ONTARIO PETROLEUM INSTITUTE

The Privacy Policy
of
The Ontario Petroleum Institute

Approved by the Board of Directors

Introduction

Protecting your privacy and the confidentiality of your information -- over the Internet, on the telephone, or through our offices – has always been fundamental to the way we do business at the Ontario Petroleum Institute. We operate on the basis of a Privacy Policy and related procedures that guide the handling of the personal information we collect. We have created this privacy statement in order to demonstrate our firm commitment to protecting the privacy of our members, partners and potential Web site visitors. This policy and related procedures are consistent with the Canadian Standards Association Model Code for the Protection of Personal Information (herein "CSA Model Code") and applicable privacy legislation.

Privacy Statement

This policy deals only with personal information handled by the Ontario Petroleum Institute. Personal information is information about an identifiable individual, excluding business contact information. The following explains how the Ontario Petroleum Institute handles personal information. The Ontario Petroleum Institute reserves the right to change this policy and it may be updated periodically. These changes may affect our use of your personal information. Accordingly, please check for changes regularly.

Accountability

The Ontario Petroleum Institute (herein called "O.P.I.]") is accountable for all personal information under its control. O.P.I.'s privacy officer is the Executive Director, Joe Van Overberghe, who is designated as responsible for O.P.I.'s privacy policy. The privacy officer can be reached by:

• telephone: 519-680-1620

• fax: 519-680-1621

• mail: Ontario Petroleum Institute Suite 104 , 555 Southdale Road East London , Ontario N6E 1A2 Joe Van Overberghe, Executive Director

Any questions about O.P.I.'s handling of personal information should be directed to the privacy officer. All requests should be made in writing. Please see below for more information about the process for referring questions about O.P.I.'s handling of personal information.

Purpose of Personal Information

The purpose for which O.P.I. collects personal information will be identified at or before the time the information is collected. O.P.I. may collect personal information for the purposes of:

• administering Institute membership and providing member services;

• registering for Institute events, for example the Annual General Meeting;

• purchasing various Institute products or services including document certification; and

• processing and administering the above or other purposes as necessary.

O.P.I. will not use personal information for any other purpose than identified at or before the time of collection.

Consent

O.P.I. seeks consent for all personal information we collect, use and disclose through information provided to individuals prior to collection, or at the time of collection.

If you have voluntarily provided information, you have consented to the collection, use and disclosure of your personally identifiable information as described in this privacy policy. As required by the CSA Model Code , O.P.I. will not use personal information for any purpose other than that for which you consented. Should O.P.I. require personal information for a new purpose, we will contact you to seek consent for that new use.

Limits for Collecting, Using, Disclosing and Keeping Personal Information

O.P.I. does not collect, use or disclose personal information of individuals except when individuals give consent and provide the information on a voluntary basis. There may be occasions where more specific personal information is necessary for us to proceed with a request for information, or provide you with a product or service. In such cases, we will provide you with a description on the information we need. In all cases, O.P.I. limits the amount and type of information collected to only the personal information that is required to provide the individual with the requested information, product, or service. We collect only information that is voluntarily provided by you and undertake that such information will be kept strictly confidential.

We retain personal information only as long as is necessary to provide the individual with the requested product, service or information and delete or destroy this information after that time. (i.e. if personal information is given to enable you to register for an event, the personal information will only be used for this event and will then be deleted or destroyed.) In some cases, however, legal reporting and retention requirements necessitate that O.P.I. retains information for a specific amount of time. In general, O.P.I. retains information for a period not longer than two years.

O.P.I. does not sell or trade any personal information with third parties. O.P.I. may transfer information to service providers where information processing is outsourced by O.P.I. in the course of its administrative procedures or member services in specific cases. Where personal information is transferred to a service provider for processing, we require the service provider to respect this Privacy Policy and we restrict them from using or disclosing personal information transferred to them for any purpose other than the provision of services to us. Any personal information that O.P.I. retains is kept in such a manner as to ensure its security and confidentiality at all times.

Safeguarding Personal Information

O.P.I. respects the privacy of our members, partners, potential website visitors and internet users and will protect that privacy as vigorously as possible. We store personal information in electronic and physical files that are secure. Our security measures include: secure locks on filing cabinets, and using industry standard techniques such as firewalls, encryption, intrusion detection and restricted access to records and to equipment, including computers. Unfortunately, no data transmission over the Internet can be guaranteed to be 100% secure. As a result, while we strive to protect your personal information, we cannot ensure or warrant the security of any information you transmit to us or receive from us electronically. This is especially true for information you transmit to us via e-mail. We have no way of protecting that information until it reaches us. Once we receive your transmission, we make our best efforts to ensure its security on our servers.

Accuracy of and Access to Personal Information Collected

O.P.I. makes every effort to keep personal information as accurate, complete, current and relevant as necessary for the identified purposes. O.P.I. does not routinely update personal information.

O.P.I. makes readily available to individuals our Privacy Policy and related procedures for managing personal information. We provide access to the Privacy Policy and related procedures to individuals on O.P.I.'s Web site and/or in written form. Any questions about the handling of personal information by O.P.I. can be raised with our privacy officer.

At the written request of an individual, he or she may view or edit their personal information as collected by O.P.I.. O.P.I. will inform them of what personal information we have about the individual, what it is being used for and, in cases where it has been disclosed, to whom it has been disclosed. There may be exceptional circumstances as provided by the CSA Model Code under which O.P.I. may not be able to give an individual access to the personal information about her or him held by O.P.I.. In this case O.P.I. will explain the reason for this lack of access, as provided by the CSA Model Code .

To make a request, please: "send a letter, email or fax, addressed to our Privacy Officer at the address indicated above". In your request, please include the following information:

"Name, contact details, the nature of your request, including whether you wish to view and/or edit information or inquire regarding use and/or disclosure".

O.P.I. will reply to your request in no later than thirty days after receipt of the request, or if we are not able to respond within this time period, we will send you a notice of extension. If we are not able to disclose all the personal information we hold on you, we will give you a reason for our inability to do so, unless prohibited by law.

Questions

Any questions or comments about the Ontario Petroleum Institute's handling of personal information should be directed to our privacy officer.