Privacy policy
This privacy policy ("Policy") applies to Metro's activities in Quebec, Ontario, and New Brunswick, including activities on the Sites (as defined below) and any loyalty or reward program offered by Metro or one of its partners.
This Policy applies to Metro Inc, its divisions, subsidiaries and affiliates ("Metro"), including:
● Metro Richelieu Inc.
● Metro Ontario Inc.
● Adonis Group Inc.
● Phoenicia Group Inc.
● Première Moisson Group Inc.
● Metro Ontario Pharmacies Limited
● The Jean Coutu Group (PJC) Inc.
● McMahon Distributeur pharmaceutique Inc.
● Pro Doc Ltée
● RX Information Centre Ltd.
● RX Centre Development Inc.
This Policy applies to Personal Information that Metro, or its suppliers on Metro’s behalf, collect, use, or disclose about its Customers.
This Policy applies to Customers who provide us with Personal Information when: (i) they visit one of our Sites; (ii) they register, or have already registered, for one of our programs, promotions, surveys or contests; (iii) they voluntarily register for a specific service, including any e-commerce service.
This Policy applies to the management of Personal Information in verbal, written or electronic form.
The purpose of this Policy is to inform Customers about how Metro collects, uses, discloses, retains and protects their Personal Information.
The term "Policy" also includes the following privacy notices:
● Privacy notice – Loyalty programs
● Privacy notice – Pharmaceutical activities
● Privacy notice – Cookies
This Policy should be read in conjunction with the terms of use of the Sites and, where applicable, with the E-commerce terms of use of the Sites.
Please note that additional privacy notices or terms may apply to the ways in which Metro collects and manages your Personal Information when you participate in certain of our programs, promotions, contests, surveys or events or purchase certain of our products or services. In such cases, such notices (including those set forth above) or terms shall apply in addition to this Policy.
When used in this Policy, the terms set forth below shall have the following meanings:
“Chief Privacy Officer” means one or more individual or individuals at Metro who are in charge of ensuring compliance with and application of this Policy and of applicable privacy laws.
"Customer" means an individual who: (i) buys or orders products or services from an Establishment or on a Site; (ii) is a patient requiring pharmaceutical or health care services from a pharmaceutical establishment affiliated with Metro; (iii) corresponds with Metro; (iv) participates in an survey or promotional contest organized by Metro; (v) is a member of a loyalty program offered by Metro; (vi) uses an application or an online service; or (vii) accesses any other customer service offered by Metro.
"Collection" means the act of collecting, acquiring, or obtaining Personal Information in any way or by any means whatsoever, including from a Third Party.
"Consent" means a willingly given agreement to the Collection, Use or Disclosure of Personal Information for the purposes specified by Metro. Consent may be express or implied and may be given directly by the Customer or by an authorized representative. Express Consent may be given orally, electronically or in writing. However, it must always be clear, free, informed and be given for specific purposes. Implied Consent is Consent that may reasonably be inferred from an act or omission on the part of a person.
"Disclosure" means the act of revealing or communicating Personal Information to a Third Party.
"Establishment(s)" means a food store, a pharmaceutical establishment or a retail bakery and pastry store under any banner of Metro.
"Personal Information" means any information that relates to a natural person and allows, directly or indirectly, that person to be identified, including but not limited to names, mailing addresses, email addresses, date of birth, credit information, membership numbers for Metro programs or applications. Personal Information also includes Personal Health Information.
"Personal Health Information" means any information that allows, directly or indirectly, the identification of a Customer and that concerns in particular (i) the Customer's physical or mental health, including the Customer's medical and family history; (ii) any health services offered to the Customer, including the nature of these services, the results, the places where they were offered and the identity of the persons who offered them; (iii) any other information relating to the Customer's health-related services and care, including information relating to public or private insurance coverage as well as information relating to the Customer's registration for health services and their payment, and to (iv) any other characteristic of or relating to the Customer that may be determined to be personal health information by any law or regulation of the applicable government authorities.
"Site(s)" means all websites, including transactional sites, social media, mobile applications, and other platforms belonging to Metro.
"Third Party" means a person other than a Customer, Metro, or an agent of Metro.
"Use" means the processing, handling and management of Personal Information by Metro.
In the course of its interactions with its Customers, Metro collects certain Personal Information about them from various sources, including:
- Directly with Customers;
- From its Sites;
- From other sources;
- Through various technologies
In the course of our interactions with our Customers, Metro collects certain Personal Information about them from a variety of sources, including:
Directly from Customers: Customers may provide us with Personal Information at an Establishment, by mail, e-mail, telephone, through our Sites or in any other direct manner.
From our Sites: Metro may electronically collect certain Personal Information about Customers when they browse our Sites or online services. This information may be collected through cookies or directly on our Sites.
For more information about the cookies Metro uses, please consult the Privacy Notice - Cookies.
From other sources: Depending on the situation, Metro may receive Personal Information from other sources, including credit bureaus or other agencies or service providers, including health and social services, as necessary to process the Customer's request. In such cases, Metro will only receive Personal Information with the Customer's consent or as required or permitted by law.
By various technologies used: Metro may collect Personal Information through various types of technologies used in our Establishments, such as video surveillance systems to help protect the safety of our Customers and Third Parties, as well as the security of our Establishments. Metro may also use other similar types of technologies, from time to time, including anonymous video analysis, which allows Metro to collect certain information to determine the number of people in the Establishments and to examine, on an anonymous basis, certain demographic information about its clientele. In addition, please note that phone calls handled by Metro's consumer service department may be recorded and monitored for quality control purposes.
Metro identifies the purposes for which Personal Information is collected prior to the Collection and limits the Collection to that which is necessary for the purposes identified.
The purposes for which Personal Information is collected are clearly described before Customers consent to subscribe to any program or service or as permitted by law.
Metro shall use its best efforts, as part of any Collection, to inform any Customer, verbally or in writing, of the purposes of the said Collection of Personal Information. The persons collecting the Personal Information shall explain, upon request, the purposes of the Collection or refer the Customer to the appropriate department for an answer.
When Customers register, use or operate the Sites, loyalty programs and services offered by Metro, Metro collects Personal Information for the following purposes, among others:
- Programs, products and services offering;
- Management of business activities;
- Communications with Customers
- Surveys and contests;
- Market research.
During registration, Use or activities of Customers on the Sites, loyalty programs and services offered by Metro, Metro collects Personal Information for the following purposes, among others:
- enable registration and participation in programs, applications, Sites, services, activities, promotional contests, surveys, online purchasing and newsletters offered by Metro or any loyalty program offered by Metro or one of its partners;
- enable the rewards, special offers and targeted promotions to be available to Customers; the organization of promotional activities and communication with winners of promotional contests;
- to enable product design, improvement and merchandising, the improvement of the Establishment’s offering (including through marketing studies and surveys, where relevant) or on the Sites;
- allow Customers to personalize their visit on the Sites in accordance with their preferences and to offer personalized services, products, promotions and advertising tailored to Customer’s shopping habits;
- send Customers advertisements, promotions and offers by mail or any other means permitted by law;
- process Customer requests and manage Customers' online orders;
- verify the identity of members of any loyalty program or to access the Sites;
- establish and maintain business relations with Customers and ensure services are provided;
- understand Customers' needs and preferences;
- recommend particular products and services to Customers that meet Customer needs;
- design, improve, market or provide products and services that meet Customers' needs;
- operate its business;
- meet the requirements of all applicable legislation and fulfill its legal and regulatory obligations;
- handle complaints;
- respond to Customer requests for products and services and requests for information;
- communicate with Customers in connection with services, newsletters, programs and contests to which Customers subscribe or enroll;
- ensure the safety of Customers, Establishment employees and Third Parties; and/or
- provide customers with pharmaceutical services and health care through our network pharmacies. For more information on this subject, please consult the Privacy Notice - Pharmaceutical Activities.
Metro uses and discloses Personal Information for the purposes identified at the time of Collection or as permitted or required by applicable law.
Metro does not use or disclose Personal Information for purposes other than those for which it was collected, except with the Customer's consent or as permitted by law.
Subject to any legal provisions to that effect, Metro may not use or disclose Personal Information it collects about a Customer for a new purpose without first identifying and recording said purpose and obtaining the Consent of the concerned Customer.
The law allows Metro to use Personal Information for a purpose other than that collected without the consent of the person concerned in the following cases:
- when it is used for purposes consistent with the purposes for which it was collected;
- when it is clearly used for the benefit of the person concerned;
- when its use is necessary for the purpose of preventing or detecting fraud or of assessing and improving protection and security measures;
- when its use is necessary for the purpose of providing or delivering a product or providing a service requested by the person concerned;
- when its use is necessary for study or research purposes, or for the production of statistics and the information is de-identified.
As a general rule, Metro will obtain the Customer's Consent at the time of Collection of the Customer Personal Information, subject to exceptions provided by law.
Metro will make reasonable efforts to ensure that the Customer is duly advised, when consenting to the Collection of Personal Information, of the purposes for which Personal Information will be used or disclosed. These purposes will be stated clearly so that the Customer can understand them.
For the purposes of this Policy, the purchase of products or the use of services, the Sites as well as the subscription to any loyalty program offered by Metro or its partners, constitute implicit Consent to the Collection, Use and Disclosure of relevant Personal Information, for the purposes identified by Metro.
When the Customer submits Personal Information to Metro, through a Site, by telephone, e-mail, in person or by any other means, the Customer consents to the Collection, Disclosure and Use of Personal Information in accordance with the terms of this Policy.
Metro may, at any time, avail itself of any applicable legislative provisions that exempt it from informing or obtaining the Consent of the persons affected by the Collection, Use or Disclosure.
For example, in accordance with the law, Metro may collect Personal Information about a Customer from a Third Party, without the Customer's knowledge or consent, if there is a serious and legitimate reason and either of the following conditions is fulfilled:
- Personal Information is collected in the interest of the Customer and cannot be collected from the Customer at the time;
- Collection from a Third Party is necessary to ensure the accuracy of the Personal Information; or
- in any other exceptional case provided for by law.
Customers may access and rectify their Personal Information and withdraw their Consent at any time and reasonable notice, subject to legal or contractual restrictions. The Customer may contact Metro to obtain further information on the consequences of such withdrawal at the coordinates indicated in the "Questions, comments and complaints" section.
A withdrawal of Consent may affect the optimization or availability of certain services and programs offered by Metro.
Metro does not sell the Personal Information from their Customers to any person or organization.
In certain cases, Metro may disclose and communicate Personal Information about a Customer to another Metro entity, to Third Parties or to certain of its services providers and partners, without the Customer's knowledge or consent, where permitted by law.
For example, when permitted by law, Metro may disclose and communicate, when necessary, Personal Information about a Customer, without the Customer's Consent:
- to certain of our service providers (IT services, cloud computing solutions or platforms, marketing, data hosting, data processing, analysis and research, printing, professional consulting and others) and to some partners of our programs to which Customers have subscribed, when the communication of Personal Information is necessary for carrying out a mandate or performing a contract of enterprise or of services that Metro entrusted to that person or organization;
- to a person who, in Metro's reasonable judgment, is requesting the Personal Information as the Customers’s lawyer, representative or agent;
- to a person or body responsible, by law, for the prevention, detecting or repression of crime or statutory offence who requires it in the performance of their duties, if the Personal Information is needed for the prosecution of an offence under an applicable law;
- a person to whom the Personal Information must be communicated by reason of the urgency of a situation that threatens the life, health or safety of the Customer;
- to protect an identifiable person or group of persons when there is reasonable cause to believe that there is a serious risk of death or serious injury to that person or group, including disappearance, violence or attempted suicide, and the nature of the threat generates a sense of urgency;
- to the other party to a commercial transaction when the Disclosure of Personal Information is necessary for the conclusion of that transaction;
- to a person or organization wishing to use Personal Information for study, research purposes or for the production of statistics, in compliance with legal requirements;
- to one or more Third Parties, where Disclosure is required by law;
- in any other exceptional case provided for by law.
To the extent that Metro discloses Personal Information to service providers, Metro uses contractual means and other measures to ensure the provision of an adequate level of protection while Personal Information is being stored, handled, or processed by these external providers.
Under these contractual agreements, third-party service providers are required to use Personal Information about a Customer only for carrying out their mandate or performing the contract and not to keep the Personal Information after a reasonable period of time following the expiration of their mandate or contract and to protect Personal Information from unauthorized access, Collection, Use or Disclosure. In addition, Service Providers are not authorized to disclose Customer Personal Information to others except as permitted by law.
Metro will take reasonable steps to protect Personal Information from loss or theft, unauthorized access, Disclosure, copying, Use, modification, destruction or other breach of security.
Only persons authorized by Metro and whose duties so require have access to Personal Information, and then only for a specific purpose. All persons authorized by Metro who have access to Personal Information must respect the confidentiality of said information.
Metro understands the importance of protecting Personal Information and uses security protocols to safeguard Personal Information collected via the Internet. However, Customers must remember that the Internet is not a secure means of communication.
Consequently, Metro makes no representations or warranties as to the absolute security of Personal Information provided to Metro via the Internet. Customers acknowledge that they provide Personal Information to Metro via the Internet at their own risk.
Metro retains Personal Information only as long as necessary for fulfill the purposes for which it was collected or as required by law to ensure compliance with its legal and regulatory obligations.
In the event of a request for access to the Personal Information under this Policy, Metro will retain certain Personal Information and the reasons for the decision for a period of time sufficient to allow the Customer to access such Personal Information or reasons.
Metro has established controls, schedules and practices for the retention, destruction, de-identification or anonymization of Personal Information when it is no longer needed for the identified purposes or required by law.
As permitted by law, Metro reserves the right to (i) destroy Personal Information; or (ii) anonymize Personal Information to use it for serious and legitimate purposes. Personal Information shall be anonymized according to generally accepted practices and according to the criteria and terms determined by laws and regulations.
As a general rule, Personal Information is stored by Metro in Canada.
In some cases, Personal Information collected by Metro may be disclosed, communicated, stored or processed outside Quebec and Canada for the purpose of providing services and may therefore be subject to the jurisdiction of those countries. In such cases, Metro ensures that the necessary safeguards and contractual agreements are in place to protect Customer Personal Information.
Metro shall make readily available to individuals specific information about its management of Personal Information.
Metro shall facilitate the understanding of this Policy namely by making the following information available upon request:
- the name of the Chief Privacy Officer, whose contact information is provided below;
- the procedure to follow in order to access Personal Information; and
- a description of the type of Personal Information held by Metro, including a general account of its use.
Metro has developed various directives and practices for the Policy’s effective application, including:
- implementing procedures designed to protect Personal Information and ensure compliance with this Policy, particularly with regard to retention, destruction, information security and data governance;
- implementing procedures for receiving and handling inquiries and complaints;
- implementing privacy impact assessment and the prevention of and potential response to privacy incidents.
- providing information and training to the employees of Metro regarding the protection of Personal Information.
Accuracy of Personal Information and rectification
The Personal Information used by Metro must be as accurate, complete and up-to-date as possible in order to minimize the possibility that incorrect Personal Information may be used.
Metro shall update Personal Information only as required to fulfill the identified purposes or after receiving an update request from the Customer.
The Customer is responsible for updating his or her Personal Information by contacting Metro as soon as reasonably possible after any change.
The Customer shall be entitled to contest the accuracy and completeness of the Personal Information and request that any necessary corrections be made.
Upon being advised of Personal Information that is deemed to be inaccurate or incomplete, Metro shall promptly correct or complete any Personal Information. Any disagreement as to the accuracy or completeness of Personal Information shall be recorded in the Customer's file.
Right of access
Upon request, Metro shall provide the Customer with access to the Personal Information that Metro holds about the Customer. Personal Information must be provided or made accessible in a timely fashion, in a form that is understandable, and at a reasonable cost to the Customer.
In certain circumstances, in accordance with the law, Metro may refuse, in whole or in part, a Customer’s request for access to his or her Personal Information.
In certain circumstances, in accordance with the law, Metro may refuse, in whole or in part, a Customer’s request for access to all his or her Personal Information, particularly if :
- it might result in serious harm to the Customer's health, as provided by law;
- the disclosure of the Personal Information would be likely to hinder an inquiry the purpose of which is the prevention, detection or repression of crime or statutory offence or to affect judicial proceedings;
- it might reveal Personal Information about a Third Party or the existence of such Personal Information and Disclosure may seriously harm that Third Party, unless the Third Party consents to the Disclosure of the information or in the case of an emergency that threatens the life, health or safety of the Customer;
- the Disclosure of such Personal Information would reveal confidential or strategic Metro commercial proprietary information;
- the Personal information is protected by professional privilege;
- the Personal Information was obtained in a dispute resolution process; or
- the Personal Information was obtained in the course of actual or potential litigation or in the course of an investigation regarding a breach of contract or a violation of law.
Upon request, Metro shall provide the reasons for denying access to Personal Information.
Upon request, Metro shall inform the Customer of the Use and Disclosure of Personal Information and, when available, the source of the information.
Before responding to a request for access to Personal Information, Metro may require the Customer to submit a written request, accompanied by a proof of identity and the payment of a reasonable sum to cover the costs before responding to such a request.
A Customer may obtain all or part of his or her Personal Information by contacting the Chief Privacy Officer as set forth in the Section "Questions, Comments and Complaints" of this Policy.
Decision based on automated processing
Under applicable laws, other than the rights mentioned above, the Customer may have the right to be informed of a decision based exclusively on automated processing of Personal Information, i.e. a decision that has been made without any human intervention; for example, an algorithm.
Metro does not use Personal Information to render a decision about Customers based exclusively on the automated processing of such information. If Metro decides to use such automated processing, Metro will comply with law with respect to informing the Customer that such a decision has been rendered. Upon request, Metro will comply with the law with respect to informing the Customer concerned by such a decision of the Personal Information used to render the decision, the reasons and the principal factors and parameters that led to the decision, and the right of Customer to have the Personal Information used to render the decision corrected. To exercise these rights, the Customer must submit a request in writing to the Chief Privacy Officer, as set forth in the Section "Questions, comments and complaints" of this Policy.
Metro is responsible for Personal Information in its possession or custody, including Personal Information entrusted to a Third Party for processing.
Metro senior management has delegated the management of the privacy program to the Chief Privacy Officer.
The Chief Privacy Officer is responsible for ensuring compliance with and application of this Policy and providing any Customer with the necessary support in the event of a question, complaint or request relating to the protection of Personal Information.
Other Metro employees may also be assigned to support the Chief Privacy Officer or to handle the day-to-day Collection, Use or Disclosure and processing of Personal Information.
All comments, questions, concerns or complaints regarding your Personal Information, this Policy or our privacy practices should be addressed to the Chief Privacy Officer at:
Activities in Quebec and New Brunswick:
by mail:
Metro Inc. and its affiliates
Attention: Chief Privacy Officer
1055
de la Pinière Boulevard West
Terrebonne, Quebec
J6Y 0J5
-or-
by e-mail: rprp@metro.ca
Activities in Ontario:
by mail:
Metro Inc. and its affiliates
Attention: Chief Privacy Officer
5559
Dundas Street West
Etobicoke, Ontario
M9B 1B9
-or-
by e-mail: privacy@metro.ca
The Chief Privacy Officer is responsible for the application of this Policy and may, at his or her sole discretion, seek advice from any person, before providing a final response to any complaint.
Metro shall review all complaints regarding compliance with this Policy. If a complaint is found to be justified, Metro shall take appropriate measures, including, if necessary and where reasonable, amending this Policy and its practices. The Customer shall be informed of the steps taken regarding the complaint.
The Chief Privacy Officer will attempt to respond to each written requests from Customers within thirty (30) days after receipt of such requests. If the Chief Privacy Officer cannot meet the request within this time limit, the Chief Privacy Officer will provide the Customer with a revised timeline that is required in the circumstances.
If the Chief Privacy Officer is unable to respond satisfactorily to the Customer's request, a mediation process may be an option to settle the dispute. Mediation is a form of dispute resolution. If the parties decide to pursue the mediation, the parties will refer the dispute to a mediator who would assist them to find a mutually acceptable solution.
If the Customer remains unsatisfied, the Customer may bring the matter to the attention of the Commission d'accès à l'information du Québec if the Customer is a resident of Quebec or to the Office of the Privacy Commissioner of Canada if the Customer is a resident of Ontario or New Brunswick.
This Policy does not apply to other third-party websites that may be accessed through links on the Site.
Metro is not responsible for the content, access and privacy practices of other Internet sites not owned or controlled by Metro but that are accessible from Metro Sites through links or hyperlinks. The use of these third-party websites is subject to the terms and conditions of such websites.
Therefore, any Personal Information transmitted by a Customer through these sites is subject to the privacy policies of those sites. It is the Customer's responsibility to read their policies to ensure the protection of his or her Personal Information.
This Policy may be modified at any time at Metro's sole discretion without prior notice. Any changes will be effective upon posting of the revised version on this web page. The reference to "effective date" at the end of this Policy indicates the date on which it was last updated.
Effective date: September 22, 2023