General policies and legal notices
This page is a translation of the official French text, which prevails in case of any discrepancy.
Last updated: February 28, 2026
At 9498-0356 Québec Inc., carrying on business under the names “ZenFi Capital”, “Groupe ZenFi” or “ZenFi”, we attach great importance to the privacy of our clients and users. This policy explains how we collect, use, disclose and protect your personal information when you use our website (https://zenfi.ca) or call on our mortgage brokerage services.
By using our website or our services, you accept the practices described in this policy. If you do not agree with them, please do not use our site or our services.
1. Collection of information
a. Information you give us directly: We collect the personal information you send us when you request a consultation or fill in a contact form, in particular: your name, email address, phone number, mailing address, and financial information relevant to your mortgage file (income, debts, property value, and so on).
b. Information collected automatically: When you browse our site, we may collect certain non-personal data such as your IP address, the browser you use, the pages you view and the length of your visit, for analytics purposes.
2. Use of information
We use the information we collect to:
- Assess your eligibility and process your mortgage refinancing request;
- Communicate with you about your file and answer your questions;
- Send you marketing communications, with your consent;
- Improve our website and our services;
- Meet our legal and regulatory obligations under the Loi sur la distribution de produits et services financiers (LDPSF), Quebec’s act respecting the distribution of financial products and services, and under the guidelines of the AMF, Quebec’s financial regulator;
- Carry out the administrative processing of your documents with the help of technological tools (see section 5 below).
3. Sharing of information
We do not sell, rent or trade your personal information with third parties for commercial purposes. However, as part of the processing of your file, we may share your information with:
- Our banking partners and lenders, to the extent needed to obtain financing;
- Technical service providers acting as subcontractors (see section 5);
- The competent regulatory authorities (in particular the AMF), where the law requires it.
If your file is covered by an exclusive brokerage contract, the confidentiality provisions of that contract will prevail over this public policy with respect to the processing of your mortgage file.
4. Security of information
We put appropriate security measures in place, both technical and organizational, to protect your personal information against unauthorized access, disclosure, alteration or destruction. Your data is encrypted in transit and at rest by our technology providers.
No method of transmission or storage on the Internet is guaranteed to be 100% secure. We nonetheless take every reasonable precaution to protect your data.
5. Use of artificial intelligence tools and technology subcontractors
This section was added in compliance with Loi 25 (LPRPSP), Quebec’s privacy law, and with the AMF’s requirements on cybersecurity and data management (F-117).
As part of our internal operations, Groupe ZenFi uses advanced technological tools to make the administrative processing of documents easier and to improve the efficiency of our processes. Those tools include, in particular, artificial intelligence (AI) solutions.
a. AI-assisted processing: We use artificial intelligence tools to assist our brokers in the analysis and administrative processing of your mortgage documents (bank statements, notices of assessment, identity documents, and so on). That processing is always supervised by a member of our team: no automated decision affecting your file is made without the involvement of a qualified broker.
b. AI provider, Anthropic (Claude): Our main AI tool is provided by Anthropic, PBC, an American company. As part of our use of this tool in its commercial version (Claude for Work), your data is not used to train Anthropic’s AI models.
c. Data location, United States: The data processed by Anthropic’s AI tools is hosted and processed on servers located in the United States. As a Quebec firm, we have an obligation to inform you of this under Loi 25. Anthropic meets high data protection standards, including encryption in transit and at rest, and operates under Commercial Terms that prohibit the use of your data for training purposes.
d. Storage of client documents, Zoho WorkDrive: Your documents are kept in our secure document management system, Zoho WorkDrive, provided by Zoho Corporation. Zoho is SOC 2 Type II and ISO 27001 certified, and its servers are available in the American and international regions. Your documents are encrypted and accessible only to authorized Groupe ZenFi staff.
e. CRM, Zoho CRM: Your contact information and the follow-up on your file are managed in Zoho CRM, which is subject to the same security standards as Zoho WorkDrive.
f. Contact forms, Web3Forms (India, servers in the United States): Submissions from the contact forms on our website (name, email, phone number, free-text message) are routed by Web3Forms, operated by Web3Creative, a company registered in Palakkad, Kerala (India). Web3Forms’ application servers are located in the United States (US-East region) and the logs containing personal information are deleted roughly every two months. To date, Web3Forms has not published a SOC 2 or ISO 27001 attestation, nor any participation in the EU-US Data Privacy Framework. We therefore limit the information sent to this service to what you enter voluntarily in the form.
g. Web hosting and bot protection, Cloudflare (United States): Our website is hosted on Cloudflare Pages, some server functions run on Cloudflare Workers, and we use Cloudflare Turnstile for protection against automated bots. Cloudflare, Inc. has its head office in San Francisco (California, United States). Cloudflare is SOC 2 Type II, ISO 27001 and ISO 27701 certified, adheres to the EU-US Data Privacy Framework (DPF), to its UK extension and to the Swiss-US framework. Transfers outside the EEA (European Economic Area) are also covered by the European Union’s standard contractual clauses. Cloudflare undertakes contractually not to use your personal information for marketing or advertising purposes, and operates points of presence in several Canadian cities (Calgary, Halifax, Montréal, Ottawa, Toronto, Vancouver, Winnipeg).
h. Appointment booking, Calendly (United States): When you book a consultation with a broker, your contact details (name, email, phone number) are processed by Calendly, LLC (Buford, Georgia, United States). Calendly is SOC 2 Type II, SOC 3 and ISO/IEC 27001 certified; data is encrypted at rest with AES-256 and in transit with TLS 1.2 or higher. Calendly adheres to the EU-US Data Privacy Framework (DPF), to its UK extension and to the Swiss-US framework.
i. Advertising measurement, Meta (Facebook / Instagram, United States): When you consent through the marketing cookie banner, we send Meta Platforms, Inc. (Menlo Park, California, United States), through the Meta Pixel and the Conversions API, anonymized advertising events as well as identifiers encrypted with SHA-256 hashing from the information you gave us (email, phone, first name, last name). Your information is never sent to Meta in clear text. Meta adheres to the EU-US Data Privacy Framework (DPF) and to the Swiss-US framework. You can turn off marketing tracking at any time through the consent banner.
j. Consolidation simulator, Typeform (Spain): The consolidation simulator and the qualification forms used on our site are provided by Typeform SL (Barcelona, Spain), a company operating under the European Union’s General Data Protection Regulation (GDPR), which is considered equivalent to Loi 25. Typeform is SOC 2 Type II, ISO 27001, ISO 27017 and ISO 27018 certified. Typeform’s infrastructure is hosted by Amazon Web Services in data centres in the United States and in the European Union; transfers from the EEA are governed by the EU’s standard contractual clauses and by the UK addendum.
k. Email hosting, Microsoft 365 / Exchange Online (Canadian data centres): Our professional email service is hosted on Microsoft 365 / Exchange Online, operated by Microsoft Corporation (Redmond, Washington, United States). Our firm’s mailboxes are routed through Microsoft’s Canadian data centres, in accordance with Microsoft’s service agreements for tenants established in Canada. Microsoft 365 is SOC 2 Type II, ISO 27001 and ISO 27018 certified.
l. Internal file management application, Microsoft Azure (Canada Central): Our internal file management application (`app.zenfi.ca`) is hosted on Microsoft Azure App Service in the Canada Central region (Toronto). The data processed by this application therefore stays in Canadian data centres. Microsoft Azure is SOC 2 Type II, ISO 27001 and ISO 27018 certified.
m. Product analytics, PostHog (United States): We use PostHog Inc. (San Francisco, California, United States) to measure how our site is used, analyze conversion paths and improve the user experience. PostHog receives pseudonymized events (page views, clicks, form steps, session length) tied to a random identifier generated in the browser; no personally identifiable information (name, email, phone number) is sent to PostHog. PostHog is SOC 2 Type II certified and adheres to the EU-US Data Privacy Framework (DPF); its international transfers are also governed by the European Union’s standard contractual clauses. You can turn off this analytics collection by enabling the “Do Not Track” option in your browser or by blocking the `us.i.posthog.com` domain.
The full list of our technology subcontractors is available on request by writing to [email protected].
6. Cookies and similar technologies
Our website uses cookies and similar technologies to improve your browsing experience and analyze how the site is used. You can set your browser to refuse cookies, although some features of the site may then not work properly.
7. Links to third-party sites
Our site may contain links to third-party sites. We have no control over their content or their privacy practices, and we encourage you to read their privacy policy.
8. Your rights: Loi 25 (LPRPSP)
In accordance with the Loi sur la protection des renseignements personnels dans le secteur privé (Loi 25), Quebec’s act respecting the protection of personal information in the private sector, you have the following rights:
- The right to access your personal information held by Groupe ZenFi;
- The right to have inaccurate or incomplete information corrected;
- The right to have your information deleted, within the limits allowed by law;
- The right to withdraw your consent to the processing of your data at any time;
- The right to be informed of any communication of your information to a third party;
- The right to the portability of your data in a structured technological format, on request.
To exercise these rights, please contact us:
David Ponce, Person in Charge of the Protection of Personal Information
Email: [email protected]
Address: 9498-0356 Québec Inc., 2104-1569 Rue Saint-Hubert, Montréal, Québec, H2L 0H5
Phone: 514-586-6898
9. Reporting a confidentiality incident
In the event of a confidentiality incident (for example, a data breach) that presents a serious risk of harm, Groupe ZenFi undertakes to notify the Commission d’accès à l’information (CAI), Quebec’s privacy authority, and the individuals concerned, in accordance with the requirements of Loi 25.
10. Changes to this policy
We reserve the right to change this policy at any time. Any change will be published on this page with a revised update date. By continuing to use our services after the changes are published, you accept them.
COMPLAINT HANDLING POLICY
This policy falls under the provisions of the Loi sur la distribution de produits et services financiers (LDPSF) regarding the handling of complaints and the settlement of disputes.
1. Purpose of the policy
The purpose of this policy is to set up a fair and free procedure to ensure the handling of complaints made about Groupe ZenFi, its brokers or its employees. The firm undertakes to deal fairly with every dissatisfaction its clients report.
2. Definition of a complaint
A complaint is the expression of at least one of the following:
- A reproach directed at the firm, at one of its brokers or employees;
- The identification of potential or actual harm;
- A request for a corrective measure.
To be admissible, a complaint must be made in writing and clearly set out the subject of the dispute or the dissatisfaction.
3. First step: preliminary discussion
Before filing a formal complaint, the client is invited to discuss the dissatisfaction with the broker responsible for the file, or directly with the Compliance Officer:
Mr. David Ponce, Compliance Officer and Officer in charge of complaint handling
Email: [email protected]
Mr. Ponce acts as the firm’s designated representative (répondant) with the Autorité des marchés financiers (AMF).
4. Second step: filing and handling of the complaint
If the preliminary discussion does not resolve the dissatisfaction, the client may file a formal written complaint addressed to Mr. David Ponce at the email address above.
The AMF’s model form is available at the following address:
On receiving the complaint, the Officer in charge:
- Acknowledges receipt within 5 business days;
- Conducts an investigation and issues a written, reasoned response within one working month;
- Informs the client of the right to request the intervention of the AMF.
5. Third step: transfer to the AMF
If the client is not satisfied with the firm’s response, the client may ask for the file to be transferred to the AMF. That right is exercised within the year following receipt of the final response, or at the expiry of the one working month period.
6. Complaints register
The firm keeps a complaints register, updated by the Officer in charge of complaint handling. This register is kept in accordance with the AMF’s regulatory obligations.
LEGAL NOTICES
Company identification
Legal name: 9498-0356 Québec Inc.
Business names: ZenFi Capital, Groupe ZenFi, ZenFi
Address: 2104-1569 Rue Saint-Hubert, Montréal, Québec, Canada, H2L 0H5
AMF number: 3003043028
Email: [email protected]
Phone: 514-586-6898
Legal disclaimer
The information available on the zenfi.ca site is provided for information purposes only and does not constitute financial, legal or professional advice. Since every situation is different, we invite you to speak with one of our experts.
Groupe ZenFi accepts no liability arising from a misreading of the information on this site, from the use of inaccurate information, or from the use of links to third-party sites.
Intellectual property
All content on this site (text, images, logos, graphics, videos) is the exclusive property of Groupe ZenFi and is protected by the applicable Canadian and international intellectual property laws. Any unauthorized reproduction is strictly prohibited.
Applicable laws
This site and all of Groupe ZenFi’s activities are governed by the laws in force in the province of Quebec and in Canada. In the event of a dispute, the parties agree to submit to the exclusive jurisdiction of the courts of the province of Quebec.
Groupe ZenFi, 9498-0356 Québec Inc. | AMF 3003043028 | [email protected] | 514-586-6898