Privacy and Cookies Policy

Last Updated: May 1, 2026

Privacy and Cookies Policy

Introduction

Jim Pattison Industries Ltd. dba Jim Pattison Lease (“JPL,” “we,” “us,” or “our”) is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose and protect personal information in accordance with applicable Canadian and United States privacy laws, including the Personal Information Protection Act (British Columbia), the Personal Information Protection Act (Alberta), the Act respecting the protection of personal information in the private sector (Quebec), as amended by Law 25, the Personal Information Protection and Electronic Documents Act (Canada), the Colorado Privacy Act, the Iowa Consumer Data Protection Act, and other applicable federal, state and provincial laws.

Privacy Officer

We have designated a Privacy Officer who is responsible for our compliance with this Privacy Policy and applicable privacy laws. If you have any questions, concerns or complaints about our privacy practices, please contact:

Privacy Officer President. Address: 4937 Regent Street, Burnaby, BC V5C 4H4 Contact#1-800-268-5660

Personal Information We Collect

We collect personal information that is necessary for the purposes identified below. The types of personal information we may collect include:

Identity and Contact Information

• name, address, telephone number and email address
• date of birth
• driver’s license and other government-issued identification
• biometric information (facial recognition data) for identity verification

Financial Information

• employment and income information
• credit history and credit score
• banking and payment information

Transaction Information

• vehicle leasing and financing history
• payment history and account information

Website Information

• IP address and device information
• browser type and operating system
• pages visited and links clicked
• cookies and similar technologies (see our Cookie Policy https://www.jimpattisonlease.com/privacy-policy/ for details)

How We Collect Personal Information

We collect personal information:

• Directly from you when you complete an application, sign a lease or financing agreement, contact us or use our website;
• From third parties such as credit bureaus, financial institutions, employers and references you provide; and
• Automatically through cookies and similar technologies when you visit our website (see our Cookie Policy https://www.jimpattisonlease.com/privacy-policy/ for details).

Purposes for Collection, Use and Disclosure

We collect, use and disclose your personal information for the following purposes:

• processing and evaluating your lease or financing application;
• verifying your identity;
• administering your account and lease or financing agreement;
• processing payments and collections;
• communicating with you about your account, transactions and our services;
• obtaining credit reports and assessing creditworthiness;
• complying with legal and regulatory requirements;
• preventing fraud and protecting security;
• improving our services and website; and
• other purposes with your consent.

We do not sell your personal information for monetary consideration. We do not engage in targeted advertising based on your personal information.

Consent

We collect, use and disclose your personal information with your knowledge and consent, except where permitted or required by law. Consent may be express (e.g., written or verbal agreement) or implied (e.g., when you provide information for an obvious purpose).

For sensitive personal information, including biometric data collected during identity verification, we obtain your express consent prior to collection.

Withdrawing Consent

You may withdraw your consent at any time by contacting our Privacy Officer. However, withdrawing consent may affect our ability to provide services to you. With respect to the identity verification process, withdrawal of consent cannot reverse any verification already completed or undo personal information, including biometric data, already transmitted to third-party identity verification providers and may prevent JPL from processing your application. We will explain the consequences of withdrawing consent when you make a request.

Your Privacy Rights

Depending on where you reside, you may have specific privacy rights under applicable law. All customers have the right to access their personal information, request correction of inaccurate information and obtain information about how their personal information has been used and disclosed.

Universal Opt-Out Mechanisms

Colorado residents may use a universal opt-out mechanism to opt out of the processing of their personal data for targeted advertising or sale. We will recognize and respond to universal opt-out preference signals in accordance with the Colorado Privacy Act.

Additional Rights for Quebec Residents

Under Quebec’s Act respecting the protection of personal information in the private sector, as amended by Law 25, Quebec residents also have the right to: data portability (receiving your information in a structured, commonly used format or having it transferred to another organization); de-indexation (requesting we cease disseminating your information or de-index hyperlinks to it); be informed of automated decision-making and submit observations for human review; and receive notification of confidentiality incidents presenting a risk of serious injury.

Additional Rights for US Residents

Under applicable state privacy laws, including the Colorado Privacy Act and the Iowa Consumer Data Protection Act, US residents in certain states may also have the right to: request deletion of personal data; obtain a portable copy of personal data and opt out of the sale of personal data, targeted advertising or profiling that produces legal or similarly significant effects. We will not process sensitive data without providing clear notice and obtaining consent or providing an opportunity to opt out, as required by applicable law.

Exercising Your Rights

To exercise any of your rights, please contact our Privacy Officer. For personal information, including biometric data, held by third-party identity verification providers, you must contact the applicable provider directly. JPL does not control the identity verification providers’ systems or data and cannot action requests relating to data held by those providers on your behalf. We will respond within the timeframes required by applicable law and will not discriminate against you for exercising your rights. If we decline your request, you may appeal by contacting our Privacy Officer. If you remain unsatisfied, you may file a complaint with the applicable privacy commissioner or state attorney general (see “Complaints” below).

Disclosure to Third Parties

We may disclose your personal information to the following categories of third parties:

• service providers who perform services on our behalf, such as identity verification providers, payment processors and IT service providers;
• credit bureaus for credit checks and reporting;
• financial institutions involved in your lease or financing;
• professional advisors such as lawyers and accountants;
• affiliates within the Jim Pattison group of companies;
• government authorities where required by law; and
• other parties with your consent.

We require third-party service providers to protect personal information in a manner consistent with this Privacy Policy and applicable law.

Third-Party Identity Verification Services

If you are purchasing or leasing a vehicle from JPL, we may require identity verification as part of our customer onboarding and compliance processes. This verification may be conducted by one or more of JPL’s designated third-party identity verification providers using facial recognition and other biometric technologies. You must have reached the age of majority in your province or state of residence to participate in this identify verification process.

Depending on the service being provided, you may voluntarily consent to participate in this identity verification process and understand that you will be redirected to the third-party provider’s secure platform and that any biometric information, images, and identification documents you submit will be collected, used and stored in accordance with that third party’s privacy policy and terms of service. We do not control the third party’s systems, data handling practices or security measures.

Digital identity verification using biometric data (facial recognition) is currently available only at our locations in British Columbia, Alberta and Nova Scotia.

Use of De-identified Data

Third-party service providers may use de-identified and aggregated data derived from your information for analytical, service improvement and other commercial purposes. Such de-identified data will not identify you personally.

Cross-Border Transfers

JPL operates in both Canada and the United States. Your personal information may be transferred, stored and processed in either country by us or our service providers. When your information is processed outside your province, state or country, it becomes subject to the laws of that jurisdiction, including laws that may permit access by government authorities. We take appropriate steps to ensure your personal information receives a comparable level of protection regardless of where it is processed.

For Quebec residents, we conduct a privacy impact assessment before transferring personal information outside Quebec, as required by the Act respecting the protection of personal information in the private sector (Quebec), as amended by Law 25.

Retention

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, including:

• for the duration of your lease or financing agreement;
• for a period following the termination or expiry of your agreement, in accordance with applicable legal and regulatory requirements; and
• as otherwise required by law.

JPL does not retain biometric data collected during the identity verification process. Biometric data is held by JPL’s third-party identity verification providers, who may retain it in accordance with their own policies and as required by applicable law.

When personal information is no longer needed, we securely destroy or de-identify it.

Security

JPL implements appropriate safeguards to protect personal information in our custody and control. However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

Limitation of Liability

Your use of our services, including the identity verification process and the collection, use, disclosure and storage of your personal information, is subject to the limitation of liability provisions set out in our Terms of Service. Nothing in this Privacy Policy limits your right to file a complaint with the applicable privacy commissioner or state attorney general.

Complaints

If you have a concern about our privacy practices, please contact our Privacy Officer. We will investigate your complaint and respond to you.

If you are not satisfied with our response, you have the right to file a complaint with the applicable regulator:

Canada

• Office of the Privacy Commissioner of Canada: priv.gc.ca
• Office of the Information and Privacy Commissioner for British Columbia: oipc.bc.ca
• Office of the Information and Privacy Commissioner of Alberta: oipc.ab.ca
• Commission d’accès à l’information du Québec: cai.gouv.qc.ca

United States

• Colorado Attorney General: gov
• Iowa Attorney General: iowaattorneygeneral.gov
• Missouri Attorney General: mo.gov
• North Carolina Attorney General: gov

• Ohio Attorney General: www.ohioattorneygeneral.gov

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on our website with an updated “Last Updated” date. We encourage you to review this Privacy Policy periodically. Your continued use of our services after any changes constitutes your acceptance of the updated Privacy Policy.

Language: For residents of Quebec, this Privacy Policy is available in French upon request. In the event of a discrepancy between the English and French versions, the French version shall prevail for Quebec residents. / Pour les résidents du Québec, cette politique de confidentialité est disponible en français sur demande. En cas de divergence entre les versions anglaise et française, la version française prévaudra pour les résidents du Québec.

Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact:

Privacy Officer President. Address: 4937 Regent Street, Burnaby, BC V5C 4H4 Contact#1-800-268-5660