Website Privacy Policy

THIS PRIVACY POLICY SETS OUT INFORMATION THAT WE ARE REQUIRED TO PROVIDE TO YOU UNDER APPLICABLE LAWS. PLEASE READ THIS PRIVACY POLICY BEFORE USING THIS WEBSITE. BY USING THIS WEBSITE, YOU ACKNOWLEDGE THAT THIS PRIVACY POLICY, WHICH IS SUBJECT TO CHANGE AS DESCRIBED BELOW, APPLIES TO OUR COLLECTION, USE AND DISCLOSURE OF YOUR PERSONAL INFORMATION.

Last Updated: November 5, 2025

GENERAL INFORMATION

British Columbia Investment Management Corporation (“BCI”, “we”, “our” or “us”) is committed to maintaining trust with the users of our Website. BCI uses this Website to provide you with general information about BCI. Any information provided to you through the Website is referred to in this Privacy Policy as the “Content”. We are committed to the protection of your privacy. To help us meet this commitment to you, and to comply with our legal obligations, we have created this Website Privacy Policy, as may be amended from time to time (this “Privacy Policy “).

For the purposes of this Privacy Policy, the term “Website” means www.bci.ca and all its related webpages and websites (including without limitation any mobile optimized website), but does not include any third party websites which are linked to or may link from this Website (“Linked Sites”) whether or not such Linked Sites are used in association with the Content.

This Privacy Policy describes how BCI collects, uses and discloses Personal Information (as defined below) that is collected by BCI or provided by you as you use the Website. To take advantage of some of the features of the Website you may have to provide us with your Personal Information. All Personal Information in our custody and control will be collected, used and disclosed in accordance with the Freedom of Information and Protection of Privacy Act (British Columbia) (“FIPPA”), and where you are visiting the Website from the United Kingdom (“UK”), the UK General Data Protection Regulation (“UK GDPR”) and the UK Data Protection Act 2018 (“UK DPA”).

If you are visiting the Website from the UK, then BCI is the data controller of, and responsible for, your Personal Information.

As used in this Privacy Policy, “Personal Information” means recorded information about an identifiable individual, but excludes Business Contact Information. However, if you are visiting the Website from the UK, “Personal Information” includes Business Contact Information. “Business Contact Information” means any information that enables an individual at a place of business to be contacted (including the name, position or title, business telephone number, business address, business email and business fax number of the individual).

APPLICATION OF THIS PRIVACY POLICY

By accessing or using the Website or any of the Content you acknowledge that the terms set out in this Privacy Policy will apply to our collection, use and disclosure of your Personal Information. If you do not accept this Privacy Policy you must not access or use the Website or any of the Content.

This Privacy Policy only applies to Personal Information collected by, or supplied to, BCI through the Website. The Website may contain links to Linked Sites that are not controlled or operated by BCI. The Linked Sites are maintained by the third parties who have their own website privacy policies and their own terms and conditions of use. This Privacy Policy does not apply to any of the Linked Sites and BCI is not responsible for any Personal Information collected, used or disclosed by those Linked Sites or for the privacy practices of any operators or sponsors of the Linked Sites. To determine how Personal Information will be treated when accessing or using the Linked Sites, you must read the website privacy policy (or other appropriate privacy information) that applies to each of the Linked Sites.

REVISIONS TO THIS PRIVACY POLICY

BCI may, at any time, revise this Privacy Policy. This Privacy Policy was last revised at the date given above. You should periodically revisit this Privacy Policy to review any revisions. If you continue to access or use the Website or any of the Contents after any revisions to this Privacy Policy are posted, you will be deemed to have acknowledged those revisions.

CATEGORIES OF PERSONAL INFORMATION

The categories of your Personal Information we collect include:

• Contact and biographical information: including your legal name, preferred name, title, home postal address, personal email address and telephone numbers.
• Communications information: including the date and time of your communications and the content of your communications.
• Job application information: including your account login name and password, cover letter, information contained in your curriculum vitae/resume, work experience, employment references, background check information (including information about criminal convictions and offences), educational history, certifications, languages, skills, personal websites and social media accounts, work authorization information, and any other information you choose to provide to us when applying for a career opportunity at BCI.
• Technical information: including your internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, session recordings of your interactions with the Website (including mouse movements, clicks, scrolling behaviour, and page navigation), and other technology on the devices you use to access this Websit

PURPOSES OF COLLECTION

We collect the Personal Information described under the ‘Categories of Personal Information’ section above for the purposes set out in the table below.

Information about criminal convictions

Our third party background check providers may collect information about criminal convictions and offences as part of the recruitment process. This information will only be collected if it is appropriate given the nature of the role you have applied for (and where we are legally able to do so), or where we are legally required to carry out background checks for a particular role. We will use information about criminal convictions and offences in order to assess your suitability for certain roles.

HOW WE COLLECT YOUR PERSONAL INFORMATION

Your Personal Information is collected by us in different ways, including:

• Directly from you: you may provide us with your contact and biographical information, communications information or job application information in connection with your access and use of the Website, such as if you fill in forms, email us with a request for information or apply for a career opportunity.
• Automated technologies or interactions: as you interact with our Website, we will automatically collect technical information about your equipment, browsing actions and patterns. We collect this Personal Information by using cookies and other similar technologies, including session replay technology that records your interactions with the Website. Please see the ‘Cookies’ section below for further details.
• Third parties: BCI will receive Personal Information about you from various third parties as set out below:
  • technical information from analytics providers such as Google and Siteimprove;
• if you use the Website to apply for career opportunities, BCI will, directly and through its third-party service providers, including Workday Limited (“Workday”), collect your contact information and job application information;
• criminal conviction and offence information from background or criminal record check providers; and
• your named references, from which we collect employment references.

HOW WE USE YOUR PERSONAL INFORMATION

We will use the Personal Information we collect about you for the various purposes outlined under the ‘Purposes of Collection’ section above or a use that is consistent with one of those purposes.

Where you are based in the UK, we have also specified which legal basis under UK data protection law we rely on to process your Personal Information.

DISCLOSING YOUR PERSONAL INFORMATION

We will only disclose the Personal Information we collect about to third parties where they have agreed to comply with legally required privacy standards, and use the information only for the various purposes outlined under the ‘Purposes of Collection’ section above, a use that is consistent with one of those purposes, or as otherwise permitted or required under applicable law. This may include disclosing your Personal Information to:

• other entities (including branch offices) within BCI;
• service providers that provide us with services such as cloud services providers, recruitment and job application management services (e.g. Workday), analytics and session replay providers (e.g. Siteimprove), and other IT and system administration providers.
• professional advisors and auditors for BCI;
• legal and regulatory authorities, courts, tribunals, government agencies and law enforcement agencies; and
• third parties as required in connection with our investment activity including for anti-money laundering (AML), know-your-client (KYC), anti-bribery and anti-corruption obligations.

We reserve the right to disclose Personal Information if we reasonably believe that we may or are required to do so by law (for example, under FIPPA, the UK GDPR or the UK DPA) or a legal process. In addition, we reserve the right to disclose Personal Information in order to (i) enforce the Website Terms of Use; (ii) protect and defend the rights or property of BCI; or (iii) act in urgent circumstances to protect the safety or security of the public or users of the Website.

CONSENT

Although we will generally not rely on your consent when collecting, using or disclosing your Personal Information, in limited circumstances we may approach you for such consent, which we will obtain only in accordance with applicable law.

INTERNATIONAL TRANSFERS OF YOUR PERSONAL INFORMATION

We may transfer your Personal Information to the entities / persons listed under the ‘Disclosing Your Personal Information’ section above, which may include transfers of Personal Information outside Canada. If we plan to transfer your Personal Information outside Canada, we will do so in accordance with applicable requirements under FIPPA.

Where you are based in the UK, this may include transfers of Personal Information to Canada, the US and India. Whenever we transfer your Personal Information out of the UK, we ensure at least one of the following UK GDPR-approved transfer mechanisms is relied on:

• the transfer is to a jurisdiction that has been designated as “adequate” (i.e. providing an equivalent level of data protection as that in the UK) by the UK Secretary of State;
• where we have entered into pre-approved contractual clauses for international transfers out of the UK (approved by the UK Information Commissioner’s Office or the UK Secretary of State) with the data recipient outside the UK;
• where UK data protection law otherwise permits us to transfer your Personal Information outside the UK (e.g. where we have obtained your explicit consent, or where the transfer is necessary for us to perform a contract with you).

Please contact us if you want further information on the specific mechanism used by us when transferring your Personal Information out of the UK.

PROTECTING YOUR PERSONAL INFORMATION

BCI has implemented reasonable physical and technical security arrangements to help protect against unauthorized access, collection, use, disclosure and disposal of Personal Information obtained through the Website. For further information on how we protect Personal Information, contact us using the information listed under the ‘Where to Direct Questions or Complaints’ section below. However, because no data transmission over the Internet or storing of electronic data is ever 100 per cent secure, we cannot guarantee that your Personal Information will never be accessed, used, or released in a manner that is inconsistent with this Privacy Policy.

We have put in place procedures to deal with any suspected breach of Personal Information and will notify you and any applicable regulator of a breach where we are legally required to do so.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, WE EXPRESSLY DISCLAIM ANY DEFINITIVE GUARANTEE OF SECURITY IN CONNECTION WITH YOUR PERSONAL INFORMATION.

RETENTION OF YOUR PERSONAL INFORMATION

We will retain your Personal Information only for the duration it is required for the purposes for which we collected it, as well as any additional period required by law.

In general, to determine the appropriate retention period for your Personal Information, we consider:

• the amount, nature and sensitivity of Personal Information;
• the potential risk of harm from unauthorized use or disclosure of your Personal Information;
• the purposes for which we collect, use and disclose your Personal Information and whether we can achieve those purposes through other means; and
• any applicable legal requirements.

CORRECTION OF YOUR PERSONAL INFORMATION

If you believe there is an error or omission in your Personal Information, you may request that we correct the information.

INDIVIDUALS BASED IN THE UNITED KINGDOM

Where you are based in the UK, UK data protection law requires us to provide you with certain additional information in relation to our processing of your Personal Information. This information is set out below.

Special Categories of Personal Information

We do not generally collect any Special Categories of Personal Information about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). However, where necessary, we may collect and use information about your disability or health status to consider whether we need to provide appropriate adjustments during the recruitment process, for example, whether adjustments need to be made during a test or interview. It is a legal requirement for us to make such reasonable adjustments during the recruitment process.

What rights do you have in relation to your Personal Information?

If you are based in the UK, you have certain rights under UK data protection laws in relation to your Personal Information. These rights include:

• Access: you have the right to request a copy of the Personal Information we hold about you;
• Erasure: you have the right to request that we erase your Personal Information, in certain circumstances;
• Restriction of processing: you have the right to request that we restrict the processing of your Personal Information, in certain circumstances;
• Object to processing: you have the right to object to our processing of your Personal Information, in certain circumstances;
• Data portability: you have the right to request that we transfer your Personal Information to you or a third party (in certain circumstances), in a commonly used machine-readable format;
• Withdraw consent: you have the right to withdraw your consent to our processing of your Personal Information at any time. This will not affect the lawfulness of any processing carried out before you withdraw your consent.

If you wish to exercise any of your rights described above, please contact the Privacy Officer at the details provided below.

Where you are based in the UK, you also have the right to lodge a complaint with the UK Information Commissioner’s Office, the UK regulator for data protection (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

COOKIES

Our Website uses standard technology known as “cookies”, including session cookies and persistent cookies. Session cookies temporarily keep your settings. This information is stored until your browser is closed. Persistent cookies are created for specific functions you may choose to use on the Website, including, but not limited to: accepting terms of use; saving searches; and saving favourites. Persistent cookies are used to improve your experience of the Website and are retained from session to session. These cookies remain after the browser is closed and are stored locally on your system. BCI does not track such cookies on BCI servers, nor does BCI use such cookies to store Personal Information. You may choose to delete persistent cookies after visiting the Website. If you do not wish to accept cookies, you have the option of blocking or disabling cookies. However, please be aware that you may be unable to access certain parts of the Website if you do block or disable cookies.

WHERE TO DIRECT QUESTIONS OR COMPLAINTS

If you have any questions or concerns about your privacy in connection with the Website or relating to the collection, use or disclosure of Personal Information by BCI, please contact:

Privacy Officer

750 Pandora Avenue, Victoria, BC, Canada V8W 0E4

Phone: 778-410-7100

Email: privacy@bci.ca

4879-8300-6545, v. 6