Privacy Policy

Personal information protection

English translation of the French policy provided by Karine Gosselin.

Preamble

This policy governs compliance by the independent representative Karine Gosselin. It must be applied rigorously and used as a tool to support independent mortgage brokers and firms in meeting the requirements of the Autorité des marchés financiers (hereinafter the “AMF”).

Purpose of the policies

1. Establish general principles for collecting, using and disclosing personal information;
2. Retain data appropriately;
3. Destroy personal information appropriately;
4. Anonymize personal information where applicable;
5. Properly receive and handle complaints and requests from individuals wishing to exercise their rights;
6. Secure data appropriately;
7. Manage confidentiality incidents and the incident response plan.

Objectives

1. Ensure that the confidentiality of our clients’ personal information is and remains a priority at all times;
2. Ensure that necessary measures are taken to protect personal information that is collected, used, disclosed, retained or destroyed, and that those measures are reasonable in light of its sensitivity, the purpose of its use, its quantity, its distribution and its medium.

1. Roles and responsibilities

The person responsible for implementing this policy is the person in charge of the protection of personal information, Ms. Karine Gosselin. The privacy officer’s title and contact information are published on the websites of Karine Gosselin and Consortium Hypothécaire.

Karine Gosselin’s staff must comply with this policy and implement security measures with the privacy officer’s support and guidance.

2. Definition of personal information

Personal information is defined as follows: “Any information which relates to a natural person and allows that person to be identified, directly or indirectly.”

Data is considered personal information from the time it is collected if it can be combined with other information to identify a person.

Examples of personal information include, without limitation: name, religion, marital status, education level, age, height, weight, medical records, blood type, DNA, voice signature, fingerprints, income, purchases, consumption habits, banking information, social insurance number, street address, income tax return, credit report, geolocation data, online identifier, IP address, date of birth and identity documents.

Information relating to a person’s role in a business, such as their name, title, duties, business address, work email address and work telephone number, is not considered personal information under the Act respecting the protection of personal information in the private sector.

Personal information protection obligations apply regardless of the medium or form in which information is accessible: written, graphic, audio, visual, computerized or otherwise.

3. Definition of sensitive personal information

Personal information is sensitive when its nature, particularly medical, biometric or otherwise intimate, or the context of its use or disclosure gives rise to a high reasonable expectation of privacy.

4. Hiring

Every employee must sign a confidentiality agreement.

An example of an employee confidentiality agreement appears in Appendix A.

5. Service agreements

Anyone entering into a service agreement with a supplier whose activities could provide access to personal information must ensure that the service proposal includes a confidentiality undertaking. Otherwise, a confidentiality undertaking must be signed.

An example of a supplier confidentiality undertaking appears in Appendix B.

6. Consent

The mortgage broker must always obtain written authorization duly signed by the client authorizing the collection, use, disclosure and retention of personal information concerning the client or, where applicable, the client’s business or its employees.

An example of a consent form appears in Appendix C.

7. General principles for collecting, using and disclosing personal information outside a needs analysis

Refer to the compliance policy for matters concerning the collection of information during a needs analysis.

7.1. Collection of personal information

There must be a serious and legitimate interest in collecting personal information about another person. This principle cannot be waived, even with that person’s consent. Information must be collected only by lawful means.

At or before collection, the person collecting personal information informs the individual of the purposes of collection, the means used, the rights of access and rectification provided by law, and the right to withdraw consent to the disclosure or use of the collected information.

Information collected from a third party

When personal information is collected from a third party, the individual’s consent must be obtained beforehand. However, information may be collected from a third party without consent where authorized by law.

When personal information is collected from another person operating a business, the person collecting it must, at the individual’s request, identify its source.

On request, the individual may also be informed in clear and simple language of the personal information collected from them, the categories of people within Karine Gosselin’s business who have access to it, its retention period and the privacy officer’s contact information.

Information about a minor under 14

Personal information cannot be collected from a minor under 14 without the prior consent of the holder of parental authority or the tutor, unless the collection is clearly for the minor’s benefit.

7.2. Use of personal information

Personal information is used only for the purposes for which it was collected, unless the individual consents otherwise.

Use for another purpose

Personal information may be used for other purposes without consent in circumstances provided by law, including:

• Where its use is compatible with the purposes for which it was collected;
• Where its use is clearly for the individual’s benefit;
• Where its use is necessary to prevent or detect fraud, or to assess and improve protection and security measures;
• Where its use is necessary for studies, research or statistics and the information is de-identified.

Limited access

Access to personal information in a file must be limited to employees who need it to perform their duties. The information must also be necessary to those duties or to carrying out their mandate.

7.3. Disclosure of personal information

Personal information about a client must not be disclosed to third parties without the client’s prior authorization, except where permitted by law. Consent must be express whenever sensitive personal information is involved.

In carrying out a client’s mandate, the independent representative may need to disclose, retain or have certain personal information processed outside Québec, including when hosting the representative’s data on servers outside Québec. This policy informs individuals of that possibility.

Before any such disclosure, the independent representative conducts a privacy impact assessment to ensure that the information will receive adequate protection in accordance with generally recognized personal information protection principles. The disclosure is governed by a written agreement with the recipient or service provider that takes the assessment’s findings into account.

An employee asked to disclose personal information must refuse if disclosure would reveal personal information about a third party, or its existence, and could harm that third party, unless the situation could endanger the third party’s life, health or safety, or the third party consents.

8. Appropriate data retention

8.1. Retaining personal information

To ensure the appropriate retention of personal information in active files, employees take the following measures:

• Record written communications with the client in the file, including progress notes, emails and forms;
• Turn documents face down and/or close files containing personal information when away from their desk;
• Restrict access to the premises to authorized people;
• Accompany visitors on the premises at all times;
• Do not discuss clients in public areas of the office;
• Ensure that the last person leaving the premises or offices at the end of the day locks the doors;
• Put away and retain client files in filing cabinets at the end of the day;
• Lock filing cabinets every evening;
• Take responsibility for documents sent for printing and collect them as soon as they are printed.

8.2. Retaining inactive files

When a file is no longer active, it must be stored in a separate location and/or directory.

A file is closed in any of the following circumstances:

• The person has received all the services they needed;
• The person informs us that they wish to discontinue the process or close their file;
• Karine Gosselin has not heard from the client for more than six (6) months.

A note in the file records the date and the reason it may be considered inactive.

Inactive files are retained for at least seven (7) years from the time they are declared inactive.

Storage is provided for at least seven (7) years from the date files are declared inactive and maintains the confidentiality of the personal information held. After that period, the files may be destroyed.

An example of a personal information retention register appears in Appendix D. This procedure facilitates the management and destruction of closed files. It also makes it possible to confirm that a file exists in a client’s name and, where applicable, that it has been destroyed in accordance with the policy.

9. Access to the file

Clients must be able to access their file at any time, consult it or request a copy.

Clients must also be able to request that false or erroneous information be corrected as soon as possible.

10. Closing files

After seven (7) years, files may be destroyed. Destruction methods must meet the same confidentiality criteria as storage methods.

11. Appropriate destruction and, where applicable, anonymization of personal information

11.1. Destroying personal information

Once the purposes for which personal information was collected or used have been fulfilled, it is destroyed or anonymized, subject to the retention period required by law.

Personal information may be anonymized where it is reasonable in the circumstances to expect that it will irreversibly cease to identify a person, directly or indirectly. Anonymized information may be retained only for serious or legitimate purposes. Destruction is the standard method used. Anonymization is permitted only exceptionally and for specific purposes.

Employees ensure the protection of the personal information they destroy and must not discard paper or electronic documents without first ensuring that their contents cannot be recovered or reconstructed.

Destruction must use specialized equipment, such as an office shredder. Shredded pieces must be small enough to make reconstruction impossible.

Burning documents outdoors is not considered a secure destruction method.

The privacy officer ensures that all staff understand and follow this rule.

Using a specialized company

Where the volume of documents justifies it, Karine Gosselin uses a specialized company. Until destruction, documents are stored in a locked location. The privacy officer, Ms. Karine Gosselin, is responsible for the key and may delegate that responsibility to a designated employee.

Karine Gosselin may also use a specialized company to destroy personal information contained in computer programs.

In both cases, a written contract must be established with the specialized company to ensure security measures and the protection of confidential information.

At a minimum, the specialized company must undertake in the contract to:

• Use a document destruction procedure that meets legal requirements;
• Acknowledge the confidentiality of the information processed and the prohibition on retaining it for its own purposes;
• Not subcontract the destruction of confidential documents without Karine Gosselin’s agreement;
• Establish the consequences of failing to meet its commitments;
• Restrict access to the premises and confidential information;
• Obtain a signed confidentiality undertaking from everyone who will access or handle the documents;
• Regularly report to Karine Gosselin on the progress of document destruction;
• Notify Karine Gosselin without delay of any breach or attempted breach of security or confidentiality obligations.

If the specialized company fails to meet its commitments, the privacy officer terminates the contract and requests the return of the personal information.

12. Receiving and handling complaints and requests from individuals exercising their rights

12.1. Definition of a complaint and register

For the purposes of this policy, a complaint is an expression of at least one (1) of the following two (2) elements:

• A reproach concerning an employee or Karine Gosselin;
• Identification of potential or actual harm that a client has suffered or could suffer.

An informal effort to correct a particular problem is not a complaint, provided the problem is handled as part of the employee’s regular activities and the client has not made a complaint.

The privacy officer must ensure that a complaints register is created and is responsible for managing it. Every complaint file must be entered in it. An example of the register appears in Appendix E.

12.2. Procedure when a complaint is reported

Opening the file

When a complaint is reported in any form, the privacy officer opens a file and records the date of receipt in the complaints register. The person receiving the complaint invites the complainant to submit it in writing or records all details in writing, whichever is most appropriate in the circumstances.

If someone other than the privacy officer receives the complaint, that employee must notify the privacy officer without delay.

A copy of the written complaint, or the recorded version of a verbal complaint, must be placed in the file.

Receiving the complaint

Any client wishing to make a complaint must do so in writing at the following address:

Acknowledgement of receipt

Upon receiving the complaint, the privacy officer initiates the complaints-handling process.

The privacy officer sends an acknowledgement of receipt without delay or, failing that, within five (5) days of receiving the complaint.

The acknowledgement must contain:

• A description of the complaint, specifying the actual or potential harm, the reproach made and the corrective action requested;
• The name and contact information of the person responsible for handling the complaint;
• For an incomplete complaint, a request for additional information that the complainant must answer within a specified period, failing which the complaint is deemed abandoned;
• The section of this policy dealing with complaint handling.

An example of an acknowledgement template appears in Appendix F.

Contents of the complaint file

The privacy officer must create a complaint file containing:

• The written complaint, including its three (3) elements: the reproach, actual or potential harm, and corrective action requested;
• The outcome of the handling process, including the analysis and supporting documents;
• The final written, reasoned response to the complainant;
• Correspondence with the complainant and any document relating to the complaint.

Investigation

The privacy officer investigates the file, collecting and analysing relevant comments and documentation, and obtains any additional information considered missing.

Where applicable, the privacy officer or employee concerned by the complaint notifies their professional liability insurer without delay.

Report

After completing the handling of the complaint, the privacy officer prepares a report and informs the complainant of the investigation’s outcome through a written, reasoned response. The report and response are placed in the complaint file.

12.3. Access to the file

Clients and employees may access their file at any time to consult it or request a copy.

A client or employee may request the rectification or correction of information that is false, inaccurate, incomplete, ambiguous or erroneous. If its collection, disclosure or retention is not authorized by law, they may require its destruction.

If the request is insufficiently precise, or if assistance is requested, the privacy officer will help identify the information sought.

Where disclosure of personal information contravenes the law, the individual may require Karine Gosselin to stop disseminating it or to de-index any hyperlink attached to the individual’s name that provides access to it by technological means.

The privacy officer responds in writing to an access or rectification request within thirty (30) days of receipt. Failure to respond within that time is deemed a refusal. The individual may then apply to the Commission d’accès à l’information for an examination of the disagreement within thirty (30) days after that deadline expires.

Access to information is free. However, reasonable fees may be charged for transcription, reproduction or transmission. The individual must be informed of those fees before the information is transcribed, reproduced or transmitted.

A refusal by the privacy officer must give reasons, identify the legal provision supporting it, and state the remedies available under the law and the time limits for exercising them. Information subject to a refusal must be retained for the time necessary to allow the individual to exhaust the remedies provided by law.

When the privacy officer grants a rectification request, the requester must receive, free of charge, a copy of any personal information changed or added or, as applicable, confirmation that the information has been deleted.

Access request by an interested third party

An individual or mortgage broker requesting access to a file must establish their identity and make the request in writing to the privacy officer.

13. Managing confidentiality incidents and the incident response plan

As soon as anyone in Karine Gosselin’s business has reason to believe that a confidentiality incident involving personal information held by the business has occurred, they must immediately take reasonable measures to reduce the risk of harm and prevent similar incidents.

A confidentiality incident includes:

• Access to, disclosure of or use of personal information not authorized by law;
• Loss of personal information; or
• Any other breach of its protection.

The incident must be assessed with the privacy officer to determine whether there is a risk of serious injury. If there is such a risk, the privacy officer must notify the individual concerned and the Commission d’accès à l’information. An example of a notification appears in Appendix G.

Karine Gosselin reserves the right to notify any person or organization able to reduce the risk of serious injury, disclosing only the personal information necessary for that purpose without the individual’s consent. The privacy officer ensures that verbal communications are recorded and written communications are retained.

When assessing the incident, the sensitivity of the information, the anticipated consequences of its use and the likelihood of its use for harmful purposes must be considered.

The privacy officer analyses the causes and identifies measures to prevent a similar incident.

The following information is recorded in a confidentiality incident register, whether or not the incident presents a risk of serious injury:

• The date of the incident;
• A description of its circumstances and the personal information involved;
• The assessment of the seriousness of the risk of harm and the conclusion;
• Where applicable, the reasons Karine Gosselin considers the incident does not pose a risk of serious injury to the individuals concerned;
• A description of the measures taken in response;
• Where applicable, the date and description of notices sent.

A sample confidentiality incident register appears in Appendix H. The privacy officer determines what communications should be exchanged with the client concerned, where applicable. Decisions must always comply with applicable laws and regulations.

Security measures are reviewed after the incident to prevent a recurrence. The privacy officer also ensures that any new measures are communicated to all staff where applicable.

If the measures taken change the policy in force, the privacy officer ensures that the necessary amendments are made.

14. Identity theft

If a client reports possible identity theft, the privacy officer must activate an identity theft flag in the computer system and the physical file.

The privacy officer must also ensure that the insurer involved is informed in writing without delay and implement additional measures to verify the client’s identity.

An employee who receives a report of identity theft must immediately inform the privacy officer.

15. General provisions

The privacy officer must review this policy annually and prepare a document describing the review.

The document must address, in particular, whether changes to the policy are appropriate, any proposed changes, and the reasons for them.

If an external audit takes place during the year, the report’s recommendations must be incorporated into the policy where applicable.

This compliance policy has been in effect since December 17, 2020, and was updated on April 22, 2025, and May 7, 2026.

The appendices referenced in this policy are not included in the supplied document. Contact Karine Gosselin to obtain the applicable documents.