1. Purpose

This Privacy Policy (External) (the “Policy”) has been prepared by the Canada Pension Plan Investment Board (“CPP Investments”) and sets out the manner in which CPP Investments collects, uses, discloses and otherwise manages personal information through our websites, as well as through other interactions with individuals. For more information regarding the manner in which we treat personal information of individuals applying for a job with CPP Investments, or a CPP Investments Board of Director appointment, please see the CPP Investments Applicant Privacy Policy. Individuals who are residents of California should also refer to the CPP Investments California Consumer Privacy Statement (link to CCPS).

2. Definitions

“Personal information” means information about an identified or identifiable individual, including name, address, email address, signature, an opinion regarding the data subject, and other information relating to an individual, including sensitive personal information. Depending on the jurisdiction in which you are located, certain business contact information may be excluded from the meaning of personal information or from the application of certain privacy law requirements.

3. Collection and Use of Personal Information

We may collect personal information from individuals in the following circumstances:

• When you visit our Website;
• When you visit our facilities;
• When you sign-up to receive communications from CPP Investments;
• In the course of managing our investments and undertaking due diligence;
• In connection with discussion forums, meetings, conferences or other activities sponsored by CPP Investments;
• In connection with public consultations, opinion surveys, focus groups or feedback; or
• When you contact us with a comment or question or otherwise provide us with personal information.

Our collection and use of personal information is required for us to deliver the services and perform the functions described below, and without which we would not be able to undertake certain tasks.

Visiting our Website
Please see the section below titled “Cookies and Additional Information about our Website” for details about the Website’s collection, use and disclosure of personal information.

Visiting our Facilities
In accordance with applicable laws, CCTV cameras are installed by CPP Investments to ensure the security and safety of our premises. For more information about our use of CCTV, please refer to CPP Investments’ CCTV Standard which is available upon request from privacy@cppib.com.

When we are required or permitted by law to do so, we may collect sensitive personal information relating to health and coronavirus vaccination status of visitors to our premises, in order to protect the health and safety of CPP Investments personnel and visitors to our premises.

Signing Up for CPP Investments Communications
We may provide you with an opportunity to sign-up to receive CPP Investments communications by email or mail, such as news and updates. If you choose to sign-up to receive CPP Investments communications, we may collect contact information such as your email and postal address. You can opt-out of receiving these communications at any time by clicking on the unsubscribe link included in our email communications or by contacting us as described in the Contact Us section below. Please note that if you unsubscribe, you may continue to receive certain non-marketing electronic communications from us.

Managing Investment Activities
In the course of CPP Investments’ investment activities, we may collect personal information about individuals with whom CPP Investments works or invests (such as investment advisors or fund managers), or about members of the Boards of Directors (or similar) or management, clients or suppliers of companies or entities in which CPP Investments is considering an investment. The information we collect may include information obtained through background verifications. We collect and use this information in order to conduct due diligence regarding potential investments, investment advisors or fund managers, to manage our investments, to track attendance at board meetings and as required by applicable law. For individuals located in the European Economic Area (EEA), the United Kingdom (UK), or Brazil we use personal information for these purposes (i) in reliance on our legitimate interest under applicable law in operating and improving our business, or (ii) because we are required to do so by applicable law.

Forums, Meetings, Conferences and Other Activities
From time to time, CPP Investments may sponsor forums for discussion, conferences or other similar activities. In the course of these activities, we may collect personal information of registrants such as name, email address, contact information and payment information in order to administer registration for the forum, conference or other activity. For example, CPP Investments may collect the name, municipality or township, province/state and country of residence of individuals who attend any of the CPP Investments Bi-Annual Public Meetings in Canada. This information is used for security and reporting purposes. For individuals located in the EEA, the UK, or Brazil we use personal information for these purposes in reliance on our legitimate interest under applicable law in administering these events.

Public Consultations, Opinion Surveys, Focus Groups or Feedback
CPP Investments or its authorized survey, polling or other service providers may conduct public consultations, opinion surveys, focus groups or solicit public feedback in which individuals participate to support the fulfilment of our mandate. In the course of these activities, CPP Investments may obtain consent from participants to collect and use personal information such as first and last name, email address, telephone number, and mailing address for the purpose of conducting research and/or public engagement. Reports generated from such public consultation will be provided to CPP Investments in aggregate form and in a manner that does not identify any individual participant.

Call Recording
Subject to applicable law, CPP Investments may monitor and record audio and video conversations with the CPP Investments securities trading desk or with other CPP Investments personnel to ensure accuracy and for record-keeping purposes. For individuals located in the EEA, the UK, or Brazil we use personal information obtained from these conversations in reliance on our legitimate interest under applicable law in ensuring accuracy and maintaining records related to our business.

Social Media
We may offer you the opportunity to engage with CPP Investments or its content on or through third-party social networking websites, plug-ins and applications. When you engage with us on or through third-party social networking websites, plug-ins and applications, you may allow us to have access to certain information associated with your social media account (e.g., name, username, email address, profile picture) to deliver content or as part of the operation of the website, plug-in or application. For individuals located in the EEA, the UK, or Brazil we use this information in reliance on our legitimate interest under applicable law to do so (including to deliver content or as part of the operation of the website, plug-in or application).

Questions, Comments and Complaints
If you contact us with a comment, question or complaint, you may be asked for information that identifies you (such as your name, email address, address and phone number) along with additional information we need to help us promptly answer your question or respond to your comment, question or complaint. We may also retain this information to assist you in the future. For individuals located in the EEA, the UK, or Brazil we use this information in reliance on our legitimate interest under applicable law in communicating with individuals who contact us.

4. Sharing of Personal Information

We will not disclose, trade, rent, sell or otherwise transfer personal information, without your consent, except as set out herein.

Service Providers
We may transfer (or otherwise make available) your personal information to third parties who provide services on our behalf. For example, we may use service providers to send our emails, host our Websites and operate certain of their features. Our service providers are only given the information they need to perform their designated functions, and we do not authorize them to use or disclose personal information for their own marketing or other purposes.

Your personal information may be maintained and processed by CPP Investments or its third party service providers in the US, Canada, Hong Kong and India. If you are located in the EEA, Switzerland or in the UK, we comply with applicable legal requirements providing adequate protection for the transfer of personal information to recipients in countries outside the EEA, Switzerland or the UK which have not been recognized as providing for an adequate level of protection for personal data. If you are located in Brazil, we also comply with applicable legal requirements for the transfer of personal information outside Brazil. In all such cases, we will only transfer your personal information if we have put in place appropriate safeguards in respect of the transfer, for example, EU Standard Contractual Clauses. You may obtain a copy of the safeguards we use in respect of such transfers by contacting us as indicated below.

Legal Requirements
CPP Investments and our Canadian, US and other service providers may provide your personal information in response to a search warrant or other legally valid inquiry or order (which may include lawful access by Canadian, US or other foreign governmental, regulatory or investigative authorities, courts or law enforcement agencies), to an organization in the case of a breach of an agreement or contravention of law, to detect, suppress or prevent fraud, or as otherwise required or permitted by applicable Canadian, US or other law. We may also disclose personal information where necessary for the establishment, exercise or defence of legal claims or disputes, and to investigate or prevent actual or suspected loss or harm to persons or property.

5. Safeguards & Retention

We retain personal data as long as we need it: (i) for the processing purposes described in section 3 above, (ii) in connection with litigation, investigations or proceedings, and (iii) as required or permitted by applicable law. We have implemented reasonable administrative, technical and physical safeguards in an effort to protect against unauthorized access, use, modification and disclosure of personal information in our custody and control. These measures include locked filing cabinets and restricted access to offices, restricted access to personal information on a “need to know” basis, and the use of passwords, encryption and firewalls.

6. Individual Rights

Subject to applicable privacy legislation, you may access, update and correct inaccuracies in your personal information in our custody or control at any time. You can request access, corrections or updates to all personal information by contacting us as set out in the Contact Us section below. Subject to applicable privacy legislation, you may also have the right to object to the processing of your personal information, or request that we erase, anonymize, block or restrict our processing of your personal information. We may request certain personal information for the purpose of verifying the identity of the individual seeking access to their personal information records. Subject to applicable privacy legislation, where we rely on your consent to process your personal information, you have the right to withdraw your consent at any time. This will not affect the lawfulness of our processing prior to such withdrawal.

If you are not satisfied with CPP Investments’ response, you may have a right to file a complaint with the privacy commissioner’s office in your jurisdiction pursuant to applicable privacy legislation.

Subject to applicable privacy legislation, you may also have the right to data portability or to obtain certain information from us, such as confirmation that we process your personal information and information about third parties with whom we share your personal information.

7. For EEA and UK Individuals

For the purposes of applicable data protection law, if you are a resident of Luxembourg, the primary data controllers of your personal information are Canada Pension Plan Investment Board; Canada Pension Plan Investment Board, Luxembourg Branch; CPPIB Credit Investments Inc., Luxembourg Branch; CPPIB Credit Europe S.à r.l.; CPP Investment Board Europe S.à r.l.; Canada Pension Plan Investment Board, UK Branch; CPPIB Credit Investment Inc., UK Branch; CPPIB Equity Investment Inc., UK Branch; and if you are a resident of the UK, the primary data controllers of your personal information are Canada Pension Plan Investment Board; Canada Pension Plan Investment Board, UK Branch; CPPIB Credit Investment Inc., UK Branch; and CPPIB Equity Investment Inc., UK Branch. These entities can all be contacted by sending an email to privacy@cppib.com.

8. Links to Other Websites

Our websites may contain links to other websites, some of which operate independently of CPP Investments. We provide links to third party websites as a convenience to the user. These links are not intended as an endorsement of or referral to the linked websites that operate independently of CPP Investments. The linked websites that operate independently of CPP Investments have separate and independent privacy statements, notices and terms of use, which we recommend you read carefully. We do not have any control over the linked websites that operate independently of CPP Investments, and therefore we have no responsibility or liability for the manner in which the organizations that operate such independent linked websites may collect, use or disclose, secure and otherwise treat your personal information.

9. Changes to Our Privacy Policy

This Privacy Policy may be updated periodically to reflect changes to our personal information practices, including our use of cookies and other tracking technologies, or applicable law. The revised Privacy Policy will be posted on the websites and in certain circumstances we may notify you of any changes to our policy by email. We encourage you to refer to this Privacy Policy on our websites often for the latest information about our personal information practices. Appendix A sets out our cookies and tracking technologies and will remain current on our websites.

10. Contact Us

Please contact us if:

• you have any questions or comments about this Privacy Policy,
• you wish to access, update and/or correct inaccuracies or omissions in your personal information or otherwise exercise your data protection rights, or
• you otherwise have a question or complaint about the manner in which we or our service providers treat your personal information.

You may contact us by email at privacy@cppib.com or by mail at the following address:
Canada Pension Plan Investment Board

Attn: Managing Director, Head of Compliance
One Queen Street East, Suite 2500
Toronto, ON, Canada, M5C 2W5

Appendix A – Cookies and other Tracking Technologies

When you visit our websites, we collect your IP (Internet protocol) address and other related information such as device identifiers and characteristics, page requests, browser characteristics, operating system, referring URLs, clickstream data and average time spent on our websites. We collect these types of personal information using automated means, including cookies and pixels.

Cookies are small files that are downloaded to the device you use to visit a website. They are generally used to help improve visitors’ experiences on the site, by, for instance, remembering preferences, login information, or otherwise recognizing that they have visited the site previously (or are the same user during a single visit). They are also used by website owners to make improvements to the site based on visitor behaviour. In some cases they are used to collect and store information about specific users. A “pixel,” also known as a “web beacon,” links web pages to web servers and cookies and may be used to transmit information collected through cookies back to a web server.

Subject to applicable privacy legislation, we only use cookies that are not necessary for our websites to function if you give consent, which is requested when you first visit the websites.
The non-necessary cookies we may use on our websites, and the tracking technologies we may use in our communications and advertisements, are primarily for analytics purposes: to better understand how individuals are moving through the websites, what pages they visit, what CPP Investments emails they open, how long they remain on pages, and so on. We use this information to make improvements to how the websites work and to ensure we meet the information needs of our visitors, including with respect to the effectiveness of our communications.

In accordance with applicable privacy legislation, we also may use third-party advertising cookies, pixels and other tracking technologies to provide you with information about us, or products and services that may be tailored to your interests. Where we use these technologies and services, they:

• Track your online activities over time and across multiple websites and apps by collecting information through automated means.
• Use this information to show you ads that may be tailored to your individual interests.
• May collect information that includes data about your visits to websites that serve our advertisements, such as the pages or ads you view and the actions you take on the websites or apps. This data collection takes place both on our Website and on third-party websites and apps that participate in these ad services.

When we utilize these services, this process helps us track the effectiveness of our marketing efforts. Our websites are not designed to respond to “do not track” signals from browsers. To learn how to opt out of interest-based advertising, please visit the Digital Advertising Alliance and the Network Advertising Initiative. Please also refer to the “Disabling Cookies” section below for information on how to restrict cookies through the settings on your browser.

Some of the cookies we use on our websites are persistent cookies which remain on your computer or other Internet-connected device for a certain period of time after you end your browsing session unless you delete them. Others are session cookies and are deleted when you end your browsing session.

Disabling Cookies
You can choose to prevent cookies from being downloaded to your device by adjusting your cookie consent preferences using our Cookie Settings Centre that can be accessed by using the widget on each page of the site, or blocking some or all of them. However please note that if you do this you may not be able to use the full functionality of the site. You can also delete cookies that have already been downloaded.

If you do wish to restrict or block cookies you can do this through the settings of whatever browser you are using. To find out how click on the appropriate link:
Deleting cookies using Internet Explorer
Deleting cookies using Firefox
Deleting cookies using Chrome
Deleting cookies using Safari and iOS devices

Summary of Tracking Technologies

Google Analytics (www.google.com/analytics/)
Google Analytics is an analytics solution that provides information on how visitors interact with the site. It is used to track things such as how long you spend on the site, which pages you go to, how you get to the site, and which geographic areas you are from.

Google Analytics uses two cookies: The cookie called “_ga” is a persistent cookie that is used to distinguish between visitors to the site. The “_ga_<container-id>” cookie provides information about visitor behaviour on the site and site performance. You can learn more about Google Analytics cookies here.

Meta Conversion Tracking Pixel (www.facebook.com/privacy/policy)
The Meta Pixel is a snippet of JavaScript code that allows us to track visitor activity on our website, including whether users who had received CPP Investments information on one of the Meta services subsequently visited our website, and with which features of our website they engaged. We use the Meta Pixel to collect information that allows us to assess how effective our advertising activities are. In some cases, and only in accordance with applicable privacy legislation, we also may use the Meta pixel to serve advertisements to users that are tailored to their interests based on their online activities and inferred interests, and to develop customized audiences for targeted advertising campaigns.

YouTube (www.youtube.com)
We may use YouTube to house videos that we display on the Websites. YouTube cookies are used by YouTube to track visitors’ use of its services. These cookies, described below, are installed only once when you press play.

The persistent “PREF” cookie stores your preferences and other information, including how many search results you wish to be shown on your page. The “VISITOR_INFO1_LIVE” cookie measures your bandwidth to determine which player will be used to show the video. The session cookie “use_hitbox” is used to add to the views counter on YouTube. And the session “YSC” cookie is set by the YouTube video service on pages with embedded YouTube video.

You can learn more about cookies that Google uses through its YouTube platform here.

MailChimp (Mail Chimp Privacy Policy)
In accordance with applicable law, we use Mailchimp to send emails to those that sign up to receive information from CPP Investments. Mailchimp may place a pixel in these emails, which contain unique identifiers that enable CPP Investments, through Mailchimp, to recognize when our subscribers have opened an email or clicked certain links in an email. This technology records the email address, IP address, date, and time associated with an open and click for an email. We use this data to create reports about how an email performed and what actions recipients took. You can learn more about Mail Chimp’s Privacy Policy and Cookie Statement here.

On CPPIB.com, in addition to the cookies and tracking technologies discussed above, the following third-party cookie is deployed:

Siteimprove (www.siteimprove.com)
Siteimprove is an application that provides us with analytics about traffic to our website. It uses a cookie called “nmstat” that is persistent. The cookie contains a randomly generated ID used to recognise the browser when you read a page.

Siteimprove also uses a session cookie (one that is stored in temporary memory and is erased when you close your web browser). This cookie is called “siteimproveses” and is used to track the sequence of pages you view during a visit to the site. For more information about Siteimprove’s cookies practices, please visit their website.