For the purposes of this Policy, "Personal Information" means information, recorded in any form, about an identifiable individual (including, a home address and phone number, names of partners and spouses, a social insurance number or hobbies and interests). This does not include the name, title, business address or telephone number of an employee of an organization, when used for business communications. Also, Personal Information does not include anonymous or non-personal information (i.e., information that cannot be associated with or tracked back to a specific individual).

When a Team Member provides Pengrowth with Personal Information, the Team Member consents to Pengrowth's collection, use and possible disclosure of their Personal Information and agrees to the terms for accessing and correcting data described below.

The Policy governs Pengrowth's activities that are subject to the provisions of applicable privacy legislation, including Alberta's Personal Information Protection Act, the Personal Information and Protection of Electronic Documents Act and, where applicable, the federal Personal Information Protection and Electronic Documents Act.

We collect and maintain different types of Personal Information about individuals with whom we interact, including those who seek to be, are, or were employed by us, including:

• identification and contact information: such as a Team Member's name, home address, telephone, personal email address, date of birth, social insurance number, marital and dependent status, videos, photographs, and beneficiary and emergency contact information;
• employment information: such as a Team Member's job title, resumes and/or applications, interview notes, letters of offer and acceptance of employment, compensation and benefit information, background verification information, drivers' abstracts, employment references, mandatory policy acknowledgement sign-off sheets and evaluations;
• benefit information: such as forms relating to the application or change of employee health and welfare benefits, including but not limited to health care, life insurance, short and long term disability, medical and dental care;
• payroll and financial information: including but not limited to social insurance number, wages, pay cheque deposit information, GRRSP/ESP information and tax related information;
• business relationship and operations information: such as customer and vendor service requests, investor contact information and requests, agreement terms and preferences, land tenure holder information necessary for administration of our leases and operations, and information necessary to effect emergency response plans; and
• other information necessary for Pengrowth's business purposes, which may be voluntarily disclosed or collected in the course of a Team Member's application to and employment with Pengrowth.

As a general rule, Pengrowth collects Personal Information directly from the individual it pertains to. If third parties hold information Pengrowth requires, we will endeavour to ensure the information has been collected with the appropriate consent.

Where permitted or required by applicable law or regulatory requirements, Pengrowth may collect Personal Information about an individual without their knowledge or consent.

Pengrowth collects Personal Information to allow us to manage and develop our business and operations, including:

• determining eligibility for initial employment, including the verification of references and qualifications;
• administering pay and benefits;
• establishing training and/or development requirements and assessing qualifications for a particular job or task;
• performance reviews and determining performance requirements;
• establishing, managing and terminating business relations with you;
• gathering evidence for disciplinary action, or termination;
• informing you of, and supplying you with, investor relations information, other than that which you specifically requested;
• protecting Pengrowth against error, fraud, theft damage or nuisance relating to Pengrowth's assets, operations or reputation and securing company-held information;
• enabling Pengrowth to undertake our environmental, health and safety activities, including incident planning, emergency response and investigation;
• processing employee work-related claims (e.g. worker compensation, insurance claims, etc.);
• complying with your requests;
• enabling us to comply with applicable law or regulatory requirements; and
• any other reasonable purpose required by Pengrowth and to which you consent.

The work output of Pengrowth's Team Members, whether in paper record, computer files, or in any other storage format belongs to Pengrowth, and that work output, whether it is stored electronically, on paper or in any other format, and the tools used to generate that work product, are always subject to review and monitoring by Pengrowth.

In the course of conducting Pengrowth's business, we may monitor Team Member activities and our property. Pursuant to Pengrowth's Acceptable Use Policy, e-mail and Internet use policies, we have the capability to monitor all Team Members' computer and e-mail use.

This section is not meant to suggest that all Team Members will in fact be monitored or their actions subject to constant surveillance. Pengrowth has no duty to so monitor. It is meant to bring to your attention the fact that such monitoring may occur and may result in the collection of Personal Information from Team Members (e.g. through their use of Pengrowth's resources). When using Pengrowth equipment or resources Team Members should not have any expectation of privacy with respect to their use of such equipment or resources.

Any collection of Personal Information held or used in the course of monitoring will not be more than is necessary for the purpose of the monitoring. Monitoring is or will be done on an "as required" basis and will be in proportion to the risks that Pengrowth faces. Pengrowth will conduct any monitoring in the least intrusive way possible. In some instances, when reasonably necessary, Pengrowth may supplement this monitoring notice with more specific ones as appropriate (e.g. video surveillance).

Pengrowth may use Personal Information without consent, provided it is reasonably required to establish, manage or terminate the business or employment relationship. We use and disclose your Personal Information when, for example:

• it is for purposes described in this Privacy Policy;
• the information is publicly available;
• it is necessary to protect the rights and property of Pengrowth;
• emergencies occur or where the use is necessary to protect the safety of a person or group of persons;
• it is required by Team Members and other parties (including its related business entities or affiliates) who require Personal Information to assist us to establish, maintain and manage our relationship with you, including, for example, third parties that provide services to us or on our behalf or third parties that collaborate with Pengrowth in the provision of services to you;
• it is required by another party, in the event of a change in ownership of or granting of security interests in all or a part of Pengrowth through, for example, some form of merger, purchase, sale, lease, amalgamation or other form of business combination, provided that the parties are bound by appropriate agreements or obligations which require them to collect, use or disclose your Personal Information in a manner consistent with the use and disclosure provisions of this Privacy Policy, unless you consent otherwise; or
• we have obtained your consent.

We may use or disclose your Personal Information without your knowledge or consent where we are permitted or required by applicable law or regulatory requirements to do so.

Pengrowth is not in the business of selling customer information to third parties.

Pengrowth endeavours to maintain physical, technical and procedural safeguards that are appropriate to the sensitivity of the Personal Information in question. These safeguards are designed to prevent Personal Information from loss and unauthorized access, copying, use, modification or disclosure. Examples of these safeguards include: password, encryption and other electronic security means; locked or limited access premises and file cabinets; and the security monitoring methods referred to earlier in this policy.

If any Team Member misuses the Personal Information of another Team Member, this will be considered as a serious offence for which appropriate disciplinary action may be taken, up to and including termination of employment. If any individual or organization misuses the Personal Information of a Team Member – provided for the purpose of providing services to Pengrowth – this will be considered a serious issue for which appropriate action may be taken, up to and including termination of the service agreement.

Except as otherwise permitted or required by applicable law or regulatory requirements, Pengrowth endeavours to retain your Personal Information only for as long as it believes is necessary to fulfill the purposes for which the Personal Information was collected (including, for the purpose of meeting any legal, accounting or other reporting requirements or obligations). We may, instead of destroying or erasing your Personal Information, make it anonymous such that it cannot be associated with or tracked back to you.

It is important that Personal Information contained in our records is both accurate and current. Pengrowth asks that you to keep us informed of changes to Personal Information during the course of your employment or business relationship.

If an individual believes the Personal Information about them held by Pengrowth is not correct, the individual may request an update of that information by making a request to our Privacy Officer using the contact information set out below. In some circumstances we may not agree with your request to change your Personal Information and will instead append an alternative text to the record in question.

You can ask to see the Personal Information that we hold about you. If you want to review, verify or correct your Personal Information, please contact our Privacy Officer. Please note that any such communications must be in writing.

When making an access request, we may require specific information from you to confirm your identity and right to access, as well as to search for, and provide you with, the Personal Information that we hold about you. We may charge you a fee to access your Personal Information; but we will advise you of any fee in advance. If you need help in preparing your request, please contact the office of our Privacy Officer. Where Personal Information will be disclosed to an individual, Pengrowth will endeavour to provide the information in question within a reasonable time and no later than 30 days following the request.

Your right to access the Personal Information that we hold about you is not absolute. There are instances where applicable law or regulatory requirements allow or require us to refuse to provide some or all of the Personal Information that we hold about you. Pengrowth reserves the right to decline to provide access to Personal Information where the information requested:

1. would disclose:
   
   a. Personal Information, including opinions, about another individual or about a deceased individual; or
   
   b. Trade secrets or other business confidential information that may harm Pengrowth or competitive position of a third party, or interfere with contractual or other negotiations of Pengrowth or a third party;
    
2. is subject to solicitor-client or litigation privilege;
    
3. is not readily retrievable and the burden or cost of providing would be disproportionate to the nature or value of the information;
    
4. could reasonably result in (i) serious harm to the treatment or recovery of the individual concerned, (ii) serious emotional harm to the individual or another individual, or (iii) serious bodily harm to another individual; or
    
5. may harm or interfere with law enforcement activities and other legal or employment related investigative or regulatory functions.
    

In addition, the Personal Information may no longer exist, may have been destroyed, erased or made anonymous in accordance with Pengrowth's record retention obligations and practices. Pengrowth's Records Management Policy and Records Retention Schedule outlines procedures for the retention and subsequent disposition of Pengrowth records including those that contain Personal Information.

In the event that Pengrowth cannot provide you with access to your Personal Information, we will endeavour to inform you of the reasons why access has been denied, subject to any legal or regulatory restrictions.

It is important to us that we collect, use or disclose your Personal Information where we have your consent to do so or as provided in this Privacy Policy. Depending on the sensitivity of the Personal Information, your consent may be implied, deemed (using an opt-out mechanism) or express. Express consent can be given orally, electronically or in writing. Implied consent is consent that can reasonably be inferred from your action or inaction. For example, when you request financial information for investment purposes, we will assume your consent to the collection, use or disclosure of your Personal Information for purposes related to that request for information or for other purposes identified by you at the time.

Typically, we will seek your consent at the time that we collect the Personal Information. In some circumstances, your consent may be obtained after collection but prior to our use or disclosure of your Personal Information. If we plan to use or disclose your Personal Information for a purpose not previously identified (either in this Privacy Policy or separately), we will endeavour to advise you of that purpose before such use or disclosure.

We may collect, use or disclose your Personal Information without your knowledge or consent where we are permitted or required to do so by applicable law or regulatory requirements.

We assume that, unless you advise us otherwise, that by receiving a copy of this Privacy Policy or by continuing to deal with us, you have consented to the collection, use and disclosure of your Personal Information as explained in this Privacy Policy.

You may change or withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting our Privacy Officer using the contact information set out below. In some circumstances, a change in or withdrawal of consent may limit our ability to provide products or services to, or acquire products or services from, you.

If you have a question about (a) access to Personal Information, (b) the collection, use, management or disclosure of Personal Information, (c) to changing or withdrawing consent with respect to Personal Information, or (d) to get more information about this Policy or relevant legislation, please contact the office of our Privacy Officer by telephone or in writing or by e-mail at:

                       2100, 222 – 3rdAvenue S.W.
                       Calgary, Alberta T2P 0B4
                       Attention: Privacy Officer
                       (403) 233-0224
                       Privacy.Officer@Pengrowth.com

We will endeavour to answer your questions and advise you in writing of any steps taken to address any issues you have raised. If you are not satisfied with our response, you may be entitled to make a written submission to the Privacy Commissioner applicable for your jurisdiction.

Pengrowth will from time to time review and revise this Policy to reflect changes in legal or regulatory obligations or changes in the manner in which we deal with Personal Information.

We will post any revised version of this Policy on our website, and we encourage you to refer back to it on a regular basis. Any changes to this Policy will be effective from the time they are posted, provided that any change that relates to why we collect, use or disclose your Personal Information will not apply to you, where your consent is required to such collection, use or disclosure, until we have obtained your consent to such change.

Any interpretation associated with this Policy will be made by the Privacy Officer. This Policy includes examples but is not intended to be restricted in its application to such examples, therefore where the word 'including' is used, it shall mean 'including without limitation'.

This Policy does not create or confer upon any individual any rights, or impose upon Pengrowth any rights or obligations outside of, or in addition to, any rights or obligations imposed by Canada's federal and provincial privacy laws, as applicable. Should there be, in a specific case, any inconsistency between this Policy and Canada's federal and provincial privacy laws, as applicable, this Policy shall be interpreted, in respect of that case, to give effect to, and comply with, those privacy laws.

This policy is one of a series of related policies addressing the collection, use, disclosure and security of Personal Information, including:

• Acceptable Use Policy
• E-mail Use Policy
• Internet Use Policy
• Telephone Call Recording Policy
• Records Management Policy and Records Retention Schedule.