Introduction

Fountain Tire is committed to protecting the privacy of personal information of our customers and associates (“Personal Information”) by developing and implementing this Privacy Code for the Protection of Personal Information (the “Fountain Tire Privacy Code”).

The Fountain Tire Privacy Code incorporates the principles of Part 1 of the Personal lnformation Protection and Electronic Documents Act (Canada) as well as the principles of the Personal Information Protection Act (Alberta), and includes the principles set out in the Canadian Standards Association (CSA) Model Code for the Protection of Personal Information.

The Fountain Tire Privacy Code applies to Personal Information collected, used or disclosed by Fountain Tire. It also applies to all Personal Information held in Fountain Tire databases and utilized by Fountain Tire stores.

The Fountain Tire Privacy Code:

• is subject to all applicable laws and regulations;
• does not apply to information regarding our corporate customers (although their information may be protected by other practices including agreements between Fountain Tire and the corporate customer in question); and
• does not apply to Personal Information that is publicly available and/or is permitted by law to be collected, used or disclosed without consent.

In this Fountain Tire Privacy Code, “Fountain Tire”, “we”, “us” and similar terms mean (collectively) Fountain Tire Ltd. and its wholly and partially owned subsidiaries and affiliates, as they may exist from time to time.

The Principles

Principle 1 Accountability

Fountain Tire is responsible for Personal Information under its control and shall designate an individual or individuals (the “Privacy Compliance Officer(s)”) who are accountable for Fountain Tire’s compliance with the following principles:

1.1 Fountain Tire is responsible for Personal Information in its custody or control, including information that has been disclosed by Fountain Tire to a third party for processing. Fountain Tire endeavours to use appropriate safeguards to ensure the protection of Personal Information while it is being processed by a third party.

1.2 Fountain Tire has:

• implemented internal policies and procedures (the “Policies”) to protect Personal Information;
• implemented the Policies to receive and respond to complaints and inquiries; and
• communicated its Policies to its Corporate Office associates and all Fountain Tire stores and their associates.
• Responsibility for Fountain Tire’s compliance with the Fountain Tire Privacy Code rests with the Privacy Compliance Officer, although other individuals within Fountain Tire may be delegated responsibility for the day-to-day collection and processing of Personal Information and to act on behalf of the Privacy Compliance Officer.
• The name or title of the Privacy Compliance Officer shall be made known upon request.

Principle 2 Identifying Purposes

Fountain Tire shall identify the purposes for which Personal Information is collected on or before the time the Personal Information is collected.

2.1 Fountain Tire collects Personal Information for a number of purposes, including the following:

• to establish and maintain relationships with its customers and associates;
• to provide customers with requested and ongoing products and services;
• to obtain a better understanding of its customers and their requirements and preferences;
• to develop, enhance and/or market products and services to its customers and associates;
• to offer various contests/promotions to its customers;
• to improve its business; and
• to meet legal and regulatory requirements;

(collectively, the “Identified Purposes”):

Fountain Tire will specify, orally, electronically or in writing, the Identified Purposes to the customer or associate on or before the time the Personal Information is collected and will collect only that Personal Information necessary for the Identified Purposes.

When Personal Information that has been collected is to be used for a purpose not previously authorized by the customer or associate (collectively called the “Individual”), the new purpose shall be identified to that Individual prior to its use and it will not be used except with that Individual’s consent, unless the new purpose is required or permitted by law.

All associates of Fountain Tire who collect Personal Information on behalf of Fountain Tire will notify the customer of the Identified Purposes for which the Personal Information is being collected and, if further information or clarification is requested, will refer the Individual to the Privacy Compliance Officer(s) or their delegates.

Principle 3 Consent

Generally, the knowledge and consent of an Individual is required for the collection, use, or disclosure of Personal Information. However, Personal Information may be collected, used, or disclosed without the knowledge and consent of an Individual in certain circumstances, including, without limitation:

• where the collection or use of Personal Information is clearly in the interests of an Individual and consent cannot be obtained in a timely way;
• where it can be reasonably expected that seeking the consent of the Individual in question would compromise the availability or accuracy of the Personal Information and the collection and use is reasonable for the purposes of investigating the breach of an agreement or the contravention of a law;
• with respect to certain types of publicly available Personal Information;
• where the use or disclosure occurs in acting in respect of an emergency that threatens the life, health or security of an Individual; or
• where the disclosure is made:
  • to a lawyer representing Fountain Tire;
  • for the purpose of collecting a debt; or
  • for the purpose of complying with a subpoena or warrant or other order issued by a court or body with lawful jurisdiction.
• When obtaining consent, Fountain Tire will notify the Individual, in writing, of the Identified Purposes for which Personal Information may be used or disclosed. Identified Purposes will be conveyed in a manner that can be reasonably understood by the Individual.
• Generally, Fountain Tire will obtain consent to use and disclose Personal Information at the same time it collects the Personal Information, however, Fountain Tire may seek consent to use or disclose Personal Information after it has been collected, but before it is used or disclosed.
• Fountain Tire will require an Individual to consent to the collection, use or disclosure of Personal Information as a condition of the supply of a product or service only if such collection, use or disclosure is required to fulfill an Identified Purpose.
• Consent may also be given by an authorized representative of the Individual such as a legal guardian or a person having and, if requested by Fountain Tire, providing, a power of attorney or some other legal form of directive from the Individual.
• In determining the appropriate form of consent, Fountain Tire will take into account the sensitivity of the Personal Information and the reasonable expectations of the Individual.
• In general, the use of products and services provided by Fountain Tire to a customer, or the acceptance of employment or benefits by an associate, constitutes implied consent for Fountain Tire, acting reasonably, to collect, use and disclose Personal Information for the Identified Purposes.
• An Individual may withdraw his or her consent at any time, subject to legal or contractual restrictions and reasonable notice. Individuals may contact Fountain Tire for more information regarding the withdrawing of consent and the implications of doing so.

Principle 4 Limiting Collection

The collection of Personal Information is limited to that which is reasonably necessary for the Identified Purposes and will be collected by fair and lawful means.

4.1 Fountain Tire does not collect Personal Information indiscriminately. Both the amount and type of Personal Information collected are limited to that which is reasonably necessary to fulfill the Identified Purposes.

4.2 Fountain Tire collects Personal Information primarily from its customers and associates.

4.3 Where an Individual’s consent has been obtained or where permitted by law, Fountain Tire may also collect Personal Information from other sources including credit bureaus, employers, personal references, or other third parties who represent that they have the right to disclose the Personal Information.

Principle 5 Limiting Use, Disclosure, and Retention

Fountain Tire does not use or disclose Personal Information for purposes other than for which it was collected, except with the consent of the Individual or as permitted or required by law. Fountain Tire retains Personal Information only as long as reasonably necessary for the fulfillment of those purposes.

5.1 Fountain Tire may disclose a customer’s Personal Information to the following parties:

• a person who, in the reasonable judgment of Fountain Tire, is seeking the Personal Information as an agent or authorized representative of the Individual;
• a company or individual employed or retained by Fountain Tire to perform functions on its behalf, such as research or data processing;
• another company or individual retained for the development, enhancement, marketing or provision of any of Fountain Tire’s products or services;
• an agent used by Fountain Tire to evaluate the customer’s creditworthiness or to collect the customer’s account;
• a credit reporting agency;
• a public authority or agent of a public authority, if in the reasonable judgment of Fountain Tire, it appears that there is an imminent danger to life or property which could be avoided or minimized by disclosure of the Personal Information; and
• a third party or parties, where the customer consents to such disclosure or where such disclosure is required or permitted by law.

5.2 Fountain Tire may disclose an associate’s Personal Information:

• for normal personnel and benefits administration;
• in the context of providing references regarding current or former associates in response to requests from prospective employers; and
• where disclosure is required or permitted by law.
• Only Fountain Tire associates with a business need-to-know, or whose duties reasonably so require, are granted access to Personal Information about customers and associates.
• Fountain Tire, or a party to whom Fountain Tire has disclosed Personal Information under Section 5.1 above, or a third party service provider utilized by Fountain Tire for the purposes set out in this Privacy Code, may store Personal Information in any of the Provinces in which it was collected; outside of the Province in which it was collected but only in Canada or the United States, and the laws of the jurisdiction in which it is stored will apply.
• Fountain Tire shall keep Personal Information only for as long as it remains reasonably necessary or relevant for the Identified Purposes or as required by law.
• Fountain Tire will maintain reasonable guidelines and procedures to govern the destruction of Personal Information that is no longer required to fulfill the Identified Purposes.

Principle 6 Accuracy

Personal Information shall be as accurate, complete, and up-to-date as is necessary for the Identified Purposes.

• Personal Information used by Fountain Tire will be sufficiently accurate, complete, and up-todate to minimize the possibility that inaccurate or incomplete information will be relied on by Fountain Tire or a third party.
• Fountain Tire will update Personal Information used on an ongoing basis as and when reasonably necessary to fulfill the Identified Purposes.

Principle 7 Safeguards

Fountain Tire protects Personal Information by security safeguards appropriate to the sensitivity of the information.

• Fountain Tire protects Personal Information against loss or theft, as well as unauthorized access, disclosure, copying, use or modification regardless of the format in which it is held.
• The methods of protection for Personal Information include:
• physical measures, for example, locked filing cabinets and restricted access to offices;
• organizational measures, for example, confidentiality agreements, security clearances and limiting access on a “need-to-know” basis; and
• technological measures, for example, the use of passwords and firewalls.
• Fountain Tire makes its associates aware of the importance of maintaining, and requires its associates to respect, the confidentiality of Personal Information.
• Fountain Tire ensures that when it discloses Personal Information to a third party through contractual arrangements, that the third party has a comparable level of protection in place to protect the confidentiality of the Personal Information and that the Personal Information is used only for the Identified Purposes.
• Personal Information will be disposed of or destroyed with care to prevent unauthorized parties from gaining access to the Personal Information.

Principle 8 Openness

Fountain Tire makes information about its privacy policies and practices readily available to the public through written materials, its website (www.fountaintire.com), other electronic means, and its Customer Service Centre. In addition, copies of the Fountain Tire Privacy Code are available upon request.

Principle 9 Individual Access

Upon request, Fountain Tire will inform an Individual of the existence, use and disclosure of and will give an Individual access to his or her Personal Information. An Individual will be able to challenge the accuracy and completeness of their Personal Information and have it amended if appropriate.

9.1 Upon request, Fountain Tire will afford Individuals a reasonable opportunity to review the Personal Information in the requesting Individual’s file only. Personal Information will be provided in an understandable form, within the time limits prescribed by applicable law and at a reasonable cost, as determined by Fountain Tire. Fountain Tire will provide Individuals with a written estimate of the cost for providing such Personal Information prior to providing the service.

9.2 In certain situations Fountain Tire may not be able to provide access to all the Personal

Information that it holds about an Individual (for example, if access would reveal Personal Information about another Individual or reveal confidential commercial information) and, in such cases, it shall advise the Individual of (i) the reasons for the refusal and the provisions of the applicable law on which the refusal is based; (ii) the name of the person(s) who can answer on behalf of Fountain Tire any questions the Individual has about the refusal; and (iii) the Individual’s right to seek a review of such decision under the applicable legislation.

9.3 Upon request, and where possible, Fountain Tire will provide an account of the use that has been made or is being made of the Personal Information and an account of the third parties to which the Personal Information has been disclosed.

9.4 An Individual may be required to provide sufficient identification information, which includes authorization to access his or her file(s), to permit Fountain Tire to provide an account of the existence, use or disclosure of Personal Information, which identification information shall be used only for this purpose.

9.5 Fountain Tire will respond to an Individual’s request within a reasonable time (as prescribed by applicable law) and at a reasonable cost, as determined by Fountain Tire, to the Individual. The requested Personal Information will be provided or made available in a form that is generally understandable. If abbreviations or codes are used to record Personal Information, an explanation will be provided.

9.6 When an Individual successfully demonstrates the inaccuracy or incompleteness of their Personal Information, Fountain Tire will amend his or her Personal Information as required. Depending upon the nature of the Personal Information challenged, amendment may involve the correction, deletion, or addition of Personal Information. Where appropriate, Fountain Tire will transmit the corrected Personal Information to third parties which have had access to the Personal Information in question.

9.7 Any unresolved differences as to accuracy or completeness of an Individual’s Personal Information will be noted in that Individual’s file and, where appropriate, transmitted to third parties which have had access to the Personal Information in question.

9.8 Individuals may contact the Privacy Compliance Officer(s) at Fountain Tire in order to obtain their Personal Information or seek access to their file(s).

Principle 10 Challenging Compliance

An Individual has the right to challenge Fountain Tire’s compliance with the Fountain Tire Privacy Code, and may do so by contacting the Privacy Compliance Officer(s) at Fountain Tire.

10.1 Fountain Tire has developed and maintains procedures to receive and respond to complaints or inquiries about its privacy policies and practices relating to the handling of Personal Information.

10.2 Fountain Tire will inform Individuals who make inquiries or lodge complaints of the existence of relevant complaint procedures.

10.3 Fountain Tire will reasonably investigate all complaints. If a complaint is found to be justified, Fountain Tire will take reasonably appropriate measures, including, if necessary, amending its privacy policies and practices.