Website Privacy Policy

THIS PRIVACY POLICY CONTAINS LEGAL OBLIGATIONS. PLEASE READ THIS PRIVACY POLICY BEFORE USING THIS WEBSITE. BY USING THIS WEBSITE, YOU ACKNOWLEDGE THAT THIS PRIVACY POLICY, WHICH IS SUBJECT TO CHANGE AS DESCRIBED BELOW, APPLIES TO YOU.

Last Updated: May 21, 2025

INTRODUCTION

British Columbia Investment Management Corporation (“BCI”, “we”, “our” or “us”) respects your privacy and is committed to protecting your Personal Information (as defined below). To help us meet this commitment to you, and to comply with our legal obligations, we have created this External Privacy Notice, as may be amended from time to time (this “Privacy Notice”).

This Privacy Notice explains how we collect, use, and share information about you when you interact with BCI, including when you:

• Visit our website (www.bci.ca) and all its related webpages (“Website”). Our Website may contain links to third-party websites, applications, or services that are not owned or controlled by BCI (“Linked Sites”). This Privacy Notice applies only to our Website and we are not responsible for the privacy practices, content, or security of any Linked Sites. We encourage you to review the privacy policies of any Linked Sites you visit.
• Communicate with us through email, phone, or other methods
• Apply for employment or other opportunities with BCI
• Engage with us as a business partner, service provider, or other stakeholder
• Participate in our events or promotional initiatives

By engaging with BCI in any of these ways, you acknowledge that your Personal Information will be handled as described in this Privacy Notice.

APPLICABLE PRIVACY LAWS AND DEFINITIONS

All Personal Information in our custody and control will be collected, used and disclosed in accordance with the Freedom of Information and Protection of Privacy Act (British Columbia) (“FIPPA”), and where you are located in the United Kingdom (“UK”), the UK General Data Protection Regulation (“UK GDPR”) and the UK Data Protection Act 2018 (“UK DPA”).

If you are located in the UK, then BCI is the data controller of, and responsible for, your Personal Information.

As used in this Privacy Notice, “Personal Information” means recorded information about an identifiable individual, but excludes Business Contact Information. However, if you are located in the UK, “Personal Information” includes Business Contact Information. “Business Contact Information” means any information that enables an individual at a place of business to be contacted (including the name, position or title, business telephone number, business address, business email and business fax number of the individual).

CATEGORIES OF PERSONAL INFORMATION

The categories of your Personal Information we collect include:

• Contact and biographical information: including your legal name, preferred name, title, home postal address, personal email address and telephone numbers.
• Communications information: including the date and time of your communications and the content of your communications.
• Job application information: including your account login name and password, cover letter, information contained in your curriculum vitae/resume, work experience, employment references, background check information (including information about criminal convictions and offences), educational history, certifications, languages, skills, personal websites and social media accounts, work authorization information, and any other information you choose to provide to us when applying for a career opportunity at BCI.
• Technical information: including your internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this Website.
• Business relationship information: including professional qualifications, financial information, personal ownership stakes or interests in businesses, personal identity verification details, travel preferences for business meetings, information collected through know-your-client (KYC) and anti-money laundering (AML) processes, conflicts of interest disclosures, due diligence questionnaire responses and board memberships.
• Event information: including attendance and registration details, dietary preferences and photographs or recordings taken at our events where you may appear. including managing registrations, accommodating special requirements, and creating event documentation such as attendance records, photographs, and recordings.
• Visitor information: including identification details, photographs, CCTV images and footage, visit logs, emergency contact details, and any access requirements or accommodations needed during your visit to our physical premises.
• Electronic monitoring: including records of your access to and usage of our electronic devices and systems.

PURPOSES OF COLLECTION

We collect the Personal Information described under the ‘Categories of Personal Information’ section above for the purposes set out in the table below.

Information about criminal convictions

Our third party background check providers may collect information about criminal convictions and offences as part of the recruitment process. This information will only be collected if it is appropriate given the nature of the role you have applied for (and where we are legally able to do so), or where we are legally required to carry out background checks for a particular role. We will use information about criminal convictions and offences in order to assess your suitability for certain roles.

HOW WE COLLECT YOUR PERSONAL INFORMATION

Your Personal Information is collected by us in different ways, including:

• Directly from you: we collect personal information that you voluntarily provide to us through various forms of direct interaction with BCI, including when you:
  • respond to requests for proposals or other business opportunities;
  • submit information as part of our due diligence processes;
  • apply for jobs (including when you create an account on our careers portal, submit your resume or CV, provide cover letters, complete application forms, share professional qualifications, participate in interviews or take skills assessments);
  • complete forms on our Website or provide information during video conferences, phone calls or in-person;
  • visit our physical premises and provide information for security or visitor management purposes;
  • when you subscribe to our newsletters or publications; and
  • register for BCI-hosted events or webinars;
• Automated technologies or interactions: as you interact with our digital platforms and physical facilities, we collect information through various automated systems and technologies, including through:
  • cookies and similar tracking technologies on our Website, which collect technical information about your equipment, browsing actions and patterns;
  • our email communication platforms when you open or interact with our emails;
  • building access systems and security cameras at our physical premises;
  • our network and IT systems when you connect to our Wi-Fi or other services while visiting our premises; and
  • usage data collected when you access our secure portals and data rooms.
• Third parties: BCI will receive Personal Information about you from various third parties as set out below:
  • event registration services when you register for BCI-sponsored events;
  • building access and security providers for our physical premises;
  • technical information from analytics providers such as Google;

• if you use the Website to apply for career opportunities, BCI will, directly and through its third-party service providers, including Workday Limited (“Workday”), collect your contact information and job application information;
• criminal conviction and offence information from background or criminal record check providers; and
• your named references, from which we collect employment references.

HOW WE USE YOUR PERSONAL INFORMATION

We will use the Personal Information we collect about you for the various purposes outlined under the ‘Purposes of Collection’ section above or a use that is consistent with one of those purposes.

Where you are based in the UK, we have also specified which legal basis under UK data protection law we rely on to process your Personal Information.

DISCLOSING YOUR PERSONAL INFORMATION

We will only disclose the Personal Information we collect about to third parties where they have agreed to comply with legally required privacy standards, and use the information only for the various purposes outlined under the ‘Purposes of Collection’ section above, a use that is consistent with one of those purposes, or as otherwise permitted or required under applicable law. This may include disclosing your Personal Information to:

• other entities (including branch offices) within BCI;
• service providers that provide us with services such as cloud services providers, security and facility management providers, recruitment and job application management services (e.g. Workday), analytics and other IT and system administration providers, event management and conference organizers; travel and accommodation booking services; .
• professional advisors and auditors for BCI;
• legal and regulatory authorities, courts, tribunals, government agencies and law enforcement agencies; and
• third parties as required in connection with our investment activity including for anti-money laundering (AML), know-your-client (KYC), anti-bribery and anti-corruption obligations.

We reserve the right to disclose Personal Information if we reasonably believe that we may or are required to do so by law (for example, under FIPPA, the UK GDPR or the UK DPA) or a legal process. In addition, we reserve the right to disclose Personal Information in order to (i) enforce the Website Terms of Use; (ii) protect and defend the rights or property of BCI; or (iii) act in urgent circumstances to protect the safety or security of the public or users of the Website.

CONSENT

Although we will generally not rely on your consent when collecting, using or disclosing your Personal Information, in limited circumstances we may approach you for such consent, which we will obtain only in accordance with applicable law.

INTERNATIONAL TRANSFERS OF YOUR PERSONAL INFORMATION

We may transfer your Personal Information to the entities / persons listed under the ‘Disclosing Your Personal Information’ section above, which may include transfers of Personal Information outside Canada. If we plan to transfer your Personal Information outside Canada, we will do so in accordance with applicable requirements under FIPPA.

Where you are based in the UK, this may include transfers of Personal Information to Canada, the US and India. Whenever we transfer your Personal Information out of the UK, we ensure at least one of the following UK GDPR-approved transfer mechanisms is relied on:

• the transfer is to a jurisdiction that has been designated as “adequate” (i.e. providing an equivalent level of data protection as that in the UK) by the UK Secretary of State;
• where we have entered into pre-approved contractual clauses for international transfers out of the UK (approved by the UK Information Commissioner’s Office or the UK Secretary of State) with the data recipient outside the UK;
• where UK data protection law otherwise permits us to transfer your Personal Information outside the UK (e.g. where we have obtained your explicit consent, or where the transfer is necessary for us to perform a contract with you).

Please contact us if you want further information on the specific mechanism used by us when transferring your Personal Information out of the UK.

PROTECTING YOUR PERSONAL INFORMATION

BCI has implemented reasonable physical and technical security arrangements to help protect against unauthorized access, collection, use, disclosure and disposal of Personal Information obtained through the Website. For further information on how we protect Personal Information, contact us using the information listed under the ‘Where to Direct Questions or Complaints’ section below. However, because no data transmission over the Internet or storing of electronic data is ever 100 per cent secure, we cannot guarantee that your Personal Information will never be accessed, used, or released in a manner that is inconsistent with this Privacy Notice.

We have put in place procedures to deal with any suspected breach of Personal Information and will notify you and any applicable regulator of a breach where we are legally required to do so.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, WE EXPRESSLY DISCLAIM ANY DEFINITIVE GUARANTEE OF SECURITY IN CONNECTION WITH YOUR PERSONAL INFORMATION.

RETENTION OF YOUR PERSONAL INFORMATION

We will retain your Personal Information only for the duration it is required for the purposes for which we collected it, as well as any additional period required by law.

In general, to determine the appropriate retention period for your Personal Information, we consider:

• the amount, nature and sensitivity of Personal Information;
• the potential risk of harm from unauthorized use or disclosure of your Personal Information;
• the purposes for which we collect, use and disclose your Personal Information and whether we can achieve those purposes through other means; and
• any applicable legal requirements.

CORRECTION OF YOUR PERSONAL INFORMATION

If you believe there is an error or omission in your Personal Information, you may request that we correct the information.

INDIVIDUALS BASED IN THE UNITED KINGDOM

Where you are based in the UK, UK data protection law requires us to provide you with certain additional information in relation to our processing of your Personal Information. This information is set out below.

Special Categories of Personal Information

We do not generally collect any Special Categories of Personal Information about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). However, where necessary, we may collect and use information about your disability or health status to consider whether we need to provide appropriate adjustments during the recruitment process, for example, whether adjustments need to be made during a test or interview. It is a legal requirement for us to make such reasonable adjustments during the recruitment process.

What rights do you have in relation to your Personal Information?

If you are based in the UK, you have certain rights under UK data protection laws in relation to your Personal Information. These rights include:

• Access: you have the right to request a copy of the Personal Information we hold about you;
• Erasure: you have the right to request that we erase your Personal Information, in certain circumstances;
• Restriction of processing: you have the right to request that we restrict the processing of your Personal Information, in certain circumstances;
• Object to processing: you have the right to object to our processing of your Personal Information, in certain circumstances;
• Data portability: you have the right to request that we transfer your Personal Information to you or a third party (in certain circumstances), in a commonly used machine-readable format;
• Withdraw consent: you have the right to withdraw your consent to our processing of your Personal Information at any time. This will not affect the lawfulness of any processing carried out before you withdraw your consent.

If you wish to exercise any of your rights described above, please contact the Privacy Officer at the details provided below.

Where you are based in the UK, you also have the right to lodge a complaint with the UK Information Commissioner’s Office, the UK regulator for data protection (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

COOKIES

Our Website uses standard technology known as “cookies”, including session cookies and persistent cookies. Session cookies temporarily keep your settings. This information is stored until your browser is closed. Persistent cookies are created for specific functions you may choose to use on the Website, including, but not limited to: accepting terms of use; saving searches; and saving favourites. Persistent cookies are used to improve your experience of the Website and are retained from session to session. These cookies remain after the browser is closed and are stored locally on your system. BCI does not track such cookies on BCI servers, nor does BCI use such cookies to store Personal Information. You may choose to delete persistent cookies after visiting the Website. If you do not wish to accept cookies, you have the option of blocking or disabling cookies. However, please be aware that you may be unable to access certain parts of the Website if you do block or disable cookies.

REVISIONS TO THIS PRIVACY NOTICE

BCI may, at any time, revise this Privacy Notice. This Privacy Notice was last revised at the date given above. You should periodically revisit this Privacy Notice to review any revisions. If you continue to access or use the Website after any revisions to this Privacy Notice are posted, you will be deemed to have acknowledged those revisions.

WHERE TO DIRECT QUESTIONS OR COMPLAINTS

If you have any questions or concerns about your privacy in connection with the Website or relating to the collection, use or disclosure of Personal Information by BCI, please contact:

Privacy Officer
750 Pandora Avenue, Victoria, BC, Canada V8W 0E4
Phone: 778-410-7100
Email: privacy@bci.ca