External Privacy Policy

The privacy and security of personal information is important to Canpotex Limited and its subsidiaries (collectively, “Canpotex”, “we”, “us”, “our”, and like terms), and it is Canpotex’s policy to endeavour to comply with applicable privacy laws. This External Privacy Policy (the “Policy”) explains Canpotex’s privacy and security practices with respect to personal information in the possession and control of Canpotex, and may be supplemented by specific policies, procedures and practices.

This Policy applies to all personal information that we collect in the course of our business activities, unless the personal information is related to a current or former employee of Canpotex, in which case the personal information is dealt with in accordance with Canpotex’s “Employee Privacy Policy”.

For the purposes of this Policy, “personal information” means personal information or personal data about an identifiable individual as defined in applicable law, but does not include information exempted by applicable law. For clarity, “personal information” does not include anonymous or non-personal information (i.e., information that cannot be associated with or traced back to a specific individual), and in many jurisdictions (including Canada) also does not include the name, title, business address, business telephone number, business e-mail, business fax number or other business contact information of a representative of an organization when such information is collected, used or disclosed for the purpose of contacting such individual as a representative of such organization.

For residents of Brazil, please see the section below titled “LGPD INFORMATION FOR RESIDENTS OF BRAZIL” for further information required pursuant to the Brazilian General Data Protection Law, the Lei Geral de Proteção de Dados Pessoais (the “LGPD”).

For residents of mainland China, please see the section below titled “PIPL INFORMATION FOR RESIDENTS OF MAINLAND CHINA” for further information required pursuant to the Personal Information Protection Law of the People’s Republic of China (the “PIPL”).

WHY DOES CANPOTEX COLLECT PERSONAL INFORMATION?

Canpotex may collect personal information for the following purposes:

  • To establish, administer, plan, maintain and manage the relationship with individuals and/or their respective organizations and to communicate with them;
  • To provide individuals and/or their respective organizations with requested information, products and services (as applicable);
  • To better understand how Canpotex may improve its products and services, to develop and conduct its business and operations, and for other internal business purposes, including, for example, market research and customer surveys;
  • To be able to review the products and services we obtain from individuals and/or their respective organizations so that Canpotex may work with them and so that they may understand Canpotex’s requirements for such products and services and work to improve the products and services they provide to us;
  • To provide individuals and/or their respective organizations with information on current and future products and services, as well as other developments with respect to Canpotex, Canpotex Limited’s shareholders and their respective affiliates, and other persons with which Canpotex has a business relationship (in accordance with applicable anti-spam laws, such as Canada’s Anti-Spam Legislation – see below);
  • To comply with applicable law and regulatory requirements;
  • To comply with Canpotex’s policies and procedures;
  • To review and consider applications for current and future employment opportunities at Canpotex;
  • To facilitate the individual’s and/or their respective organization’s participation in Canpotex / Canpotex-sponsored events;
  • To facilitate applicable environmental, health and safety activities;
  • To protect against error and fraud;
  • To review and consider requests made to Canpotex for community support;
  • To protect Canpotex’s rights and property; and
  • Any additional purposes where Canpotex has a legal duty or right to do so (which may be an individual’s consent to the collection, use or disclosure of personal information) or any additional purposes for which Canpotex has the consent (in accordance with applicable law) of the individual to whom the personal information relates;

(collectively, the “Authorized Purposes”).

The types of information that Canpotex may collect from individuals include, for example, name, email address, address, phone number, identification, employment, and other information individuals may provide.

HOW DOES CANPOTEX COLLECT PERSONAL INFORMATION?

Where permitted or required by applicable law or regulatory requirements, Canpotex may collect personal information without an individual’s knowledge or consent.

Where an individual’s consent is required to collect personal information, Canpotex only collects personal information about an individual with the individual’s consent (see “CONSENT – IS THERE A CHOICE?”, below). Generally, this means that Canpotex collects personal information directly from the individual to whom it relates, whether via Canpotex’s website, e-mail, telephone, text messaging, direct messaging, fax, regular mail, or in person. Occasionally, Canpotex may collect personal information from third party sources, but only with the consent of the individual or where otherwise authorized by law.

Visitors to Canpotex’s website should also be aware that certain technical information may be collected by Canpotex as a result of a visit to Canpotex’s website. For example, this information may include the visitor’s IP address, network location, browser type, operating system, device specifications, domain name, access times, pages visited, time spent on each page, and referring website addresses. Canpotex uses this technical information for various purposes, such as diagnosing problems with Canpotex’s servers, improving the operation and content of Canpotex’s website, and compiling aggregate and statistical information.

Canpotex will not attempt to link or match such technical information with any personally- identifiable information unless Canpotex has an individual’s consent, Canpotex (or its service providers) have detected or reasonably suspect any unlawful use of Canpotex’s services or a security breach, or Canpotex has a legal duty or right to do so.

Canpotex may use “cookies” on its website. “Cookies” are small text files placed on computers that can collect and store a variety of information. Permanent cookies are stored indefinitely on a user’s hard drive unless manually deleted, while temporary cookies are automatically deleted from the user’s browser upon logging out of a website. Web browsers typically allow users to disable permanent and/or temporary cookies.

Canpotex’s website may contain links to third-party websites, plug-ins and applications, including, for example, social media platforms. Canpotex cannot and does not assume any responsibility for the privacy practices, policies or actions of the third parties that operate these websites, plug-ins and applications. Canpotex is not responsible for how such third parties collect, use or disclose personal information. Individuals should review the privacy policies of these third parties before providing them with personal information.

Please note that Canpotex may use Google Analytics. There is more information about how Google collects, uses and processes data here: http://www.google.com/policies/privacy/partners/

In the course of conducting its business, Canpotex may monitor the activities of individuals in respect of its operations and its premises and property, to the extent and in the manner permitted by applicable law. For example, some Canpotex locations are equipped with video surveillance. When in use, video surveillance is there for the protection of employees and third parties, and to protect against theft, vandalism and damage to Canpotex’s or third-party property.

Meetings with Canpotex in which individuals subject to this Policy may participate, including those meetings conducted using platforms such as Microsoft Teams, Zoom, Skype or any other similar platform, may be recorded by or on behalf of Canpotex and used by Canpotex as permitted by applicable law.

WHEN DOES CANPOTEX USE OR DISCLOSE PERSONAL INFORMATION?

Canpotex may use and disclose personal information as reasonably required to facilitate the Authorized Purposes.

Personal information may be shared between and among Canpotex entities, and Canpotex may share personal information with Canpotex’s employees, contractors and consultants, as well as other parties (including, for example, Canpotex Limited’s shareholders and their respective affiliates), to facilitate the Authorized Purposes. In some cases, Canpotex may share personal information with third party service providers performing functions on Canpotex’s behalf, including, for example, vendors that provide information technology services or provide data processing, analytics or assessment services.

Canpotex may share personal information as contemplated above both inside and outside the individual’s home jurisdiction, and as a result, the individual’s personal information may be collected, used, processed, stored or disclosed in Canada, the United States and other jurisdictions. In such situations, the personal information may be subject to the laws of such jurisdictions and may be accessible by legal and regulatory authorities in such jurisdictions.

Canpotex may also use and disclose personal information as required or permitted by applicable law or regulatory requirements, to protect the rights or property of Canpotex, during emergency situations or where necessary to protect the safety of a person or group of persons, where the personal information is publicly available, or where Canpotex has the applicable individual’s consent to do so.

In addition, personal information may be disclosed or transferred to another party in the event of a change in ownership of all or part of Canpotex.

We may use or disclose personal information without an individual’s knowledge or consent where we are permitted or required to do so by applicable law or regulatory requirements.

Canpotex does not rent, sell or trade customer lists or other personal information.

CONSENT – IS THERE A CHOICE?

Typically, individuals provide their consent to the collection, use and disclosure of personal information by Canpotex when they provide their information to Canpotex or use Canpotex’s products, services or website (as applicable).

Where consent is required by applicable law, individuals can deny or withdraw their consent to Canpotex’s collection, use or disclosure of their personal information at any time upon reasonable notice, subject to any legal or contractual requirements, by contacting Canpotex’s Privacy Officer (Data Protection Officer) using the contact information set forth below under the heading “CONTACT CANPOTEX”. However, if consent is denied or withdrawn, Canpotex may not be able to provide or receive certain products or services. Also see “CERTAIN LIMITATIONS”, below.

Depending on the sensitivity of the personal information, consent may be express, deemed (using an opt-out mechanism, where permitted by applicable law) or implied (where permitted by applicable law). Express consent can be given orally, electronically or in writing. Implied consent is consent that can reasonably be inferred from an individual’s action or inaction.

Canpotex may use personal information to inform individuals of current and new products and services, as well as other developments that Canpotex, Canpotex Limited’s shareholders or their respective affiliates, or persons with which Canpotex has a business relationship believe will be of interest to individuals, in accordance with applicable anti-spam laws, including Canada’s Anti- Spam Legislation. Such communications may be made by way of telephone, text message, direct messaging, e-mail, fax or regular mail. Individuals provide their consent to Canpotex and such other persons contacting them in this manner when they use Canpotex’s products, services or website (as applicable). Individuals may opt-out of receiving such communications by contacting Canpotex at the e-mail address listed below.

We assume that, unless an individual expressly advises us otherwise, by receiving or reviewing this Policy or by continuing to deal with us, the individual has consented to the collection, use and disclosure of the individual’s personal information as described in this Policy.

Canpotex may collect, use or disclose personal information without an individual’s knowledge or consent where Canpotex is permitted or required to do so by applicable law or regulatory requirements.

HOW DOES CANPOTEX PROTECT THE SECURITY OF PERSONAL INFORMATION?

Canpotex has in place reasonable policies, procedures and safeguards (including physical, technological and organizational measures) designed to protect the security of personal information under its control.

The protection of personal information is of paramount concern to Canpotex, and Canpotex is prepared to take appropriate and timely steps in the event of any incidents involving personal information in accordance with applicable privacy laws.

CORRECTING AND UPDATING PERSONAL INFORMATION

Canpotex makes every reasonable effort to ensure that personal information is accurate and complete. This may involve requesting further information or updates from individuals. Canpotex relies on individuals to notify Canpotex if there is a change to their personal information that may affect their or their respective organization’s relationship with Canpotex. Requests to make corrections or changes must be made to the Privacy Officer (Data Protection Officer) using the contact information set forth below under the heading “CONTACT CANPOTEX”.

Canpotex will correct or amend the personal information in its files where it can be shown that the information is incorrect or incomplete. In some circumstances, Canpotex may not agree with an individual’s request to change personal information and will instead append an alternative text to the record in question.

Requests for changes to personal information will be handled in accordance with applicable law.

Also see “CERTAIN LIMITATIONS”, below.

HOW LONG IS PERSONAL INFORMATION RETAINED?

Except as otherwise permitted or required by applicable law or regulatory requirements, Canpotex endeavours to retain personal information only for as long as Canpotex believes is reasonably necessary to fulfill the purposes for which the personal information was collected. Once the personal information is no longer required to fulfill the purposes for which it was collected and is no longer required or permitted to be retained for legal, regulatory or business purposes, it will be destroyed, erased or made anonymous.

Also see “CERTAIN LIMITATIONS”, below.

DOES CANPOTEX PROVIDE ACCESS TO PERSONAL INFORMATION?

In accordance with and to the extent required by applicable law, Canpotex will provide individuals with access to the personal information Canpotex holds about them. To the extent permitted by applicable law, Canpotex reserves the right to require that any request for access to personal information be made in writing. Generally, there is no cost for such access. However, Canpotex reserves the right to charge such costs on a case by case basis in accordance with applicable law. The individual will be notified in advance if charges apply.

Requests for access to personal information must be made to the Privacy Officer (Data Protection Officer) using the contact information set forth below under the heading “CONTACT CANPOTEX”.

Also see “CERTAIN LIMITATIONS”, below.

STORAGE AND PROCESSING

Personal information retained in electronic form is stored on Canpotex’s internal servers and/or with its service providers. Personal information retained in physical form is stored on Canpotex’s premises and/or with its service providers.

As noted above, Canpotex and/or Canpotex’s service providers may, among other things, store and/or process personal information outside of Canada, including in the United States and other jurisdictions. When information is stored or processed outside of Canada, it may be subject to the laws of and be accessible by legal and regulatory authorities in such other jurisdictions. Canpotex has taken appropriate technical, organizational, and legal steps to secure this information.

Canpotex and/or Canpotex’s service providers may use certain cloud-based services to, among other things, process and/or store information.

CERTAIN LIMITATIONS

This Policy does not create or confer upon any individual any rights, or impose upon Canpotex any obligations, outside of, or in addition to, any rights or obligations imposed by the privacy laws applicable to such individual’s personal information. Should there be, in a specific case, any inconsistency between this Policy and such privacy laws, this Policy shall be interpreted, in respect of that case, to give effect to, and to comply with, such privacy laws. This Policy has a limited scope and application, and the rights and obligations contained in this Policy may not be available to all individuals or in all jurisdictions.
 

Without limiting the scope of the preceding paragraph, an individual’s right to access, rectify or delete the personal information that Canpotex holds about the individual is not absolute. There are instances where applicable law or regulatory requirements allow or require Canpotex to refuse the request. In addition, the personal information may have been destroyed, erased or made anonymous in accordance with applicable law and Canpotex’s record retention obligations and practices.

CONTACT CANPOTEX

For further information about Canpotex’s privacy practices, to make a request for access to personal information, to correct or update personal information, or to seek to exercise any other rights outlined in this Policy, please contact Canpotex’s Privacy Officer (Data Protection Officer) at privacy.officer@canpotex.com.

CHANGES TO POLICY

Canpotex reserves the right to change this Policy at any time in accordance with applicable law. Please check our website for updates to this Policy.

LGPD INFORMATION FOR RESIDENTS OF BRAZIL

The LGPD sets out obligations and rights with respect to the personal data of residents of Brazil. Canpotex is committed to ensuring that it complies with the requirements of the LGPD. As such, this section outlines additional information relevant to residents of Brazil only. Please see the remainder of this Policy for more information on our privacy practices.

For the purposes of the LGPD, Canpotex Brasil Escritório de Representação Ltda. (“Canpotex Brasil”) is considered the data controller in respect of all personal data of residents of Brazil that is collected, used or disclosed by or on behalf of Canpotex.

Your Rights Relating to Your Personal Data (Brazil)

Subject to some exceptions, the LGPD provides you with the following rights:

a. Right of confirmation: You have the right to confirm the existence of the processing of your data.

b. Right of access: You have the right to information about whether and why we process your personal data and related information (for example, what personal data we are processing).

c. Right to correction: You have the right to correct any inaccurate or incomplete personal data that we hold about you.

d. Right to anonymization or erasure: You have the right to ask us to anonymize, block or delete unnecessary or excessive personal data we have collected about you or that we have processed in noncompliance with the LGPD.

e. Right to data portability: You have the right to ask us for a copy of personal data we hold about you and to transfer such data to another entity.

f. Right to deletion: You have the right to ask us to delete your personal data, except where we have a legal right to store your data.

g. Right to information: You have the right to request information about other entities we have shared your personal data with or information about your right to deny consent and the consequences of such denial.

h. Right to revoke consent: You have the right to revoke your consent to the processing of your personal data at any time.

i. Right to complain: We encourage you to contact us at the contact information below if you have any questions or concerns with our personal data practices. However, you also have the right to complain to regulatory authorities in your jurisdiction. Please contact us at the contact information above under the heading “CONTACT CANPOTEX” if you need information about the appropriate authority.

j. Right to opposition: When the legal basis for processing is not consent, you may object to the processing of your personal data if you believe that such processing is contrary to a particular aspect of applicable Brazilian law.

k. Right to review decisions: When applicable, you have the right to request a review of decisions made solely on the basis of automated processing of your personal data affecting your interests.

You may exercise these rights or find out more about these rights by contacting Canpotex at the contact information listed above under the heading “CONTACT CANPOTEX”.

Certain Matters Concerning Retention (Brazil)

Without limiting the scope of Canpotex’s retention rights in respect of personal information described elsewhere in this Policy, Canpotex may retain personal information of an individual following cessation of the relationship with that individual (or the individual’s respective organization) (a) for any one or more of the establishment, exercise or defence of potential claims to the extent permitted or required by applicable law or regulatory requirements, or (b) where otherwise permitted or required by applicable law or regulatory requirements.

Processing Activities Related to Candidates (Brazil)

When an individual resident in Brazil applies for a position at Canpotex Brasil (a “Candidate”), the following personal data may also be collected, among other information:

  • identification data, such as name, marital status, photo, identity card, CPF, nationality, citizenship, voting card, PIS (Contribution to the Social Plan), military discharge certificate, work permits, professional identity;
  • personal information, such as date and birthplace, emergency contact information and gender;
  • contact data, such as home address, home telephone, mobile and personal email address;
  • career information, such as curriculum, graduation, post-graduation, master, doctorate, applicable training courses and sessions, spoken languages, courses, technical skills and competences, articles and publications, involvement in associations;
  • professional experience information, such as previous position, title, previous employers, management level, work time, usual working day, job tracking, department, type of position and responsibilities, supervisor name, attributions, start and end date of each previous job, reasons for leaving, employment history (including previous jobs titles and employers, and reasons for leaving), and management letters;
  • salary and benefits information, such as base salary, bonus, commissions and compensation plans, increase values, benefits such as health and life insurance, vehicle and pension/retirement plan, payment date and information about deductions;
  • information about intended career, such as intended position, intended salary, how the Candidate applied for the position;
  • notes during interviews, as well as any other data that the Candidate voluntarily discloses during any interview or during the recruitment process; and
  • sensitive personal data, such as health information, which may include data concerning disability.

Such personal data may be collected:

  • through the information the Candidate submits in the application, such as through their curriculum,
  • through the information the Candidate provides in interviews or voluntarily,
  • through recruitment consultants hired by Canpotex to assist in selection processes, or
  • through public sources.

Such personal data may be shared with Canpotex’s service providers that assist Canpotex on recruitment processes.

The Candidate is under no obligation to send Canpotex any information. However, depending on the type of information and the intended position, Canpotex may not be able to proceed with the recruitment process without assessing all necessary information.

Canpotex may collect and use the Candidate’s personal data for the following purposes:

  • recruiting activities, such as to approach the individual as a Candidate, either through Canpotex’s staff or through consultants hired to provide recruiting services, for interviews, tests consistent with the position, if applicable, and other recruiting considerations;
  • for planning and managing human resources, including for sizing Canpotex’s teams appropriately;
  • for company investment decisions;
  • for planning and managing the competencies and skills of Canpotex’s employees and potential employees;
  • for analyzing applications received in various forms;
  • for organizing the hiring process;
  • to make job offers to a Candidate;
  • to be able to consider applicants for future opportunities; and
  • to comply with the law and to defend and exercise the rights of Canpotex and third parties, if necessary.

During the recruitment process, the sensitive personal data will only be collected for the purpose of recruiting for a specific position intended for people with disabilities, or if any additional steps need to be taken in Canpotex to enable eventual hiring. We request that Candidates do not include sensitive personal data in their resumes except in the cases mentioned herein.

PIPL INFORMATION FOR RESIDENTS OF MAINLAND CHINA

The PIPL sets out obligations and rights with respect to the personal information of residents of mainland China. Canpotex is committed to ensuring that it complies with the requirements of the PIPL. As such, this section outlines additional information relevant to residents of mainland China only. Please see the remainder of this Policy for more information on our privacy practices.

Legal Basis for Processing Personal Information (Mainland China)

Pursuant to the PIPL, we may process personal data if one of the following options applies:

  • Relevant data subject has given prior consent to processing of the subject’s personal data for one or more specific purposes;
  • Processing is necessary for compliance with any statutory duties or legal obligations;
  • Processing is necessary in order to, in an emergency, protect the lives, health or property of natural persons;
  • The personal data has been made public by the data subject concerned or has otherwise been lawfully made public, the processing is done pursuant to the PIPL and the extent of the processing is reasonable;
  • Processing is done in other circumstances provided for in applicable law or administrative regulations.

Your Rights Relating to Your Personal Data (China)

a. Right of access and copy: An individual may request access to and make a copy of the individual’s personal information. Canpotex will provide appropriate access to the personal information requested. A written explanation will be provided if the requested access is not granted.

b. Right to explanation: You have the right to require us to explain our rules of processing of personal information.

c. Right to rectification: An individual may request in writing that Canpotex correct an error or omission in personal information. If Canpotex is satisfied that a correction should be made, it will amend the information as requested.

d. Right to erasure: You have the right to ask Canpotex to erase the personal information (to the extent required by law) Canpotex has collected about you or that Canpotex has processed in noncompliance with the PIPL, other applicable data protection laws and regulations, this Policy, or the agreement on data collection between you and Canpotex. In any event, Canpotex may still process your personal information where the processing is necessary for performing the contract to which you are a party or necessary in order to perform our statutory duty or legal obligation. You agree to provide Canpotex a written explanation prior to exercising this right.

e. Right to transfer: You have the right to ask Canpotex for a copy of personal information Canpotex holds about you and to transfer such data to another entity. We will review your request, and if such request meets the requirements under relevant provisions formulated by the relevant authority, we will duly provide you with the channel for the transfer.

f. Right to withdraw your consent: You have the right to revoke your consent to the processing of your personal information at any time with future effect. Such a withdrawal will not affect the lawfulness of the processing that has been conducted prior to the consent withdrawal or processing based on other legal basis. You need to provide Canpotex a written explanation prior to exercising this right.

g. Other rights permitted by the applicable law.

You may exercise these rights or find out more about these rights by contacting Canpotex at the contact information set forth above under the heading “CONTACT CANPOTEX”.

Sharing and Cross-border Transfer of Personal Information (China)

We may share your personal information with third parties as specified in this Policy. You may contact us as specified above under the heading “CONTACT CANPOTEX” to obtain information regarding the third-party recipients who act in the capacity of data controllers. Such sharing will always be conducted to the extent necessary and will not exceed or alter the purposes and means of processing that you have originally consented to or based on a non-consent legal basis. By contacting us or dealing with us, you will be deemed as having consented to our sharing of your personal information to recipients as described above in accordance with this Policy (and specific policies, procedures and practices, if any).

You understand that we may transfer the personal information we collect about you to recipients in countries or regions other than mainland China. When we conduct international transfers of personal information, we will always ensure to comply with requirements stipulated under applicable law. By contacting us or dealing with us, you will be deemed as having consented to our cross-border sharing of your personal information to recipients in countries or regions other than mainland China in accordance with this Policy (and specific policies, procedures and practices, if any).