Law 25 (Loi 25) compliance

1. Loi 25 overview

Quebec’s Law 25 (formerly Bill 64), the Act to modernize legislative provisions as regards the protection of personal information, reforms the rules governing how organizations in the private sector collect, use, share, and protect personal information about Quebec residents. The main provisions came into force in September 2022, with additional requirements added in September 2023 and September 2024.

RK Assurance is committed to complying with Loi 25 in everything we do as a Québec-licensed insurance brokerage. This page describes how we meet our obligations under the Act.

2. Person responsible for the protection of personal information

Loi 25 requires every organization to designate a person responsible for the protection of personal information (the “Privacy Officer”). At RK Assurance, that person is:

• Title: Privacy Officer, RK Assurance
• Email: confidentialite@rkassurance.ca
• Phone: 514-360-4420
• Mail: 247 Av. Dunbar #202, Mont-Royal, QC H3P 2H4

Our Privacy Officer is the single point of contact for any question, request, or complaint related to your personal information.

3. Categories of personal information we collect

As an insurance brokerage, we collect personal information in the following categories:

• Identity: name, date of birth, language preference.
• Contact: mailing address, phone, email.
• Risk and underwriting information: driving record, vehicle details, property details, business operations, prior claims, prior coverage.
• Financial: banking and payment details for premium collection.
• Web and analytics: IP address, browser and device info, page-level analytics (only where you have consented).

4. Retention schedule

We retain personal information only for as long as we need it for the purpose for which it was collected, or as required by law:

• Active client files: for the duration of the brokerage relationship.
• Closed client files: a minimum of seven (7) years after the relationship ends, per AMF and insurance regulations.
• Quote requests that do not become policies: up to twenty-four (24) months unless you object.
• Web analytics: up to twenty-six (26) months.

At the end of the retention period, information is securely destroyed or anonymized.

5. Automated decision-making

RK Assurance does not make automated decisions about insurance approval or pricing. Quotes are produced by insurer systems and reviewed by licensed brokers. Final coverage decisions are made by the insurer (which may use its own automated underwriting); brokers advocate on your behalf. You can ask us, or the insurer directly, what factors went into a decision that affects you.

6. Cross-border and out-of-province processing

Before sending personal information outside Québec, we conduct the assessment required by Loi 25 to confirm that the information will receive a level of protection equivalent to what it would receive in Québec.

• Website hosting: hosted in data centres located in Toronto, Canada.
• Email and operational systems: may use service providers with infrastructure outside Québec, governed by contractual protections.
• Insurers: personal information shared with an insurer to place coverage is handled under that insurer’s own Loi 25-compliant privacy program.

7. Confidentiality incidents (data breaches)

If a confidentiality incident presents a risk of serious harm, we will:

1. Take immediate steps to limit and contain the incident.
2. Notify the Commission d’accès à l’information du Québec.
3. Notify any affected person without delay.
4. Record the incident in our internal register, kept in line with the Act.

8. How to exercise your rights

Under Loi 25 you have the right to access, rectify, withdraw consent, request deletion, and request that your information be communicated in a structured technological format (data portability, in force since September 2024). To exercise a right, contact our Privacy Officer using the details below. We respond within thirty (30) days.

9. How to file a complaint

If you believe your personal information has been handled improperly:

1. Contact our Privacy Officer first so we can investigate and try to resolve the issue directly.
2. If you are not satisfied, you may file a complaint with the Commission d’accès à l’information du Québec.

10. Our last compliance review

Our last internal Loi 25 compliance review was completed in May 2026. We review our practices at least once a year, and whenever we materially change how we collect or use personal information.