privacy policy

Updated on September 19, 2023

1. Why did we adopt this policy?

The personal information (“information”) you entrust to us is essential to our business relationship with you. We know how valuable it is, and we are determined to do everything in our power to protect it.

That’s why we’ve adopted this policy, which describes our practices for protecting your information and privacy. Our goal is to be transparent with you. This policy applies to the use and disclosure of any information collected, and the manner in which Nymbus collects such information, in the course of your business relationship with us. This policy applies for as long as we hold your information, including after the end of our business relationship.

Our Chief Privacy Officer is responsible for Nymbus’ privacy practices. If you have any questions about this policy, you can write to her at one of the following addresses:

compliance@nymbus.ca

Chief Privacy Officer

1800 McGill College

Suite 1430

Montreal, Quebec

H3A 3J6

You can also contact us as indicated in section 8 below if you have any questions.

2. What type of information we may collect and from whom

2.1. What information we may collect

Identification information

• Names
• Date of birth
• Civil status
• Contact
• E-mail address
• Information on identification (driver’s license, passport, social insurance number*)
• Jobs
• Account number
• Information we hold about you as an authorized representative, director, officer or shareholder

*You are not required to provide your social insurance number, but it will help identify you to information agencies (if applicable). It is also required for tax purposes, especially if an account generates income.

Information to confirm your identity

• Identifier
• Signatures
• Account information

Know Your Customer (KYC) financial information

• Income, wages and balances
• Products and investments and their terms and conditions (e.g. term, repayment frequency, limits, rates, maturity, etc.).
• Professional and financial background

Other information

• Why you do business with us
• Language and communication preferences
• Information about people other than you (proxyholder, secondary cardholder, beneficiaries, your spouse or common-law partner or dependents insured under an insurance product or registered plan, an authorized user of your account, and contact information for someone you think may be interested in a Nymbus* product or service).

*If you provide us with information about another person, we will assume that you are authorized to do so and that you have obtained that person’s consent to its collection, use or disclosure for the purposes set out in this policy.

Information on your operations

• History of transactions and interactions in your accounts
• Investment instructions
• Investment and planning knowledge and objectives
• Risk tolerance

Information for follow-up purposes

• History of individual visits

IMPORTANT: We limit the collection of your information to what is necessary to help us serve you better.

2.2. From whom we may collect your information

We may collect your information directly from you when you communicate or interact with us or when you update your account preferences and settings. We may also collect your information indirectly from other sources. When required, we obtain your consent.

• publicly available sources or records
• regulatory and self-regulatory bodies
• content generated by the use of our websites
• brokers or others involved in securities matters
• intelligence and credit bureaus (if applicable)

3. How we use and share your information and with whom

3.1 How we use and share your information

We use and disclose your information for:

1. identify you, update your information and verify the veracity of the information provided
2. establish your investor profile, financial needs and objectives, and investment strategies
3. establish, manage, administer and maintain the products and services requested
4. Combine the financial information Nymbus holds on you to generate a complete view of the products you hold and serve you better.
5. inform you about new features available on our mobile applications (if applicable)
6. our day-to-day business and operations
7. determine your eligibility for incentives (fee waivers, discounts)
8. prevent, detect and control fraud, as well as unauthorized or illegal activities (money laundering, cyberthreats)
9. enable due diligence on our operations in anticipation of entering into a commercial transaction
10. manage risks, particularly credit and business risks, and comply with laws and regulations
11. communicate with you using the contact details you have provided (by post, e-mail, phone)
12. use and communicate certain information where we are authorized to do so by law (see section 4).

3.2. To whom we may disclose your information

It is sometimes necessary to share your information with others for legitimate purposes. For example, this may be required by law, to protect your interests in the event of fraud, or to provide you with services on our behalf. At all times, we are committed to limiting information to that which is strictly necessary, and to obtaining your consent when required.

We ensure the integrity, security and confidentiality of your information. Under no circumstances do we sell customer lists to third parties.

We may share your information with :

• Internally, for personally identifiable information, compliance purposes and to simplify the day-to-day management of your accounts.
• Internally, for your financial information, to serve you better
• a person acting on your behalf or at your request
• another financial institution or credit reporting agency
• an agent acting on our behalf
• a clearing or settlement system
• a person who holds an account jointly with you or who is otherwise involved in your relationship with us
• third parties, if we need to disclose your information in connection with legal proceedings
• a regulatory or governmental authority or self-regulatory organization
• a person authorized by law to obtain them
• third parties involved in concluding a business transaction
  as described below, the service providers we use to perform certain tasks, such as producing investment statements.

3.3. Service providers

We select our service providers with great care. They fall into the following categories:

• technology services (applications, data center, data storage and backup, hosting services, maintenance and support services)
• professional services
• communication services
• mail services

4. When do we need your consent?

We use your information only with your consent or as permitted by law. We obtain your consent to collect, use and disclose your information:

• when you request a new product or service
• when we need to use your information for a purpose different from those for which you have already given your consent

However, we do not obtain your consent for every interaction with you.

In addition, we do not obtain your consent in certain situations provided for by law, for :

• comply with a court order or other binding request
• debt recovery
• investigation of breach of contract or breach of law
• prevent, stop or detect fraud

5. Your rights and how to exercise them

5.1. Right to accept or refuse to provide your information

Your information belongs to you. Subject to legal, commercial or contractual requirements, you have the right to withdraw your consent to the collection, use or disclosure of information. We will process your request as quickly as possible.

However, certain information is essential for us to provide you with certain products and services. If you refuse to provide it, it may be difficult, if not impossible, to establish or maintain a business relationship with you or even to offer you some of our products. For example, if you do not wish to provide your SIN, we will not be able to offer you products for which it is mandatory, such as a registered product like an RRSP.

5.2. Right to refuse that we use your information for certain purposes

You may refuse to allow us to use your information or withdraw your consent for the following purposes:

a) Send you our promotional offers (marketing)

Nymbus may, from time to time, share with you promotions that may be of interest to you. You may withdraw your consent to receive these at any time. There may be a delay before you stop receiving our promotional offers, particularly those from a promotional campaign already underway.

From time to time, we may contact you to ask if you wish to update your choice to ensure that our records are current and reflect your current preferences.

b) Collecting and using your digital information on our online services

Digital information (e.g. device and browsing data) is not currently collected by Nymbus but may be in the future.

How to withdraw your consent

You may at any time withdraw your consent to receive our promotional offers (5.2 a). You can request this by contacting Nymbus Customer Service or our Compliance Department. We will deal with your request as quickly as possible.

What you will continue to receive once you have withdrawn your consent

You will continue to receive :

• Regulatory notices we are required by law to send you
• Service messages on account statements, if applicable
• Information about your current products and services.

You may also continue to receive information about our products and services verbally or in person from our representatives. In fact, some of our representatives have a duty to advise you and will continue to provide you with this information when necessary.

5.3. Right to access your information

You may request access to the information we hold about you, except where restricted by law.

How to consult your information

To consult your information, you must make a request :

• by telephone by contacting our customer service department
• by contacting our Compliance Department (compliance@nymbus.ca)

We will process your request within 30 days, or longer if required by law. We will inform you if the deadline is longer than 30 days.

5.4. Right to correct your information

You can and must correct inaccurate information about yourself. In order to provide you with quality service, it is essential that your information be accurate and complete. To this end, we rely on you to help us maintain the quality of the information we hold by informing us of any changes. To make a request, please refer to the procedure identified in section 5.3 above.

6. What are our security measures for storing your information?

6.1. Time-limited conservation

We retain your information, in physical or digital format, for as long as necessary to fulfill the purposes for which the information was collected, or as long as required or permitted by law. The purpose, nature and sensitivity of the information have been taken into account in determining retention periods.

Nymbus is subject to numerous legal obligations regarding the retention of personal information (for example, under securities, tax and anti-money laundering laws). In general, to meet these obligations, your customer profile information (such as name, address, date of birth) will be retained for the duration of your relationship with us and for a period of seven years following the end of your relationship with us. In addition, we will retain your transactional information for seven years after completion.

Certain exceptions may apply and require longer retention periods, for example in the case of litigation or claims. In such cases, your information may be retained for up to ten years. When your information is no longer required, we endeavour to destroy it securely.

6.2. Storage locations

Nymbus, its service providers and other third parties to whom your information is disclosed under this Policy may operate outside Quebec and Canada. Your information may therefore be used and stored securely in other provinces and countries. In some cases, your information may be subject to the laws and access rights of authorities in foreign countries, including the United States.

6.3. Information security program

We go to great lengths to protect your information against loss, theft, unauthorized access, use or disclosure, and any other breach of security. We have implemented security measures to keep pace with the ever-changing threats to information security. The measures adopted in our security program are :

• protect infrastructures through secure access to our premises and secure locations for our equipment, etc.
• limit the people who have access to your information. This means that only employees who need to consult your information in the course of their work have access to it.
• manage passwords and set up firewalls.

You have a role to play in protecting your information. We ask you never to divulge your passwords, codes and personal identification numbers. Our employees do not have this information and will not ask you for it. Avoid sending information in any e-mail.

7. How to modify this policy

We may change this policy from time to time. We will notify you by means of a notice appearing on our websites and/or by any other appropriate means to reach you.

8. How to contact us with a question, comment or complaint

To ask a question or send a comment, please contact us :

• Send an e-mail to compliance@nymbus.ca
• Call our customer service
• Talk to your Nymbus representative
• Write to our Chief Privacy Officer, whose contact information appears at the beginning of this document.

To make a complaint, you must follow the procedure set out in our complaints resolution leaflet, available on our website, under Learn > Complaints.