Governance of Personal Information

This publication sets out the governance rules for personal information at Canadian Wealth Creation Centre Inc. Quebec's Law 25 requires these rules to be published separately from the privacy policy, because a policy tells a client what happens to their information and governance rules tell them how the practice ensures it.

Quebec's Law 25 requires two separate publications, and most organisations publish only one.

A privacy policy tells a person what information is collected, why, who receives it and how to exercise their rights. That document sits at the privacy policy.

Governance rules tell them how the practice ensures the policy is actually followed: who is accountable, what the internal practices are, how incidents are handled, and what happens before information moves anywhere.

This page is the second document. It exists because the requirement is separate, and because a policy without governance behind it is a statement of intention.

Who is accountable

The person responsible for the protection of personal information holds this accountability, and Law 25 requires that their name and contact details be published, not the name alone.

That person is Mona Haddad, reachable at info@cwcc.ca, by telephone on 514-875-9444, and by post at the address published in the privacy policy. A request sent there reaches the person accountable for it rather than a queue. No reason is required for any request described here, and none will be asked for.

The responsible person's functions are: overseeing how personal information is handled, approving the practices set out below, responding to access and correction requests, assessing and reporting confidentiality incidents, and authorising any communication of information outside Quebec.

What is collected, and the principle behind it

Only what is necessary for a stated purpose. Law 25 does not permit collection because information might one day be useful.

This has one consequence worth naming, because it changed a form on this website. The previous version of the discovery meeting form asked whether a visitor was a Canadian citizen or a landed immigrant. That question is not necessary for any purpose here and has been removed. What determines whether a conversation can usefully happen is residency, because these contracts are available to residents of Canada and advisors are licensed provincially. Residency is now asked, with the reason stated beside it.

A form field that cannot be justified against a stated purpose does not belong on the form. That is the working test applied to every field on this site.

Consent attaches to a purpose, and there are several purposes, so there are several consents. A single acceptance covering everything is administratively convenient and is not what the legislation contemplates.

Consent is express, specific and informed. For anything beyond what is strictly necessary to deliver a service requested, it is sought separately and it is not bundled.

Non-essential technologies are off by default. Law 25 requires the highest privacy settings by default for a technological service offered to the public. Analytics and marketing categories load only after a person has affirmatively enabled them.

The rule is enforced by the build itself, not by a promise. This site is constructed so that no third-party request can fire before a choice is made: the build gate fails and the site does not publish if any would. What a person enables is what loads, and nothing else runs while the question is still open.

Retention

Information is kept only as long as the purpose requires, and then destroyed or anonymised.

Retention differs by category. Client file information is subject to periods set by insurance regulation and by professional obligations. Enquiry information from someone who did not become a client is kept for a much shorter period.

The periods applied to a particular file are given on request by the person responsible, and they match the privacy policy exactly. Two documents stating different retention periods would be a governance failure in itself.

Communication outside Quebec

An assessment is required before information leaves the province, not after, and not merely a disclosure that it does.

Law 25 requires a privacy impact assessment considering the sensitivity of the information, the purpose, the protections in place where it is going, and the legal framework of that jurisdiction.

This applies to ordinary web infrastructure, which is where most practices are exposed without realising it. Analytics, tag management, form processing, email delivery and hosting all frequently involve servers outside Quebec, and each is a communication of personal information.

That assessment is completed before any such communication takes place, and personal information is not communicated outside Quebec without one. The obligation is a live one rather than a theoretical one, because ordinary infrastructure raises it on any working website.

Service providers

Where a provider handles personal information on the practice's behalf, it does so under a written contract containing confidentiality undertakings, and the provider may not use the information for its own purposes.

The providers relevant to a particular file are identified on request by the person responsible. A provider that will not give those undertakings in writing is not engaged to handle personal information at all.

Confidentiality incidents

An incident is unauthorised access to personal information, unauthorised use, unauthorised communication, or loss of it.

A register of all incidents is kept, and each entry is retained five years, as the Act requires, and it is produced to the Commission d'accès à l'information on request. That includes minor incidents, not only serious ones.

Where an incident presents a risk of serious injury, the Commission and the affected people must be notified.

The register is an internal record rather than a website item. It is maintained by the person responsible, who assesses each incident and decides what notification the circumstances require.

Rights, and how they are exercised

A person may ask what information is held, ask for a copy, have inaccurate information corrected, withdraw consent, ask for deletion where retention is no longer justified, and receive computerised information in a structured format so it can be moved elsewhere.

Requests go to the responsible person, Mona Haddad, at info@cwcc.ca or 514-875-9444. The Commission d'accès à l'information can be approached directly where a person is not satisfied with the response, and no permission from this practice is needed to do that.

Training and review

Everyone handling personal information receives training on these rules, and the rules are part of what a new person is taken through before touching a file.

These rules are reviewed at least annually, and immediately on any change of provider, any new technology touching personal information, any change in the responsible person, and any confidentiality incident.

The review date appears at the foot of this page.

Why these rules are published

Law 25 requires governance rules to be published, and this page is written to be read rather than filed.

A household is entitled to see how its own information is handled. Setting the rules out in writing is what allows a reader to hold this practice to them, because a written statement of how a practice operates can be tested against what the practice actually does.

The person responsible is named and reachable. A reader who wants something done writes to a person rather than to a form or a general enquiry address, and that is the part of a governance publication anyone can act on immediately. Her name and her address appear at the head of this page.

Scope

These rules apply to Canadian Wealth Creation Centre Inc., trading as IBC Financial and as Financière CBI, and to everyone acting on its behalf.

They apply to personal information however it arrives: through this website, through a form, in a meeting, by telephone, by email, or from an insurer or distributor.

Law 25 applies regardless of where a head office sits. The federal Personal Information Protection and Electronic Documents Act applies to information crossing provincial or national borders in the course of commercial activity. Both are engaged here.

This publication is required by Quebec's Law 25 to be published separately from the privacy policy. It is not legal advice. Qualified Quebec privacy counsel should review both documents before the site launches.

A thirty-minute discovery meeting

A first conversation establishes whether this fits. No illustration is prepared and nothing is arranged.

Often the answer is no, and you will hear it during the call rather than in a proposal afterwards.

Hold a licence? To place business, deal directly with Canadian Wealth Creation Centre Inc. This page is for households.

By submitting this form, you consent to Canadian Wealth Creation Centre Inc. using the information you provide to respond to your request and arrange your meeting, including by text message to the number you give. See our Privacy Policy.

This form reaches Canadian Wealth Creation Centre Inc. Any meeting, any advice and any insurance product is provided by Canadian Wealth Creation Centre Inc., through its representatives certified by the Autorité des marchés financiers. IBC Financial is the company's education platform: it distributes no product and no financial service, and it gives no individualised advice.

Important disclosure

It does not suit everyone. The strategies described may not be suitable for all individuals. Suitability depends on personal financial circumstances, cash flow, risk tolerance, time horizon and objectives that can only be assessed through individual consultation.
This does not fit everyone, and I would rather say so plainly than let you find out later. It depends on your cash flow, your time horizon and what you are actually trying to do. Some of the people who ask me about it should not do it, and I tell them that.

Common questions

Why is this separate from the privacy policy?

Because Quebec's Law 25 requires two separate publications and most organisations publish only one. A privacy policy tells a person what information is collected, why, who receives it, and how to exercise their rights. Governance rules tell them how the practice ensures that policy is actually followed: who is accountable, what the internal practices are, how incidents are handled, and what happens before information moves anywhere. This page is the second document. A policy published without governance behind it is a statement of intention, and the separation exists so a reader can see the difference rather than being asked to assume the second half is there.

Who is responsible for the protection of personal information here?

Mona Haddad, inside Canadian Wealth Creation Centre Inc., whose functions are set out on this page: overseeing how personal information is handled, approving the internal practices, responding to access and correction requests, assessing and reporting confidentiality incidents, and authorising any communication of information outside Quebec. Law 25 places the role by default with the person holding the highest authority in the organisation unless it is delegated in writing, and a delegation does not reduce the organisation's own responsibility. Requests reach her at info@cwcc.ca, by telephone on 514-875-9444, or by post at the address published in the privacy policy. The Commission d'accès à l'information can also be approached directly, and no permission from this practice is needed to do it.

What do these governance rules actually cover?

Five things, and they are the ones Law 25 expects an organisation to be able to describe in writing. Who inside the firm may see personal information, and for what purpose. How long each category is kept, and what happens to it at the end of that period. How a confidentiality incident is recognised, recorded, assessed and reported. What has to be considered before any information is communicated outside Quebec. And how a service provider is chosen, what it may do with what it holds, and what binds it. Setting those out together is what turns a privacy policy from a statement of intention into something a reader can hold this practice to.

What counts as a confidentiality incident, and what has to happen?

An incident is unauthorised access to personal information, unauthorised use, unauthorised communication, or loss of it. Law 25 requires a register of all incidents, retained for five years and producible to the Commission d'accès à l'information on request, and that register covers minor incidents rather than only serious ones. Where an incident presents a risk of serious injury, both the Commission and the affected people must be notified promptly. The commonest incident in any practice is an email sent to the wrong recipient, which is why the handling of client correspondence is the part of the internal practice looked at most often here.

Does my information leave Quebec?

Possibly, because ordinary web infrastructure often sits outside the province. Analytics, tag management, form processing, email delivery and hosting frequently involve servers elsewhere, and each of those is a communication of personal information. Law 25 requires a privacy impact assessment before information leaves, considering its sensitivity, the purpose it is being sent for, the protections in place where it is going, and the legal framework of that jurisdiction. That assessment belongs to the internal practices this page describes, and it is done before a new tool is put in place rather than afterwards. A reader may ask what is in use on either website and will get a straight answer.

What can I do if I am not satisfied with the response to a request?

Approach the Commission d'accès à l'information directly. No permission from this practice is needed to do that, and the route exists whether or not anybody here mentions it. The underlying rights are broad: you may ask what information is held, ask for a copy, have inaccurate information corrected, withdraw consent, ask for deletion where retention is no longer justified, and receive computerised information in a structured format so it can be moved elsewhere. Requests go to Mona Haddad, the person responsible, at info@cwcc.ca or 514-875-9444. The federal Personal Information Protection and Electronic Documents Act also applies where information crosses provincial or national borders in commercial activity.

Last reviewed 2026-08-21.