Global Privacy Notice

Holding ourselves to the highest standards of integrity

We are firmly committed to your privacy.

Our Global Privacy Notice

At RBC, we are dedicated to protecting your privacy and safeguarding the personal information you have entrusted to us.

We strive to earn the right to be our clients’ first choice, and we hold ourselves to the highest standards to build trust. Our privacy management practices, including RBC’s Code of Conduct, are based on these values and comply with applicable laws and regulations.

The following commitments apply to all our dealings with our prospective, current, and former clients. This notice forms part of each RBC product or service agreement and if there is a conflict between them, this notice governs.

Accountability and Privacy By Design

At RBC, we are dedicated to protecting the personal information entrusted to us. That commitment is fundamental to the way we do business and is reflected in our privacy policies and practices. RBC has a Global Privacy Office led by our Chief Privacy Officer, which is responsible for overall privacy governance. Privacy Officers around the globe support businesses, functions, and regions with expert advice and all our employees receive mandatory privacy and security training.

Contact Details

If you have questions regarding privacy, there are different ways for you to contact us:

If you need to escalate a privacy complaint, you may escalate to the RBC Chief Privacy Officer:

Office of the RBC Chief Privacy Officer

PO Box 7500, Station A

Toronto, ON M5W 1P9

General Questions: for questions regarding general privacy or security matters, including to learn more about our use of automated processing.

Make a Complaint: if you have problems, concerns or wish to provide us with your general feedback.

For UK and European Union residents and citizens, if you need to contact RBC’s Data Protection Officer, please email: DPO@rbc.com

If you have concerns with how we handle your personal information, you have the right to contact the privacy/data protection regulator in your country. In Canada, please contact the Office of the Privacy Commission of Canada.

For privacy/data protection regulators in the United Kingdom, the European Union, and the Asia Pacific region, please contact:

Data Protection Authorities - UK and EU
United Kingdom and European Union
France	Commission Nationale de l'Informatique et des Libertés - CNIL
Germany	Die Bundesbeauftragte für den Datenschutz und die Informationsfreiheit
Guernsey	Office of the Data Protection Authority
Ireland	Data Protection Commissioner
Italy	Garante per la protezione dei dati personali
Jersey	Office of the Information Commissioner
Netherlands	Autoriteit Persoonsgegevens
Spain	Agencia de Protección de Datos
Switzerland	Eidg. Datenschutz- und Öffentlichkeitsbeauftragter
United Kingdom	Information Commissioner's Office (ICO)

Data Protection Authorities - APAC
Asia Pacific
Australia	Office of the Australian Information Commissioner (OAIC)
Malaysia	The Department of Personal Data Protection (JPDP)
Hong Kong	Office of the Privacy Commissioner for Personal Data - PCPD
Singapore	Personal Data Protection Commission Singapore- PDPC

California Residents

The California Consumer Privacy Act of 2018 (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”), affords Consumers residing in California certain rights with respect to their Personal Information. If you are an individual California Consumer interacting with RBC you can refer to the relevant Privacy Notices below:

City National Bank California Privacy Notice
RBC Bank California Privacy Notice
RBC Capital Markets, LLC Privacy Policy

What information we collect

Most of the information we collect is collected when you interact directly with us, for example when you:

apply for a product or service;
communicate, interact, transact with or through us; or
sign up for special offers, enter a contest or complete a survey.

We also collect financial and other information about you from a variety of other sources including:

credit bureaus;
references you have provided to us; and
other financial institutions.

We may also collect personal information about you from third parties in accordance with their respective terms and conditions and privacy policies. Examples of third parties that may share personal information with us may include third party verification services; commercially available sources such as research firms and mailing list providers; publicly available sources such as internet news and social media sites, and government agencies, registries, or public records.

The categories of personal information we collect depend on the products and services you have with us, and your use of RBC’s websites, applications, and channels. Over the past 12 months and on an ongoing basis as needed, the information we may collect includes:

Name, address, telephone numbers, title, email address, date of birth, tax identification number, account numbers, credit card numbers, debit card number, passport number, driver’s license or province/state identification card number, insurance policy number, device information (e.g., device model, browser type, IP address, security cookie and approximate physical location of device), knowledge-based information (e.g., username, password, and account information)
Information pertaining to business clients will include financial status and details on the owners, management, and directors.

Records of personal property, products or services purchased, obtained, or considered, or purchasing and other activities;
Information related to transactions arising from your relationship with and through us, and from other financial institutions, including point of sale details; and
Information you provide on an application for our products and services, such as your annual income, investments, account balance, financial liabilities, transaction history.

Fingerprint, signature, voiceprint, video surveillance, photo/video self-footage (i.e., “selfies”).

Browsing history, search history, information regarding your interaction with a web site, mobile applications, application, or advertisements on RBC owned properties.

Information about the approximate physical location of your device to provide a location-dependent service such as to allow you to locate a nearby ATM or RBC branch or, with consent, to inform you of nearby offers; to validate user identity; and to prevent, detect or suppress crime or financial abuse.

Occupation, education, place of employment, employment history, titles or positions with government entities, employers, or companies you own, salary or self-employment income.

Information you provide during conversations or other communications with us which may include family details, health records, life events, goals and your opinions and issues you may have encountered.
Additional information may be requested to help us determine your eligibility for products and services that we offer.
We only use your personal information if we have a legal basis to do so. This includes sharing the information among and outside of RBC companies. We may use your personal information:
- with your consent;
- to fulfil a contract we have with you to provide products or services covered by your account agreement;
- to verify your identity and investigate your personal background, as permitted by law;
- for legitimate business purposes; as permitted by law;
- to manage risks and operations;
- to comply with legal and regulatory obligations;
- for the purposes of preventing and detecting fraud and suppression of financial abuse;
- to establish, exercise or defend legal claims or proceedings;
- to protect client and employee safety, and to protect against theft and property damage in and around physical premises.

We do not sell personal information and have not sold personal information in the past 12 months.

Sensitive information such as health records will never, under any circumstances, be shared or used for a purpose other than that of your original intent.

We also create reports containing statistics, rules, and data insights, as well as analysis and predictive models, based on information about you and other current, former, and prospective clients. The reports contain aggregated and de-identified information, not personal information, and cannot be used to identify you or any other individual. The reports may be used for business purposes such as market and product analysis, analyzing credit risk and product development and enhancement.

How we use your information

We may use your personal information:

for the purposes communicated to you at the time of collection or in your agreement(s) with us and in this notice, to verify your identity and to authenticate you when you contact us;
to provide you with the products and services requested;
to ensure we can act on your instructions (e.g., by recording phone conversations, maintaining records of email communications and in-person conversations)
to communicate to you any benefit, feature or other information about products and services you have with us;
to better understand your financial situation and offer financial advice;

to operate the payment card network;
to assess and determine your eligibility for products and services, using your credit bureau and other information;
to manage our risks and operations;
to prevent and detect fraud and suppress financial abuse;
to help us understand the interests of our current and prospective clients and to improve our products and services; and
to meet legal and regulatory requirements

If we have your tax identification number (such as social insurance number or social security number), and you hold a product generating income, we may use it for tax related purposes and share it with the appropriate government agencies. We may also share it with credit bureaus as an aid to identify you; you may request that we do not use tax identification number for this purpose. For more information, go to: Your Choice.

We may communicate with you through various channels including telephone, email, text, post or through mobile applications using the contact information you have provided.
We may wish to send you information on other products and services we offer and of third parties we select that may benefit you. We will only send you information on products and services in accordance with the choices you have made.
If you deal with multiple RBC companies, for example banking, insurance, and investment providers, we may, where not prohibited by law, consolidate all information to better manage our relationship with you.
We may also use automated processing to make decisions about you, including credit and loan adjudication, where applicable.

Under certain circumstances, your personal information including some or all the categories of information set out under What Information We Collect is shared and may have been shared among RBC companies, outside service providers or third parties in the past 12 months.

RBC Companies

Sharing your personal information among RBC companies may be necessary to provide you with the financial products and services you have requested. Sharing can also allow us to help you achieve your financial goals, as part of building and maintaining a knowledgeable advice-based relationship with you. We may also share this information to better understand your financial needs and to identify products and services we believe may benefit you.

Your personal information is only shared according to your choice. If you prefer that we not share your information among RBC companies, or if you do not wish to receive special offers and promotions, kindly let us know by following the instructions in Your Choice.

If you choose not to have your information shared, you will not be refused credit or other services for that decision. We will respect your choice and may advise other RBC companies of your preference for the sole purpose of honouring your choice.

We share your information among RBC companies for the purposes outlined in How We Use Your Information.

RBC Employees

Your personal information will be accessed by RBC employees and RBC contingent workers who have a legitimate business purpose for using it.

Unauthorized access, use and disclosure of information by an employee or contingent worker of RBC is strictly prohibited. All employees and contingent workers are required to maintain the confidentiality of client information at all times and failing to do so will result in appropriate disciplinary measures, which may include dismissal.

Outside Service Providers

We may share personal information with service providers we use to perform specialized services on our behalf including financial services, data processing, data analytics and research, marketing, and operational activities. They are provided only the information necessary to perform the services. In addition, we require them to protect the information in accordance with applicable law and in a manner that is consistent with our privacy policies, security practices and RBC’s Supplier Code of Conduct.

Other Third Parties

We will only share your information with other third parties as permitted or required by law:

to comply with laws, regulations, subpoena, or court order;
to respond to valid and authorized information requests from domestic and international authorities;
to prevent and detect fraud and suppress financial abuse, and
to protect the personal safety of employees, clients or other third parties on RBC property.

We also share aggregated information in the form of insights, trends or analytics that do not identify you with outside service providers and other third parties to use for their own benefit. These purposes include products and services improvement, and supporting business development, for example by creating sales performance insights and supporting development of customer demographic and behavioral insights. We also share aggregated information with third parties for benchmarking, understanding, and forecasting spending patterns and macroeconomic trend analysis.

Jurisdictions to Which We Transfer Your Information

Your personal information may be transmitted through, stored, or processed in countries, states, or provinces other than where you are based, in which case the information is bound by the laws of those jurisdictions and may be disclosed in accordance with those laws. We will take measures to protect your personal information with appropriate contract clauses or other applicable safeguards. Countries where your personal information may be transmitted, stored, or processed may include, but are not limited to:

Canada
United States of America
European Union member states
United Kingdom
India
China
Singapore
Malaysia

Keeping Your Information Safe

Protecting your personal information is fundamental to the way we do business. It is critical that we ensure the information we have about you is accurate and complete. As we make decisions based on the information we have, we encourage you to help us keep your information current.

We keep your personal information for as long as required to comply with all business, legal and regulatory record keeping requirements and aligned with our internal policies and retention schedules. When your personal information is no longer required, we have policies in place that require the information to be purged or destroyed. This commitment extends to our online services and any new technologies we employ.