Privacy

A. Which companies are included in this privacy policy?

This policy applies to Loblaw Companies Limited and certain subsidiaries in Canada, as well as their websites, mobile applications, and banners, as follows:

• Loblaws Inc.

• President’s Choice Services Inc.

• Shoppers Drug Mart Inc.

• Pharmaprix Inc.

• Lifemark Health Corp.

• Shoppers Drug Mart Specialty Health Network Inc.

• MediSystem Technologies Inc.

• Certain other current and future subsidiaries and affiliates of Loblaw.

This policy does not apply to the following companies within the Loblaw group of companies, which have their own privacy policies available on their websites:

• T&T Supermarket Inc.(Open in a new tab)

• QHR Technologies Inc. (Open in a new tab)

• Sanis Health Inc.(Open in a new tab)

Please visit the “About Us” section on the Loblaw.ca webpage to learn more about our group of companies and banners.

B. What does this privacy policy include?

This policy describes how we handle your personal information, specifically, what we collect, and how we collect, use, share, protect and store it. We also explain your Privacy Choices and how you can exercise those choices.

This policy applies to you when you visit one of our websites, sign up to be a part of any of our programs, promotions, contests, or events, apply for or purchase our products, or receive our services.

The term “policy” also includes each of these specific privacy notices:

• A Loyalty Privacy Notice, which provides privacy information about our PC Optimum loyalty program and PC Insiders paid subscription program (called our “Loyalty Program”), including how we share personal information with participating third parties (called our “Loyalty Program Partners”).

• A Health and Wellness Privacy Notice, specific to our healthcare services.

• An Interest-Based Advertising and Media Notice, which describes how we collect, use and share personal information to deliver targeted ads, identify general advertising categories that may interest you and report on effectiveness of media campaigns.

Please note that specific privacy notices and/or additional terms and conditions may apply to how we are collecting and managing your information when you engage with some of our programs, products, services, promotions, contests and/or events. Those specific privacy notices and/or terms and conditions will apply together with this policy.

For example:

You are required to accept terms and conditions when you register for our PC Optimum loyalty program. This policy is not part of those terms, but they both apply.

A. Personal information we collect

The personal information we collect may include contact information, information about the specific products and services that you purchase in our stores or from us online, information provided to us in connection with our programs, products and/or services and/or information collected automatically when you interact with us online, connect with our customer service representatives and tools, visit our stores, or otherwise interact with us.

Personal information that we collect may include:

• Contact information, such as your name, email address, home address, and phone numbers.

• Transaction information, including your purchase details (amount, purchased items, location, time) and related information (method of purchase)when you make a transaction in our stores or online, including when you use e-commerce accounts (e.g. a PC Express account). We also collect information about transactions you make with other merchants (name, type, and location) when you use your PCiD^TM (Open in a new tab)as part of the transaction, including when you use afinancial product related to our Loyalty Program. This also includes information about your Loyalty Program account.

• Financial information, such as electronic payment methods you use, and payment details you save to your PCiD^TM Account Centre. It also includes information about financial or insurance products you hold that are related to our Loyalty Program.

• Health information, through the use of any of our healthcare services provided by regulated health professionals, including pharmacists, nurses, nurse practitioners, physiotherapists and other healthcare providers which includes any information that identifies or can identify you and relates to the state of your health or the treatment you are receiving. More specifically, personal health information means both diagnostic, treatment and care information, and/or registration information with our healthcare services. For more information, see our Health and Wellness Privacy Notice.

• Digital activity information, such as how you use our websites and mobile applications, the ads or promotions you interact with, and other information about how you interact with us and our content online. This can include information about your device, IP address, and approximate location. It can also include information about your preferences and interests. For more information, see “B. How We Collect Personal Information” below.

• Candidate information, such as your resume, employment history, references, and other information you provide to us in connection with a job application or recruitment process.

• Other information you choose to provide us, such as when you contact us or provide us with information when communicating with customer service.

Other types of personal information that we collect in certain circumstances are described in this policy and our other privacy notices.

B. How we collect personal information

We collect personal information in the following ways:

Directly from you

You may provide personal information to us in our stores, by mail, by email, over the telephone, through our websites or mobile applications, or in any other direct manner.

For example:

• When you voluntarily share information about yourself with us, we will collect that information to provide you with our programs, products, or services, respond to your inquiry, or for any other purpose disclosed to you at that time.

If you provide us with personal information about someone else, you are required to ensure that you are authorized to do so and, where applicable, that you have obtained consent for us to handle their personal information.

From other sources

We may receive personal information from other sources with your consent (e.g. when you choose to use a third-party authentication provider, or when you use a third party application or website to access our products and services) or if the law requires or permits us to do so (e.g., to meet our anti-money laundering compliance or other legal and regulatory obligations).

In order to ensure the accuracy of the contact information that you provide us, such as your name, email address and phone number, we may retain the services of a service provider to verify and, if necessary, update, complete or otherwise supplement your contact information by providing us with such additional information. This helps us protect you against error and fraud, and to manage our business operations by ensuring that we can reach you in case of an issue in connection with our programs, products or services, or as otherwise permitted by applicable law, as described below in the “How Do We Use Personal Information” section.

For example:

• If you have a PC Optimum account and make a transaction involving one of our Loyalty Program Partners, we receive information about the transaction.

• If you register for a PC Optimum account, we may retain certain service providers to verify and, if necessary, update, complete or otherwise supplement your mobile number or other contact information you provide us, in order to ensure that this information is sufficiently accurate, complete and up-to-date so that you may be contacted without undue delay if we need to verify your account or provide you with relevant notice in accordance with applicable law and to provide you with communications you request about our programs, products, services and promotions.

• If you use a third-party app or platform, to browse or purchase our products and services, we may receive personal information about you from that app or platform in connection with fulfilling your order.

• When you use virtual assistant or chat features on our websites or mobile applications, we collect the content of your chat (that is, the words you type into the chat feature and the responses you receive).

From technologies used at our locations

We may collect personal information through various types of technologies used across our locations (e.g., grocery, pharmacy), including your image. These can include our point-of-sale systems, video surveillance or other similar types of technologies.

For example:

• We use video surveillance in areas surrounding our stores, pharmacies, kiosks, pavilions, bank machines, parking lots and other locations for security purposes, to protect against theft, to prevent damage to our properties, and to prevent fraud.

• We may also use sensor-based technologies to tell us basic information about how people move through and interact with our stores, to help manage our stores and improve customer experience.

Through our websites and mobile applications

We may collect certain types of information electronically when you interact with our websites, email, mobile applications, social media accounts, online advertising, or through the use of our or a third party’s technologies. This information helps us understand what actions you take on our websites and applications, as well as other platforms.

The technologies we use include:

• Cookies, which are small text files that are saved on your computer when you visit a website so that information can be saved between visits, such as your login credentials or language preferences. For example, cookies allow you to log in quickly when you visit our sites.

• Web beacons and single pixel gifs, which are small image files that provide us with information such as your network IP address and certain activities taken on online platforms.

We may combine the digital activity information we collect through these technologies with other information. We use this information to operate, help protect, and understand how you use our sites and applications, and to provide a personalized experience (such as by remembering your preferences). This includes serving targeted advertising to you and related activities described in our Interest-Based Advertising and Media Notice.

For example:

• We use your location or language preference to auto-select features when you visit our websites and mobile applications.

• We use information about how you and others use our websites and applications to improve them.

• We analyze digital activity information and transaction information to improve our businesses and better serve customers.

Your choices. You can learn more about the cookies we use and update your cookies preferences by using the “Cookie Settings” link, which can be found at the bottom of most of our website pages. To learn more about other privacy choices available to you, review How Do I Change My Privacy Choices? below.

Google Analytics. We may use Google Analytics, a web analysis service of Google Inc. ("Google"). Google Analytics uses cookies to analyze your use of our websites, to create reports about visitor activities for us and to provide further services associated with the use of the websites and other digital activity. For more information about how Google uses data from sites that use its services, visit www.google.com/policies/privacy/partners(Open in a new tab). You may opt out of Google Analytics by adjusting your Google ad settings at www.google.com/settings/ads or by downloading and installing the Google Analytics opt-out browser add-on available at https://tools.google.com/dlpage/gaoptout(Open in a new tab).

We use your personal information for the following purposes. The personal information we use for these purposes depends on the circumstances.

A. Providing programs, products and services

We may use your personal information in order to provide you with our programs, products, and services, which includes:

• Providing you with a quote or determining your eligibility for a program, product or service.

• Authenticating your identity, linking accounts, and securing access to our services.

• Processing your transactions and returns, online or in store.

• Fulfilling your product and service requests, inquiries, and purchases.

• Administering our Loyalty Program, as detailed in our Loyalty Privacy Notice.

• Providing you with healthcare services such as pharmacy and rehabilitation services. For more information see our Health and Wellness Privacy Notice.

The types of personal information we may use for these purposes include your contact information, transaction and account information, financial information, and digital activity information.

B. Managing our businesses

We use your personal information to manage and improve our business, which includes:

• Managing and facilitating the use of our websites and mobile applications, which may include using cookies and other similar technologies that collect digital activity information about you.

• Operating our stores and digital properties, which is informed in part by transaction information.

• Using candidate information to consider job applications, including verifying references and conducting background checks.

• Validating the contact information that you provide us through service providers and updating your contact information if needed.

• Meeting our legal and regulatory obligations.

C. Communicating with you

We use your personal information to communicate with you in a variety of ways, including:

• Providing you with information and updates about our programs, products, services, promotions, contests, and events. We may do this in a variety of ways (e.g., email, telephone, SMS, direct mail).

• Responding to your inquiries.

• Running contests, promotions, surveys, chats, seminars or workshops.

• Taking or verifying instructions from you.

• Delivering targeted advertisements relating to our or third-party products and services that may be of interest to you. For more information see our Interest-Based Advertising and Media Notice.

• Providing you with offers or services based on the approximate location provided by your mobile device (also called “location-based advertising”).

We may use your contact, financial and account, transaction, and digital activity information for these purposes.

If you no longer wish to receive commercial electronic messages, please let us know by following the unsubscribe directions provided in every commercial electronic message. For more information see How Do I Change My Privacy Choices?.

D. Improving our businesses, products and services

We may use personal information to better understand our customers, improve the offers we provide you, and to improve our business, including:

• Conducting analytics to inform and improve our business, including how we operate our business, connect with you, provide our programs products and services, and protect you and us.

• Conducting analytics to grow our business, including by developing new programs, products and services.

• Developing offers and promotional campaigns.

• Personalizing the experience for you on our applications, including customizing offers for Loyalty Program members with online accounts.

• Improving the functionality and customer experience of our websites and mobile applications.

• Measuring and improving the effectiveness of our marketing and targeted advertising campaigns. For more information, see our Interest-Based Advertising and Media Notice.

The information we may use for these purposes varies and depends on the circumstances, but includes transaction information, financial information, and digital activity information.

E. Protect you and us

We may use personal information to help protect you and us, which includes:

• Maintaining the health, safety and security of the public and our customers, employees, and property (e.g., through video surveillance and other monitoring technologies).

• Protecting our websites, applications, data and information technology.

• Informing you of public health concerns, in accordance with public health laws.

• Preventing, detecting, and investigating fraud and other potentially illegal or harmful activity.

• Monitoring and investigating incidents and responding to claims.

• Responding to requests from law enforcement and other third parties that we view as legitimate.

• Any other activity to protect our rights, property or interests.

We may use any personal information reasonably necessary for these purposes.

F. Automated decision-making

We may develop or use various technologies to help us provide you with our programs, products, and services, to manage our business operations, to communicate with you, to enhance your experience with us and the other purposes discussed above. In some cases, these technologies make automated decisions so we can respond in real time.

• For example, we use automated tools to help detect and prevent fraud. We may review shopping or related activity to identify unusual or suspicious transactions. If an activity appears suspicious or potentially harmful, we may block or stop it.

A. Service providers

In the course of providing our programs, products, services, promotions, contests, and events we may share personal information with our service providers. These service providers help us operate our business, technology systems and applications, internal procedures, infrastructure, advertising, marketing, risk mitigation, and loyalty and analytics capabilities as well as assist us with meeting our legal and regulatory obligations. They provide services to us such as data hosting, contest administration, email deployment, call centre, marketing, fraud mitigation, processing or analysis of personal information. We require these service providers to limit their access to and/or use of personal information to what is required to provide their services and to comply with our privacy requirements, where applicable.

For example:

• Personal information collected from contest participants may be shared with our contest administrator to contact selected participants.

• The PC Express home delivery service, which is offered through Loblaws Inc., is supported by a third-party delivery company that fulfills orders on our behalf.

• We use a range of recruitment and human resources, investment, insurance and IT services providers to support our businesses.

• Our service providers include business professional firms that provide accounting, law, and consulting services.

B. Service delivery partners

In the course of providing our programs, products, and services, we may do so through arrangements with third parties. As a result, your personal information may be collected, used, and shared by us and the applicable third party. These third parties may have their own privacy policies and terms and conditions, which will govern their use of your personal information.

For example:

• To administer our Loyalty Program and other related purposes, we share personal information with our Loyalty Program Partners. See our Loyalty Privacy Notice for details.

• The PC mobile pre-paid service, which is offered through Loblaws Inc., is provided by a carrier that is identified in connection with that service.

• We share personal information, including transaction and digital activity information, with advertising partners as described in our Interest-Based Advertising and Media Notice.

• We share personal information, including transaction and digital activity information, with third parties to help you shop (e.g., delivery platforms).

C. Academic and research institutions

In certain circumstances, we may conduct research activities or partner with academic or research institutions to collaborate on research projects. Some research projects may be reviewed and approved by a research ethics board or similar oversight body, while others may be conducted based on your consent and in accordance with applicable laws and our privacy practices. With your consent, we may share your personal information with them if you choose to participate in a relevant study.

We may also share aggregated or de-identified information with academic or research institutions to support research projects or related initiatives.

D. Our group of companies

We may share your personal information within our group of companies to collaborate on providing and developing programs, products and services. We may also share personal information as part of managing our businesses, improving our businesses and offers, to help protect you and us, and for other purposes identified in this policy.

E. Sale or transfer of business or other transaction

We may decide to sell or transfer all or part of our business to a related company or to a third party, to merge with another entity, to insure or securitize our assets, or to engage in another form of corporate or financing transaction (including the proceedings of insolvency or bankruptcy), corporate reorganization, share sale, or other change in corporate control. If your personal information is required in connection with any such transactions, we will comply with the legal requirements for the disclosure of personal information.

F. Manage our business and help protect you and us

We share personal information with third parties to manage our business and help protect you and us. This includes:

• Responding to requests from law enforcement, government agencies, and other third parties that we determine to be legitimate.

• Disclosing information as required to meet our legal and regulatory requirements.

• Sharing information with third parties to help prevent, detect, and investigate fraud and other potentially illegal or harmful activity or incidents.

• Disclosing candidate information to conduct background and reference checks on job applicants.

• As we otherwise determine to be necessary to protect our rights, property or interests.

G. With your consent

Other than the purposes listed above, we may, with your implied or express consent, share or disclose your personal information outside of our group of companies, in accordance with applicable law.

Your consent can be withdrawn at any time, except in limited circumstances, including where withdrawal of consent is restricted by legal or regulatory requirements or as a result of your contractual obligations with us. For information on how to manage your privacy preferences, please see How Do I Change My Privacy Choices? below.

If you choose not to provide us with certain personal information or if you withdraw your consent, where such withdrawal is available, we may not be able to offer you the programs, products, services, contests, promotions, events, or information that you requested or that could be offered to you.

Depending on the circumstances (including the services and technologies you use), you can update your choices on:

• Marketing and promotional communications. You can opt out using the unsubscribe link or other method provided in the communication (e.g. in the text or the email you received). You can also update your choice through the PCiD^TM Account Centre or the applicable application provided by us. You can also opt out of marketing and promotional communications by contacting our Customer Relations Centre at 1-800-296-2332. We may still contact you for non-promotional purposes after you opt out, such as to confirm a transaction, respond to or process a request, provide service or reminder notices, or contact you regarding an order.

• Targeted advertising. You can opt out of targeted advertising and related activities) by accessing the PCiD^TM Account Centre. You can also opt out by contacting our Customer Relations Centre at 1-800-296-2332, If you opt out, you will still see ads, but they may be less relevant to you. If you participate in our Loyalty Program using an online account, you will continue to receive personalized offers.

• Cookies and similar technologies. You can learn more about the cookies we use and update your cookies preferences by using the “Cookie Settings” link, which can be found at the bottom of most of our website pages.

  • You can also update your browser or device settings. Your browser’s instructions may provide further details, including by using the following quick links based on the browser type that you are using: Microsoft Edge(Open in a new tab), Google Chrome(Open in a new tab), Firefox(Open in a new tab), and Safari(Open in a new tab).

  • You can opt out of Google Analytics by downloading the browser add-on located at https://tools.google.com/dlpage/gaoptout(Open in a new tab). Google has additional ad settings available at http://www.google.com/settings/ads/(Open in a new tab).

  • You can also update your privacy settings on third party platforms (e.g. Facebook), which may mean they share less information with us if we use them for advertising or post content on them.

• App notification and device information. You can update notification settings in your application and through your device settings. You can also manage some of the information we collect from your device (e.g., location, camera permissions) through your application or your device settings.

It may take some time to fully implement the changes you make. For example, you may not stop receiving marketing communications immediately after opting out.

If you are seeking to update your privacy choices and the options above do not apply, you can always contact us using the information under Who Do I Contact With Privacy Questions? below.

For information on requesting to access, correct or delete your information, please see What Are Your Rights In Relation To Your Personal Information? below.

A. How we protect personal information

To help protect your personal information, we maintain administrative, technical, and physical safeguards designed to protect against the loss, misuse, unauthorized access, disclosure, or modification of your personal information.

Examples of safeguards we may use, where we determine to be appropriate, include:

• Multi-Factor Authentication, which is a method of confirming your identity by using more than one way to authenticate you, such as asking for your password and a code that is sent to your email address or phone number.

• Masking, which is the process of obscuring your information so that the structure remains the same, but the content is no longer identifiable.

• De-identification, including pseudonymization techniques that replace, remove or transform your information with a pseudonym (e.g., replacing identifiers with codes) to preserve its informational value.

• Anonymization, which is the process of altering your data so that it can no longer be used to identify you personally.

• Encryption, which is the process of obscuring your information in order to make it unreadable without the use of a code or a key.

• Logging and monitoring, which is the process of tracking, recording, and monitoring activity related to the access and/or use of your accounts or personal information.

• Data clean rooms, which are environments where personal information from one or more sources can be processed in accordance with defined rules and restrictions for analytics, measurement, data transformation or other purposes in a privacy-compliant manner.

B. Data governance

We maintain policies and practices which are designed to help protect your personal information. Depending on the volume and sensitivity of the information, the purposes for which it is used and the format in which it is stored, we implement a combination of measures designed to protect your personal information, including:

• Internal policies and procedures that govern our privacy and personal information handling practices, including responding to privacy complaints or inquiries, investigating potential incidents and records management.

• Designated Privacy Officers to monitor our companies’ compliance with applicable laws.

• Regular employee privacy and security training.

• Contractual protections and other measures designed to ensure that service providers with whom we share personal information maintain adequate privacy protections and standards, as described above and in How do we share personal information?

C. Where we process personal information

We or our service providers may access, process, or store your personal information outside of your province, territory, or Canada. In that case, the personal information is subject to the law of the jurisdiction in which it is used or stored, including any law permitting or requiring disclosure of the information to the government, government agencies, courts, and law enforcement in that jurisdiction. The jurisdictions where we or our service providers are currently located include Canada, the United States, the European Union, United Kingdom, India, and the Philippines.

D. How long we process personal information

We will store your personal information for as long as reasonably necessary to fulfill the purposes identified in this privacy policy, including to meet legal requirements (e.g., healthcare providers must retain patient records in accordance with their statutory retention obligations).

Please note that if your personal information is collected from you by a third party on its own behalf (and not on our behalf), it will be retained in accordance with the privacy policies and records retention policies of that third party.

Some of the personal information we hold about you is accessible to you through your online account(s). You can access and update or correct your personal information by logging into your account(s) and making updates to your profile information and your preferences.

For personal information that is not available through your online account(s), or to make any other privacy-related request, you can submit a request using the information provided under Who Do I Contact with Privacy Questions?.

To access your personal health information, please contact your healthcare provider directly. Similarly, to access your personal information collected by a third party, please contact that third party directly.

If you are unsatisfied with our response to your question or request, or how we handle your personal information, please contact the appropriate Privacy Office. For contact information, see Who Do I Contact with Privacy Questions?. If the Privacy Office is unable to address your concern to your satisfaction, you may bring the matter to the attention of the appropriate Privacy Commissioner. Some of our activities are subject to the jurisdiction of the Office of the Privacy Commissioner of Canada; other activities are subject to the jurisdiction of the Privacy Commissioner of your province or territory of residence.