Privacy Policy

Data protection declaration – general part

Protecting the privacy of our customers and visitors is our top priority. This privacy policy describes clearly and transparently how we collect, use, share and store your data, ensuring the highest level of security and compliance with all regulations when processing data.

The processing of personal data is carried out in full compliance with the General Data Protection Regulation (PIPEDA).

Processing of personal data

MASTERKREDIT (hereinafter “we”) processes your personal data in order to provide the services you have requested and to enable their optimal use. The type of processing depends on the type of service chosen.

To find out about the terms and conditions of our brokerage services, please read the General Terms and Conditions. Please refer to your contract for specific arrangements.

By using our brokerage services - for example by browsing the website or applying for a loan or insurance policy - you confirm that you have read and understood MASTERKREDIT's privacy policy.

MASTERKREDIT stores the history of interactions with the Services, including the channel through which the request was made and the dates and content of the communications exchanged.

If you apply for a loan or compare offers via MASTERKREDIT, your data will be forwarded to the partner financial institutions and insurance companies to process your request. These companies act as independent data controllers; We therefore ask you to consult the respective data protection declarations.

Links to external websites are provided as a service to the user. We assume no liability for the content and data processing on these third-party websites.

Person responsible for data processing

The person responsible for data processing in connection with the services is:
MASTERKREDIT
1000 Rue De La Gauchetière O, Bureau 2400, Montréal, QC H3B 4W5, Canada

In this privacy policy we explain how personal data is processed for each service offered and within our customer file.

Processing and legal basis

We collect data in order to provide the agreed services and to fulfill our contractual and legal obligations.

Any processing of personal data is based on a legal basis provided for by law.

If data processing is necessary to protect the legitimate interests of MASTERKREDIT or third parties, we will carefully weigh these interests against your rights. This includes the continuous improvement of our services, the maintenance of our customer relationships and security.

What personal data is collected?

The categories of personal data collected, the respective purposes and the applicable legal bases are detailed below:

Transfer of data to third parties

Your data will not be sold or passed on to third parties unless this happens in accordance with the conditions set out in this privacy policy, due to a legal obligation or with your express consent.

MASTERKREDIT The company is entitled to pass on data to the relevant authorities if there is a criminal investigation or legal regulations must be complied with.

We use contracted external processors for IT services, hosting, communication and support.

Where is my data processed?

The data will only be shared with the financial partners necessary to process your request and will never be resold for unauthorized advertising purposes.

Transfer to third countries: The data is predominantly stored within the European Economic Area (EEA). Any transfers outside the EEA will be made solely on the basis of Standard Contractual Clauses (SCC) approved by the European Commission.

Purpose of data processing

• Provision of services: User identification, compliance with anti-money laundering regulations and processing of application verification with credit institutions.
• Messages: Support and information on the processing status by telephone, SMS, email or via the messaging service.
• Direct marketing: Sending individual commercial offers, whereby you can object at any time.
• Advertising on external platforms: Creation of target group segments on partner advertising platforms (Google, Meta).
• Development of services: Aggregated analytics to optimize user experience and features offered.
• Security: Preventing unauthorized access, financial fraud and money laundering.
• Legal obligations: Compliance with applicable tax, accounting and credit regulations.
• Call recording: Purposes of quality control, training and review of completed processes.

Security and automated decision-making processes

We take the most modern technical and organizational measures (including encryption) to ensure the protection and integrity of your data.

Automated decision-making processes

Decisions based on algorithmic assessments of the credit parameters entered.

The algorithm automatically compares the parameters (income, age, credit profile) in order to forward the application to the appropriate credit institutions.

You can request a manual review of the automated review at any time by contacting our customer service team.

Your rights as a data subject

As a data subject, you have the following rights under the PIPEDA:

• Right to information: To obtain confirmation of the existence of the data and to receive a copy of it.
• Right to rectification: Request updating or correction of inaccurate information.
• Right to object: You can object to processing for advertising purposes at any time.
• Right to restriction: Data processing must be limited to the cases provided for by law.
• Right to deletion (“right to be forgotten”): Request the deletion of data that is no longer required, subject to the statutory retention requirements.
• Right to data portability: The right to receive your data in a structured and machine-readable format.

Data retention period

The data will only be stored for as long as is strictly necessary to pursue the purposes or as required by law.

• Estimates and simulations: 12 months.
• Contact details and system logs: 12 months.
• Activities in the field of insurance brokerage: 10 years + 1 year.
• Credit documents and anti-money laundering documents: 10 years.
• Data for marketing purposes: 36 months from the last interaction.
• Accounting and tax records: 6 years.