<h4 class="arial10"><b style="font-weight: 700;">A. SUMMARY</b></h4><p class="arial10"><span class="InitialStyle">Coast Hotels (Coast) is committed to adherence to the requirements of Bill 38, the <i>Personal Information Protection Act (PIPA).</i> </span>The Act governs the collection, use and disclosure of information obtained from potential or existing ambassadors, by whatever means, in a manner that recognizes both the right of individuals to protect their private information, and Coast’s need to obtain and store such information, for purposes that a reasonable person would consider appropriate in the circumstances. </p><p class="DefaultText">Information is collected to establish identification, determine employment qualifications and comply with all related legal and regulatory requirements. Collection, use, and disclosure of such information occurs only after either notice by Coast of the fact and purpose of such collection, use, or disclosure, or express consent by the individual to the fact and purpose of such collection, use, or disclosure.  Personal information is not retained for purposes other than those for which it was originally intended, which includes, but is not limited to payroll administration, benefits administration, compliance with governing provincial and federal statutes, and job performance reviews.</p><p class="DefaultText">Coast Hotels is committed to maintaining the principles of integrity and trust with respect to the privacy of personal information disclosed to Coast by former, prospective and current ambassadors.  As part of this commitment, Coast will take commercially reasonable measures to safeguard the privacy of this information and to ensure that information contained in ambassador files, both physical and electronic, is properly secured and safeguarded. This also applies to information concerning ambassadors’ families, and personal information received by Coast from other sources. </p><p class="arial10">The Ambassador Privacy Policy applies to applicants, current ambassadors, and former Coast ambassadors and it describes and identifies:</p><ul><li class="arial10" style="margin: 0px; padding: 0px;">The nature of the personal information that applicants and ambassadors are normally asked or required to furnish </li><li class="arial10" style="margin: 0px; padding: 0px;">The means by which Coast collects and uses the personal information it obtains</li><li class="arial10" style="margin: 0px; padding: 0px;">The titles (or names) and functions of Coast’s ambassadors and other organizations which require access to and use of the personal information in Coast’s custody</li><li class="arial10" style="margin: 0px; padding: 0px;">The means and procedures employed by Coast to safeguard the personal information it obtains</li><li class="arial10" style="margin: 0px; padding: 0px;">The ambassador’s right to review and correct personal information Coast collects </li><li class="arial10" style="margin: 0px; padding: 0px;">The procedures to be followed by Coast ambassadors to notify the company about improper access, disclosure or use of personal information, and actions Coast is obliged to take to correct such improprieties and prevent their recurrence </li><li class="arial10" style="margin: 0px; padding: 0px;">The circumstances under which ambassadors will be given a choice whether or not to allow disclosure of their personal information by Coast.</li></ul><h4 class="arial10"><b style="font-weight: 700;">B. DEFINITIONS</b></h4><p class="MsoNormal">&quot;Personal information&quot; means information about an identifiable individual but does not include the name, position name, title, business address or telephone number of an employee of an organization. <i>Source: PIPEDA Section 2(1)</i></p><p class="MsoNormal">&quot;Employee personal information&quot; means personal information about an individual that is collected, used or disclosed solely for the purposes reasonably required to establish, manage, or terminate an employment relationship between the organization and that individual, but does not include personal information that is not about an individual’s employment. <i>Source: Guide to OIPC Processes, Section 1.1</i></p><h4 class="MsoNormal"><b style="font-weight: 700;">C. PRIVACY OFFICER AND ASSESSMENT</b></h4><p class="MsoNormal">Coast's Chief Privacy Officer is the President of Coast Hotels. On an annual basis, the Chief Privacy Officer (or authorized designate) will assess Coast's compliance with the ambassador Privacy Policy. After completion of each annual assessment (and implementation of any necessary changes to Coast's ambassador Privacy Policy and practices), the Privacy Officer will certify the self-assessment report and attest to Coast's compliance with this ambassador Privacy Policy in writing.</p><h4 class="MsoNormal"><b style="font-weight: 700;">D. PERSONAL INFORMATION COLLECTED AND SOURCES OF DATA COLLECTION</b></h4><p class="MsoNormal">Coast collects personal information from applicants when they apply for employment with Coast, and from ambassadors during the course of their employment, by various means.   Personal information collected includes, but may not be limited to, the following:</p><ul><li style="margin: 0px; padding: 0px;">Personal information such as name, date of birth, gender, marital status, and identification numbers including social insurance and driver's license numbers </li><li style="margin: 0px; padding: 0px;">Background information, including education (schools and dates attended, and degrees or diplomas obtained), training, work history (names of former employers, dates of employment, and compensation information), military service, and criminal arrests, indictments and convictions which might have a bearing on the employment sought </li><li style="margin: 0px; padding: 0px;">Contact information such as mailing, home and office addresses, home, office and cellular telephone numbers, and home and office e-mail addresses for both the ambassador and certain family members </li><li style="margin: 0px; padding: 0px;">Health and medical information relating to ambassadors, their spouses and dependents, including family physician contact information</li><li style="margin: 0px; padding: 0px;">Coast work history, experience, training, compensation rates (including commissions and bonuses) and employment performance. </li></ul><h4 class="arial10bold"><b style="font-weight: 700;">E. DISCLOSURE</b></h4><p class="arial10bold">Coast will ensure that it informs applicants and ambassadors about:</p><ul><li class="arial10" style="margin: 0px; padding: 0px;">The purposes for which personal information is collected and used </li><li class="arial10" style="margin: 0px; padding: 0px;">How to contact Coast officials with any inquiries or complaints </li><li class="arial10" style="margin: 0px; padding: 0px;">The types of third parties to whom Coast may disclose the personal information </li><li class="arial10" style="margin: 0px; padding: 0px;">The options and means available by which applicants and ambassadors may limit Coast’s use and disclosure of their personal information.</li></ul><p class="arial10">Coast discloses personal information to its ambassadors who have a demonstrable need to have access to such personal information in order to properly perform their duties.  In addition, Coast discloses personal information to third parties who advise Coast on benefit programs or administer such programs for Coast.  Coast requires each of these third parties (except certain licensed professionals, such as doctors and lawyers, who are subject to independent and legally enforceable client confidentiality obligations which have the same effect as a confidentiality agreement) to sign a written confidentiality agreement that prohibits them from disclosing such data to any other person or entity or using such data for any purpose other than that for which Coast has engaged them.</p><p class="arial10">In certain circumstances, Coast may be requested or required to disclose personal information in response to valid legal processes or under applicable laws. Such circumstances may include the receipt by company officials of a search warrant, subpoena, court order or other request from a government or regulatory authority or agency.   Coast reserves the right to disclose such information in response to any such legitimate government or regulatory request or requirement. Coast may also disclose personal information if it is necessary to protect Coast's legal rights, or during emergency situations if the physical safety of an ambassador or others is believed to be at risk.</p><p class="arial10">Coast will not disclose an ambassador’s personal information to any person or entity for marketing purposes of any kind.</p><h4 class="arial10"><b style="font-weight: 700;">F. CONSENT</b></h4><p class="arial10bold">Coast uses and discloses personal information only in connection with its normal business operations, and for no purposes other than as stated herein.  With respect to information considered ambassador personal information, generally Coast is not required to obtain consent where the use, collection, or disclosure is reasonable for the purposes of establishing, managing, or terminating the employment relationship between Coast and the individual.  However, Coast will notify the individual of the fact and purpose of such collection, use or disclosure in advance.  Coast's Privacy Officer will monitor and report on compliance with consent and notice provisions of this policy on an on-going basis, and have the policy, procedures and practices altered to ensure compliance with governing legislation as and when required.</p><p class="arial10">Coast does not intend to disclose or use personal information in a manner not described herein.  However, if Coast desires to use or disclose personal information in a way that is inconsistent with the purposes for which it was collected, at any time, Coast will offer each ambassador the choice as to whether or not to allow such disclosure or use of that ambassador's personal information.  In this situation, ambassador consent must be received in writing (or a legally equivalent electronic form) before Coast may disclose or use personal information in such manner.  If an ambassador does not consent to such disclosure or use, all information which would facilitate personal identification will be removed from that ambassador's records before the data is disclosed or used.</p><h4 class="arial10bold"><b style="font-weight: 700;">G. SECURITY</b></h4><p class="arial10bold">Coast uses commercially reasonable means to safeguard personal information against loss, destruction, misuse, improper disclosure, unauthorized access or modification. These safeguards are routinely tested internally and periodically audited by Coast’s corporate administrative and information technology leadership team.</p><h4 class="arial10"><b style="font-weight: 700;">H. DATA INTEGRITY</b></h4><p class="arial10bold">Coast makes commercially reasonable efforts to ensure that personal information it collects and stores, physically or electronically, is reliable for its intended use, accurate, complete and current.  Coast does not process or transfer personal information in a way which would fail to comply with this policy.</p><h4 class="arial10"><b style="font-weight: 700;">I. ACCESS TO INFORMATION </b></h4><p class="arial10bold">Upon receipt of a written request, Coast will allow an ambassador, under the supervision of a Coast People &amp; Culture Representative or authorized designate, to review the personal information that Coast maintains concerning them.</p><p class="arial10">Should personal information in Coast’s custody concerning an ambassador be found to be incomplete, incorrect or if an ambassador believes that said information to be subject to misinterpretation (such as that contained in a performance review) the ambassador will be allowed to request in writing that clarifying information be placed into the ambassador’s file.</p><h4 class="arial10"><b style="font-weight: 700;"><b style="font-weight: 700;">J. ENFORCEMENT</b></b></h4><p class="arial10bold">Coast's Chief Privacy Officer (or authorized designate) will promptly and independently review, investigate and document allegations that Coast's ambassador Privacy Policy has been violated.  As part of this process, the Privacy Officer will:</p><ul><li style="margin: 0px; padding: 0px;">Review any relevant practices, processes and procedures to determine whether changes are necessary to prevent a recurrence of any substantiated violation hereof. </li><li style="margin: 0px; padding: 0px;">Determine whether or not appropriate disciplinary measures against any person or entity whom Coast determines has violated the terms of this ambassador Privacy Policy are necessary to prevent a recurrence of any substantiated violation hereof. </li></ul><p class="MsoNormal"> Coast will maintain complete and accurate records of each investigation.</p>