Privacy policy

1. Who we are

The Sommet Protection website (https://www.sommet-protection.ca) is operated by Sommet Protection, an life and health insurance marketing and referral company. We are neither a firm nor an insurer: our service consists of passing your request on to a partner financial security advisor — independent, certified by the Autorité des marchés financiers (AMF) and attached to their own registered firm. That advisor pays us for the referral.

Privacy Officer: confidentialite@sommet-protection.ca. This person is responsible for applying Quebec's Act respecting the protection of personal information in the private sector within our organization.

2. Information we collect

When you fill out our quote form, we collect:

• your contact details: first name, mobile number and, if you provide it, email; then, if you answer the optional questions, last name and postal code;
• your request: type of coverage and, optionally, approximate coverage amount, current coverage (amount, wish to replace it), age range, preferred call time and notes;
• depending on the coverage and clientele, a few optional qualification questions answered in ranges: purpose of the coverage, approximate monthly budget, income range, order of magnitude of your estate or business, existing group coverage;
• proof of your consents: date, time, IP address and browser;
• marketing attribution data: landing page, visit source (e.g. Google Ads campaign) and click identifier (gclid).

We do not request detailed medical information, social insurance numbers or financial statements: only approximate ranges are collected.

In the chat, your request is created after you accept the general terms and conditions and confirm submission at the final step. Conversation answers remain in the page’s memory until submission. If a created request remains incomplete, up to two reminders may be sent through the authorized contact channel with a secure link to finish it; reply STOP to a text to stop receiving them. The "Call me now" button collects the same minimal information (first name, mobile) for a quick call-back. The life insurance calculator runs in your browser: the amounts you enter are only transmitted if you then choose to request a quote. When mobile verification is enabled, a six-digit code is texted to you; it is stored hashed for ten minutes.

Optionally and with your separate express consent, a few health details (approximate number of prescription medications, tests underway or planned, pending results, tobacco or vaping use in the past 12 months) are stored separately and available only to the advisor handling your request and authorized administrators. They never appear in unassigned offers, emails, texts, advertising tools or scores. You may continue without answering or withdraw your agreement before sending. No diagnosis, medication name or medical document is requested. The form does not ask for your date of birth.

3. Purposes

• pass your request on to a partner financial security advisor who will contact you by phone, email or text message;
• allow that advisor to prepare your life and health insurance needs analysis;
• keep proof of your consents and meet our regulatory obligations;
• measure the effectiveness of our advertising campaigns (with your consent to optional cookies);
• follow up on your request, according to your contact details, chosen channel and applicable consent. The possible automated messages are: an acknowledgement (email); an assignment notice naming the partner advisor and their firm (text or email); up to four texts and eight educational or follow-up emails over 90 days; up to two “finish your request” reminders if it remains incomplete; up to three interest-check texts (reply 1 or 2) started by the advisor; one advisor rating text (1 to 5) after your first conversation. Every text states that STOP ends the messages;

4. Consent

Consent is requested at collection through two separate, unticked checkboxes: the required one authorizing the transfer of your request to a partner advisor (linked to the general terms and conditions), and an optional one giving express consent to commercial communications. Follow-up related to your request (reminder texts, educational or follow-up emails, using the contact details provided) relies on your request within applicable implied-consent limits (six months), unless you gave express consent. You can unsubscribe using the email link or by replying STOP to a text. Neither checkbox enables optional cookies or navigation sharing. You may withdraw consent at any time by writing to confidentialite@sommet-protection.ca; we will then stop the processing concerned and delete your information, subject to retention periods required by law.

5. Who we share your information with

The partner advisor assigned to your request. This is an independent third party attached to their own AMF-registered firm; they receive your contact details and the content of your request, and become responsible for that information under their own obligations (AMF, Law 25) as soon as they receive it. They pay us for the referral. Your information is also accessible to our authorized staff (assignment, follow-up, support). To operate the site, we use service providers acting on our instructions:

• Supabase (database and secure advisor portal) — hosted in the Canada (Montreal) region;
• Vercel (website hosting) — servers located in Canada (Montreal) and the United States (content delivery network);
• Resend (email) and Twilio (text messages, connection calls and voicemail) — United States; they deliver the acknowledgement and follow-up messages addressed to you (your first name, email address or phone number are therefore transmitted to them) as well as internal notifications to advisors, which contain only your first name, product type and region. When the advisor calls you from the portal or you call our number, Twilio connects the call to them; these calls are not recorded. If no one answers, you may leave a voicemail: that voice recording is stored with Twilio, accessible to the advisor and authorized staff, then deleted according to the retention period below;
• Google (Google Ads, Google Analytics) — only if you accept optional cookies. To measure ad conversions, your email address may then be sent to Google in hashed (irreversible) form. No health-related answer is ever sent to Google and no personalized advertising is enabled.

Some of these providers are located outside Quebec. These transfers are covered by contractual agreements with each provider and by a privacy impact assessment kept up to date by the Privacy Officer. Apart from the partner advisor described above, we never sell, rent or share your information: it is not passed on to marketing lists or to other companies.

6. Retention

Requests that do not lead to a business relationship are kept for 24 months from the last contact, then securely destroyed. When an insurance contract is concluded, the partner advisor and their firm keep the information according to their own regulatory obligations.

7. Your rights

• access the information we hold about you and obtain a copy;
• have inaccurate or incomplete information corrected;
• withdraw your consent or request that dissemination cease;
• request portability of your information in a structured technological format;
• file a complaint with our Privacy Officer and, if unsatisfied, with the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

8. Optional journey sharing with your advisor

A separate choice, off by default, shares only categories of pages and coverage viewed on Sommet, calculator use without amounts, and available origin. Collection starts after consent; prior activity is not reconstructed. Refusal does not prevent a quote request. Only the assigned advisor and authorized staff can view this summary. Observed activity remains separate from declared needs and never implies a diagnosis, psychological profile or eligibility decision.

No activity on other websites, keystrokes or field replay is collected. Birth dates and health details are excluded. Browser session data expires after 30 minutes without a new observation; the submitted summary expires after 90 days. Turning off sharing or resetting cookies clears the local journey. After submission, ask the Privacy Officer to remove it without cancelling your request. Withdrawing the request also removes its journey. Server cleanup runs through the periodic task; access is blocked immediately at expiry.

9. Cookies and tracking technologies

The site uses strictly necessary cookies (security, remembering your cookie choice). Optional audience measurement and advertising cookies (Google Ads, Google Analytics) are off by default and are set only if you click “Accept” in the banner (before that click, the Google tag runs in “consent denied” mode: no cookies, no identifiers; only aggregated, identifier-free signals — for example that a request was sent — are used for modelled statistics). You can change your choice at any time using the “Manage cookies” link at the bottom of every page. We do not profile you based on your health-related answers.

10. Security

Your information is transmitted over an encrypted connection (TLS), stored in a database encrypted at rest and accessible only after authentication, on a least-privilege basis. Notifications sent to advisors never contain your full contact details. In the event of a confidentiality incident presenting a risk of serious injury, we will notify the Commission d'accès à l'information and the persons concerned, as required by law.

11. Automated decisions

Your request is assigned to an advisor by automatic rotation among available advisors; if you recently made a request, it is routed to the same advisor. An indicative score (0 to 100), based on how complete your request is and on your region, helps the advisor organise call-backs. These operations have no effect on the products or terms that may be offered to you, and you may ask us to review them by writing to us.

12. Changes

We may update this policy; the update date appears at the top of the page. Significant changes will be announced on the site.