, through reasonable security measures. The nature of the safeguards will vary depending on the sensitivity of information collected.
- Echo will take all reasonable steps in the disposal or destruction of Personal Information, to seek to prevent unauthorized parties from gaining access to the Personal Information, including shredding paper records and permanently deleting electronic records.
H. Openness Concerning Policies and Practices
- The information that Echo makes available about its policies and practices will include:
(a) the email address, of the person(s) who is accountable for Echo’s policies and practices regarding the management of Personal Information and to whom complaints or inquiries can be forwarded;
(b) the means of gaining access to Personal Information held by Echo;
(c) a copy of information that explains Echo’s policies, standards or codes;
(d) the type of Personal Information made available to related organizations and the context and limitations of such Personal Information; and
(e) a description of the type of Personal Information held by Echo, including a general account of its use.
I. Individual Access to Personal Information
- Individuals have a right to access their own Personal Information that is in the custody or under the control of Echo subject to some limited exceptions provided for in the applicable privacy laws. Echo will grant individuals reasonable access to their Personal Information held by Echo. Echo will advise the individual in advance of any charges for retrieval, reproduction or delivery of the Personal Information requested.
- Echo may limit or deny access to Personal Information as permitted by applicable Privacy Legislation. Echo will provide the reasons for denying access.
- In order to safeguard Personal Information, an individual will be required to provide sufficient identification information to permit Echo to authorize access to the Personal Information held regarding that individual. Any such identification information will be used only for this purpose.
- Individuals can obtain information or seek access to their Personal Information by contacting the Privacy Officer.
J. Challenging Compliance
- Echo will maintain procedures for addressing and responding to all inquiries or complaints from individuals about Echo’s handling of Personal Information.
- Echo will promptly correct or complete any Personal Information found to be inaccurate or incomplete. Any unresolved differences as to accuracy or completeness will be noted in the file in which the Personal Information is contained. Where appropriate, Echo will notify third parties having access to the Personal Information in question about any amended information or the existence of any unresolved differences.
- An individual that has concerns with Echo’s privacy practices should contact Echo’s Privacy Officer.
1.5 Cross-border transfers of personal information
Echo has centralized certain aspects of its data process and human resources administration in order to allow it to better manage its business. That centralization may result in the transfer of Personal Information from one country to another within the limits and subject to the requirements of the applicable laws. The countries where the information will be transferred may or may not have laws that seek to preserve privacy of the Personal Information. However, whenever Personal Information is transferred outside of the country, the Personal Information will be processed in accordance with the principals of this Policy and Privacy Legislation.
Individuals may obtain written information regarding cross-border transfers by contacting Echo’s Privacy Officer.
Website privacy practices
1.6 How Echo collects information from the echo website
When an individual visits the Echo website, no personally identifiable information is collected unless the individual consents to that collection. The Echo website collects non-personally identifiable information as follows:
A. Non-personally Identifiable Information
Information from visitors to the Echo website is not tracked on an individual basis; but rather, the information is collected on an aggregate basis that includes all site visitors. Any visit to the Echo website automatically generates session log data consisting of the Internet Protocol (IP) address from which the connecting computer came (which contains no personal information), the website that referred the computer to the Echo website, the pages that are visited by the user, the date and time of those visits; and, the amount of time spent on the Echo website. Echo uses this information to perform analytics on users’ experience while using the site and to improve the functionality of Echo’s website to better meet user wants and needs; identify popular features; measure site activity including peak site usage times; and, page visits and click throughs. These site metrics may be shared with Echo’s affiliated service providers and others.
B. Cookies, Web Beacons and Advertisements
The Echo website uses “cookies”, web beacons/GIF/pixel tags, and third-party advertising networks that use ads and other tracking technologies to collect aggregate or other non-personally identifiable information to develop website metrics and improve a user’s online experience.
The Echo website may use session and/or persistent cookies to track user movement or other events across the website and the website of franchisees and business partners. A “cookie” is a small text file that helps Echo to improve the functionality of a user’s visit to the Echo website. Several different types of cookies are used by the Echo website. A session cookie is stored only on a visiting computer’s working memory (RAM) and only lasts for an individual’s browsing session. When an individual closes all of the browser’s windows or shuts down their computer, the session cookie disappears forever. A persistent cookie is stored on an individual’s computer hard drive until a specified date. Persistent cookies stay on an individual’s computer until they expire, they are overwritten by new cookies, or the individual manually removes them. Most browsers can be configured not to accept cookies, however, this may prevent a user from having access to some site functions or features.
The Echo website may use web beacons/GIF/pixel tags to help determine site metrics such as if a page has been viewed and how many times. In general, any electronic image viewed as part of a web page can act as a web beacon. When an individual requests information on a course or a newsletter, Echo may also use web beacons to establish how many of the emails are actually opened.
C. Collection and Use of Personally Identifiable Information on Echo’s Website
There are instances where Echo requests Personal Information on the Echo website in order to provide the user with a service, information on a course, a newsletter or where a user participates in interactive online activities such as course registration. Echo may conduct voluntary online surveys to obtain a user’s feedback. Echo requests e-mail addresses as a means of contacting a user if the user wishes to obtain ongoing information from Echo.
D. Links to other Websites
The Echo website may contain links to other websites. Echo encourages users to review the privacy statements of all sites which a user visits, including those whose links are provided, so that a user can understand how those sites collect, use and share a user’s information. Echo is not responsible for the privacy statements, content or data handling practices on other websites.
F. How Echo Uses and Discloses Information Collected From Echo’s Website
G. Security and Accuracy of Information
When a user sends personal information to the Echo website, Echo uses “Secure Socket Layers” (SSL) to protect the user’s data. SSL is encryption technology that helps safeguard personal information against misuse by unauthorized individuals.
(b) establishing procedures to receive and respond to inquiries and complaints regarding Personal Information;
(c) training staff and communicating with staff about Echo’s policies and practices; and
(d) developing employee communications to explain Echo’s policies and practices.
1.8 Contact information
Echo Aviation Leasing Corporation Inc.
2160 rue de la Montagne suite 700
Montreal, Quebec H3G 2T3
1.9 Changes to this policy
This policy may be amended from time to time, consistent with the requirements of applicable laws or business needs. Appropriate notice will be given concerning such amendments