Privacy

A. Which companies are included in this privacy policy?

This policy applies to Loblaw Companies Limited and certain subsidiaries in Canada, as well as their websites, mobile applications and banners, as follows:

• Loblaws Inc.;

• President’s Choice Services Inc.;

• President’s Choice Bank (PC Bank);

• PC Financial Insurance Broker Inc.;

• PC Financial Insurance Agency Inc.;

• Shoppers Drug Mart Inc.

• Shoppers Home Health Care (Canada) Inc.;

• Pharmaprix Inc.;

• Lifemark Health Corp.

• Shoppers Drug Mart Specialty Health Network Inc.;

• MediSystem Technologies Inc. & Subsidiaries; and

• Certain other current and future subsidiaries of Loblaw.

This policy does not apply to the following companies within the Loblaw group of companies, which have their own privacy policies available on their websites:

• T&T Supermarket Inc.(Open in a new tab);

• QHR Technologies Inc.(Open in a new tab); and

• Sanis Health Inc.(Open in a new tab)

Please visit the 'About Us' section on the Loblaw.ca webpage to learn more about our group of companies and banners.

B. What does this privacy policy include?

This policy describes how we handle your personal information, specifically, what we collect, and how we collect, use, share, protect and store it. We also explain your Privacy Choices and how you can exercise those choices.

This policy applies to you when you visit one of our websites, sign up to be a part of any of our programs, promotions, contests or events, apply for or purchase our products, or receive our services.

The term “policy” also includes each of these specific privacy notices:

• A Loyalty Privacy Notice(Open in a new tab), specific to the PC Optimum program;

• A Health Privacy Notice(Open in a new tab), specific to our healthcare services;

• An Interest-Based Advertising and Media Notice(Open in a new tab), specific to our tailored advertising;

• A President’s Choice Financial Privacy Notice(Open in a new tab), specific to the financial services provided by President’s Choice Bank; and

• An Insurance Privacy Notice(Open in a new tab), specific to the insurance services provided by PC^® Insurance.

Please note that specific privacy notices and/or additional terms and conditions may apply to how we are collecting and managing your information when you engage with some of our programs, products, services, promotions, contests and/or events. Those specific privacy notices and/or terms and conditions will apply together with this policy.

For example:

You are required to accept terms and conditions when you register for our PC Optimum loyalty program. Those terms and conditions apply together with this policy.

A. How we define personal information

“Personal information” is any information that identifies you or could be reasonably associated with you. The personal information we collect may include contact information such as your name, email address, home address, and phone numbers, as well as information about the specific products and services that you purchase in our stores or from us online, information provided to us in connection with our programs, products and/or services and/or information collected automatically when you interact with us online or visit our stores.

Personal information that we collect may include:

• Personal transactional information, when you make purchases using a PC Financial

  payment product such as account transactions and the merchants (name, type and location) that you made purchases from. This type of information is also generated by the use of your loyalty and e-commerce accounts and may include information about your purchases

• Personal financial information, through the use of your PC Financial payment product accounts, such as information about your account balances, account numbers, payment history, credit limits and credit scores

• Personal health information, through the use of any of our healthcare services provided by pharmacists, dietitians, opticians, nurses, nurse practitioners, respiratory therapists and other healthcare providers which includes any information that identifies or can identify you and relates to the state of your health or the treatment you are receiving. More specifically, personal health information means both diagnostic, treatment and care information, and/or registration information with our healthcare services.

B. How we collect personal information

We collect personal information in the following ways:

Directly From You

You may provide personal information to us in our stores, by mail, by email, over the telephone, through our websites or mobile applications or in any other direct manner.

For example:

When you voluntarily share information about yourself with us, we will collect that information in order to provide you with our programs, products or services, respond to your inquiry, or for any other purpose disclosed to you at that time.

From Other Sources

We may receive personal information from other sources with your consent or if the law requires or permits us to do so (e.g., to meet our anti-money laundering compliance or other legal and regulatory obligations).

In order to ensure the accuracy of the contact information that you provide us, such as your name, email address and phone number, we may retain the services of a service provider to verify and, if necessary, update, complete or otherwise supplement your contact information by providing us with such additional information. This helps us protect you against error and fraud, and to manage our business operations by ensuring that we can reach you in case of an issue in connection with our programs, products or services, or as otherwise permitted by applicable law, as described below in the “How Do We Use Personal Information” section.

For example:

• If you apply for a PC Financial payment product, with your consent, we may collect information from credit bureaus in order to process your application and determine whether you qualify for a specific product.

• If you register for a PC Optimum account, we may retain certain service providers to verify and, if necessary, update, complete or otherwise supplement your mobile number or other contact information you provide us, in order to ensure that this information is sufficiently accurate, complete and up-to-date so that you may be contacted without undue delay if we need to verify your account or provide you with relevant notice in accordance with applicable law (e.g. following a breach of security safeguards involving your personal information), and to provide you with communications you request about our programs, products, services and promotions.

From Technologies Used At Our Locations

We may collect personal information through various types of technologies used across our locations (e.g., grocery, pharmacy), including your image. These can include our point-of-sale systems, video surveillance or other similar types of technologies (including, for example, anonymous video analytics, which allows us to track the number of individuals in our stores and consider certain demographic information about our customer base on an anonymous basis).

For example:

• We use video surveillance in areas surrounding our stores, pharmacies, kiosks, pavilions, bank machines, parking lots and other locations: for security purposes, to protect against theft, to prevent damage to our properties, and to prevent fraud.

• We may also use anonymous video analytics (technology that collects images to detect the presence of a human and then derives limited demographic or behavioural data; for example, the time spent reviewing a digital sign, or foot traffic patterns within stores) to help manage our stores, understand our customer base, and improve customer experience.

Through Our Websites And Mobile Applications

We may collect certain types of information electronically when you interact with our websites, email, mobile applications, social media accounts, online advertising, or through the use of our or a third party’s technologies, which include cookies, web beacons, single pixel gifs and other technologies such as data management platforms. This information helps us understand what actions you take on our websites and mobile applications and allows our website and mobile applications to work correctly.

We may combine this information with other information collected in-store or online such as your online and in-store transaction history, and aggregate demographic information, such as the predominant age groups and the average size of households in your area, which can help us gain insights about your interests and preferences. We do this to support our customer understanding using website and mobile analytics and to provide you with more tailored advertising and marketing communications. This includes serving interest-based advertising to you, subject to your right to withdraw consent, as detailed in our Interest-Based Advertising and Media Notice(Open in a new tab).  

For example:

• We use your location or language preference to auto-select features when you visit our websites and mobile applications.

• We use your online and/or in-store purchase history to provide you with interest-based advertisements on products that you purchase frequently.

• We collect, combine and categorize your personal information on an aggregated basis to identify online and offline purchasing patterns to help us analyze our businesses to better serve customers.

• We collect information relating to your interests, preferences, and sentiments through your interactions with our websites, applications and social media accounts as well as through aggregate demographic information about households in your area, as determined by your postal code, to gain insights and provide you with more personalized advertising and marketing.

The technologies we use include:

• Cookies, which are small text files that are saved on your computer when you visit a website so that information can be saved between visits, such as your login credentials or language preferences. For example, cookies allow you to log in quickly when you visit our sites.

• Web beacons, and single pixel gifs, which are small image files that have information about you, such as your IP address, that can be downloaded when you visit a website or open an email. This allows us to understand your online behaviour, monitor our email delivery, and provide you with interest-based advertising. These tools also allow our third-party tracking tools to gather information, such as your IP address, and provide this back to us in an anonymized, aggregate form (i.e. in a manner that prevents us from identifying you personally). Aggregate information refers to personal information compiled and expressed in a summary form where no personal identifiers are included.

• Data clean rooms, which are secure environments where de-identified personal information from one or more sources can be processed in accordance with defined rules and restrictions for analytics, measurement, data transformation or other purposes in a privacy-compliant manner.

• Other technologies, such as data management platforms, ad-buying platforms, ad servers, reporting tools and analytics engines, which pull usage data from multiple sources and help manage and collect this data to use for personalization, interest-based advertising, customizing content and other methods to gain insights into our customers’ needs and preferences.

We may use Google Analytics, a web analysis service of Google Inc. ("Google"). Google Analytics uses cookies to analyze your use of our websites, to create reports about visitor activities for us and to provide further services associated with the use of the websites and the Internet. Although this information is collected through your Google ad settings, it is not provided to us in a personally-identifiable format.

You may delete or disable certain of these technologies at any time via your browser. However, if you do so, you may not be able to use some of the features on our websites or mobile applications. To learn more about the privacy choices available to you, please visit How Do I Change My Privacy Choices?

We use your personal information for the following purposes:

A. Providing programs, products and services

We use your personal information in order to provide you with our programs, products and services, which include:

• Providing you with a quote for a program, product or service;

• Determining your eligibility for a program, product or service;

• Validating the contact information that you provide us, such as your name, email address and phone number, through service providers to be able to communicate with you about programs, products or services;

• Processing your applications;

• Creating, administering, and maintaining your accounts (such as for loyalty or warranty programs);

• Processing your transactions and returns, online or in store;

• Fulfilling your product and service requests, inquiries, and purchases;

• Providing tailored programs, products, services or advertisements that may relate to Loblaw entities of which you frequent or shop, our service providers or third parties;

• Providing you with healthcare services such as pharmacy, dietitian and optician services. For more information see our Health Privacy Notice(Open in a new tab); and

• Providing you with financial services such as credit card, bank account or insurance services. For more information see our President’s Choice Financial Privacy Notice(Open in a new tab) and Insurance Privacy Notice(Open in a new tab).

B. Managing our businesses

We use your personal information for many business reasons, which include:

• Deploying and managing our information technology applications and systems, including managing our websites;

• Managing and facilitating the use of our websites and mobile applications, which may include using cookies and other similar technology;

• Enabling your participation in contests, promotions, surveys, chats, seminars or workshops;

• Maintaining the health, safety and security of the public and our customers, employees and property (e.g., through video surveillance and other monitoring technologies);

• Protecting parties from errors and fraud;

• Verifying the accuracy of the contact information that you provide us, such as your name, email address and phone number, through service providers and, if necessary, updating, completing or otherwise supplementing your contact information accordingly;

• Monitoring and investigating incidents and managing claims;

• Maintaining our programs, products and services, including our loyalty programs and our health and financial services. For more information see our Loyalty Privacy Notice(Open in a new tab), Health Privacy Notice(Open in a new tab), President’s Choice Financial Privacy Notice(Open in a new tab) and Insurance Privacy Notice(Open in a new tab); and

• Meeting our legal and regulatory obligations.

C. Communicating with you

We use your personal information to communicate with you in a variety of ways:

• Providing you with information and updates about our programs, products, services, promotions, contests, and events;

• Responding to your inquiries;

• Informing you of public health concerns, where we believe an exposure may have affected one of our premises, in accordance with public health laws;

• Taking or verifying instructions from you;

• If we have your consent, informing you in a variety of ways (e.g., email, telephone, SMS, direct mail) about programs, products, services, special offers, promotions, contests, or events that may be of interest to you;

• Delivering interest-based advertisements relating to our products and services or third party products and services that may be of interest to you. For more information see

  our Interest-Based Advertising and Media Notice(Open in a new tab); and

• With your consent, providing you with offers or services based on the approximate location provided by your mobile device (also called “location-based advertising”).

If you no longer wish to receive commercial electronic messages, please let us know by following the unsubscribe directions provided in every commercial electronic message. For more information see How Do I Change My Privacy Choices?

D. Conducting market research

We may use your personal information in order to conduct market research by tracking and analyzing current or previously collected information to improve or to develop new products, services, programs, promotions, contests or events, and to better understand our customer base. When doing so, we generally will use your information in an aggregated format or with direct personal identifiers removed.

The information we use for market research may include:

• Purchase history (e.g. the number and amount of transactions by type, location/store of purchase, product code information, brand, quantity purchased, date, time, payment method used, promotional offers used in connection with the transaction, etc.);

• Website or mobile application activities (e.g. offers viewed, opt-out preferences, email bounce backs, click-throughs, content on social media, and IP addresses);

• Account activity, balances and payment history;

• Use of mobile devices interacting with our websites or mobile applications (e.g. use of features, and duration, frequency, type and location of calls and text messages); and

• The methods used to apply for or to access or use our programs, products, services, promotions, contests or events.

E. Conducting data analytics

We may use your personal information in order to conduct data analytics or research for business purposes. Wherever possible, we use aggregated, anonymized or de-identified information and minimize the risk of re-identification. For more information see ‘How we protect personal information’.

Types of analytics and research we may perform include:

• Managing and developing our business and operations (e.g., analyzing and improving our store operations in order to control costs);

• Improving our programs, products, and services (e.g. improving our websites and mobile applications);

• Understanding customer needs and preferences and customizing how we tailor and market products and services to our customers based on their interests; and

• Measuring the effectiveness of our marketing.

For example:

• We may use your personal information such as purchase behavior, along with postal code information and aggregate demographic information, such as the average size of households in your area, to tailor promotional offers you may receive based on your needs and preferences.

F. Automated decision-making

We may use various technologies to help us provide you with our programs, products, and services, to manage our business operations, to communicate with you and to enhance your customer experience with us. In most cases, these tools assist, but do not replace, human judgment in making a decision.

In some cases, the technology allows us to make fully automated decisions about you. For more information see our President’s Choice Financial Privacy Notice.(Open in a new tab)

We will not share your personal information outside of our group of companies, except as indicated below.

A. Service providers

In the course of providing our programs, products, services, promotions, contests, and events we may share personal information with our service providers. These service providers help us operate our business, technology systems and applications, internal procedures, infrastructure, advertising, marketing, risk mitigation, and loyalty and analytics capabilities as well as assist us with meeting our legal and regulatory obligations. They provide services to us such as data hosting, contest administration, email deployment, call centre, marketing, fraud mitigation, sales and processing or analysis of personal information. We require these service providers to limit their access to and/or use of personal information to what is required to provide their services and to comply with our privacy requirements. For example:

Personal information collected from contest participants may be shared with our contest administrator to contact selected participants.

B. Third parties

In the course of providing certain of our programs, products and services, we may do so through arrangements with third parties. As a result, your personal information may be collected, used and shared by us and the applicable third party. These third parties may have their own privacy policies and terms and conditions, which will govern their use of your personal information. You will be informed upon signing up for the relevant program, product or service of the third party arrangement so that you can review the relevant privacy policies that apply.

For example:

• The PC mobile pre-paid service, which is offered through Loblaws Inc., is provided by a carrier that is identified in connection with that service.

• The PC insurance service, which is offered through PC Financial Insurance Broker Inc., is provided by a select number of insurance companies that are identified in connection with that service.

• The PC Express home delivery service, which is offered through Loblaws Inc., is provided by a third party delivery company that is identified in connection with that service.

C. Sale or transfer of business or other transaction

We may decide to sell or transfer all or part of our business to a related company or to a third party, to merge with another entity, to insure or securitize our assets, or to engage in another form of corporate or financing transaction (including the proceedings of insolvency or bankruptcy), corporate reorganization, share sale, or other change in corporate control. If your personal information is required in connection with any such transactions, we will comply with the legal requirements for the disclosure of personal information.

D. Other permitted reasons

Canadian law permits or requires the use, sharing, or disclosure of personal information without consent in specific circumstances. These circumstances include situations where use, sharing, or disclosure is necessary to protect our group of companies, our employees, our customers, or others (e.g., when investigating and preventing suspected or actual illegal activities, including fraud, or to assist government and law enforcement agencies). If this happens, we will not share more personal information than is reasonably required to fulfill that particular purpose.

E. With your consent

Other than the purposes listed above, we may, with your implied or express consent, share or disclose your personal information outside of our group of companies, in accordance with applicable law.

We will obtain consent when we want to use personal information for a new purpose or for a purpose other than those stated at the time of collection in this policy or in the terms and conditions of a specific program, product, service, contest, promotion or event you signed up for, participated in or purchased.

Your consent can be withdrawn at any time, except in limited circumstances, including where withdrawal of consent is restricted by legal or regulatory requirements or as a result of your contractual obligations with us. For information on how to manage your privacy preferences, please see How Do I Change My Privacy Choices?

For example:

To obtain credit products, you are required to provide consent on your application to the ongoing collection, use and sharing of your personal information to allow us to obtain and to update credit reports and other credit history information about you from time to time with credit bureau agencies and other entities that support the credit reporting system. Your consent for these purposes cannot be withdrawn during the time you have credit with us and for a reasonable period afterwards.

If you choose not to provide us with certain personal information or if you withdraw your consent, where such withdrawal is available, we may not be able to offer you the programs, products, services, contests, promotions, events or information that you requested or that could be offered to you.

A. Within your account(s)

If you have an account with us (e.g., PC Optimum account), you can update your preferences where customer preference options are available through the relevant program, product or service.

B. When you register or by contacting us directly

You may opt-in to:

• Receiving email or SMS marketing communications at the time that you register for our programs, products, or services, enter our contests or promotions or any time thereafter through your online account(s).

You may opt-out of:

• Receiving email or SMS marketing communications from the sender, by clicking “unsubscribe” within any marketing email you receive, texting “STOP” within any SMS marketing you receive, or through your online account (if you have created one);

• Receiving surveys by following the unsubscribe instructions provided in the email; and

• Receiving interest-based advertisements from us and our client advertisers as detailed in our Interest-Based Advertising and Media Notice(Open in a new tab).

Please note the following regarding withdrawal of consent or changes in your privacy preferences:

• Even if you have opted out of receiving marketing communications from us, we may still contact you for transactional purposes, in compliance with applicable laws (e.g., for customer service, product information, service or reminder notices, or recalls). We may also need to contact you with questions or information regarding your order, such as order status, shipment, or refunds; and

• It may take some time for all of our records to reflect changes in your preferences (e.g., if you request that you not receive personalized marketing communications from Loblaw, your preference may not be captured for a promotion already in progress).

C. Changing your browser settings on your device

We use technologies to enhance your customer experience and present offers to you, including interest-based advertisements (see our Interest-Based Advertising and Media Notice(Open in a new tab)). For example, technologies such as cookies allow us to recognize when you use or return to our websites, providing you with a more seamless experience. You may delete or disable certain of these technologies at any time via your browser. However, if you do so, you may not be able to use some of the features of our websites.

Please refer to your browser instructions or help screen to learn more about how to block, delete and manage cookies on your computer or mobile device. You can also use the quick links below, based on the browser type that you are using: Internet Explorer(Open in a new tab), Google Chrome(Open in a new tab), Firefox(Open in a new tab) and Safari(Open in a new tab).

D. Using third party unsubscribe functionality

We may use third parties (e.g., web companies or social media platforms) that use certain technologies to analyze your browsing behaviour as you visit our websites. You can manage your privacy preferences with respect to certain third parties, such as Google, by using the unsubscribe functionality within their platforms. Please note that disabling, blocking or deleting some of these technologies, such as cookies, may cause you to lose the functionality of certain features on our websites and mobile applications.

For example, Google Analytics uses cookies to analyze your browsing behaviour on our websites. This information is not provided to us in a personally identifiable format and is collected through your ad settings on your device or browser. If you would like to opt out of Google’s ad settings, please go to https://www.google.com/settings/ads or use the Google opt out browser add-on located at https://tools.google.com/dlpage/gaoptout(Open in a new tab).

We also may embed links to other websites, including social media websites, on our websites. For more information about social media plug-in protocols, such as “Like” buttons on Twitter, Facebook or Instagram and their impact on your privacy rights, please visit the appropriate social media help centre (e.g., Facebook’s Help Center at https://www.facebook.com/help/(Open in a new tab)).

A. How we protect personal information

To protect your personal information, we maintain administrative, technical, and physical safeguards in our stores, pavilions, kiosks, offices, digital properties, and information storage facilities. By having these safeguards, we aim to avoid the loss, misuse, unauthorized access, disclosure, or modification of your personal information that we hold. These safeguards also apply when we dispose of or destroy your personal information.

Examples of safeguards we may use, where appropriate, include but are not limited to:

• Multi-Factor Authentication, which is a method of confirming your identity by using more than one way to authenticate you, such as asking for your password and a code that is sent to your email address or phone number;

• Masking, which is the process of obscuring your information so that the structure remains the same, but the content is no longer identifiable;

• De-identification, including pseudonymization techniques that replace, remove or transform your information with a pseudonym (e.g., replacing identifiers with codes) to preserve its informational value;

• Anonymization, which is the process of altering your data so that it can no longer be used to identify you personally;

• Encryption, which is the process of obscuring your information in order to make it unreadable without the use of a code or a key; and

• Logging and monitoring, which is the process of tracking, recording, and monitoring activity related to the access and/or use of your accounts or personal information.

B. Data governance

We maintain policies and practices which ensure the protection of your personal information. Depending on the volume and sensitivity of the information, the purposes for which it is used and the format in which it is stored, we implement a combination of measures to protect your personal information, including:

• Internal policies and procedures that govern our privacy and personal information handling practices, including responding to privacy complaints or inquiries, investigating potential incidents and records management;

• Designated Privacy Officers to monitor our companies’ compliance with applicable laws;

• Regular employee privacy and security training;

• Contractual protections and other measures to ensure that service providers with whom we share personal information maintain adequate privacy protections and standards, as described above and in How do we share personal information?

C. Where we keep personal information

We use all reasonable safeguards, including contractual requirements with our service providers, to protect your personal information wherever it is used or stored. In general, we store, access, and use personal information in Canada. Some of our service providers may access, process, or store your personal information outside of your province, territory, or Canada in the course of providing their services to us. When we engage a service provider that operates outside of your province, territory or Canada, personal information may be stored, processed, accessed, or used in a foreign jurisdiction. In that case, the personal information is subject to the law of the jurisdiction in which it is used or stored, including any law permitting or requiring disclosure of the information to the government, government agencies, courts, and law enforcement in that jurisdiction. The jurisdictions where our service providers are currently located include the United States, the European Union, United Kingdom, India, and the Philippines.

D. How long we keep personal information

We will store your personal information for as long as necessary to fulfill the purposes for which it was collected, except where otherwise required or permitted by law (e.g., healthcare providers must retain patient records in accordance with their statutory retention obligations). Once no longer required, your personal information will be securely destroyed or anonymized (so the information no longer identifies you).

Please note that if your personal information is collected by a third party, it will be retained in accordance with the privacy policies and records retention requirements of that third party.

Some of the personal information we hold about you is accessible to you through your online account(s). You can access and update or correct your personal information by logging into your account(s) and making updates to your profile information and your preferences.

For personal information that is not available through your online account(s), you can request access or correction, request a review of certain automated decisions, or make a privacy complaint by contacting the applicable Privacy Office, through email or postal address (for contact information, see Who Do I Contact with Privacy Questions?).

To access your personal health information, please contact your healthcare provider directly. Similarly, to access your personal information collected by a third party, please contact that third party directly.

If you are unsatisfied with our response to your access and/or correction request, or how we handle your personal information, please contact the appropriate Privacy Office. For contact information, see Who Do I Contact with Privacy Questions?. If the Privacy Office is unable to address your concern to your satisfaction, you may bring the matter to the attention of the appropriate Privacy Commissioner. Some of our activities are subject to the jurisdiction of the Office of the Privacy Commissioner of Canada(Open in a new tab); other activities are subject to the jurisdiction of the Privacy Commissioner of your province or territory of residence.