BMO Privacy Code - Canada

Our Commitment to You

BMO Financial Group appreciates the opportunity to help you meet your financial needs. From the day Bank of Montreal was founded in 1817, earning and keeping your trust has been at the very core of our business. We are committed to respecting and protecting the privacy and confidentiality of the Personal Information you have entrusted to us. It is important for you to understand what Personal Information we will collect, how we will use it, and who may see it.

Scope

This Privacy Code applies to the operations of BMO Financial Group in Canada, regardless of how you choose to do business with us – in our branch or office, at an automated banking machine, online, or by telephone.

This Privacy Code outlines our commitment to you and incorporates the following 10 key privacy principles:

• Accountability
• Identifying Purpose
• Consent and Your Choices
• Limited Collection
• Limited Use and Disclosure
• Retention
• Accuracy
• Safeguards
• Openness
• Individual Access

Other important information:

• Online and Mobile Privacy Policy
• Contact Us

1. Accountability

We have strict policies and procedures governing how we deal with your Personal Information. Each and every one of our employees is responsible for respecting and protecting the Personal Information to which the employee has access.

Our Chief Privacy Officer oversees privacy governance including policy, dispute resolution, education, communications activities and reporting to our Board of Directors on privacy matters. Please see Contact Us for information on how to reach our Chief Privacy Officer.

2. Identifying Purpose

When we collect your Personal Information, we may use or disclose it to:

• verify your identity;
• provide and manage products and services you have requested;
• understand your financial services requirements;
• protect against fraud and manage risk;
• determine suitability of products and services for you;
• better manage your relationship with us;
• determine your eligibility for certain of our products and services, or products or services of others;
• comply with legal or regulatory requirements, or as otherwise permitted by law;
• communicate with you regarding products and services that may be of interest;
• understand our customers and to develop and tailor our products and services, and
• respond to any questions you may have.

If a new purpose for using your Personal Information develops, we will identify that purpose.

3. Consent and Your Choices

When you apply for a new product or service, we obtain your consent to collect, use or disclose your Personal Information for the purposes set out in Principle 2, Identifying Purpose.

If you prefer not to receive our Direct Marketing communications and/or not have your Personal Information shared among the members of BMO Financial Group for the purpose of marketing, you can have your name deleted from our Direct Marketing and/or shared information lists. If you want to change your privacy preferences, see Contact Us.

Please note that you cannot withdraw your consent to the collection, use and disclosure of your Personal Information if:

• we are legally required to collect, use or disclose your Personal Information, or
• it relates to a credit product we have granted to you where we are required to collect and exchange your Personal Information on an ongoing basis with credit bureaus, credit insurers and other lenders.

Withdrawing your consent in certain situations may also mean that we may not be able to provide you with the products or services you request.

4. Limited Collection

We only collect the Personal Information that we determine we need for the purposes set out in Principle 2, Identifying Purpose.

For example, we may collect:

• Contact Information including address, telephone number and email address.
• Social Insurance Number (SIN) as required in order to comply with the Canada Revenue Agency's reporting requirements. You may provide your SIN to ensure an accurate match between your Personal Information and credit bureau information and to help us differentiate customers who may have the same or similar name.
• Financial Information to ensure that the advice and/or products we provide you are appropriate for you and the investments you purchase are suitable for you.
• Device Information such as information about your operating system, browser, software applications, IP address, geolocation, security status and other device information in order to improve your experience, to protect against fraud and manage risk.
• Website Use Information such as browsing behavior on BMO sites and links, location you click, form data and downloads as well as other data gathered from the use of web tools (for example, Cookies, Web Beacons, Tagging) to better understand your interests and needs so that we can serve you better. For more information, see our Online and Mobile Privacy Policy.
• Employment Information, including information about your previous and current employers, to confirm your eligibility for certain products and services.
• Health Information as required for some of our insurance products.

We may collect Personal Information about you from you and from third parties or sources that are available to the public to satisfy legal requirements or regulatory expectations or to manage our risk and to help us understand our customers in order to develop and tailor our product and service offerings.

You can choose not to provide us with certain information in some situations, but if you make this choice, we may not be able to provide you with the product, service, or information you request.

We may monitor or record our incoming or outgoing telephone calls with you to ensure accuracy, security, service quality, for training purposes and to establish a record. If you do not wish to have your call recorded, you have other options to conduct business with us such as at one of our branches or ABMs, online, or by contacting us in writing.

We may use video surveillance in and around our branches, ABMs and other locations for the safety of our customers and employees, and to protect against theft, property damage and fraud.

5. Limited Use and Disclosure

We will only use or disclose your Personal Information for the purpose(s) it was collected and as otherwise identified in this Privacy Code. Personal Information may be released to third parties including legal or regulatory authorities in cases of suspected criminal activity or contravention of law, for the detection and prevention of fraud, or when required to satisfy the legal or regulatory requirements of governments, regulatory authorities or other self-regulatory organizations, or to comply with a court order or for the protection of our assets (for example, collection of overdue accounts).

We may share your Personal Information within BMO Financial Group, including locations outside of Canada where we do business, for legal and regulatory purposes, to manage credit risk and other business risks, to perform analytics, to ensure we have correct or up to date information about you (such as your current address or date of birth) and to better manage your relationship with us.

We may share your Personal Information within BMO Financial Group for the purpose of marketing, so that these companies can offer you a broader range of product and service solutions to meet your needs. You may withdraw your consent to this use of your Personal Information as described in Principle 3, Consent and Your Choices.

We do not sell the names or other Personal Information of our customers. We do not disclose the names or other Personal Information of our customers to other companies outside of BMO Financial Group without consent unless required or permitted by law.

Over time, we may buy new businesses or sell some of our businesses. Accordingly, Personal Information associated with any accounts, products or services of the business being purchased or sold will be transferred as a business asset to the new business owner. We may also transfer Personal Information as part of a corporate reorganization or other change in corporate control.

We may use affiliates or other companies to provide services on our behalf such as data processing, account administration, analytics and marketing. Such companies will be given only the Personal Information needed to perform those services and we do not authorize them to use or disclose Personal Information for their own marketing or other purposes. We have contracts in place holding these companies to the same standards of confidentiality by which we are governed. In some cases, these other companies may be located outside of Canada (such as in the United States) and may be required to disclose information to courts, government authorities, regulators or law enforcement in accordance with applicable law in that country.

6. Retention

We have policies in place that govern the retention of your Personal Information so it will be kept only for as long as reasonably necessary to fulfill its intended purpose or to satisfy legal requirements.

7. Accuracy

We are committed to maintaining the accuracy of your Personal Information and ensuring that it is complete and up-to-date. If you discover inaccuracies in our records, or your Personal Information changes, please notify the branch or office where you do business immediately so that we can make the necessary changes. Failure to notify us of changes to your Personal Information may negatively impact the way we communicate or provide sevices to you. Where appropriate, we will advise others of any material amendments to your Personal Information that we may have released to them. If we do not agree to make the amendments that you request, you may challenge our decision as described in Contact Us.

8. Safeguards

We use physical, electronic and procedural safeguards to protect against unauthorized use, access, modification, destruction, disclosure, loss or theft of your Personal Information in our custody or control.

We have agreements and controls in place with credit bureaus, credit insurers, other lenders and third party service providers requiring that any information we provide to them must be safeguarded and used only for the purpose of providing the service we have requested the company to perform.

To learn more about our security controls, visit bmo.com/security

9. Openness

From time to time, we may make changes to this Privacy Code.
This Privacy Code at (bmo.com/privacy) is always the most recent version.

Please see Contact Us to answer any questions you may have about our Privacy Code.

10. Individual Access

Requests to review or verify your Personal Information, or to find out to whom we have disclosed it, must be made to us in writing. The branch or office where you do business can assist you with the request. We will need specific information from you to enable us to search for, and provide you with, the Personal Information we hold about you. We may charge you a token fee depending on the nature of your request and we will advise you of any fee prior to proceeding with your request. If we are unable to provide some of the Personal Information we hold about you, we will tell you why. To request to review or verify your Personal Information, see Contact Us.

Other important information:

Online and Mobile Privacy Policy

Scope of BMO Online and Mobile Privacy Policy

This Online and Mobile Privacy Policy supplements the BMO Privacy Code and specifically addresses the way in which we will collect, use, disclose and manage Personal Information in connection with our Canadian websites, mobile offerings and other electronic services. It should be read in conjunction with the Legal Terms of Use.

Your Consent

Each time you use our online, mobile and electronic services, you are indicating your acknowledgement and consent to the collection, use and disclosure of your Personal Information as set forth in this policy, which we may revise periodically without notice. We will let you know of any changes by posting the revised policy with a new effective date. If you do not accept the terms outlined in this policy, please do not use our online, mobile and electronic services.

Collection of Personal Information

We may collect personal information when you use our websites, mobile offerings and other electronic services. For example, we may collect:

• Account/Contact Information, such as your name, email address, user ID, password and service preferences.
• Financial Information, such as that required in an online application for products or services.
• Location Information, such as the information about your device’s approximate physical location for purposes such as validating your identity, the prevention, suppression or detection of crime, and to enhance the functionality of a particular service, for example locating a nearby BMO branch. The ability to access location information is controlled by your device. Please refer to the documentation for your device regarding how to allow or block the collection of location information. If you choose not to provide location information, some services may not operate effectively.
• Transactional Information about your use of our products and services.
• Device Information such as information about your operating system, browser, software applications, IP address, geolocation, security status and other device information in order to improve your experience, to protect against fraud and manage risk.
• Website Use Information such as browsing behavior on BMO sites and links, location you click, form data and downloads as well as other data gathered from the use of web tools (for example, Cookies, Web Beacons, Tagging) to better understand your interests and needs so that we can serve you better.
• Other Information, such as any feedback you may provide to us.

We do not knowingly solicit data from, or market to, children under the age of 13. If a parent or guardian becomes aware that his or her child has provided us with information without their consent, he or she should Contact Us. We will delete such information from our files.

Purposes for the Use and Disclosure of Personal Information

We may use and disclose your information collected online to:

• Provide and manage the online products and services you have requested;
• Verify your identity and authenticate you;
• Protect against fraud, security threats and otherwise manage risks;
• Communicate with you regarding products and services that may be of interest;
• Evaluate and improve our websites and other electronic offerings;
• Tailor our services and otherwise enhance the customer experience, and
• Satisfy legal or regulatory requirements.

Use of Web Tools

BMO Financial Group or its service providers may use various web tools, including Cookies, Web Beacons and Tagging on our websites and advertisements.

• Cookies are a string of data sent between a server and a web browser to, for example, help facilitate the use of a website and to help understand how a website is being used.
  
  Different types of Cookies are used for different types of activities. Examples of Cookies we may use are:
  
  Session Cookies enable the website you are visiting to keep track of your movement from page to page so you do not get asked for the same information you've already given to the site. Session Cookies allow you to proceed through many pages of a site quickly and easily without having to authenticate or reprocess each new area you visit. They are not written to hard drive so they are deleted once you log out or close your browser. These cookies do not gather information about you that could be used for marketing or remembering where you have been on the internet.
  
  Persistent Cookies help websites remember your information and settings when you visit them in the future, and help us provide you with a more personalized experience when you are using BMO websites by analyzing which products and services you have used. When you log into BMO Online Banking, we associate you with a unique internal identifier. The unique identifier allows us to know who you are, however, the Cookie will never contain information, such as your name or address, that would identify you to a third party. This unique identifier enables us to monitor your browsing habits on BMO websites so that we can better understand your needs and communicate with you regarding products and services that may be of interest to you. Persistent Cookies are stored on your computer.
  
  Flash Cookies are used to improve your website experience by identifying online behaviors and customizing the ads you view to reflect your browsing experience.
  
  Cookies are a commonly used technology and many web browsers default to automatically accept Cookies. If you decide that you do not wish to receive Cookies, refer to your browser’s online help for further instruction and information on setting Cookie preferences. If you do not accept cookies, you may continue to browse our websites; however, you should be aware that certain features of our websites may not function properly without Cookies. You should note that if you would like to use a service such as BMO Online Banking, you will be required to accept the Cookies to maintain session integrity and enhanced security.
• Tagging is when we place customized code on our websites in order to monitor user activity on our websites. This Tagging software captures user activity and passes it on to a third party for analysis so that we might better understand and enhance the user experience and provide additional security controls.
• Web Beacons are small and transparent images embedded in web pages that, when combined with Cookies, help provide a website operator with information about the use and effectiveness of a website.
• Ad Management Solutions are tools that enable us to present appropriate ads to users based on previous interests as indicated by websites they have visited. These tools track if you have clicked on a BMO ad and identify your activity when you clicked on that ad using Cookies and Web Beacons. These tools do not identify you personally, but are associated with the device, such as the computer being used.
• Online Authentication Process captures and stores device information as well as information you provide in order to confirm your identity each time you visit our secure websites. When you purchase a new product online, register for a secure online service or activate an existing product, the application you complete may include an online authentication process. The information that you provide in your application may be compared against the information contained in your consumer credit report to validate your identity.