COSTCO WHOLESALE CANADA LTD. Customer Privacy Policy

PERSONAL INFORMATION WE COLLECT

The personal information we collect depends on how you interact with us, the Services you use, and the choices you make. We only collect personal information as is strictly necessary for the purposes outlined in this Privacy Policy or as disclosed to you at the time of collection.

Information you provide directly. We collect personal information you provide to us. For example:

• Contact information. We collect name, username, email address, postal address, and phone number.
• Photograph or digital image. We collect a photograph of you when you become a member.
• Identification information. If you are a member or sign up to be a member, we may collect membership card photo, date of birth, employer name (if you sign up for membership via your employer), and your Costco membership number.
• Demographic information. In some cases, we request that you provide age or gender.
• Payment information. If you make a purchase or other financial transaction, we collect payment card numbers, financial account information, billing address, and other payment details, including credit history if you choose to pay by cheque.
• Personal Health Information. If you use pharmacy, hearing, optical or other health-related services and programs, we collect personal health information that relates to your physical or mental condition, and the provision of health care services to you. Your prescriptions, vision test results, audiogram results, and information you provide on any patient health history form, are all examples of personal health information.
• Travel information. If you book flights, cruises, hotels, rental cars and other travel-related goods or services, we are acting as an agent connecting you to various travel providers and may collect financial information, travel document details, trip details, citizenship, gender, date of birth, credit card information, special needs information, travel preferences, loyalty program details, and emergency contact details on those providers’ behalf. When you make a reservation for someone else through us, we will ask you for their personal information. You should ensure that you have the consent of other individuals before providing us with their information. By providing us with that information, we consider that you have these other individuals’ consent and authorization to provide us with their personal information and to make bookings on their behalf in accordance with our travel providers’ privacy policies. If you do not have such consent and authorization, do not send us their personal information.
• Feedback or response information. If you provide feedback through the Services, or if you respond to a survey or other communication from Costco or its vendors, we collect your response information, including the content of your feedback or response message.
• Content and files. We collect the photos or other files you upload for us to provide Services you request. If you send us email messages or other communications such as requests for customer support, fill out a form, or participate in a promotion, we will collect and retain those communications.
• Chat Features. When you use the virtual assistant or chat features on our Services, you provide consent for us to collect the content of your chat (that is, the words you type into the chat feature and the responses you receive).

Information we collect automatically. When you access or use our Services, we collect some information automatically. For example:

• Transaction and purchase information. When you make a purchase or return, or another financial transaction, we collect information about the transaction. This may include, among other things, product details, purchase price, date, tender type, location of the transaction, shipping/delivery details, and payment type and payment authorization. It may also include account notes about the transaction, including information that helps us prevent fraud, misuse of the Services, or illegal activity.
• Identifiers and device information. When you visit our internet-based Services or use our apps, our web servers automatically log your Internet Protocol (IP) address and information about your device, including unique device identifiers (such as MAC address); device type; and your device’s operating system and version, browser type and language, and other software including type, version, language, settings, and configuration, and mobile network information. As further described in the Cookies, Mobile IDs, and Similar Technologies section below, our websites, apps, and other online services store and retrieve cookie identifiers, mobile IDs, and other information.
• Geolocation information. We may collect or infer information about your approximate location when you access or use the Services, visit our warehouses or services centers, or turn on Bluetooth, Wi-Fi or other geolocation functionality on your device, as permitted by law.
• Guest Wireless Access. When you connect to guest wireless internet service provided at our locations, we automatically log your activity on that connection, including time, date, and duration of your connection and information that identifies your device. We use this information to protect our networks and to detect potential unauthorized activities.
• Usage and session information. We automatically log your activity on our websites, apps and other Services, including the URL of the website from which you came to our sites, pages you viewed, how long you spent on a page, access times, and other details about your use of and actions on our Services. We capture the screen images that you view and collect information about how you interact with particular screens with your keyboard, mouse, or other input device. We also collect information about what products and services you browse, search for, or otherwise express an interest in, and we track your activity on our Services where our advertising is served. We collect and use such information to evaluate the effectiveness of our Services and marketing, troubleshoot and improve our Services, provide customized marketing messages, customize our advertising, and personalize and improve your experience.
• Call recordings and chat transcripts. We record and store telephone calls and chat transcripts for a period of time when you interact with us by phone or chat, or if you provide us feedback about our Services. We collect and use such information to evaluate the effectiveness of our Services, improve our Services, deal with your concerns, address any legal issues, and personalize and improve your experience.
• Video and other images. We use cameras in and around our warehouses and facilities to capture video and images. These may include images of persons inside or around our facilities and parking lots. We may collect, use and disclose such information to protect the rights, property or personal safety of Costco, its customers, employees or other members of the public.

Information we obtain from other sources. We may collect information about you from other sources that we may combine or link with information we have about you. We may combine information that we have collected offline with information we collect online. Information may also be collected by vendors acting on our behalf. These other sources include, for example:

• Primary member or accountholder. When a primary Costco member or accountholder adds additional members to the membership account (including household members and business affiliate members), we obtain contact, identification and demographic information for these members from the primary Costco member or accountholder.
• Commercial data brokers/sources. Commercial data brokers and aggregators provide us with information about you to update and supplement the information we collect. This includes marketing information and inferences, as well as information that assists us in preventing fraud or other illegal activities.
• Other companies with which you engage. We obtain information from companies that offer their products and services to Costco members, including Costco co-branded and joint venture relationships, Costco Services suppliers, vendors, and product suppliers. These products and services may include auto services, insurance, installed home improvement products and services, wireless devices and services, travel services, and order and delivery services. These companies may disclose some information to us about your experience with them, such as the items or services you purchased and your contact information. For clarity, we are not responsible for any additional information you provide directly to these companies, and we encourage you to become familiar with their privacy and security practices and policies before disclosing information to them.
• Content you post online. Any information you post or disclose on message boards, chat, profile pages, blogs, and other services, including through direct messages to Costco or public posts or disclosures via social media outlets, may be collected, used, and disclosed by Costco or its vendors as described in this Privacy Policy. Such public posts and disclosures are also viewable by other users.
• Service providers. We may use vendors and service providers to collect or provide information to Costco in connection with work they do on our behalf.

Information we create or generate. We generate new information relating to you by analyzing data we collect, including using automated means and third-party sources, to create inferences about your likely preferences or other characteristics (“inferences”). For example, we may use information about your previous purchases to infer the types of products and services that may interest you in the future. We use such information to measure and improve our marketing efforts, including providing targeted advertising and other promotional materials to you.

Information concerning minors. We do not direct the Services to individuals under the age of sixteen (16). We do not knowingly collect personal information from individuals under 16 except as provided to us to make travel reservations, fulfill a prescription or provide other services in the pharmacy, provide services in the optical department or hearing aid department, or as part of our legal or risk management processes.

COOKIES, MOBILE IDs AND SIMILAR TECHNOLOGIES

Costco and our vendors, suppliers, and advertising providers use digital trackers. Digital trackers include cookies, pixels, and web beacons placed on your browser when you use the Services, advertising identifiers accessed on your mobile device, and collection of your IP addresses and device identifiers when you use our Services. We use these trackers to collect personal information about you and your online activities over time and across different websites or services.

Why we use digital trackers.

Digital trackers have different functions, including:

• Strictly Necessary trackers are needed for our websites or applications to function. They enable core functions like carrying out network transmissions and enabling you to log in to our systems. They also enable us to maintain your privacy choices by preventing advertising-related or other optional digital trackers from being placed on your browser or device. Strictly necessary cookies cannot be switched off through our Services, but you can disable some of them by changing your browser settings. Disabling these cookies will affect how the Services function and may prevent you from using certain features of the Services.
• Functional trackers allow us to provide personalization and convenience features, such as remembering your login information, preferred warehouse location or language of preference. These are used to recognize you when you return to one of our websites. Blocking these cookies may impact your experience and some features on the Sites. Your choice is specific to the device, website, and browser you are using, and is deleted when you clear your browser’s cookies.
• Analytics and Performance trackers allow us to count visits and traffic sources so we can measure and improve the performance of our Services. They help us to know which pages are the most and least popular and see how visitors move around the site. Your choice to allow or block these cookies is specific to the device, website, and browser you are using, and is deleted when you clear your browser’s cookies.
• Targeted advertising trackers may be set through our services by us or by third party service providers and advertisers. We use these trackers to collect information about how you use our Services, as well as how you interact with advertisements and content on other websites. This information is used to provide you with advertisements tailored to your interests. If you do not allow these trackers on our Services, you may still receive advertisements, but you may receive less relevant advertising or content.

How to Manage Digital Trackers.

When you first access our Services from your computer, tablet or mobile device, a banner will be displayed informing you of your choices and how to consent to Costco’s use of Functional trackers, Analytics and Performance trackers and Targeting trackers. If you choose not to accept these digital trackers, some of the features of our Services may not function properly.

You may withdraw your consent for these non-essential cookies, or change the preferences you have set, at any time by selecting the appropriate settings on the Cookie Preferences page. A link to this page is also available at the foot of each page on our websites at all times.

If you set your browser or device to delete or reject cookies or other trackers, this could affect certain features or services of our Services. If you set your browser or device to delete or reject all cookies and trackers, your settings and preferences, including your choices regarding cookies and trackers, may be lost or stop functioning. In this instance, you may need to recreate those choices on the individual websites and applications with which you engage.

You also may be able to opt out of use of your information for advertising by interacting directly with our analytics and advertising providers or by utilizing association opt-out mechanisms:

• Ad Choices (https://youradchoices.ca/en/tools)
• NAI (http://optout.networkadvertising.org)
• DAA (http://optout.aboutads.info/)
• Google Analytics (at www.google.com/policies/privacy/partners/)

OUR USE OF PERSONAL INFORMATION

We use the personal information we collect for purposes described in this Privacy Policy or otherwise disclosed to you. For example, we use personal information for the following purposes:

• Product and service delivery. To provide our products and services, including: securing, troubleshooting, improving, and personalizing products and services, processing, fulfilling, shipping, and delivering your orders as well as processing exchanges or returns.
• Booking travel arrangements. Travel-related personal information is required for purposes including booking your trip, contacting you in association with your trip, providing mandatory information to government authorities, personalizing your travel experiences, and for other purposes identified by the applicable travel providers in their privacy policies. We may retain some or all of this information in order to provide services to you in association with your bookings.
• Health-related services and products. To provide health services and products that you request and to communicate with your health service providers.
• Business operations. To operate our business, such as: creating, maintaining, and renewing your membership, billing, accounting, improving our internal operations, securing our networks and systems, detecting fraudulent, illegal, or unauthorized activity, and monitoring trends, usage and activities in connection with our Services and warehouses.
• Product improvement, development and research. To improve our products, develop new products or features, and conduct research, as authorized by law.
• Personalization. To understand you and your preferences, to enhance your experience and enjoyment using our products and services and personalize your online experience and the advertisements you see when you use the Services or other platforms.
• Customer support. To send you information and notices about your membership account such as updates, order confirmations, delivery and pick-up notices, security alerts, and support and administrative messages.
• Marketing and advertising:
• To create marketing materials;
• to communicate with you about Costco and other companies’ products and services, offers, promotions, rewards, contests, upcoming events, and other information about our products and services and those of other selected companies;
• to manage our mailing lists; and
• to display advertising to you.
• Legal, security and safety reasons. For legal, security and safety reasons, such as to protect our rights and the rights of our customers, members, employees or members of the public, to protect the security of our systems, networks and facilities, to enforce our policies, communicate product recalls or safety notices, to investigate and resolve claims or to address legal and regulatory compliance obligations.
• For any other purpose described to you at the time information is collected.

We combine information we collect from different sources to achieve these purposes and to give you a more seamless, consistent, and personalized experience.

OUR DISCLOSURE OF PERSONAL INFORMATION

We disclose personal information we collect to complete your transactions, provide the Services, or fulfill orders or inquiries you have requested or authorized. For example, when you provide payment information to make a purchase, we will disclose that information with banks and other entities as necessary for payment processing, fraud prevention, credit risk reduction, or other related financial services. In these circumstances, the personal information that other entities receive is limited to only the personal information held by us that they need in order to render their service to us, or directly for you. The companies that are provided with the personal information are obligated to keep the information confidential and secure and prohibits them from using it for unauthorized purposes. We may also disclose personal information for additional purposes, such as:

• Primary member or account holder. Each Costco membership account has a primary member or account holder who is authorized to add and remove additional household or business affiliate members and make account management decisions. Where permitted by applicable law, we may disclose household or business affiliate members’ contact and purchase information to the primary membership account holder.
• Household or business affiliate members. Where permitted by applicable law, we may disclose primary members’ or account holders’ contact and purchase information to household or business affiliate members associated with the account.
• Account administrators. If you designate an administrator to manage your account, we may disclose contact information for primary and household account members with that administrator.
• Other companies with which you engage. When you make a complaint about a product or services you purchased through Costco, or when you request information about, or purchase products or services offered by, other companies as part of your Costco membership, we disclose information to those companies. We do this so that they may provide you with their products and services, provide customer service, resolve complaints, provide installation and warranty services, and provide recall or emergency notices.
• Businesses offering co-branded products or services. Costco discloses information to businesses that offer products or services jointly with Costco or that use the Costco brand, for our and their marketing purposes. We may disclose contact information with these other companies so that we or they can notify you of product and service offerings, determine if you qualify for products or services, and evaluate new and existing products or services offerings.
• Travel providers. When you book flights, cruises, hotels, rental cars and other travel-related goods or services, any personal information you provide to us will be transferred to the applicable travel providers and their agents, and will be subject to their privacy policies and their local laws. We are not responsible for the privacy and security practices or policies of these travel providers or their agents, and we encourage you to learn about their privacy and security practices and policies before booking travel through us.
• Travel inquiries. If another person who has your full name and booking reference numbers contacts us because they are a party to the planned travel and seeks information on your booking or wishes to make changes to it, we will disclose that information and allow that other person to make changes to your booking, on the basis that you have given that person the consent to do so.
• Health-related services. We disclose personal information to process or obtain payment for health services (for example, obtaining authorization from your insurer or provincial authorities for direct payment of pharmacy services) and to process or obtain payment from your health insurance provider. We may also disclose your personal health information to a family member, friend, or other person involved in your health care (1) if you agree to allow us to disclose this information; or (2) if you are present and able to make health care decisions and you do not object to the disclosure after being given the opportunity to do so.
• Our affiliates and entities that belong to Costco’s corporate group. We disclose personal information with our subsidiaries, corporate affiliates, and related companies under common control and ownership.
• Vendors, service providers and consultants. We disclose personal information to vendors or service providers working on our behalf for the purposes described in this Privacy Policy. For example, companies that help us:
• Process, fulfill, ship and deliver your orders;
• Provide customer service and resolve complaints;
• Identify, investigate and prevent fraudulent transactions;
• Provide installation and warranty services;
• Communicate with you or provide recall or emergency notices;
• Analyze data or member activity;
• Design and execute our marketing campaigns, administer our promotions, or provide advertising services;
• Manage, operate and improve certain components of our technology infrastructure, including websites, data storage, webmail and online business applications; or
• Investigate and resolve claims.
• Costco co-branded credit card applicants and cardholders. When you apply for a Costco co-branded credit card, we will share with our credit card stakeholders (including the issuing institution, payment processor, and other organizations that provide services relating to the Costco co-branded credit card) the information you provide on the credit card application. If the application is approved, we will share with these stakeholders your Costco membership number(s) Membership signup date, your Costco membership photograph(s) that will appear on the co-branded card, your company name and resale permit number (if applicable) and the type and status of your Costco membership. For clarity, when you apply for a Costco co-branded credit card, any personal information you provide will be subject to the privacy policies and the laws that apply to those credit card vendors. We encourage you to review these privacy policies carefully before applying for a co-branded credit card. From time to time, we may disclose your personal information such as contact information, information regarding your membership number and status, and the aggregate amount of your Costco purchases to those credit card partners.
• Marketing, advertising and analytics providers. We disclose information to other companies that conduct marketing and advertising services to promote our and our suppliers’ products and services. This includes directing digital (online) targeted advertising and other marketing offers, promotions, rewards, contests, upcoming events, and notices to you. We also may use images taken in or around our facilities or at events organized, or participated in, by Costco in marketing materials and advertisements. It also includes companies that aggregate personal information in order to provide analysis and statistics to Costco and its suppliers. As further described in the Your Privacy Choices section below, you can opt in or opt out of electronic and printed marketing communications as well as out of targeted advertising cookies and digital trackers at any time.
• Tobacco rebates for business members. For Business Members who purchase tobacco products for resale, we provide member name, address, brand name, and the amount of tobacco products purchased to the tobacco manufacturers’ representative so they can conduct market studies and other promotional activities.
• Corporate transactions. We may also disclose personal information as part of a corporate transaction or proceeding such as a merger, financing, acquisition, bankruptcy, dissolution, or a transfer, divestiture, or sale of all or a portion of our business or assets.
• Employer-provided memberships. If your employer purchased your membership as an employee benefit, we may disclose your name, address, purchase history, and membership level or status with your employer.
• Other uses and disclosures. We will access, transfer, disclose, and preserve personal information when we believe that doing so is necessary to:
• Comply with applicable law or respond to valid legal process, including from law enforcement or other government agencies;
• Protect our Costco companies, our shoppers, members, employees or the public; for example, to prevent attempts to commit fraud, or to help prevent the loss of life or serious injury of anyone;
• Demonstrate our compliance with applicable laws and regulatory requirements;
• Operate and maintain the security of our locations and systems, including to prevent or stop an attack on our computer systems or networks; or
• Protect the rights or property of Costco or others, including detecting, investigating, and preventing illegal or unauthorized activities, reporting such activities to law enforcement, and enforcing our agreements, terms, and policies.

De-identified Information. We may aggregate or de-identify information so that it is no longer personal information. Where we maintain de-identified information, we commit to maintaining and using such information in de-identified form, and will not attempt to re-identify such information except as necessary to evaluate the effectiveness of our de-identification policies and procedures, or as permitted or required by law.

YOUR PRIVACY CHOICES

We provide choices about the personal information we collect about you. The choices you make apply only to you and will not apply to household or business affiliate members associated with your membership account.

You can opt out of electronic and printed marketing communications. Please note that unless you have opted out from receiving marketing messages via email, SMS, direct messages, or other electronic means, Costco relies on consents and/or the business relationship we have with you in order to send you such communications. We will tell you about news, promotions, special offers and other information from Costco, regarding Costco, Costco affiliates and selected partners. You may unsubscribe from these kinds of messages at any time by using the “unsubscribe” link provided in the communication. In addition, you can opt out of receiving such electronic marketing messages as well as printed promotional materials from Costco by:

• Accessing your online account on Costco.ca. From the Account menu, choose “Preferences”;
• Visiting any Membership counter at any Canadian warehouse; or
• Calling our Member Service representatives at 1-800-463-3783.

You can opt out of targeted advertising cookies and digital trackers by visiting the Cookie Preferences page. Your choice to opt out of targeted advertising trackers is specific to the device, website, and browser you are using, and is deleted when you clear your browser’s cookies.

You can stop text messages (SMS) and mobile notifications. We will send you SMS (text) communications if you consent to receive them, including, for example, order and delivery status. We may also send you SMS (text) messages in case of emergency, urgent product recalls and other limited (non-marketing) instances as permitted by law. You can reply “STOP” to any SMS (text) message to cancel. We also may send push notifications or alerts to your mobile device through our app if you consent to receive them. You can stop these notifications by changing the settings in the app or on your mobile device.

You can stop use of device location information. If you use our mobile apps, we will ask for your consent to use your device's location information to enable features such as the digital membership card notifications. If you decline to consent to our use of your device’s location information, we will not collect that information, but some app features may not work. You can withdraw your consent for use of location at any time by turning off the location feature for the app in your device settings.

You can opt out of tobacco information disclosures. If you are a Business Member and do not want us to disclose information about your tobacco purchases, you can let us know by:

• Visiting any Membership counter at any Canadian Costco warehouse;
• Calling our Member Service representatives at 1-800-463-3783;
• Emailing us at costco.member.privacy@costco.com or
• Writing us at: Costco Wholesale Canada Ltd., 415 West Hunt Club Road, Ottawa, Ontario K2E 1C5 Attention: Privacy Officer.

You can get information about your membership and the personal information we may have collected about you by showing your membership card at the Membership Counter in each warehouse to confirm your identity and completing a written request for such information on a form we provide. We will generally respond to your request for information within thirty (30) days, unless, for reasons beyond our control, a longer response time is necessary, in which case you will be advised accordingly. While our response will generally be provided at no cost, you will be informed in advance of any charges that apply in connection with the information request. Charges may relate to the transcription, reproduction or transmission of personal information or personal health information held by us.

In very limited circumstances, we may not be able to supply personal information and personal health information for reasons of a legal nature, including privileged communications between professional and client or a pending judicial proceeding. In each case, we will provide written reasons outlining why your request for access has not been granted.

To the extent permitted by applicable law, we reserve the right to decline requests that are unreasonable or excessive, where providing the information would be prohibited by law or could adversely affect the privacy or other rights of another person, or where we are unable to authenticate you as the person to whom the information relates.

You can ask us to correct your personal information. If we hold personal information about you and you believe that it is not accurate, complete and up-to-date, you can request to have it corrected. If we discover that information is not accurate, complete and up-to-date, we will take reasonable steps to correct it.

We also urge you to provide us with updates regarding your personal information and to inform us of any errors affecting the personal information we hold to ensure that the personal information you provided is accurate, complete and up to date. You may update, review or correct your Costco.ca online account information at any time by accessing your password-protected registration page via the “My Account” area of the website. To update any other information, please visit the Membership Counter in any of our warehouses with your membership card to confirm your identity.

SECURITY OF PERSONAL INFORMATION

We take what we believe to be reasonable and appropriate steps to help protect personal information from unauthorized access, use, disclosure, alteration, and destruction. We employ physical, administrative, contractual and technological safeguards to protect personal information, and require that our partners do the same. Access to personal information will be restricted to authorized personnel who require the information in order to perform their duties properly. In addition, access will be limited to only that information that is strictly necessary for the performance of those duties. Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure, and therefore we are unable to guarantee the security of your personal information.

The security of your personal information can be enhanced by you by taking care to use suitably strong passwords that others cannot guess, that are kept safe by you, and that are not reused on other sites. Taking steps like avoiding dictionary words or proper names, and adding extra character and punctuation marks can also help protect you. If you believe your password has been compromised, you should change it immediately.

STORAGE OF PERSONAL INFORMATION

By providing us with personal information, you acknowledge and agree that such personal information may be transferred to other jurisdictions for processing and storage, including in servers located across Canada and in the United States. In addition, in order to provide you with our Services, our partners may also store your personal information in the following locations:

• European Union
• United Kingdom
• Taiwan
• Singapore
• Chile
• India
• Philippines
• Australia
• Turkey

For the purposes of clarity, personal health information will only be processed and stored in Canada and in the United States.

Our main cloud computing service provider may store personal information in the locations set out here: https://www.google.ca/about/datacenters/inside/locations/

Some of our service providers, including without limitation travel providers, may process and store your personal information (including, for clarity, personal health information) in these and other countries and as a result, the governments, courts or law enforcement or regulatory agencies of these jurisdictions may be able to obtain disclosure of your personal information in accordance with their laws.

RETENTION OF PERSONAL INFORMATION

Personal information is retained only for so long as is necessary for the purposes set out above. When no longer required, we will destroy, erase or de-identify the personal information in accordance with applicable laws. Legal requirements may necessitate our retaining some or all of the personal information for a period of time that is longer than we might otherwise hold it. However, Costco will restrict access to such information to prevent it from being used except for the fulfillment of these legal requirements.

CHANGES TO THIS PRIVACY POLICY

We will update this Privacy Policy when necessary to reflect changes in our Services, how we use personal information, or the applicable law. When we post changes to this Privacy Policy, we will revise the "Last Updated" date at the top of the Privacy Policy. If we make material changes to the Privacy Policy, we will provide notice or obtain consent regarding such changes as may be required by law.

HOW TO CONTACT US

If you are not completely satisfied with or wish to submit questions or comments concerning this Privacy Policy or its application by us, we invite you to convey your concerns, questions or suggestions by:

• Sending an email to costco.member.privacy@costco.com; or
• Writing to us at Costco Wholesale Canada Ltd., 415 West Hunt Club Road, Ottawa, Ontario, Canada K2E 1C5, Attention: Privacy Officer.

We will reply as quickly as possible and inform you of the steps, if any, that have been or will be taken in order to address the concern or to implement the suggestion. You can also file a complaint with the Privacy Commissioner in the province in which you reside or with the Office of the Privacy Commissioner, in Ottawa.