TELUS Business Customer Privacy Policy

Introduction

Definitions

Scope and application

Accountability

Consent

Collection and use

• To establish and maintain a responsible commercial relationship with Customers and to provide ongoing service;

• To understand Customer and End-user needs and preferences;

• To develop, enhance, promote or provide products and services to our Customers;

• To manage and develop our business and operations, including the diagnosis of technical problems or for improved functionality, and to maintain and enhance safety and security for our Customers;

• To meet contractual, legal, and regulatory requirements;

• To investigate and resolve incidents, and End-user and Customer complaints or disputes; and

• For the provision of products and services on behalf of Customers (in compliance with contractual obligations), including for billing purposes.

Disclosures and transfers for processing

Retention

Accuracy

Safeguards

• Implementing a Secure by Design methodology in our work processes, where applicable.

• Restricting and securing access to TELUS’ applications, operating systems and network platforms through the use of access controls, unique username and passwords and two factor authentication, thereby ensuring access only to authorized TELUS representatives.

• Protecting data through networking and web application firewalls, as well as intrusion detection and intrusion prevention systems.

• Employing technologies such as tokenization, de-identification, industry-standard encryption for data at rest and in transit and other mechanisms to protect Personal Information, as applicable.

• Utilizing endpoint security software that scans sensitive application files and file systems for malware and taking appropriate action in response.

• Monitoring networks and applications for security incidents and regularly testing incident response plans.

• Maintaining a business continuity and contingency plan applicable to our operations, reviewed and updated annually to address any material deficiencies.

• Regularly testing our safeguards and our overall security program.

• Developing a governance structure that promotes and values privacy and that enables TELUS team members to make the right decisions about how to respect privacy when handling Customer Personal Information.

• Requiring secure disposal of any media containing Customer Personal Information.

• Prohibiting the use of Customer Personal Information in non-production or demonstration environments except with the express consent of the Customer or as otherwise required or permitted by law.

• Limiting access to Customer Personal Information to a need-to-know basis and applying the principles of least privilege and role-based access control.

• Identifying and assessing reasonably foreseeable risks to the integrity, confidentiality or availability of Customer Personal Information that we hold and taking reasonable steps to mitigate those risks through the implementation of safeguards.

• Collecting, using and disclosing Customer Personal Information to fulfill the Services purchased by the Customer and as requested or instructed by the Customer.

• Requiring all TELUS employees and subcontractors to:

  • put privacy first when handling Customer Personal Information;

  • receive mandatory training that outlines their obligations to protect Customer privacy;

  • learn about TELUS’ Privacy Management Program, which documents TELUS’ key commitments to protecting the privacy of TELUS customers, and sets out some of the ways that TELUS has operationalized those commitments and the organizational structure TELUS has implemented in order to do so;

  • comply with TELUS’ corporate security policies that address authorization, access control, privileges, monitoring, terminating and revoking access to TELUS’ applications and associated IT infrastructure and network platforms; and

  • sign employment agreements that include contractual provisions for the safeguarding and proper usage of confidential information (including Customer Personal Information) accessible to our employees in the course of their employment, and taking appropriate disciplinary measures where necessary.

  • Protecting Customer Personal Information shared with service providers by employing contractual or other means in an effort to ensure that any such service provider will provide a comparable level of protection while Customer Personal Information is being processed by that service provider.

• TELUS’ facilities are secured and meet industry standards and certifications.

• Access to high-security areas is restricted and TELUS representatives wear badges and must either scan the badge or enter access codes for entry.

• Visitors must register prior to entry and/or be escorted at all times when at TELUS production data centres and facilities.

• These data centres are housed in non-descript facilities with access strictly controlled both at the perimeter and at building ingress points by professional security staff using video surveillance, intrusion detection systems, and other electronic means.

• TELUS data centres employ automatic fire detection and suppression equipment that utilizes smoke detection sensors in all data centre environments, mechanical and electrical infrastructure spaces, chiller rooms and generator equipment rooms.

• The data centre electrical power systems are designed to be fully redundant and maintainable without impact to operations, 24 hours a day, and seven days a week.

• Uninterruptible Power Supply (UPS) units provide back-up power in the event of an electrical failure for critical and essential loads in the facility. Data centres use generators to provide back-up power for the entire facility.

• Data centres are conditioned to maintain atmospheric conditions at optimal levels. TELUS representatives and systems monitor and control temperature and humidity at appropriate levels.

Openness concerning policies and practices

Individual access

Incident management

Contacting us