California Consumer Privacy Act (CCPA) Notice at Collection of Personal Information and Privacy Policy

Last Updated: May 2025

 Download privacy notice (PDF, 175 KB) Opens a new window.

Scope of this policy

This Privacy Policy applies to the personal information of California residents collected by CIBC (“individuals”), including the personal information collected when you visit our website or use our mobile application. This Privacy Policy does not apply to the personal information of individuals in their capacity as employees or prospective employees.

For purposes of this Privacy Policy, “personal information” means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked to, directly or indirectly, an individual. However, personal information does not include:

  • Information publicly available from government records or made publicly available by you or with your permission;
  • Deidentified or aggregated information;
  • Information excluded from the scope of the California Consumer Privacy Act (CCPA), such as protected health information covered by the Health Insurance Portability and Accountability Act or the Health Information Technology for Economic and Clinical Health Act, medical information covered by California Confidentiality of Medical Information Act, or personal information covered by certain sector-specific privacy laws such as the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, or the California Financial Information Privacy Act.

California notice at Collection

CIBC collects the personal information identified in the section titled “What we collect and how we collect it,” for the purposes identified in the section titled “How we use and retain your information,” and retains it for the period described in that same section. We do not sell your personal information or disclose it for cross-context behavioral advertising (“sharing”). We also do not collect or process sensitive personal information for the purpose of inferring characteristics about you.

California residents — Your privacy rights

The categories of personal information we collect depend on the products or services you have with us and your use of CIBC websites and services. Over the past 12 months we have collected, and may continue to collect on an ongoing basis, the following categories of information:

Category Examples
Identifiers  A real name, alias, email, telephone number, residential or business address, mailing address, unique identifiers for customer service and data analysis 
Characteristics of Protected Classifications Under California or Federal Law Age, marital status, gender
Professional or employment-related information Current or past job history 
Internet or other similar network activity Browsing history, cookie information
Commercial information  Records of personal property, products or services purchased or obtained, or considered, or other purchasing or consuming histories or tendencies 
Correspondence Records related to correspondence sent and received by CIBC regarding financial services
Inferences drawn from other personal information Profile reflecting a person’s preferences, characteristics 
Geolocation  To help serve the appropriate CIBC website or provide suggestions based on physical location
Audio, electronic, visual or similar information Call recordings to support customer service, images on building and ATM security cameras



 Category Examples
Government issued identification numbers  A consumer’s Social Security Number or Social Insurance Number, driver’s license, state or provincial identification card or passport number, including any details such as issue and expiry dates and personal address 
Financial information A consumer’s account log-in, financial account, debit card or credit card number combined with any required security or access code, password or credentials allowing access to an account. Financial account information includes background checks, financial institution account number, banking details, financial transaction history, credit history, credit bureau, insurance claim history, customer purchase history, audit reports, budgets and unreleased financial results, vendor agreements, or any other financial information
Citizenship and immigration status To ensure eligibility for commercial financial services and products and compliance with federal law
Precise location When enabled on your mobile application, to share location of the nearest ATM or ABM machines 
Protected characteristics Race, ethnicity, sex life or sexual orientation collected as part of inclusion and diversity initiatives, or as necessary to comply with applicable laws

CIBC may obtain the categories of personal information listed, both directly and indirectly:

  • Directly from you. For example, from forms you complete or products and services you purchase.
  • Indirectly from you. For example, from observing your actions on our website.
  • From business partners. For example, your employer or your employer’s service providers, such as payment initiation providers
  • From affiliated companies. For example, so that we can assist other companies in the CIBC family of companies in providing you with products or services.

How we use and retain your information

We may use the personal information we collect for one or more business purposes as follows:

  • To fulfill or meet the reason you gave the information. For example, if you provide your name and contact information to ask for a quote or ask a question about our products or services
  • To comply with capital markets trading or banking regulatory requirements
  • To provide, support, personalize and develop our website, products and services
  • To create, maintain, customize and secure your account with us
  • To process your requests, purchases, transactions and payments and prevent transactional fraud
  • To personalize your website experience and deliver content, product and service offerings relevant to your interests, including targeted offers and ads through our website, third-party sites and via email or text message (with your consent, where required by law)
  • To respond to law enforcement requests and, as required by applicable law, court order or government regulations
  • As we described to you when collecting your personal information or as otherwise permitted by law

We do not use or disclose sensitive personal information, as defined by California law, for inferring characteristics or for purposes other than those permitted by law. We keep personal information as long as it is necessary or relevant for the purposes for which it was collected. We also keep information as required by law or applicable regulations.

What we disclose and to whom

Over the past 12 months we have disclosed, and may continue to disclose on an ongoing basis, personal information to the following categories of third parties, for the following “business purposes” as that term is defined by California law:

  • CIBC may disclose to its service providers any of the categories of personal information listed in the section titled “What we collect and how we collect it,” for the business purpose of performing services on our behalf, and for the specific purposes described in the section titled “How we use and retain your information.”
  • CIBC may disclose the categories of personal information listed in the section titled “What we collect and how we collect it,” for the business purpose of auditing compliance with policies and applicable laws, in addition to performing services on our behalf.
  • CIBC may disclose any of the categories of personal information listed in the section titled “What we collect and how we collect it,” to other companies within the CIBC family of companies, for the business purposes of (a) auditing compliance with policies and applicable laws, (b) helping to ensure security and integrity, (c) debugging, (d) short-term transient use, (e) internal research, and (f) activities to maintain or improve the quality or safety of a service or device.

In addition, we have also disclosed over the past 12 months, and may continue to disclose, personal information to the following categories of third parties for purposes other than a “business purpose” as defined by California law:

  • We may disclose your personal information to third parties at your direction.
  • For example, to comply with financial reporting requirements, or to report unlawful activity to law enforcement.
  • We may disclose personal information to the public as part of a press release.
  • We will also disclose personal information if we think we have to in order to comply with the law or to protect ourselves. For example, we may disclose information in response to a court order or subpoena, or to a request made by a government agency or investigatory body, including U.S. and non-U.S. law enforcement or regulatory authorities.
  • We may disclose personal information when we believe disclosure is necessary to protect the rights, property, or safety of CIBC, individuals, or others.
  • As part of a merger, acquisition, or other sale or transfer of all or some of our assets, or as part of a bankruptcy or financing, we may disclose all categories of personal information.

How to exercise your rights

You can exercise your privacy rights under California law or ask for more information in two ways:

All requests must be verified prior to receiving a response. To verify a request, each request must include certain criteria:

  • Enough information that lets us reasonably confirm you're the person about whom we collected personal information or an authorized representative
  • Enough detail in your request that lets us properly understand, evaluate and respond to it

CIBC will search our existing information to confirm your identity or authority to make the request. Please note that for certain requests, we may ask you to provide us with a signed declaration under penalty of perjury affirming that you are the consumer whose personal information is the subject of the request. Information submitted for verification purposes will only be used to verify your identity and/or authority to make a request on another’s behalf.

If we cannot verify your request, we may deny the request Additionally, we will not honor your request where an exception applies, such as where the disclosure of personal information would adversely affect the rights and freedoms of another California resident or where the personal information that we maintain about you is not subject to the CCPA's access or deletion rights.

Upon submission of a request, you will receive an initial confirmation of receipt within 10 days. We will respond to your request within 45 days. If we need an extension for up to an additional 45 days in order to process your request, we will provide you with an explanation for the delay.

Under CCPA, you may only make a verifiable request for access twice within a 12-month period.

You may directly exercise these rights or designate an authorized agent to make a request on your behalf. If you are a minor under 16 years of age, your parent or guardian may make a verifiable request on your behalf.

Requests made on another person’s behalf can only be accepted upon receipt of documentation that the requestor is an authorized agent, parent, or legal guardian of the consumer whose information is being requested. This will require the submission of a valid Power of Attorney, Birth Certificate, Guardianship Order, or other court order granting authority to receive information, as appropriate.

Your California privacy rights

As a California resident, you have certain rights with respect to your personal information.

Subject to certain exceptions, you have the right to access what personal information CIBC has collected about you and our use of your personal information for the period during which we retain the personal information for business purposes. Once we receive and confirm your verifiable request, we’ll provide you with the following information:

  • The categories of personal information we collected about you
  • The categories of sources for the personal information we collected about you
  • Our business or commercial purpose for collecting that personal information
  • The categories of third parties with whom we share that personal information
  • The categories of third parties with whom we disclose that personal information
  • The specific pieces of personal information we collected about you
  • If we disclosed your personal information for a business purpose, we’ll provide a separate list of disclosures for a business purpose. We'll identify the personal information categories that each category of recipient received

You have the right to ask us to delete any of the personal information we collected from you and kept, with certain exceptions. Once we receive and confirm your verifiable request, we’ll delete your personal information from our records, unless there’s an exception. 

Subject to certain exceptions, you also have the right to ask us to correct any inaccurate personal information we collected from you and kept. Once we receive and confirm your verifiable request, we’ll correct your personal information within our records.

We will not discriminate or retaliate against you for exercising your privacy rights as described in this Policy.

Do not sell or share rights

CIBC doesn’t sell personal information, meaning under California law, we do not provide personal information to a third party for monetary or other valuable consideration. We do not sell personal information of minors under the age of 16. We also do not share personal information, meaning under California law, we do not provide personal information to third parties for cross-context behavioral advertising.

Other important information

We may change or update this Notice from time to time. When we do, we will post the revised Notice on this page with a new “Last Updated” date.

General questions

If you have questions, contact CIBC’s U.S. Client Support Center at 877 448 6500 Opens your phone app..

Start my privacy request  Opens in a dialog.

We can’t respond to your request or provide you with personal information if we can’t confirm your identity or authority to make the request and confirm the personal information as it relates to you. You don’t need to have an account with us to make a verifiable request.