Privacy Policy and Protection of Personal Information

1. Information We Collect

Personal information is any information concerning a natural person that allows them to be identified. Without limitation, this information may be identifying (e.g., name, address, phone number, driver's license number), financial (e.g., credit card number), related to professional activities (e.g., employee file), etc.

To meet your needs, we request only essential information. This may include:

• Identifying Data: Name, address, phone number, driver's license number.
• Service Offering Data : All information necessary to complete an insurance quote request.
• Financial Data: Banking information or credit card number for payment.
• Professional Data: When necessary, information required for a credit investigation or in connection with a job application.
• Records and Communications: For purposes of information integrity, training and quality control of customer service, all telephone conversations may be recorded or monitored.
• Navigation Data (Cookies/Tracking) and Profiling:
  We use cookies and web analytics technologies to ensure the proper functioning of our site, remember your preferences and analyze the use of our platforms (profiling).

  Management and Disabling: You may at any time manage your preferences and enable or disable these functions by clicking the "Cookie Preferences" link located at the bottom of all pages on our site. For more details on the types of cookies we use and how to disable them, please see our "Website Terms of Use" page.

2. How We Use Your Information

The use of your data, whether the request is made by phone, in person or online, serves specific purposes to fulfill our mandate:

• Conduct a complete analysis of your protection needs.
• Provide an insurance quote (the online form authorizes us to use your information for analysis purposes and to contact you by email or telephone).
• Issue and administer an insurance policy.
• Pay for a product or service purchased.

Quote Request

• In order to establish a quote, service offer or insurance contract, it is our duty to analyze all persons concerned by the request.
• Whether requests are made by phone, in person or online, the consent of all targeted persons must necessarily be obtained directly.

Online Quote Requests (via Website)

When a quote request form is submitted through our online application (https://soumission.gendron.services), you authorize and consent that GENDRON ASSURANCE :

• Uses your personal information to analyze your protection needs to provide an insurance quote for the requested product;
• Uses your email address to respond to your request;
• Communicates with you by phone, email or other means to discuss your file, provide the requested quote and, if necessary, present the other services offered by GENDRON ASSURANCE .

3. Who Your Information May Be Shared With

GENDRON ASSURANCE does not sell or make public any personal information. However, to carry out our mandate or comply with the law, we may share your data with third parties who have formally committed to protect it:

• Insurance brokers, claims adjusters, insurers, reinsurers and financial institutions.
• The Central Motor Vehicle Claim File (FCSA) of the Groupement des assureurs automobiles (GAA) and the SAAQ.
• Credit, risk and collections analysis agencies.
• Courts, legal consultants or authorized government agencies.
• IT and cloud service providers, authorized delivery or payment partners.
  • Data Hosting and Transfer Outside Quebec: Some of our providers or partners may host or process data outside the Province of Quebec or Canada. Before communicating any personal information outside Quebec, we systematically conduct a Privacy Impact Assessment (PIA) . This transfer is only made if this assessment demonstrates that your information will benefit from adequate protection. Where applicable, this transfer is governed by a written agreement — such as the terms of service and data processing agreement (DPA) agreed with the provider — stipulating the required security measures, although your data may be subject to the laws of the country or province concerned.

4. How We Protect and Retain Your Data

We adopt rigorous security measures to protect your information, which we retain as long as necessary for our mandate and legal obligations:

Security, Retention and Destruction of Personal Information

To ensure the security and confidentiality of personal information, we apply industry standards, including both physical and technological aspects:

• Access controls
• Data encryption
• Disaster recovery plans
• Intrusion monitoring and detection
• Technology monitoring
• Ongoing training and awareness program on best practices for all staff

Retention Period, Destruction and Anonymization

Our internal policies establish rules governing the retention and destruction of your personal information. Generally, we retain it for as long as reasonably necessary for the purposes for which it was collected and to fulfill our legal and business obligations, subject to retention periods imposed by applicable law and regulations (in particular regarding damage insurance and use of the Central Motor Vehicle Claim File – FCSA). By way of example:

• section_4_retention_indicative_title
  • Quote requests, quotes and rejected insurance proposals are retained according to applicable requirements;
  • Insurance policies and claim files are retained as long as necessary to meet legal obligations;
  • Records evidencing a consultation with the FCSA (audit logs) are retained in accordance with industry standards and regulations.

Once these purposes have been achieved and legal periods have elapsed, your information is either securely and irreversibly destroyed , or anonymized so that it is no longer possible, irreversibly, to identify you. These operations are performed in accordance with our internal data management and secure destruction policies, and a destruction certificate is issued when required.

Confidentiality Commitment

All our employees and partners are contractually committed (indefinitely) to protect your data from the moment they join.

Notice on the Security of Electronic Communications

Although we apply industry best practices to secure our platforms (including data encryption in transit via SSL/TLS), no method of transmission over the Internet or by email is infallible. Gendron Assurance cannot be held responsible for damages resulting from interception, loss or alteration of electronic communications beyond its control, in particular due to misconfiguration of your IT equipment, inadequate use of our services or negligence on your part.

5. Your Rights (Consent, Access and Withdrawal)

No information is collected by GENDRON ASSURANCE without your prior consent, that of a proxy or prospect. By providing us with your personal information, you give effective consent. Accordingly, you accept the terms of this policy and authorize us to collect, retain, use and disclose your information for the purposes for which it was collected.

You have the following rights:

• Right to Withdraw

  You may withdraw your consent at any time, though this may prevent us from offering you the requested product or service.

• Right of Access and Rectification

  If information is inaccurate, you may submit a written request to our responsible party. Your identity will be validated and processing will be completed within a maximum of 30 days, in accordance with the law. Access to your information is free ; however, reasonable fees may be charged for transcription, reproduction or transmission, and you will be informed in advance. If we refuse, we will advise you of the reasons, the applicable legal provision, as well as available remedies and their time limits.

• Right to Data Portability

  You may request that we provide you, in a structured technological format commonly used, the computerized personal information you have provided to us (for example your contact details or information submitted with a quote request). Upon your request, this information may also be transmitted directly to another organization authorized by law to collect it. This right applies only to information collected from you — not information we have created or inferred — and does not apply to information obtained from third parties, such as data from the Central Motor Vehicle Claim File (FCSA) or insurance companies with which we have a business relationship.

• Information Available Upon Request

  Upon request, we provide information on the personal information we hold about you, the categories of persons who have access to it within our firm, the retention period for this information, as well as the contact information for our privacy officer. Internally, access is limited, on a "least privilege" basis, to authorized staff members whose duties require it — including brokers or agents assigned to your file and technical staff responsible for our systems — all bound by a confidentiality commitment. No subcontractor has access to your information without a prior confidentiality agreement.

• Unsubscribe from Marketing Newsletter

  You may unsubscribe via the link in our messages or by contacting our privacy officer .

• Text and SMS

  To stop receiving texts, you may reply STOP to any message received at any time.

• Emails Related to Our Business Relationship

  Under the Canadian Anti-Spam Legislation (CASL), we may send you commercial emails in the context of our business relationship for up to 6 months after a quote and up to 24 months after the end of an active contract. You may withdraw your consent to receive such solicitations at any time. Purely transactional messages (such as sending the requested quote, policy documents or renewal notices) are not affected by this withdrawal.

Automated Mechanisms for a Withdrawal Request:

• Newsletter

  • You may use the "unsubscribe" link at the bottom of the emails

Decisions Based on Automated Processing

In the course of our activities (particularly when using our online quote tool), we may make a decision about you based solely on automated processing of your personal information (for example, to assess a risk profile or generate an insurance rate entirely by computer). If this occurs, we will notify you no later than when communicating this decision. In accordance with the law, you then have the following rights:

• Email (business relationship)

  • You may use the "unsubscribe" link at the bottom of the message
  • Reply to the message received by adding "Unsubscribe" in the subject line

• Text and SMS

  • Reply STOP or ARRET to a message previously received on your phone

Manual Mechanism for a Withdrawal Request:

• Send an email to the address specified at the bottom of the page with the words "Withdrawal of consent"
• Depending on the circumstances, the following procedure will apply:
  • Submit the written request to the firm's email or physical address;
  • You will receive an acknowledgement of receipt;
  • Your identity will be validated;
  • Your request will be processed no later than 30 days after receipt.

Decisions Based on Automated Processing

In the course of our activities (particularly when using our online quote tool), we may make a decision about you based solely on automated processing of your personal information (for example, to assess a risk profile or generate an insurance rate entirely by computer). If this occurs, we will notify you no later than when communicating this decision. In accordance with the law, you then have the following rights:

• Right to Information

  You may request that we advise you of the personal information used to make this decision, as well as the reasons and principal factors and parameters that led to this result.

• Right to Submit Comments

  You have the right to challenge this decision, to correct the personal information used if you find an error, and to submit your comments to a team member who can review your file in a human manner.

  To exercise these rights, simply contact our privacy officer at the contact information provided at the end of this document.

6. Privacy Incident Management

In accordance with legal requirements, we apply a privacy incident management protocol.

A privacy incident is any access, use or disclosure of personal information that is not authorized by law, as well as the loss of such information or any other breach of its security.

Should we become aware of a privacy incident involving your personal information, we commit to:

• Take Immediate Action: We will promptly apply reasonable measures to reduce the risk of harm and prevent similar incidents from occurring.
• Assess the Risk: We will evaluate the situation to determine whether the incident presents a serious risk of harm (considering the sensitivity of the information, possible consequences and likelihood of misuse).
• Notify Authorities and Affected Persons: If the assessment shows a serious risk of harm, we will notify the Commission d'accès à l'information (CAI) of Quebec, the Autorité des marchés financiers (AMF) and all affected persons without delay, as required by law.
• Maintain a Register: We maintain an updated register of all privacy incidents (whether or not they present a serious risk of harm) and a copy of this register will be provided to the CAI upon request.

7. Complaints and Remedies

If you are dissatisfied with how we handle your personal information or any of your requests, you may lodge a complaint with our privacy officer (contact information below). We will acknowledge receipt and respond diligently.

In the event of a dispute or complaint regarding the protection of personal or sensitive information, you are invited to consult the firm's dispute and complaint handling policy . This is available on our website (https://gendronassurance.com/politique-de-gestion-des-plaintes) or upon request:

• By email: info@gendronassurance.com
• By phone: 450-679-1182

If our response or the follow-up to your complaint does not satisfy you, you have a right of recourse to the Commission d'accès à l'information du Québec (CAI) .

8. Privacy Officer

This policy may evolve to reflect legal or internal changes. We invite you to review our privacy policy regularly to stay informed of any changes.

For any questions, access or rectification requests, please contact: