This privacy policy is adopted in full from the policy published at cpkcr.com/en/privacy-policy, without content modifications.

 

Introduction

Canadian Pacific Kansas City and each of its subsidiaries (collectively, “CPKC”) are committed to maintaining the accuracy, confidentiality and security of your personal information. This Privacy Policy explains our privacy practices, as well as the choices you can make about the way your personal information is collected, used and disclosed by CPKC.

For the purposes of this Privacy Policy, “personal information” means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an individual or household.

 

Scope

It is CPKC’s policy to comply with the privacy legislation in each of the jurisdictions in which we operate.  Sometimes the privacy legislation and/or an individual’s right to privacy are different from one jurisdiction to another.  This Privacy Policy covers only those activities that are subject to the provisions of federal and provincial privacy laws in Canada, the United States and Mexico, as applicable.  Consequently, the rights and obligations contained in this Privacy Policy may not be available to all individuals or in all jurisdictions.  For greater certainty, this Privacy Policy does not vary or amend any contractual obligations that may otherwise be specifically set out in an agreement with CPKC.

Please note that we have adopted a series of policies in order to, among other things, address the specific privacy concerns of certain groupings of individuals.  This Privacy Policy applies to how we collect, use and disclose the personal information of our customers, suppliers and other third parties with whom we interact.  We have developed other documents that describe our privacy policies and practices with respect to our employees.

If you are unsure if or how this Privacy Policy applies to you or have questions about this Privacy Policy (including how we may collect, use and disclose your personal information), please contact our Chief Privacy Officer at [email protected].

 

What Personal Information Do We Collect?

Generally

We collect and maintain different types of personal information in respect of the individuals with whom we interact.  This may include, for example, your name, gender, age, work information, financial information, mailing address, phone number, and e-mail address.   We may also collect market-related information, which may include personal information, concerning share ownership, market trends and activities impacting our business.  This information may include contract terms, financial information and other information for the purpose of market analysis and strategic planning.  We may also collect information related to our media, investor and public relations activities.

CPKC is a transcontinental railway in North America with direct links to major ports.  As such, CPKC may also collect personal information from individuals participating in and / or impacted by these activities. CPKC is a transcontinental railway in North America with direct links to major ports. As such, CPKC may also collect personal information from individuals participating in and / or impacted by these activities relating to our railway operations, such as contractors, business partners, and suppliers.

As described in further detail below, we may utilize the services of third parties and may also receive personal information collected by those third parties in the course of the performance of their services for us or otherwise.

 

Our Websites

We may collect information related to your visit to our websites, including, for example, the IP address and domain used to access our websites, any page within our websites that is viewed by that IP address, the website you came from to access one of our websites, the amount of time that you visited a particular webpage, the type and version of your browser, and what country you are from.  To the extent applicable, we may also collect your login credentials (e.g., user name, password, account number, etc.).

In connection with the foregoing, we may place a “cookie” on the hard drive of your computer to track your visit.  The cookie allows our websites to identify you and to record your preferences.  The cookie allows us to track your visit to our websites so that we can understand your use of our websites so that we can tailor the websites to better meet your needs.  Most web browsers are set to accept cookies.  However, on most web browsers you may change this setting to have your web browser either: (i) notify you prior to a website placing a cookie on your hard drive so that you can decide whether or not to accept the cookie; or (ii) automatically prevent the placing of a cookie on your hard drive.  It should be noted that if cookies are not accepted, you may not be able to access a number of webpages found on our websites.

 

Third-Party Analytics Services and Online Tracking

We also use third-party web analytics services, such as those of Google Analytics. These third-party analytics providers use automated technologies such as cookies, web server logs and web beacons to evaluate use of the website. To learn more about Google Analytics and how to opt out, please visit  https://support.google.com/analytics/answer/9019185hl=en&ref_topic=2919631#zippy=%2Cin-this-article or https://support.google.com/analytics/answer/181881?hl=en.

This is not meant to suggest that all individuals visiting our equipment, facilities or property will in fact be monitored or their actions subject to surveillance.  Rather, it is meant to bring to your attention that such monitoring may occur and may result in the collection of personal information from you (including your image, likeness or voice).

 

Why Do We Collect Personal Information? 

CPKC collects personal information to enable us to manage, maintain, and develop our operations and conduct our business, including, for example:

• To be able to provide our products and services;

• To be able to review the products and services that we provide to you so that we may: (i) understand your requirements for our products and services; and (ii) work to improve our products and services;

• To send you promotional and other marketing materials that we think might be of interest to you;

• To respond to your inquiries, and comply with your requests;

• To enable us to undertake our environmental as well as occupational health and safety activities, including incident planning, response and investigation, and managing claims;

• To verify your identity and authority;

• To analyze and monitor our websites’ performance and other related purposes (e.g. determine the popularity of certain online content, better understand your online activity, and assists us in improving our online presence);

• To protect CPKC against error, fraud, theft, and damage to our property;

• To enable us to comply with applicable laws or regulations; and

• Any other reasonable purpose to which you consent.

 

How Do We Use and Disclose Your Personal Information?

We may use and disclose your personal information:

• For the purposes described in this Privacy Policy;

• As permitted or required by applicable laws or regulatory requirements; and
• For any additional purposes for which we have obtained your consent to the use or disclosure of your personal information.

We may also use or disclose your personal information without your knowledge or consent where we are permitted or required by applicable law or regulatory requirements to do so.

When Do We Disclose Your Personal Information?

We may share your personal information with our employees, contractors, consultants, and other third parties who require such information for the purpose of providing certain services to us. 

For example, we may share your personal information from time to time with our third-party marketing, payment processing, information technology, or other service providers so that we may operate our business.

In addition, your personal information may be disclosed or transferred to another party during the course of the grant of a security interest in CPKC’s assets, or the sale of, all or a part of CPKC through, for example, an asset or share sale, or some other form of business combination, merger or joint venture, bankruptcy or restructuring, provided that such party is bound by appropriate agreements or obligations and required to use or disclose your personal information in a manner consistent with the use and disclosure provisions of this Privacy Policy, unless you consent otherwise.

Finally, your personal information may be disclosed:

• As permitted or required by applicable law or regulatory requirements;

• To comply with valid legal processes such as search warrants, subpoenas or court orders;

• As part of CPKC’s reporting activities to its affiliates;

• To protect the rights and property of CPKC or any third party;

• During emergency situations or where necessary to protect the safety of a person or group of persons; or
• With your consent.
  

   

Location of Your Personal Information

We are an international organization and have offices throughout Canada, the United States and Mexico. We also use third-party service providers who may have operations in each of these jurisdictions.  As a result, your personal information may potentially be: (i) collected, used, processed, transferred, stored and/or disclosed in any province, territory or state in any of the foregoing countries; and (ii) accessible to the law enforcement and national security authorities of those jurisdictions.

 

Your Consent Is Important to Us

It is important to us that we collect, use or disclose your personal information where we have your consent to do so.  Depending on the circumstances (including the sensitivity of the personal information), your consent may be implied, deemed (using an opt-out mechanism) or express.  Express consent can be given orally, electronically or in writing.  Implied consent is consent that can reasonably be inferred from your action or inaction.

Typically, we will seek your consent at the time that we collect your personal information.  In certain circumstances, your consent may be obtained after collection but prior to our use or disclosure of your personal information.  If we plan to use or disclose your personal information for a purpose not previously identified (either in this Privacy Policy or separately), we will endeavor to advise you of that purpose before such use or disclosure.

 

Exceptions to Consent 

We may collect, or use disclose your personal information without your knowledge or consent where we are permitted or required to do so by applicable law or regulatory requirements.  For example, we may (to the extent permitted under applicable law) collect or use your personal information without your knowledge or consent under the following circumstances:

Business Activity

We may collect or use your personal information without your knowledge or consent if:

(i) we engage in one of the following activities;

(ii) a reasonable person would expect such a collection or use for that activity; and (iii) the personal information is not collected or used for the purpose of influencing your behaviour or decisions:

(a) an activity that is necessary to provide or deliver a product or service that you have requested from CPKC;

(b) an activity that is carried out in the exercise of due diligence to prevent or reduce CPKC’s commercial risk;

(c) an activity that is necessary for our information, system or network security;

(d) an activity that is necessary for the safety of a product or service that CPKC provides or delivers;

(e) an activity in the course of which obtaining your consent would be impracticable because we do not have a direct relationship with you; and

(f) any other activity prescribed under applicable laws.

 

Legitimate Interest

We may collect or use your personal information without your knowledge or consent if the collection or use is made for the purpose of an activity in which we have a legitimate interest that outweighs any potential adverse effect on you resulting from that collection or use and

(a) a reasonable person would expect the collection or use for such an activity; and

(b) the personal information is not collected or used for the purpose of influencing your behaviour or decisions.

 

Transfer to Service Provider

As above, we may transfer your personal information to any of our service providers.

 

Special Provisions (Mexico)

For residents of the United Mexican States needing to understand the treatment of their personal information, know that your personal information will not be transferred to any third party without your consent, except in the cases provided by Article 37 of the Federal Law on the Protection of Personal Information in the Possession of Civil Parties (Ley Federal de Protección de Datos Personales en Posesión de Particulares), and except when the personal information is transferred to Kansas City Southern de México, S.A. de C.V., Nafta Rail, S.A. de C.V., Arrendadora KCSM, S. de R.L. de C.V., Vamos a Mexico, S.A. de C.V., Servicios Puerta México, S. de R.L. de C.V., CPKC or any other subsidiary, affiliate, or member of CPKC. Your consent will be understood if you do not express your objection to your personal information being transferred. As used in this paragraph, “treatment”—gathering, use, access, handling, transfer or transmission, release, or storage—of your “personal information” have those meaning that such terms are given in this Privacy Policy and/or as defined in the Ley Federal de Protección de Datos Personales en Posesión de Particulares (Federal Law on the Protection of Personal Information in the Possession of Civil Parties), published in the Official Federal Gazette on July 5, 2010, as amended.

 

De-identification of Personal Information

We may use your personal information without your knowledge or consent to de-identify or anonymize the information.

 

Research and Development

We may use your personal information without your knowledge or consent in connection with our internal research and development purposes, if the information is de-identified before it is used.

 

Prospective and Actual Business Transaction

Providing that various legal requirements are met: (i) we may use and disclose your personal information without your knowledge or consent to determine whether to proceed with a particular transaction, and if the determination is made to proceed with the transaction, to complete it; and (ii) if the business transaction is completed, we may use and disclose your personal information if the information is necessary for carrying on the business or activity that was the object of the transaction.

 

Additional Activities

We may disclose your personal information to another organization without your knowledge or consent if the disclosure is reasonable for the purposes of detecting or suppressing fraud or of preventing fraud that is likely to be committed and it is reasonable to expect that the disclosure with your knowledge or consent would compromise the ability to prevent, detect or suppress the fraud.In addition, we may disclose an individual’s personal information without your knowledge or consent for the purpose of collecting a debt owed by you to us.Please note that this list is intended to provide you with some example of the circumstances in which we may collect, use or disclose your personal information – there may be other circumstances in which we may do so to the extent permitted by applicable laws.

 

Choice/Opt-Out

You may change or withdraw your consent at any time, subject to legal or contractual obligations and reasonable notice, by contacting our Chief Privacy Officer using the contact information set out below.  All communications with respect to such withdrawal or variation of consent should be in writing and addressed to our Chief Privacy Officer.  In certain circumstances, the withdrawal of consent may render us unable to continue to provide products or services where the collection, use or disclosure of your personal information is necessary to provide the product or service.We assume that, unless you advise us otherwise, you have consented to the collection, use and disclosure of your personal information as explained in this Privacy Policy.

 

How Is Your Personal Information Protected?

CPKC endeavors to maintain physical, technical and procedural safeguards that are appropriate to the sensitivity of the personal information in question.  These safeguards are designed to prevent your personal information from loss and unauthorized access, collection, use, disclosure, copying, modification, disposal or destruction.  Unfortunately, we cannot guarantee complete security: for example, (i) unauthorized access use, or disclosure, (ii) hardware or software failure, and (iii) other events may compromise the security of your personal information at any time.The security of your personal information is important to us, please advise our Chief Privacy Officer immediately of any incident involving the loss of or unauthorized access to or disclosure of personal information that is in our custody or control.

 

Updating Your Personal Information

It is important that the information contained in our records is both accurate and current.  If your personal information happens to change during the course of our relationship, please keep us informed of such changes. In some circumstances, we may not agree with your request to change your personal information and will instead append an alternative text to the record in question.

 

Access to and Disposal of Your Personal Information

You can ask us whether we have any personal information about you.  If we have any of your personal information, you can ask us how we use that information and whether we have disclosed the information.  You can also ask to see this personal information, or have such information disposed.  To do so, please contact our Chief Privacy Officer.  Any such request must be in writing.

When making any of the requests described above, we may request specific information from you to enable us to (i) confirm your identity and your right to make the request; as well as (ii) search for and provide you with the information that you seek.  To the extent permitted by law, we may charge you a fee to attend to your request; however, we will advise you of any fee in advance.  If you require assistance in preparing your request, please contact our Chief Privacy Officer.

Your rights, as described under this section of our Privacy Policy, are not absolute.  There are instances where applicable law or regulatory requirements allow or require us to refuse to provide some or all of the personal information that we hold about you.  In addition, the personal information may have been destroyed, erased or made anonymous in accordance with our record retention obligations and practices.  Similarly, there are instances where applicable law or regulatory requirements allow or require us to refuse to dispose of your personal information.  In the event that we cannot satisfy your request to access or dispose of your personal information, we will endeavor to inform you of the reasons why, subject to any legal or regulatory restrictions.

 

Special Provisions for Residents of United Mexican States (“ARCO Rights”):

Pursuant and subject to the Ley Federal de Protección de Datos Personales en Posesión de Particulares (Federal Law on the Protection of Personal Information in the Possession of Civil Parties), published in the Official Federal Gazette on July 5, 2010, as amended (“the Law”), you have certain “ARCO Rights” if you are a resident of the United Mexican States, which rights are as follows:

• ACCESS – Access your Personal Information in our possession and know the details of the Treatment of your Personal Information;
• RECTIFY – Rectify your Personal Information in the event such information is inaccurate or incomplete;
• CANCEL – Have CPKC cancel or delete your Personal Information when you believe this information is not necessary for any of the purposes laid out in this Privacy Policy or is being used for purposes for which you have not given your consent; and
• OBJECT – Object to the treatment of your Personal Information for specific purposes, which you are required to express clearly.

For the purposes of the Law, “personal information” means any information concerning an identified or identifiable natural person whose personal information is protected by the Law. The Law considers a person to be “identifiable” when his or her identity can be determined directly or indirectly from the personal information at issue.

 

Mechanisms for Exercising ARCO Rights:

The ARCO Rights described previously are exercised by presenting the respective request in writing and in Spanish, free of charge, as described in this Privacy Policy in the sections below entitled Inquiries or concerns? and Chief Privacy Officer. We will respond within 20 (twenty) days of receiving your request to access, rectify, cancel, or object. This with the understanding that—under Article 3, section VII of the Law—the terms and times given in this Privacy Policy will be counted in business days. In addition, we hereby inform you that the Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (Federal Institute for Transparency, Access to Information and the Protection of Personal Information) is responsible for protecting your ARCO rights and regulates and verifies compliance with the Law.

 

Inquiries or concerns? 

If you have any questions about this Privacy Policy or concerns about how we manage your personal information, please contact our Chief Privacy Officer by telephone, in writing or by e-mail.  We will endeavor to answer your questions and advise you of any steps taken to address the issues raised by you.  If you are dissatisfied with our response, you may be entitled to make a written submission to the federal Office of the Privacy Commissioner of Canada or the Privacy Commissioner in your jurisdiction.

Further, if you are a resident of the United Mexican States and you have inquiries regarding how to exercise any of the potentially applicable rights outlined herein, remove or change your contact information in our database, or opt out of receiving future mailings or other communications from us (e.g., promotions, offers, or services), as well as for all other inquiries, please contact us at any time using the option below:

Via email to [email protected]; by conventional mail sent to: Montes Urales No. 625, Colonia Lomas de Chapultepec, Alcaldía Miguel Hidalgo, C.P. 11000, Ciudad de México, to the attention of “Department of Personal Information”; or By phone to (+52) 9178-5645.

 

Chief Privacy Officer

We have appointed a Chief Privacy Officer to oversee compliance with this Privacy Policy.  The contact information for our Chief Privacy Officer is as follows:

Canadian Pacific Kansas City 
Building 1, 7550 Ogden Dale Road S.E.
Calgary, Alberta
T2C 4X9
Canada
1-888-333-6370
Attention: Chief Privacy Officer
E-mail: [email protected]

 

Revisions to this Privacy Policy

CPKC from time to time, may make changes to this Privacy Policy to reflect changes in its legal or regulatory obligations or in the manner in which we deal with your personal information.  We will post any revised version of this Privacy Policy on our website, and we encourage you to refer back to it on a regular basis.  This Privacy Policy was last updated on October 24, 2024.

 

Interpretation of this Privacy Policy

Any interpretation associated with this Privacy Policy will be made by our Chief Privacy Officer.  This Privacy Policy includes examples but is not intended to be restricted in its application to such examples; therefore, where the word “including” is used, it shall mean “including without limitation”.This Privacy Policy does not create or confer upon any individual any rights, or impose upon CPKC any rights or obligations outside of, or in addition to, any rights or obligations imposed by federal, state, and provincial privacy laws, as applicable.  Should there be, in a specific case, any inconsistency between this Privacy Policy and any applicable federal, state, and provincial privacy laws, this Privacy Policy shall be interpreted, in respect of that case, to give effect to, and comply with, such privacy laws.