Introduction is demonstrating its commitment to protecting the privacy of Customers' Personal Information by developing and implementing this Privacy Commitment to the Protection of Customer Information.

The Privacy Commitment complies with or exceeds the federal Personal Information Protection and Electronic Documents Act, the Canadian Marketing Association's Code of Ethics and Standards of Practice, and applicable provincial privacy laws. It is also based on the Canadian Standards Association's Model Code for the Protection of Personal Information.

This Privacy Commitment applies to the collection, storage, use, disclosure, protection, and accuracy of Personal Information collected and controlled by It also applies to all Personal Information held in the database.


collect - to gather, acquire, or obtain Personal Information from any source, including third parties.

consent - voluntary agreement with what is being done or proposed. Consent can be either express or implied. Express consent is given explicitly, either orally or in writing. Express consent is unequivocal and does not require any inference on the part of Implied consent arises where consent may reasonably be inferred from the action or inaction of the Customer.

Customer - an individual, business or organization that is a customer of

direct marketing - direct communications targeted to Customers, including mail, telemarketing, fax or electronic mail.

Personal Information - information about an identifiable Customer recorded in any form.

Supplier - a company under contract to provide products or data collection, processing and/or management services to

LoyaltyOne - the creator and manager of, the AIR MILES® Reward Program and the AIR MILES For Business Program™ in Canada. In addition, The Loyalty Group operates other businesses including AIR MILES INCENTIVES.

™/® LoyaltyOne Canada Inc. © 2003 LoyaltyOne Canada Inc. All rights reserved, including the right to reproduction, in whole or in part, in any form.

™/® AIR MILES International Holdings B.V. used under licence by Loyalty Management Group Canada Inc.

The Principles

Principle 1 - Accountability is responsible for Personal Information under its control, including Personal Information disclosed by to a third party for data and list processing.

1.1 The Executive Committee of LoyaltyOne is accountable for compliance with the Privacy Commitment.
1.2 The General Manager of oversees compliance with the Privacy Commitment.
1.3 uses legal agreements to provide a comparable level of protection for Personal Information while the information is being processed by an authorized third party.

The management of has established procedures to implement the Privacy Commitment, including

  • procedures to protect Personal Information;
  • procedures to receive and respond to complaints and inquiries;
  • communications and training programs to provide information to staff about privacy policies and practices;
  • information for Customers and employees to explain the Privacy Commitment.
Principle 2 - Identifying Purposes collects Personal Information for three primary purposes: to ensure the proper functioning of the business; to meet the direct marketing, product development and research requirements of; and to improve the promotional offers and services of

2.1 provides Customers with information that explains:
  • the purposes for which Personal Information is being collected; and
  • how the Personal Information may be used or disclosed
2.2 collects Personal Information for the following purposes:
  • To administer including the management of Customer accounts to accurately process Customer purchases;
  • To provide services to Customers;
  • To invoice Customer accounts for services provided by
  • To communicate information and offers to Customers;
  • To understand and analyze Customers' responses, needs and preferences;
  • To develop, enhance, market and/or provide products and services to meet those needs; and
  • To enable Customers to participate in promotions and contests
2.3 Customers of can opt out of receiving marketing and promotional communications in electronic, printed or verbal form by writing to Customer Service, P.O. Box 602, Station A, Scarborough, Ontario M1K 5K7, by email to or by phoning 1-888-247-6453, in Toronto call (416) 226-5171. The decision to opt out of these communications does not affect the Customer's ability to do business with
2.4 obtains a Customer's consent before using Personal Information for a purpose that has not been specified, unless the new purpose is required by law.
2.5 Employees of who collect Personal Information are able to provide information which explains the purposes for which it is being collected.
Principle 3 - Consent makes a reasonable effort to ensure that Customers understand how Personal Information will be used. obtains the consent of Customers as required for the collection, use or disclosure of Personal Information, except where it is inappropriate to do so.

3.1 provides its Customers with information about the way in which Personal Information will be used through its Web site, printed materials, and other electronic means.
3.2 obtains consent for the collection, use or disclosure of Personal Information. Typically, this consent is obtained during online communications with Customers, during telephone conversations and online survey forms.
3.3 does not require a Customer to consent to the collection, use, or disclosure of Personal Information beyond that required to fulfill specified purposes.
3.4 Consent can be either express or implied. Express consent is given either verbally or in writing - e.g., during online enrollment on Consent is implied when it can be reasonably understood by the action or inaction of the Customer. For example, if a Customer makes a repeat purchase with it is assumed that the Customer has given consent to the collection of the transaction information required to fulfill the specified purposes.
3.5 A Customer can withdraw consent at any time as per Section 2.3. If a Customer withdraws consent, makes the Customer aware of the consequences of this action
Principle 4 - Limiting Collection

The collection of Personal Information is limited to that which is necessary for the purposes identified by collects Personal Information by fair and lawful means.

4.1 does not collect Personal Information indiscriminately. Both the amount and the type of Personal Information collected are limited to that which is necessary to fulfill the purposes identified.
4.2 collects Personal Information from the Customer
  • as a result of online sign-in by the Customer with;
  • through online and electronic activity with; and
  • through telephone, paper and online surveys and contests.
Principle 5 - Limiting Use, Disclosure and Retention does not use or disclose Personal Information for purposes other than those for which it is collected, except with the consent of the Customer or as required by law. retains Personal Information only as long as necessary for the fulfillment of those purposes.

5.1 does not give, rent or sell Customer lists to any organization or individual other than its affiliated companies or suppliers contracted to process and manage Customer transactions and communications.
5.2 may disclose Personal Information to comply with legal and regulatory requirements, or to ensure compliance with the terms and conditions and the administration of the business.
5.3 retains Personal Information in accordance with documented guidelines and procedures established by
5.4 has guidelines and implements procedures to govern the destruction of Personal Information that is no longer required to fulfill the identified purposes.
Principle 6 - Accuracy keeps Personal Information as accurate, complete and up-to-date as necessary for the purposes for which it is to be used.

6.1 updates Personal Information as it is made available by Customers.
6.2 Customers are responsible for informing about changes to Personal Information, as appropriate.
6.3 does not routinely update Personal Information unless such a process is necessary to fulfill the purposes for which the Personal Information is collected.
Principle 7 - Safeguards protects Personal Information with security safeguards appropriate to the sensitivity of the Personal Information.

7.1 protects Personal Information against loss or theft, as well as unauthorized access, disclosure, copying, use or modification with security safeguards appropriate to the sensitivity of the Personal Information. protects Personal Information regardless of the format in which it is held.
7.2 The methods of protection for Personal Information include:
(a) physical measures, for example, locked filing cabinets and restricted access to offices;
(b) organizational measures, for example, employee confidentiality agreements, security clearances and limiting access on a "need-to-know" basis; and
(c) technological measures, for example, the use of passwords and encryption.
7.3 Personal Information is stored in secure and confidential databases in Toronto, Ontario and Dallas, Texas.
7.4 When uses a third party to process information on its behalf, legal agreements require the third party to protect the privacy and confidentiality of the Personal Information. Further, these agreements ensure that the Personal Information is retained only as long as necessary to complete the assigned task and that the third-party organization only uses it for the specified purposes for which it is given.
7.5 has appropriate training programs and provides employees with information about its policies and procedures for protecting Customers' Personal Information and the importance of maintaining the confidentiality of Personal Information.
7.6 Personal Information is disposed of or destroyed with care to prevent unauthorized parties from gaining access to the information.
Principle 8 - Openness makes specific information about its policies and practices relating to the management of Personal Information readily available to Customers.

8.1 is open about its policies and practices with respect to the management of Personal Information.
8.2 makes information about its privacy policies and practices readily available to individuals and Customers through its Web site (www., written materials, and other electronic means. In addition, copies of the Privacy Commitment are available to individuals and Customers upon request.
Principle 9 - Individual Access

Upon request, gives Customers access to their Personal Information and an account of its use and disclosure.

9.1 Customers can request access to their Personal Information held by by writing to Privacy Office, P.O. Box 602, Station A, Scarborough, Ontario M1K 5K7, or by email to Upon request, informs the Customer whether or not it holds Personal Information about that Customer, and discloses details of that Customer's Personal Information.
9.2 may request sufficient information from the Customer including passwords to verify the identity of the Customer and the existence, use and disclosure of Personal Information held by will assist any Customer who informs that he or she needs assistance in preparing a request for access.
9.3 responds to a request for information within thirty (30) business days of receipt of request.
9.4 Responding to a Customer request for information will usually be done at no or minimal cost to the Customer. However, a fee for reasonable costs incurred may be charged in responding to more complex requests, provided the Customer is informed of the fee in advance. The Personal Information requested is provided to the Customer in a form that is generally understandable.
9.5 amends the Personal Information contained in the database as required when an individual successfully demonstrates the inaccuracy or incompleteness of the Personal Information. An amendment may involve the correction, deletion or addition of information.
9.6 When it is not possible to provide a list of agents and research organizations to has disclosed Personal Information about a Customer, provides a list of agents and research organizations to which it may have disclosed such Personal Information about the Customer.
9.7 A Customer has the opportunity to challenge the accuracy and completeness of the Personal Information and have it amended as appropriate. When a challenge is not resolved to the satisfaction of the Customer, the Personal Information relating to that Customer shall reflect the unresolved challenge. The existence of the challenge is transmitted to third parties as appropriate.
9.8 If is unable to provide access to all the Personal Information it holds about a Customer, the reasons for denying access are provided to the Customer.
Principle 10 - Challenging Compliance

A Customer is able to address a challenge concerning's compliance with the above principles with the individual identified in Section 1.2.

10.1 has procedures in place to receive and respond to inquiries about its policies and practices relating to the handling of Personal Information.
10.2 Inquiries about the privacy policies of can be forwarded to the Privacy Office, P.O. Box 602, Station A, Scarborough, Ontario M1K 5K7, by email to, or by calling the AIR MILES Service Centre at
1-888-247-6453, in Toronto call (416)-226-5171.
10.3 investigates all complaints and responds within ninety (90) business days after receipt of written correspondence. If the complaint is found to be justified, takes appropriate measures to resolve the complaint, including, if necessary, amending its policies and practices.

The Web Site Policy: collects information on Customer activity through user navigation and the use of tools and functions available on This information is to be used to understand and analyze Customers' responses, needs and preferences, and to develop, enhance, market and/or provide products and services to meet those needs. In addition, information collected may also be used for the specified purposes of as outlined in The Privacy Commitment.

Privacy and Cookies. The Website uses two types of "cookies": a "session cookie" and a second which allows us to "set" a cookie. A session cookie resides in memory and persists only as long as the browser is open. This cookie holds only the information that is uniquely generated when you log on to the site and persists only as long as your browser is open. Upon your departure from the Website and closure of your browser, the information in the session cookie is removed from memory. The Website will also set a cookie to remember your language preference so you don't have to choose a language each time you visit the Website