Implementing Privacy

Collus PowerStream Corp and Collingwood Public Utilities

Preface

We are committed to keeping the personal information of our customers accurate, confidential, secure and private. This Privacy Policy has been designed to inform employees, customers, subcontractors and stakeholders of our commitment and recognition to our obligation to meet the spirit and terms of the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

Contents

This Privacy Policy describes the principles we will use to protect the privacy of personal information in our possession. It addresses the reasons why such information is collected, how it is used, how its confidentiality is protected and outlines the customers' rights in respect of this information. This Privacy Policy incorporates and expands the 10 principles for the protection of personal information, as devised by the Canadian Standards Association (CSA).

This Privacy Code does not apply to information about business customers who carry on business as corporations, partnerships or other forms of association. We do however protect the confidentiality of those customer's information in accordance with the law and our own policies.

Personal Information Protection Principles

1. ACCOUNTABILITY

We are accountable for the protection of all personal information within the organization's possession or control, including any personal information that has been transferred to a third party for regulatory, legal or processing purposes. We will require a comparable level of protection of this information from our third party relations.

Mrs. Nella Morrow, our Privacy Officer, has overall responsibility for our protection of personal information and for our compliance with this Privacy Policy.

2. IDENTIFYING PURPOSES

Personal information that we collect from customers includes: the customer's name and address and other contact information; the meter number; facts about consumption of power and/or water, both historic and current; facts about payment for service, including general financial information; credit and reference information, such as date of birth, employment information, drivers license, previous addresses, telephone numbers, e-mail address, medical information to be used in case of emergency power outages, and bank information requested for pre-authorized payments. When an individual applies for service, we will make the individual aware of the purposes for which we are requesting the personal information. If we identify other purposes for which the personal information may be used, we will seek the individual's consent prior to such use. We will advise that it is the individual's right to refuse permission for us to use personal information for any new purposes.

Additional purposes for collecting personal information may be identified to an individual before or at the time of collection. However, at a minimum we will collect personal information for the following purposes:

Billing and collection of payments for electric and/or water service
Pre-authorized payment for services
Priority restoration of electric service to the correct address and meter, as may be required by medical circumstances
Energy sector legal, regulatory and settlement requirements

3. CONSENT

We will obtain consent before or when it collects, uses or discloses personal information about an individual. An individual can provide consent to the collection, use and disclosure of personal information about them expressly or implicitly. We will collect, use or disclose personal information without an individual's consent only in limited circumstances as permitted by law. Subject to certain legal and contractual restrictions and reasonable notice, an individual can refuse or withdraw their consent to the collection, use or disclosure of personal information about them at any time.

All existing customers will be informed of what types of personal information have been collected, the purpose for the collection and the procedures available for contacting us with any inquiries. All new customers will be provided with a consent form and an accompanying explanation about the collection, use and disclosure of their personal information when requesting service.

4. LIMITING COLLECTION

We limit the amount and type of personal information we collect to that which is necessary for the business of the utility. Each affiliate of ours will be responsible for its own collection, use and disclosure of information. Personal Information will be collected using procedures that are fair, transparent and lawful.

5. LIMITING USE, DISCLOSURE AND RETENTION

We will only use the personal information for the purpose for which it was collected as identified in principle #2, unless consent is given by the individual to use or disclose it for another purpose. In accordance with the Affiliates Relationship Code, created under the provincial Electricity Act, no customer information will be disclosed by one affiliate to another. In other words, no customer personal information will be shared by the distribution company and the telecom or energy affiliates.

We will develop explicit retention periods for closed accounts (zero balance), after which the personal information will be destroyed or made anonymous.

Under certain exceptional circumstances, we may have a legal duty or right to disclose personal information without the individual's knowledge or consent.

6. ACCURACY

In order to ensure the reliable delivery of electric service and the correct billing for such service, all personal information will be kept accurate, complete and up to date.

Individuals may challenge the accuracy and completeness of personal information about them and have it amended, as appropriate.

7. SAFEGUARDS

In executing our responsibilities with respect to the confidentiality of personal information, we will employ a number of safeguards, appropriate to the sensitivity of the information, to protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification. Such safeguards will include physical measures, organizational measures and technological measures, for example locked filing cabinets, restricted access to offices, security clearances and limiting access on a "need to know" basis and use of passwords and encryption. Procedures for implementing these measures will be communicated to all employees and third parties to ensure compliance with this principle.

8. OPENNESS

We will make our policies and practices relating to the protection of personal information available to our customers. We will keep our customers informed of these policies and practices and customers shall be provided access to all related policies and procedures via our web page and bill inserts. The information will be available in a format that is easy to understand.

9. INDIVIDUAL ACCESS

Any customer of ours can have access to the personal information about them that we have in our possession or control. Any customer may request that their personal information be amended for purposes of accuracy and completeness.

Customers can make their requests by telephone 1-705-445-1800 Ext. 2231, via email privacy@collus.com or in writing 43 Stewart Road, Collingwood ON L9Y 4M7. Response to an individual's request will be made in a timely and efficient manner.

10. CHALLENGING COMPLIANCE

Any customer of ours may challenge our compliance with this Privacy Policy by contacting us directly. We have policies and procedures to receive, investigate and respond to individuals' complaints and questions. If the customer is not satisfied with the way we have responded to a complaint, the customer can contact the Privacy Commissioner of Canada.