ENDVR Energy Privacy Policy

YOUR PRIVACY IS OUR PRIORITY

Safeguarding your privacy and protecting your information is a top priority at ENDVR Energy. We are committed to maintaining the highest standards of cybersecurity to ensure your data remains secure. Our privacy practices are designed to be transparent, so you understand why we collect your information, how we use it, how we protect it, and how we securely dispose of it when it is no longer needed.

To reinforce this commitment, our Corporate Privacy Officer oversees compliance across all ENDVR Energy employees and third-party partners, ensuring strict adherence to our privacy and security protocols.

For more details, please review our Privacy Policy below.

Commitment to Privacy

ENDVR Energy (or the “Company”) is committed to keeping the personal information of its customers accurate, confidential, secure and private, in accordance with law and this Privacy Policy. Our Privacy Policy has been designed to inform customers, employees, and third-party contractors of ENDVR Energy’s commitment to, and recognition of, our obligation to protect  the personal information in our custody or control, and meet the terms of applicable privacy laws, such as Municipal Freedom of Information and Protection of Privacy Act (MFIPPA).

Our Privacy Policy describes the principles by which ENDVR Energy protects the privacy of personal information in its possession. It addresses how ENDVR Energy handles personal information and outlines individuals’ rights in respect of accessing their personal information. Our Privacy Policy incorporates and expands on the ten principles for the protection of personal information, as established by the Canadian Standards Association (CSA).

This Privacy Policy applies to individuals only; it does not apply to information about businesses who carry on business as corporations, partnerships, or other forms of association. ENDVR Energy does, however, protect the confidentiality of such information in accordance with the law.

In this Privacy Policy, “we”, “us” or “our” means ENDVR Energy and “customer” and “individual” means an individual customer, prospective individual customer or other individual member of the public whose personal information is in our custody or control.

The terms set out in ENDVR Energy’s Privacy Policy shall be effective from September 18, 2025 and may change from time to time. Please check our website periodically for any revisions.

Ten Principles for the Protection of Personal Information

Ten internationally accepted principles lie at the core of organizational responsibilities for safeguarding personal information. These are:

1. Accountability: 

An organization is responsible for personal information under its control and shall designate an individual or individuals who are accountable for the organization’s compliance with privacy principles.

ENDVR Energy is accountable for all personal information in its possession or control and will designate one or more persons who will be responsible for the Company’s compliance with the following principles:  

• The Vice President of ENDVR Energy has ultimate responsibility for the protection of personal information. The Vice-President has delegated the day-to-day operational privacy responsibilities to the Corporate Privacy Officer. Entire staff at ENDVR Energy share responsibility for adhering to ENDVR Energy’s privacy policies and procedures.
• The Corporate Privacy Officer may be contacted at the following address or by e-mail at privacy@ENDVRenergy.com:
  • Corporate Privacy Officer
    200 Chisholm Drive
    Milton, Ontario, L9C 3G9  
• ENDVR Energy is responsible for personal information in its possession or control, including any personal information that has been transferred to a third party for processing. ENDVR Energy will use contractual or other means to provide a comparable level of protection of personal information while such information is being processed by a third party.
• ENDVR Energy has implemented policies and procedures to give effect to the ENDVR Energy Privacy Policy including:
  • implementing procedures to protect personal information and to oversee the Company’s compliance with MFIPPA;
  • establishing procedures to receive and respond to inquiries or complaints with respect to an individual’s personal information; 
  • training staff and communicating to staff about the Company’s privacy policies and practices; and
  • developing information to explain the Company’s policies and procedures.

2. Identifying Purposes: 

The purposes for which personal information is collected shall be identified by the organization at or before the time the information is collected.

For the purposes of this Privacy Policy, “personal information” means information about an identifiable individual but does not include the name, title, contact information or designation of an individual that identifies the individual in a business, professional or official capacity even if such contact information for the individual relates to the dwelling from where the individual carries out business, professional or official responsibilities.

Personal information that ENDVR Energy may collect from an identifiable individual includes, but may not be limited to:

• name and address and other contact information;
• the meter number (when relevant);
• facts about consumption of power, both historic and current, when relevant;
• information about a customer’s transactions with the Company (e.g. account numbers, account balances, payment history);
• identifying information, such as date of birth, employment information, driver’s licence;
• credit and banking information for pre-authorized payments;

Before collecting any personal information, ENDVR Energy will make the individual aware of the purpose(s) for which ENDVR Energy is requesting the personal information, legal authority for collection of such information and title, business address and business telephone number of an officer or employee of the Company who can answer the individual’s questions about the collection. If personal information that has been collected is to be used for a purpose not previously identified, ENDVR Energy shall identify the new purpose  and seek the individual’s consent prior to such use, unless such use of personal information is required or done in accordance with law. Unless such use of personal information is required or done in accordance with law, ENDVR Energy will advise that individual has right to refuse permission for ENDVR Energy to use personal information for any purposes and that such refusal may impact their ability to access certain services or features, if any.
 
Additional purpose(s) for collecting personal information may be identified to an individual before or at the time of collection. However, at a minimum ENDVR Energy will collect personal information for the following purposes:  

• to establish and maintain responsible commercial relationships with customers and to provide ongoing service;
• to meet all legal, regulatory, settlement, and market operations requirements;
• to identify or contact customers, respond to customer inquiries, and otherwise maintain business relations with customers;
• to help prevent or investigate fraud, theft of power, or other breaches of the law;
• to bill and collect payments;
• to register customers for pre-authorized payment for services;
• to provide customers with information about our services,
• to request customer participation in surveys or contests; or
• to notify customers about events or causes sponsored by ENDVR Energy or our affiliates.

We may also collect information about individuals from other sources, including where the individual provides authorization to do so, or where we are authorized by law.

ENDVR Energy may:

• Monitor and/or record any telephone conversations with its customers for quality assurance and training purposes.
• Share information with third-party service providers who perform services on our behalf. These service providers are given only the information necessary to perform those services that we have contracted them to provide and are obligated to meet the same privacy standards as ENDVR Energy.

3. Consent: 

The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.
 
ENDVR Energy will ask for your consent for the collection, use, and disclosure of your personal information for an identified purpose when we collect your information, unless such collection, use or disclosure is otherwise required or done in accordance with law . An individual can provide consent to the collection, use or disclosure of personal information about them expressly, implicitly, orally or in writing. ENDVR Energy may collect, use or disclose personal information without an individual’s consent only in limited circumstances as permitted or required by law. 
 
Subject to certain legal and contractual restrictions and reasonable notice, an individual can refuse or withdraw their consent to the collection, use or disclosure of personal information about them at any time by contacting Company’s Corporate Privacy Officer using the contact information mentioned above. However, refusal to provide such consent or withdrawal of such consent, may prevent the Company from providing some services as it may require a minimum amount of personal information to provide its services.

4. Limiting Collection: 

The collection of personal information shall be limited to that which is necessary for the purposes identified by the organization. Information shall be collected by fair and lawful means.
 
ENDVR Energy limits the amount and type of personal information it collects to that which is reasonable and necessary for the purposes identified by the Company. ENDVR Energy collects personal information using procedures which are fair, transparent and lawful.

5. Limiting Use, Disclosure, and Retention: 

Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Personal information must be retained only as long as necessary for the fulfillment of those purposes.
 
ENDVR Energy does not use or disclose personal information for purposes other than those for which it was collected, unless consent is given by the individual to use or disclose it for another purpose, or as required by law. ENDVR Energy retains personal information only as long as necessary to fulfill the identified purposes and to meet our legal or contractual obligations.
 
Personal information that is no longer required to fulfill the identified purposes for which it was collected will be destroyed, erased, or made anonymous. ENDVR Energy has developed guidelines and implemented procedures to govern the destruction of personal information.

Access to personal information is restricted to only those employees of ENDVR Energy who require access in order to perform their duties in fulfilling the purposes outlined in this Privacy Policy or the purposes for which the consent has been obtained and as authorized or required by applicable law. ENDVR Energy will use contractual or other means to provide a comparable level of protection of personal information while such information is being processed by its employees.
 

6. Accuracy:

Personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.
 
ENDVR Energy maintains procedures to ensure all personal information we collect and use is kept as accurate, complete and up to date as necessary. ENDVR Energy will update personal information about customers upon notification by the individual requesting that their personal information be updated or amended. ENDVR Energy relies on individuals to tell us about any errors or changes in such information.
 

7. Safeguards: 

Personal information shall be protected by security safeguards appropriate to the sensitivity of the information.
 
In executing its responsibilities with respect to the confidentiality of personal information, ENDVR Energy employs a number of safeguards, appropriate to the sensitivity of the information, to protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification. Such safeguards include physical measures, organizational measures and technological measures. These include: locked filing cabinets, restricted access to offices, security clearances, limiting access on a “need to know” basis, and use of passwords and encryption. Procedures for implementing these measures are communicated to all employees and third parties to ensure compliance with this principle.
 
It is also important for you to:  

• take precautions to protect your personal information such as keeping your username and passwords confidential.
• tell us about any errors or changes in your information.

8. Openness: 

An organization shall make readily available to individuals, specific information about its policies and practices relating to the management of personal information.
 
ENDVR Energy will make its policies and practices relating to the management of personal information readily available to individuals. The information about its policies and practices relating to the management of personal information can be obtained from Company’s Corporate Privacy Officer using the contact information mentioned above. Further, ENDVR Energy’s Privacy Policy is available at its office and on its website.

9. Individual Access: 

Upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.

MFIPPA provides individuals with the right to request access to your personal information. Individuals can request access to their personal information that we have and get information about existence, use or disclosure of such personal information. An individual may be required to provide sufficient information to enable the Company to retrieve the information requested. The information provided by the individual shall only be used for retrieving the requested information.

Individuals can challenge the accuracy and completeness of your personal information and request that their personal information be updated or corrected for purposes of accuracy and completeness. Where any correction is requested but is not made a statement of disagreement reflecting the substance of the unresolved challenge will be attached to such personal information.

We may require individuals to submit access or correction requests in writing. We will require individuals to provide information to confirm their identity before we provide a response. We may also charge a fee for responding to such requests, and, if so, will advise the individual in advance of such costs. Individuals can make their formal requests by:

• email at privacy@ENDVRenergy.com, 
• online at ENDVR Energy’s Freedom of Information Request;  or
• by letter to ENDVR Energy, 200 Chisholm Drive, Milton, ON L9T 3G9.

Response to an individual’s request will be made within 30 days.

10. Challenging Compliance: 

An individual shall be able to address a challenge concerning compliance with the above principles to the designated individual or individuals accountable for the organization’s compliance.
 
Individuals may submit any privacy related concerns or complaints to Company’s Corporate Privacy Officer using the contact information mentioned above. ENDVR Energy has policies and procedures to receive, investigate, and respond to individuals’ complaints and questions. If the individual is not satisfied with the way ENDVR Energy has responded to a complaint or a request, individual can contact and submit its appeal to the Information and Privacy Commissioner of Ontario. The contact information of Information and Privacy Commissioner of Ontario has been mentioned below:
 
Information and Privacy Commissioner, Ontario
2 Bloor Street East, Suite 1400,
Toronto, ON M4W 1A8
 
Telephone: 1-800-387-0073 or (416) 326-3333
Fax: (416) 325-9195
Website: www.ipc.on.ca
E-Mail: info@ipc.on.ca

11. How We Use Your Information: 

ENDVR Energy will only collect information pertinent to your potential project and billing. The only people at ENDVR Energy who see your information are those employees who need to see it to do their jobs. All the employees who work with customers’ information have been trained and understand the privacy rules and why they are important.

Your information is protected while it is with us. If we have paper files about you, they are stored in locked filing cabinets. If the information is electronic, it is protected by security firewalls. Employees who need to see it must log in with a username and a password.

If we hire an outside company to do work for us, we make sure that company understands our privacy rules and why they are important. Anyone doing work for us who does not work at ENDVR Energy has to sign a contract that includes our privacy rules as part of the agreement. Those companies and organizations only see the information they need to do the job we have hired them to do.

To see all the ways we use your information, and for further details on our privacy commitment to you, please see our privacy policy.

12. Disposing of Personal Information: 

If you close your account with us, we may have to keep the information about your file for a number of years, as set out by the energy regulator, Ontario Energy Regulator. Once that time is up, we dispose of your information in ways that mean no one else can see it or use it again. Paper files are shredded securely; electronic files are disposed of in compliance with our security policy.

If you have any questions about these privacy standards, or about your information in particular, please contact our Privacy Officer:

• by telephone: (905)876-4611 ex 236
• by mail: Privacy Officer, ENDVR Energy, 200 Chisholm Drive, Milton ON, L9T 3G9
• by email: privacy@endvrenergy.com