Privacy Statement

The Facility Association (“we,” “our,” or “us”) is committed to protecting your privacy and safeguarding your personal information.

This Policy explains how we collect, use, and disclose personal information and your choices regarding that information.

Our Privacy Officer is responsible for ensuring compliance with this Policy and privacy legislation.

Topics Covered in this Privacy Policy

1. Whose personal information do we collect, use, and disclose?
2. On what basis do we collect, use, and disclose your personal information?
3. What personal information do we collect, use, and disclose?
4. Why do we collect, use, and disclose your personal information?
5. From whom do we collect your personal information?
6. Who are the third parties involved in the collection, use, and disclosure of your personal information?
7. How long do we retain your personal information?
8. Is your personal information transferred outside Canada?
9. What safeguards have we implemented to protect your personal Information?
10. How can you access your personal information that we have collected, used, or disclosed?
11. What if the personal information we have on you is inaccurate?
12. How do you withdraw your consent?
13. How do we handle your privacy requests?
14. How do you make a complaint or challenge our privacy compliance?
15. How do you contact our Privacy Officer?
16. Updates

1.   Whose personal information do we collect, use, and disclose?

We may collect, use, and disclose personal information belonging to:

• Our policyholders and individuals who have claims against them

• Individuals in the four Atlantic provinces who have claims under the Uninsured Automobile Funds we administer

• Individuals in the risk-sharing pools we administer and individuals who have claims against them

• Insured drivers whose information is submitted to us under the Underwriting Information Plan (“UIP”), which we provide and administer

2.  On what basis do we collect, use, and disclose your personal information?

For personal information submitted to us under the UIP, we primarily rely on authority granted to us under applicable provincial statutes and regulations to collect, use, and disclose such information.

For our policies issued through the Facility Association Residual Market (“FARM”), we generally rely on your consent obtained by your broker, our servicing carriers, agents, or directly from you. The form of consent, whether express or implied, depends on the sensitivity of the personal information involved.

There may also be other circumstances in which we collect, use, or disclose your personal information based on the authority granted to us under applicable provincial statutes and regulations, on your consent, or under exceptions to consent permitted by privacy laws, such as when investigating fraud.

3.  What personal information do we collect, use, and disclose?

The personal information we may collect, use, and disclose includes:

• Name, contact information, and identification

• Personal identifiers (e.g., driver’s license number, address, age, gender, family or marital status)

• Vehicle and driving history, including accidents and traffic violations

• Previous insurance and claims history

• Financial and credit information (e.g., social insurance number, payment details, credit score) and

• Claims-related information, including details from medical, financial, and educational institutions, employers, legal professionals, adjusters, witnesses, experts, private investigators, and law enforcement

4.  Why do we collect, use, and disclose your personal information?

The purposes for which we collect, use, and disclose your personal information may include:

• Ensuring the availability of automobile insurance to owners, lessees and licensed drivers of motor vehicles who are eligible

• Assisting Member Insurers in conducting valid and appropriate risk assessments and underwriting

• Determining insurance eligibility, calculating premiums, and other underwriting purposes

• Contacting you and verifying your identity

• Managing our relationship with other parties including Member Insurers, brokers, and agents

• Administering billing and payments

• Administering risk-sharing pools and claims under them

• Handling and settling claims

• Conducting statistical analysis for internal and industry purposes

• Handling complaints

• Operating, maintaining, and securing our website

• Preventing and detecting fraud

• Managing recruitment and selection processes

• Responding to lawsuits and enforcing our legal rights

• Complying with regulatory and legal obligations

5.  From whom do we collect your personal information?

The personal information we collect as part of the UIP is generally provided to us by Member Insurers.

For our FARM policies, we primarily collect your personal information from your broker, our agents, and/or your insurance company. In some cases, we may collect your personal information directly from you.

Other third parties from whom we may collect your personal information are detailed below.

6.  Who are the third parties involved in the collection, use, and disclosure of your personal information?

The third parties that may be involved in the collection, use, and disclosure of your personal information include the insurance companies required to participate in the Facility Association (Member Insurers) and the insurers appointed by us to provide services on our behalf (servicing carriers). These third parties, along with others, are listed in the table below:

7.   How long do we retain your personal information?

We retain your personal information for as long as reasonably necessary to fulfill the purposes outlined in this Policy, unless your consent is provided or retention is required by law. This includes allowing you a reasonable period to challenge decisions made using your personal information.

We maintain a records retention policy and schedule, which sets out maximum retention periods. Generally, personal information that reaches its maximum retention period is destroyed or anonymized.

8.   Is your personal information transferred outside Canada?

Your personal information may be transferred to jurisdictions outside Canada.

We take steps to protect your privacy during these transfers and ensure that appropriate safeguards are in place, including contractual obligations with the parties receiving your information.

Personal information transferred to other jurisdictions may be subject to local laws and could be accessed by government authorities, courts, law enforcement, or regulatory agencies in those jurisdictions. For more information about our policies regarding foreign processing of your personal information, contact our Privacy Officer (see contact information below).

9.  What safeguards have we implemented to protect your personal Information?

We endeavor to protect your personal information using a combination of physical, organizational, contractual and technological security measures. These measures are intended to restrict access to your personal information only to employees who need it for their work.

10. How can you access your personal information that we have collected, used, or disclosed?

You have a right under privacy legislation to access your personal information.

If you make a written request to our Privacy Officer, we will provide you with access to your personal information as required under privacy laws.

However, there may be circumstances where we are unable to comply with your request. In such cases, we will provide you with reasons for the refusal.

11. What if the personal information we have on you is inaccurate?

You can challenge the accuracy or completeness of your personal information in our records. If you successfully demonstrate that your personal information in our records is inaccurate or incomplete, we will amend the personal information as required. Where appropriate, we will provide the amended information to third parties having access to your personal information.

12. How do you withdraw your consent?

You may withdraw your consent at any time, subject to legal, contractual, or regulatory requirements. However, withdrawing your consent may limit our ability to provide certain products or services.

13. How do we handle your privacy requests?

Privacy requests must be in writing.

We will respond to your written request within 30 days of receipt. If we cannot meet this timeline, we will notify you in writing.

Accessing your personal information is generally free of charge. If any costs apply, we will provide you with an estimate before proceeding.

To protect your privacy, we may require sufficient identification to confirm your identity.

14. How do you make a complaint or challenge our privacy compliance?

If you wish to make a complaint about our privacy practices or challenge our compliance, please contact our Privacy Officer.

If we are unable to resolve your concern, you have the right to contact the Office of the Privacy Commissioner of Canada or the applicable provincial privacy commissioner. However, we encourage you to contact our Privacy Officer first so we can attempt to resolve your concern directly.

15. How do you contact our Privacy Officer?

All comments, questions, concerns or complaints regarding your personal information or our privacy practices should be directed to our Privacy Officer:

Privacy Officer, Facility Association

2235 Sheppard Avenue E. Atria II, Suite 600

Toronto, ON M2J 5B5

E-mail: PrivacyOfficer@facilityassociation.com

16. Updates

We may update this Privacy Policy from time to time. The Privacy Policy is current as of the “last revised” date below.

Last Revised: January 2026