Privacy Policy

VIP Gestion de patrimoine inc.
Last updated :

1. Who we are

VIP Gestion de patrimoine inc. is a Quebec-based insurance brokerage. We are subject to Quebec's Act respecting the protection of personal information in the private sector (Law 25), the federal PIPEDA, and where applicable the EU's GDPR.

2. Data we collect

When you submit a quote request, we collect:

• Identification: name, date of birth, gender, marital status, profession
• Contact: email, phone number, address
• Insurance-specific: vehicle, property, current insurer, claims history
• Consent records: timestamp, IP, device
• Technical: browser, operating system, language preference

3. How we use your data

Your data is used exclusively for:

• Processing your quote request and obtaining offers from insurers
• Communicating with you (email, phone) about your file
• Meeting our legal and regulatory obligations
• Improving our service (anonymized statistics only)

We never sell your personal data.

4. Data retention

We retain your data for 84 months following your last interaction, after which it is automatically deleted. You can request earlier deletion at any time (see section 6).

5. Sharing with third parties

Where third parties receive personal data, they are bound by contractual obligations of confidentiality and security at least equivalent to ours.

6. Your rights

Under Law 25 and GDPR, you have the right to:

• Access — See all data we have about you
• Portability — Receive your data in a structured, portable format (JSON)
• Correction — Have inaccurate data corrected
• Deletion — Have all your data permanently deleted
• Withdraw consent — Withdraw any consent previously given
• Object — Object to certain uses (e.g. marketing)

7. Security

We protect your data through:

• AES encryption at rest (database)
• TLS encryption in transit (HTTPS)
• Two-factor authentication for staff access
• Role-based access controls
• Audit logs of all access and modifications
• Daily backups, encrypted and access-controlled

8. Cookies

We use only strictly necessary cookies (session, CSRF protection, language preference). We do not use advertising or third-party tracking cookies. No consent banner is required because no non-essential cookies are set.

9. Privacy Officer (Law 25)

If you are dissatisfied with our handling of your request, you may file a complaint with the Commission d'accès à l'information du Québec (CAI): cai.gouv.qc.ca

10. Privacy incidents

In case of a confidentiality incident presenting a risk of serious harm, we notify the CAI and the affected persons without unreasonable delay, in accordance with our Incident Response Policy. We maintain a register of all incidents.

11. Updates to this policy

We may update this policy. The current version date is shown at the top. Substantial changes are communicated to active clients by email.