Privacy Policy

This Notice describes how we, M3 Group and our affiliates¹, collect, use, communicate and protect the Personal Information entrusted to us.

Personal Information is any information which relates to a natural person and directly or indirectly allows that person to be identified.

This Notice is designed to comply with Canadian privacy laws, more specifically the Canada Personal Information Protection and Electronic Documents Act (PIPEDA), as well as any other applicable provincial and territorial privacy legislation.

1. Scope and Application

This Notice applies to all Personal Information we collect, use or communicate in the course of our commercial activities, whether collected digitally, in writing, verbally, or through any other means, including Personal Information from:

• Clients and prospective clients
• Users of our products and services
• Website visitors
• Business partners, contractors, and service providers
• Job applicants

2. How do we collect Personal Information?

2.1 From whom do we collect Personal Information?

We may collect Personal Information from the individual concerned. We may also collect it from others, depending on the circumstances and the products or services used, including:

• Our mortgage brokerages, brokers, agents, representatives and partners
• Financial institutions, lenders and insurance companies
• A person who wishes that the individual benefit from that product or service (for example as a co-borrower, co-insured or beneficiary)
• Credit bureaus and reporting agencies
• Insurance claims and fraud databases
• Personal and employer references
• Public bodies

2.2 By what means do we collect Personal Information?

We may collect Personal Information in person, by phone, email, paper or online form, or when visiting our websites or using our applications, when an individual:

• Creates an account or registers for our services
• Interacts with our mortgage brokers, agents, representatives or partners
• Contacts us for support or inquiries
• Subscribes to our newsletters or marketing communications
• Participates in surveys, contests, or promotions
• Interacts on social media
• Applies for employment with us
• Visits our websites or uses our applications, via cookies, web beacons, pixels, and similar technologies (see Section 7)

2.3 What Personal Information do we collect?

We only collect the Personal Information necessary to fulfil the purposes outlined in this Notice. The Personal Information we collect may include:

Categories of information	Examples
Identification	Name, date of birth, gender or non-binary, government identifiers (for example a passport or a driver’s licence number), marital status
Contact	Email, postal address, phone numbers
Authentication	Passwords and PINs, answers to authentication questions, multi-factor authentication codes, biometric information2
Communication with us	Appointment details, messages, logs, history, voice and video call recordings, analysis and transcription, support tickets, emails, chats, complaints, survey responses, security video recordings
Technical information (via our websites and applications)	IP address, location, browser type and preferences, device identifier and configurations, the referring website and keywords searched, pages visited, clickstream, features used, time spent on services, advertisement seen, including information collected via cookies, web beacons, pixels, and similar technologies (see Section 7)
Products and services	Information on products held (mortgage loans, insurance policies, dates, amounts, terms, payment methods), authorised account users
Financial	Salary, other income, financial report, financial profile, assets and liabilities, rent, mortgage, bank account, credit report and rating
Insurance	Policies, claims history, vehicle, residence, lifestyle habits
Employment	Employment status, current and former employers and references
Communication preferences	How we communicate with individuals and what kind of information we may send them
Legal compliance	Social Insurance Number, proof of citizenship, country of birth, country of residence and tax identification numbers.
Other	We may also create or infer information from the Personal Information we collect, including client profiles and identifiers.

2.4 When do we obtain consent?

We obtain consent before we collect, use or communicate Personal Information to third parties. We may obtain consent directly from the individual concerned, or it may be obtained by another person, such as a broker, agent or representative. We will request consent again, if we wish to use or communicate Personal Information for a purpose to which the individual has not consented.

In some circumstances, consent is not required to collect, use or communicate Personal Information, including:

• When communicated to a supplier or service provider for the purpose of providing a product or service we offer
• To detect and prevent fraud or improve security measures
• When it is clearly for the benefit of the individual concerned
• When required by law, a court order or a regulatory authority
• When communicated to a third party for a sale, merger, reorganisation or financing of all or part of our business

3. How do we use Personal Information?

We may use Personal Information solely for the purposes outlined in this Notice, or for other purposes consistent with these initial purposes. These purposes are communicated to the individual before Personal Information is collected.

The purposes below may be essential to providing products and services to the individual.

Categories	Purposes
Know who the individual is	Identity verification and authentication Ensuring Personal Information is complete, accurate and up to date Identification throughout our affiliates
Establish a relationship with the individual	Contact individual and answer questions Understand needs and advise Analyse requests for products or services Establish or verify credit Determine eligibility for a product or service Determine if a product or service is right for the individual Establish the cost of a product or service
Maintain the relationship with the individual	Manage file and process applications, pre-qualifications, transactions and other requests related to mortgage financing and insurance Process payments Process insurance claims Handle complaints or dissatisfaction Transfer file to another broker, agent or representative, if necessary
Application for employment or consulting work	Receive, process and analyse job applications
Manage risks	Detect, prevent and contain unauthorised activities and cyber threats Monitor business practices for quality assurance Verify transactions for compliance Meet our contractual requirements Train our employees, brokers, agents and representatives Insuring certain risks
Comply with laws	Detect, prevent and contain illegal activities, including fraud, money laundering and terrorism financing Comply with our legal obligations and court requirements Comply with regulatory authorities and organisations

Some purposes are optional. The individual may consent to them for an improved client experience and to obtain offers that meet its needs. We must obtain consent to collect, use and communicate Personal Information for the following purposes:

Categories	Purposes
Improve our products and services and provide a customised client experience	Understand how our products and services, including our websites, are used in order to improve them Consult individuals to learn about their experience and interactions with us Consult individuals to make our products and services more useful and effective Identify differences and similarities between the individual and our other clients
Keep the individual informed about our products and services, promotions, contests and events	Understand the individual’s current products and services portfolio in order to offer other relevant products and services Contact the individual with the desired frequency and means Keep the individual informed of relevant promotions, contests and events

To withdraw consent for any of the above purposes, the individual can do so by clicking an unsubscribe link (for example at the bottom of an email they receive), by visiting a preference centre (for example via the cookie management link on our websites) or by contacting us using the procedure described in Section 10 below.

3.1 Who has access to Personal Information?

Access to Personal Information is kept to a minimum and is limited to our employees, brokers, agents and representatives who need to access it to perform their duties.

These people are trained to protect the confidentiality of Personal Information and are committed to comply with our policies and this Notice. We regularly review their access rights according to their roles and responsibilities to ensure that access to Personal Information is still needed.

4. To whom do we communicate Personal Information?

To fulfil the purposes outlined in this Notice, we may communicate Personal Information to the third parties identified below. In all circumstances, only the minimum amount of Personal Information required is communicated to fulfil the required purpose. We will not sell, rent or trade Personal Information with any third party under any circumstances.

To insure the security and confidentiality of Personal Information, prior verifications are performed and contractual agreements are in place with third party service providers.

Third Parties	Purposes
Trusted service providers to assist us in operating our business	Application, data hosting, IT and telecommunication infrastructure IT security services Analytics and marketing platforms Payment processors Legal, accounting and other professional advisors
Financial institutions and other lenders	Provide and manage mortgage loans and proposals
Credit bureaus and reporting agencies	Assess and report on individual’s credit
Insurers	Provide mortgage loan insurance, life insurance, home and auto insurance and proposals
Appraisers	Provide real estate property assessments and evaluations
Collection agencies	Recover our debts
Authorities	When required by law, court order, subpoena, search warrant, government investigation or other lawful request. When required by regulatory authorities or organisations To law enforcement or emergency services any activity that we believe to be unlawful or pose a risk to the safety, rights or property of individuals or organisations.
Others	To a person who has a product or service with us from which the individual is benefitting To a person who is authorised to act on behalf of the individual, for example under a power of attorney or similar legal authority.

4.1 Is Personal Information communicated outside Canada?

We store Personal Information primarily in Canada. In some situations, we may communicate Personal Information outside of Canada, to a service provider located in another country.

When Personal Information is communicated to another jurisdiction, it is subject to applicable local laws. In all cases, we ensure that our contract with the service provider and the law of the applicable jurisdiction adequately protect Personal Information. When required, we perform privacy impact assessments.

5. For how long is Personal Information kept?

We retain Personal Information only as long as necessary to fulfil the purposes for which it was collected, and to meet our legal obligations. We have established retention periods that vary depending on the type of Personal Information, the purposes of collection, our legal and regulatory obligations and the time needed to protect our rights in the event of litigation.

For serious and legitimate purposes, we may anonymise certain Personal Information before destroying it and keep a copy. Once the information is anonymised, it can no longer be used to identify an individual, directly or indirectly. and is therefore no longer considered Personal Information. This information can then be used to improve our product and services, identify trends and establish performance indicators, among other things.

When Personal Information is no longer needed, we destroy or erase it using secure methods.

6. How is Personal Information protected?

We implement appropriate technical, administrative, and physical security and privacy measures to protect Personal Information against unauthorised access, use, communication, alteration or destruction, including:

Types	Measures
Technical measures	Passwords and multi-factor authentication Data encryption at rest and in transit Role-based access controls Suspicious activity monitoring Security logs Digital certificates Malware detection and prevention Vulnerability testing and management Network security (firewalls, virtual private networks and device management)
Administrative measures	Code of conduct for people who have access to Personal Information Access to Personal Information limited on a need-to-know and least privilege basis Training and awareness for people who have access to Personal Information Information security and privacy policies and procedures Secure coding best practices for developers Security and confidentiality incident management plan Privacy impact assessments on new systems and processes Service provider due diligence and assessment Security assessments and audits
Physical measures	Access cards for sensitive areas File cabinet locks Surveillance cameras in office buildings Secure destruction of documents and media containing Personal Information Security guards

Despite these measures, no system can be guaranteed to be completely secure. In the event of a confidentiality incident that presents a risk of serious harm, we will notify affected individuals and the competent privacy regulatory authority, as required by law.

7. How do we use cookies and other tracking technologies?

Our websites and applications may use cookies, web beacons, pixels, and similar technologies to insure and improve their functionality, analyse usage and serve relevant content, including advertising. See Section 2.3 for examples of information collected.

Cookie preferences can be managed through our cookie consent tool on our websites and via the user’s browser settings. Please note that disabling certain cookies may affect the functionality of our services.

8. What are the rights related to Personal Information?

An individual has several rights regarding the Personal Information we hold about them, including:

Rights	Description
Access	Confirm the existence and obtain a copy of their Personal Information.
Rectification	Request that we correct Personal Information that is inaccurate, incomplete or equivocal, or if collecting, communicating or keeping that Personal Information is not authorised by law.
Deletion	Request that we delete the Personal Information. We will delete the Personal Information if we have fulfilled the purposes for which it was collected.   If we are asked to delete Personal Information for which the purposes of collection have not yet been fulfilled, we will no longer be able to provide the related products and services.   In all cases, we may retain the Personal Information in order to meet our legal and regulatory obligations and protect our rights in the event of litigation.
Withdraw consent	Withdraw consent for the collection, use and communication of Personal Information, subject to legal restrictions.   We will no longer be able to offer products and services if consent is withdrawn for a purpose that is essential to the relationship with that individual (see Section 3).   For optional purposes, consent may be withdrawn at any time, without adversely affecting the relationship (see Section 3).
De-indexation	Request that we cease disseminating Personal Information, or de-index any hyperlink to it, if such dissemination is illegal or causes serious injury to the individual.
Data portability	Request certain computerised Personal Information, collected directly from the individual, in a structured, commonly used technological format.
Automated decisions	Request information and submit observations, when an important decision concerning the individual is based exclusively on an automated processing of their Personal Information, and such decision has been communicated to the individual.
Lodge a complaint	An individual may file a complaint if they feel that we have mishandled their Personal Information. We will take the time to analyse the complaint and work with them to resolve the situation.   A complaint can also be filed with the competent privacy regulatory authority.

To exercise any of the above rights, the individual can submit a written request following the procedure described in Section 10 below.

In all cases, we will need to validate the identity of the individual making the request.

9. Can our Privacy Notice Change?

We may review this Privacy Notice from time to time, as required to keep current with applicable laws and regulations, standards, new technologies and customer concerns.

Any changes are effective as of the date indicated on the Privacy Notice and will be communicated by posting the revised Notice on our websites. If the changes are material, we will provide a more prominent notice and inform our clients directly by other means.

Continued use of our products and services, including our websites, after the effective date of any changes constitutes acceptance of the revised Notice.

10. Questions or Requests

We have designated a Privacy Officer responsible to oversee compliance with this Notice and applicable privacy legislation.

For questions, concerns, or requests regarding this Privacy Notice or our privacy practices, individuals may use this form or contact our Privacy Officer at:

M3 Group
Privacy Officer
525 Avenue Viger West,
Montreal (Quebec) H2Z 1G6
Email: privacy@m3-grp.com

We will acknowledge receipt of a request from any individual promptly and aim to resolve all inquiries within 30 days, or as required by law.

---

¹ M3 Group is primarily composed of the following entities: Invis Inc., The Mortgage Alliance Company of Canada Inc., Mortgage Intelligence Inc., Multi-Prêts Mortgages, Verico, Simplinsur and M3 Tech. The updated list is available on our website at https://www.m3-grp.com/#Brands

² The collection of biometric data is strictly regulated by law and, in addition to specific protection measures, requires the explicit consent of the person concerned.