The Building Owners and Managers Association of Canada Inc. (“we“, “us“, “our“, or “BOMA“) is committed to protecting the personal information of its members, partners, program participants, and other stakeholders. This Privacy Policy applies to our collection, use, and disclosure of your personal information when you access or use our websites, mobile applications, portals, tools, assessments and programs, and our services related thereto, that are owned, operated, or provided by or on behalf of BOMA including, but not limited to, bomacanada.ca, bomabest.org, bomabestfieldguide.org, bomabesthub.com, bomaenspire.ca, bomex.ca, BOMA BEST, the BOMA BEST Risk Assessment, the BOMA BEST Certification Program, the BOMA Best Hub, the BOMA Enspire Portal, and the BOMA Canada E-Mail Update Service (collectively, the “Services“).

This Privacy Policy has been developed to ensure compliance with the federal Personal Information Protection and Electronic Documents Act (“PIPEDA“), as well as applicable provincial privacy legislation, including British Columbia’s Personal Information Protection Act, Alberta’s Personal Information Protection Act, and Quebec’s Act Respecting the Protection of Personal Information in the Private Sector and related amendments under Law 25, as each may be amended from time to time (collectively, “Applicable Privacy Legislation“).

What Is Personal Information?

Personal information means any factual or subjective information, in any form, recorded or not, on its own or combined with other information, that can identify an individual. This includes information such as a person’s name, mailing address, email address, credit card information, government-issued identification numbers, and similar information.

Personal information does not include the name, title, or business address or telephone number of an employee of an organization, nor does it include information that cannot be attributed to an identifiable individual, such as de-identified information.

Consent

By accessing or using the Services, you consent to this Privacy Policy and our collection, use, and disclosure of your personal information as described in this Privacy Policy. If you do not agree with the terms of this Privacy Policy or how we collect, use, or disclose or otherwise handle your personal information as described in this Privacy Policy, please do not access or use the Services.

We will obtain your express or implied consent prior to or when collecting, using, or disclosing your personal information for any purpose not described in this Privacy Policy, unless otherwise required or permitted by law.

You can always refuse to provide your personal information, except that refusal may prevent you from using the Services or receiving responses to your inquiries.

You can also withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. If you withdraw your consent, we will inform you of the likely consequences of doing so, which may include an impact on our ability to provide all or certain of the Services to you.

For residents of Quebec, we will obtain your express consent in a clear, free, and informed manner for the collection, use, or disclosure of sensitive personal information. Where applicable, consent will be requested separately from other information and in plain language.

Accountability

BOMA has designated the Executive Vice President of BOMA as its Privacy Officer, who is responsible for ensuring BOMA’s compliance with Applicable Privacy Legislation and with this Privacy Policy. Other individuals within BOMA may be delegated to act on behalf of the Privacy Officer or to take responsibility for occasional collection, use, and disclosure of personal information. BOMA is accountable and responsible for all personal information in its possession or control, including personal information transferred to third-party service providers for processing.

Collection of Personal Information

In the course of your access or use of the Services, we may collect certain personal information as described below. We strive to uphold data minimization principles and will only collect the personal information that is necessary for the purposes identified in this Privacy Policy. We do not intentionally collect personal information of individuals below the age of 16 or other statutory age of majority in the jurisdiction of residence.

The specific types of personal information we collect depend on the Services you use and include the following:

• Cookies and similar automatic data collection technologies when you visit our websites including the BOMA Enspire Portal and the BOMA BEST Hub and your name, contact information and the details of your inquiry when you contact us online or offline.

Generally, we collect your personal information directly from you however, we may also collect your personal information from other sources to, among other things, enable us to complete, verify, or update personal information contained in our records and to better customize the Services we provide.

Cookies and Similar Automatic Data Collection Technologies

We use cookies and similar automatic data collection technologies on our websites to enhance your browsing experience and provide personalized service.

Cookies are small text files that are stored on your website or mobile device when you visit a website. They are widely used to make websites work more efficiently and provide information to the website owners. Other similar automatic tracking technologies are web beacons, embedded scripts, and entity tags.

BOMA does not use cookies on the BOMA BEST Hub.

How We Use Your Personal Information

We use personal information for the purposes described below. The specific uses depend on the Services you interact with.

Across all of our Services, we use personal information to:

• Administer our relationship with you including facilitating your interactions and transactions with us, such as requests for support or additional services or responding to your suggestions, comments, and inquiries, and feedback about the Services.
• Analyze and measure performance, maintenance, and operations of the Services.
• Develop new products and services and build or improve products, features, and delivery.
• Gauge market interest in BOMA BEST and BOMA Enspire and conduct market research to better understand the preferences of our customers.
• Provide you with, and improve, relevant marketing offers, promotional items, or information from us or third parties.
• Develop and manage relationships with our business partners.
• Respond to legally binding demands from law enforcement, regulatory authorities, or other third parties.
• Defend, protect, or enforce our rights including our Terms of Use.
• Prevent fraud or the recurrence of fraud.
• Assist in the event of an emergency and comply with applicable law.

We will not use your personal information for any other purpose without your consent or as otherwise required or permitted by law.

De-identified and Aggregated Data

We may use your data, solely on a de-identified basis and aggregated with other users’ data, for the compilation and analysis of trends, statistics, and other information without any link or identifiable reference to you, and we may generate aggregated data from such use (“Aggregated Data“). We may share our analyses based on Aggregated Data with our business partners and third-party customers. For the avoidance of doubt, we will not distribute or share your personal information with anyone in its identifiable form, except as expressly described in this Privacy Policy.

If you would like to withdraw your consent to BOMA extracting information from your data and generating Aggregated Data, please contact the Privacy Officer using the contact information provided below. You acknowledge, however, that withdrawal of consent may impact our ability to perform certain assessments or provide certain Services and that we may, at our discretion, cease performing those assessments. We will process your withdrawal request within a commercially reasonable period of time.

How We Share or Disclose Your Personal Information

We do not sell, rent, share, or trade your personal information to any third party for any purpose, except as described in this Privacy Policy or as otherwise required or permitted by applicable law.

We may share or disclose personal information in the following circumstances:

• To program stakeholders, including BOMA members, partner organizations, and program participants, where such disclosure is necessary for the administration and delivery of our program and the Services. In connection with the BOMA Enspire Portal, personal information may be disclosed to Natural Resources Canada as required for program administration, reporting, and compliance with applicable government program requirements.
• To our third-party service providers and affiliated companies that we use to support our business including those that help us with the uses described in the “How We Use Your Personal Information” section above.
• To other parties where we are under a duty to disclose your personal information in order to comply with any court order, law, or legal process, including to respond to any government or regulatory request.
• To other parties to protect the rights, property or safety of BOMA, its affiliates, our program stakeholders, our service providers, our customers, or others.
• In the event that BOMA is involved in a transaction such as a merger, stock purchase or sale, or sale of BOMA’s assets to which your personal information pertains, we may share your personal information with the other party in such transaction and in accordance with applicable law. The party to which your information is transferred will be required to adhere to the same privacy practices as those described in this Privacy Policy.

Cross-Border Transfers and Data Security

We may transfer your personal information outside the province of Quebec and/or outside Canada, including to the United States and Mexico, for processing and storage by us or our service providers. We use contractual and other means to ensure your personal information is protected while in the foreign jurisdiction, however, your personal information may be still accessible to law enforcement agencies, government agencies, courts, and national security authorities of the foreign jurisdiction.

BOMA employs reasonable administrative, technical, and physical safeguards to protect your personal information against unauthorized access, disclosure, theft, or misuse. These measures include, without limitation, limiting access to personal information on a “need-to-know” basis, using passwords and encryption, maintaining firewalls in the computer system, and storing physical records in locked filing cabinets. Only the Privacy Officer and delegated individuals have access to personal information.

We endeavour to safeguard personal information once we receive it; however, please understand that no transmission of data over the Internet or any other public network can be guaranteed to be 100% secure. BOMA will not be liable for any breach of data security caused by circumstances outside its control, including unauthorized network intrusions. If you suspect an unauthorized use or security breach of your personal information, please contact us as soon as possible.

Data Retention

We will retain your personal information only as long as needed to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Once personal information is no longer needed for the purposes for which it was collected, we will securely erase, delete or destroy your personal information. Alternatively, where permitted by law, we may de-identify or anonymize your personal information, in accordance with legal requirements, if any, and retain it indefinitely for study or research purposes or for any other purpose permitted by law.

Your Rights

You have certain rights pursuant to Applicable Privacy Legislation regarding your personal information including, but not limited to, the right to:

• Withdraw your consent to the communication or any of the uses of your personal information as described above. As explained above, if you withdraw your consent to our use of your personal information, then you may no longer be able to access or use some or all of the Services.
• Access your personal that we have on file about you, discuss the accuracy and/or completeness of your personal, and have your personal information rectified or corrected.
• Request information regarding the processing of your personal information including asking questions about our policies or practices regarding our use of Service Providers and lodge a complaint about our privacy practices.

If you wish to exercise any of these rights or any other rights granted to you by Applicable Privacy Legislation, you may do so by contacting our Privacy Officer using the contact information provided below. You may also update certain of your personal information directly on the BOMA Best Hub and the BOMA Enspire Portal.

Changes to This Policy

The effective date of this Privacy Policy is set forth at the top of this page. We may change the Privacy Policy from time to time by posting the changes so please come back and review this Privacy Policy regularly. We will take reasonable steps to alert you prior to changing the collection, use or disclosure practices associated with your personal information and, if required by law, obtain your consent to such changes.

Contact Us

Please contact us as follows if you have any questions about this Privacy Policy or would like to exercise your rights under Applicable Privacy Legislation:

BOMA Privacy Officer
141 Adelaide Street West, Suite 1002
Toronto, Ontario, Canada
M5H 3L5
Phone: (416) 214-1912
Email: info@bomacanada.ca

For your protection, we may need to verify your identity before assisting with your request, such as verifying that the information used to contact us matches the information that we have on file.