Notice to California residents — Your privacy rights

Effective January 1, 2020
Last updated: January 6, 2020

Download privacy notice (PDF, 135 KB) Opens a new window in your browser.

About this privacy notice

This privacy notice to California residents applies solely to California residents. Under the California Consumer Privacy Act (CCPA), a California resident has the right to request access to, a copy of and/or deletion of their personal information that CIBC collects, uses or discloses in connection with CIBC business purposes, in the immediate past 12 months before the request, with certain exceptions. Personal information is defined as the information that identifies, relates to, describes, is capable of being associated with, or may reasonably be linked to, directly or indirectly, a particular consumer or household.

If personal information is collected directly from you, in some cases you may have the option to decline providing that information. In some circumstances, choosing not to provide personal information may mean that we can’t provide you with the same experience. However, as required by applicable law, we take reasonable measures to provide equal services and price regardless of the sharing of personal information. You have the right to not receive discriminatory treatment for exercising your privacy rights granted by the CCPA.

What we collect and how we collect it

We collect information that identifies, describes, references, relates to, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device (personal information). Specifically, CIBC, has collected these categories of personal information in the last 12 months:

 

Category Personal information examples
Identifiers  A real name, alias, unique personal identifier, etc. 
Customer information A name, age, marital status, telephone number, etc.
Sensitive information Social security number, passport number, driver’s license, gender, etc. 
Financial information Bank account number, credit card number, debit card number, background checks, financial institution account number, banking details, financial transaction history, credit history, insurance claim history, customer purchase history, audit reports, budgets and unreleased financial results, vendor agreements, or any other financial information
Geolocation data   Physical location 
Professional or employment-related information Current or past job history
Internet or other similar network activity Browsing history, cookie information, etc. 
Inferences drawn from other personal information  Profile reflecting a person’s preferences, characteristics, etc.
Commercial information Records of personal property, products or services purchased or obtained, or considered, or other purchasing or consuming histories or tendencies


Personal information covered by other privacy laws, like the Gramm-Leach-Bliley Act, is exempt under the CCPA. This means information collected, processed, sold or disclosed to provide you a financial service or product can't be included in this notice or considered when you make a CCPA individual rights request.

CIBC may obtain the categories of personal information listed, both directly and indirectly:

  • Directly from you. For example, from forms you complete or products and services you purchase.
  • Indirectly from you. For example, from observing your actions on our website.

How we use your information

We may use or share the personal information we collect for one or more business purposes:

  • To fulfill or meet the reason you gave the information. For example, if you share your name and contact information to ask for a quote or ask a question about our products or services
  • To provide, support, personalize and develop our website, products and services
  • To create, maintain, customize and secure your account with us
  • To process your requests, purchases, transactions and payments and prevent transactional fraud
  • To personalize your website experience and deliver content, product and service offerings relevant to your interests, including targeted offers and ads through our website, third-party sites and via email or text message (with your consent, where required by law)
  • To respond to law enforcement requests and, as required by applicable law, court order or government regulations
  • As we described to you when collecting your personal information or as otherwise stated in the CCPA

What we share

In the past 12 months, we have shared several categories of personal information with service providers for a business purpose:

  • Identifiers
  • Customer information
  • Sensitive information
  • Financial information
  • Geolocation data
  • Professional or employment-related information
  • Internet or other similar network activity
  • Inferences drawn from other personal information
  • Commercial information

Sale of personal information

CIBC doesn’t sell personal information.

Your California individual rights

Only you, or a person registered with the California Secretary of State you authorize to act on your behalf, may make a verifiable request related to your personal information. You may also make a verifiable request on behalf of your minor child under 16 years of age.

You may only make a verifiable request for access twice within a 12-month period. The verifiable request must include certain criteria:

  • Enough information that lets us reasonably confirm you're the person about whom we collected personal information or an authorized representative
  • Enough detail in your request that lets us properly understand, evaluate and respond to it

You have the right to request that CIBC reveal certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable request, we’ll share this information with you:

  • The categories of personal information we collected about you
  • The categories of sources for the personal information we collected about you
  • Our business or commercial purpose for collecting that personal information
  • The categories of third parties with whom we share that personal information
  • The specific pieces of personal information we collected about you
  • If we disclosed your personal information for a business purpose, we’ll provide a separate list of disclosures for a business purpose. We'll identify the personal information categories that each category of recipient received

You have the right to ask us to delete any of the personal information we collected from you and kept, with certain exceptions. Once we receive and confirm your verifiable request, we’ll delete your personal information from our records, unless there’s an exception. We'll ask our service providers to do the same.

How to exercise your rights

You can exercise your CCPA rights or ask for more information in 2 ways:

We can’t respond to your request or provide you with personal information if we can’t confirm your identity or authority to make the request and confirm the personal information relates to you. You don’t need to have an account with us to make a verifiable request.