Privacy policy

Assurance Boréale values the protection of your personal information. This privacy policy explains, in plain and clear terms, how we collect, use and protect it (s. 8.2). It is generated from our personal information register and reviewed before publication.

Information collected and purposes

We collect the following categories of personal information: Medical information, Household information, Contact details, Financial information, Geolocation data, Driving history. They are used only for these specific purposes: Life insurance for dependents, Home insurance, Surveys and service improvement, Tax record keeping, Fraud prevention, Safe driving program, Claims assessment, Underwriting and pricing, Marketing communications, Client file management.

For the following purposes we rely on your consent, which you may withdraw at any time (ss. 8 and 14): Life insurance for dependents, Home insurance, Surveys and service improvement, Safe driving program, Claims assessment, Underwriting and pricing, Marketing communications.

The category "Financial information" (purpose: Tax record keeping) is held on a declared statutory basis (a legal retention obligation, s. 23), not on your consent: The Tax Administration Act (CQLR, c. A-6.002, s. 35.6) and the Income Tax Act (R.S.C. 1985, c. 1, 5th Supp., s. 230) require the company to keep its books, records and supporting documents for six years after the end of the taxation year concerned. This retention period is set by law (s. 18 and s. 23 of Law 25).

The category "Financial information" (purpose: Fraud prevention) is held on a declared statutory basis (fraud prevention and security, s. 12 para. 2 (3)), not on your consent: Using this information is necessary to prevent and detect insurance fraud and to assess and improve our protection and security measures (s. 12 para. 2 (3) of the Act respecting the protection of personal information in the private sector).

The category "Contact details" (purpose: Client file management) is held on a declared statutory basis (necessary for a service you requested, s. 12 para. 2 (4)), not on your consent: Maintaining the client file is necessary to supply the insurance product and deliver the services requested by the policyholder (s. 12 para. 2 (4) of the Act respecting the protection of personal information in the private sector). Without this information, the contract cannot be administered.

Some of this information is sensitive. As sensitive information, its use and communication require your express consent (ss. 12 para. 1 and 13 para. 2); we therefore collect it with your express consent at the time of collection: Health information about a dependent, including a minor: express consent of the holder of parental authority. Continuous geolocation tracks your movements: it requires a distinct express consent. Intimate health information: consent must be expressly manifested.

Retention and destruction

Personal information is kept only as long as necessary to fulfil the purposes for which it was collected, then destroyed or anonymized in accordance with s. 23. Financial information: kept for 72 months, then destroyed. Geolocation data: kept for 24 months, then anonymized. Medical information: kept for 120 months, then destroyed. Used to render a decision: kept for at least one year (s. 11, para. 2). Contact details: kept for 36 months, then destroyed. Contact details: kept for 84 months, then destroyed. Used to render a decision: kept for at least one year (s. 11, para. 2).

Protection of your personal information

We take reasonable security measures to protect your personal information, considering in particular its sensitivity, the purposes for which it is used, its quantity, its distribution and its medium (s. 10). When your information is destroyed, it is destroyed securely.

Recipients

Your personal information is communicated only to the persons in our organization whose duties require it and, for the communications described below, to the following recipients: Nordlys Cloud Services Ltd (Irlande (Union européenne)). They are not disclosed to any other third party without your consent, except in the cases provided for by law (ss. 13 and 18).

Communication outside Quebec

Some of your personal information may be communicated outside Quebec (to Irlande (Union européenne)). A privacy impact assessment has been carried out for this communication and concluded that adequate protection is in place (s. 17). Each communication is covered by a written agreement that reflects the results of the assessment.

Automated decisions

When a decision concerning you is based exclusively on automated processing of your personal information, you are informed and may submit observations (s. 12.1). The premium is set by a fully automated processing based on your risk profile. You may submit observations and request a review by an advisor.

Your rights

You have a right of access and rectification (ss. 27 and 28). You also have the right to obtain a computerized copy of personal information you provided to us in a structured, commonly used technological format, unless doing so raises serious practical difficulties (s. 27, para. 3). In the cases provided for by law, you may require that the dissemination of your information cease or that it be de-indexed (s. 28.1). You may exercise these rights online at the following address: https://app.agreely.ca/p/showcase-assurance-boreale/rights, or with the person in charge identified below (ss. 29 and 30).

Person in charge of personal information protection

To exercise your rights or for any question, contact: Marie-Claude Gagnon, Responsable de la protection des renseignements personnels - protection@assurance-boreale.example. You may also submit your request online: https://app.agreely.ca/p/showcase-assurance-boreale/rights.