My favorites

No favorites added

Privacy policy

Protection of Personal Information — Groupe Gamache

Effective date: September 16, 2026

1. Purpose and scope

Centre du Camion Gamache, Groupe Gamache and all of their divisions, subsidiaries and websites ("Gamache", "we") describe in this policy how they collect, use, communicate, retain, protect and destroy the personal information of the individuals with whom they do business, in accordance with the Act respecting the protection of personal information in the private sector (Québec) as amended by Law 25 and with applicable Canadian legislation. It applies to all personal information collected by Gamache, regardless of the medium, as well as to any person doing business with Gamache (visitors, customers, buyers/sellers, financing applicants, suppliers, partners, candidates, employees, virtual assistant users, etc.), and to all websites and digital platforms operated by Gamache, in particular groupegamache.com, gamex.ca and financementgamache.com.

2. Key definitions

Personal information: any information that makes it possible to identify, directly or indirectly, a natural person (name, contact details, financial information, vehicle information, purchase history, location, IP address, chatbot conversation history, etc.).
Sensitive personal information: information which, by its nature — in particular medical, biometric or otherwise intimate — or because of the context of its use or communication, gives rise to a high reasonable expectation of privacy. Enhanced protective measures are applied to it.
Processing: any operation carried out on personal information (collection, use, communication, retention, destruction, etc.).
Virtual assistant (chatbot): an AI-powered conversational service, available on certain Gamache websites, which answers general questions, helps find a vehicle or a part, and forwards qualified requests to a representative.

3. General principles

Gamache is accountable for the information it holds, collects only what is necessary for its activities, uses information solely for the purposes for which it was collected (unless otherwise authorized by law), takes reasonable steps to keep it accurate and up to date, and informs the individuals concerned of the information collected, the purposes pursued, the categories of persons having access to it, the retention period and their rights.

Depending on the nature of our activities, we may collect: name, contact details, company, language preference, financial information or information related to a financing application, information about the vehicles sought, request history, and any information voluntarily provided to our team or to the virtual assistant. This information is obtained through web forms, by telephone, by email, in person, at the dealership, via the chatbot, during promotional activities or events, through advertising platforms, or by means of cookies. Where consent is required, it is requested directly from the individual concerned. It must be manifest, free and informed, given for specific purposes, requested separately for each of those purposes and for the necessary duration. Express consent is obtained where a positive action is required; implied consent may apply to uses and communications necessary for the primary purposes clearly announced at the time of collection. Consent may be withdrawn at any time, subject to applicable legal or contractual obligations and to the consequences explained beforehand.

5. Virtual assistant (chatbot) and artificial intelligence

Use of the chatbot is entirely voluntary. Depending on the conversation, it may collect the questions asked, the answers generated, purchase preferences (vehicle type, budget, timeline) and, with explicit consent, first name, email or telephone number. This information is used to answer questions, find a vehicle, forward a qualified request, provide follow-up, improve service and prevent misuse. Before the first message is sent, a clearly displayed privacy notice sets out the information collected, the purposes of the processing and a link to this policy. After reading this notice, sending a first message constitutes consent to the processing necessary for the operation of the service. The collection of contact details or any optional use requires separate consent where required by law. Users may end the conversation at any time and request the deletion of their history from the Privacy Officer, subject to legal retention obligations.

The chatbot is not intended for persons under 14 years of age. A person under 14 must not use it or provide personal information without the authorization of the person having parental authority. Any information collected in breach of this requirement is deleted as soon as possible once brought to Gamache's attention. AI is used exclusively as a communication support tool (understanding questions, searching for information, guiding users) and may generate answers containing errors; a human representative may take over. No legal, financial or commercial decision (sale, purchase, financing, price, firm quote or appointment) is made exclusively by an automated system — each one is validated by a Gamache representative.

6. Disclosure of personal information

Gamache never sells personal information to third parties. It is disclosed only to the persons or organizations that need it in order to provide a service or to comply with a contractual or legal obligation, and internal access is limited to employees whose duties require it (need-to-know principle). Gamache uses specialized suppliers (hosting, cloud computing, email, marketing, statistics, financing, customer service, chatbot, IT security), each bound by a contractual agreement setting out the authorized purposes, security measures, confidentiality, the prohibition on use for other purposes — in particular for training their own models — the obligation to report any incident, and the destruction of information at the end of the mandate. Technology suppliers used by the chatbot and its related services, acting as technical subcontractors:

Supplier	Role
InnovXAI Inc.	Chatbot development and maintenance
MongoDB Atlas	Conversation and inventory database
Cohere Inc.	Semantic search
Vercel Inc.	Web widget hosting
Auth0 / Okta	Dashboard authentication
Anthropic	Artificial intelligence engine
OpenAI	Artificial intelligence engine
Railway	API service hosting
Sentry	Technical monitoring and error logging
Microsoft Clarity	Website usage measurement and analysis

7. Transfers outside Québec

Certain suppliers process or host information outside Québec, in Canada or in the United States. Gamache has carried out a privacy impact assessment for the chatbot, the use of AI and these transfers. That assessment takes into account, among other things, the sensitivity of the information, the purposes pursued, the protective measures in place and the legal regime applicable in the territory concerned. Gamache puts in place the contractual and security measures necessary to ensure that the information receives adequate protection.

8. Cookies and local storage

Gamache websites use essential, functional, analytical, performance, advertising and security cookies, which can be managed through the consent banner or browser settings. Non-essential cookies and technologies are disabled by default and are enabled only after the user's consent. No advertising cookie specific to the chatbot is placed. The chatbot widget may record the following non-advertising technical items in the browser's local storage:

Function	Purpose
Session identifier	Maintain the conversation across multiple visits
Consent preference	Retain the consent choice
Language preference	Retain the selected language

9. Analytics and measurement tools

Gamache uses Google Analytics, Google Tag Manager, Google Ads, Meta Pixel and Microsoft Clarity in order to obtain statistics, improve the user experience and optimize advertising campaigns. These tools remain disabled until the user consents to them through the consent banner. Wherever possible, information is aggregated or anonymized before analysis.

10. Retention, destruction and security

Information is retained only for as long as necessary for the purposes for which it was collected or in order to comply with legal obligations, and is then securely destroyed or anonymized. For the chatbot, deletions are applied automatically, including in secondary systems, according to the following timeframes: conversation history after 365 days, prospect contact details after 730 days and technical logs after 30 days. Gamache applies reasonable administrative, physical and technological security measures: access control, authentication, logging, encryption, firewalls, monitoring, backups, vulnerability management and employee training. In the event of a confidentiality incident presenting a serious risk of injury, Gamache limits the consequences, documents the incident, notifies the Commission d'accès à l'information du Québec and the individuals concerned where the law so requires, and puts corrective measures in place.

11. Privacy Officer

The Privacy Officer ensures compliance with applicable legislation and with this policy: approval of internal policies, oversight of practices, handling of access and rectification requests, incident management, responses to complaints and the carrying out of privacy impact assessments.

Current officer: Catherine Gamache, CPA, CMA — Human Resources Director
Telephone: 1 800 363-3881
Email: catherinegamache@gamache.net

In her absence, this responsibility is assumed by the person designated by management.

12. Rights of the individuals concerned

Access: confirm that Gamache holds personal information concerning the individual and obtain communication of it, subject to the exceptions provided by law.
Rectification: correct information that is inaccurate, incomplete or equivocal, or object to a collection, communication or retention that is not authorized by law.
Withdrawal of consent: at any time, without retroactive effect on processing already carried out; may limit certain services.
Cessation of dissemination and de-indexing: request that the dissemination of information cease, or that a hyperlink be de-indexed or re-indexed, where the conditions provided by law are met.
Portability: receive eligible computerized personal information in a structured, commonly used technological format, or request its transfer to a person or body authorized to collect it, where the law so permits and where this does not raise serious practical difficulties.
Commercial prospection: require that personal information no longer be used for commercial prospection purposes.
Deletion: request the deletion of information where the law so permits, subject to legal or contractual retention obligations.

Chatbot users enjoy the same rights. Requests for access to conversations are handled manually after verification of identity and to the extent that the conversation can be linked to the requester. They may also request the correction of information, the deletion of their history subject to applicable exceptions, the withdrawal of consent to future use, and the intervention of a human representative.

13. Exercising rights and complaints

Any request must be sent in writing to the Privacy Officer with the full name, contact details and a sufficiently precise description; proof of identity may be required. An objection to the use of information for commercial prospection purposes may be made in writing or verbally. Gamache responds to a request for access, rectification, portability, cessation of dissemination or de-indexing within 30 days of its receipt. In the event of a refusal, Gamache communicates in writing the reasons for the refusal as well as the remedies provided by law. Any complaint relating to non-compliance with this policy must be sent in writing to the Privacy Officer with the complainant's contact details, a detailed description and the relevant documents. Each complaint is handled confidentially and a written response is provided within the legal timeframes. A person who is dissatisfied may then apply to the Commission d'accès à l'information du Québec.

14. Privacy impact assessments, review and publication

Where a new project, a new technology or a new processing activity is likely to present risks to privacy — in particular the implementation of an AI system or the use of a new supplier — Gamache carries out the required privacy impact assessment before its implementation. Such an assessment has been carried out for the chatbot, its AI functions and transfers of information outside Québec. This policy is reviewed periodically in line with legislative, technological and operational developments. Gamache may amend it at any time; any significant amendment is published on its websites together with the effective date. The most recent version replaces any earlier version and takes effect on the date of its adoption.

Version history

Version	Date	Description
3.0	September 16, 2026	Full update: AI, chatbot, new suppliers, transfers outside Québec, alignment with Law 25.
2.0	September 13, 2023	Addition of the appendix
1.0	April 20, 2023	First version

Appendix A — Categories of information and technologies

Summary of the main categories of personal information likely to be collected, provided for information purposes; the list may change according to services, technologies or legal obligations.

Customers and prospective customers

Last name, first name, email, telephone, city, province, company, language, request history and purchase preferences — collected through forms, by telephone, in person, by email, through the CRM or the chatbot, for the purposes of identification, communication, follow-up and customer service.

Financing: name, contact details, employer, income, employment history and financial information, solely for the purpose of assessing a credit application. Recruitment: résumé, experience, education, references and skills, for the purpose of assessing applications. Newsletter: first name, email, language and marketing preferences, with the possibility of unsubscribing at any time.

Virtual assistant (chatbot) — categories collected

Category	Mandatory
Questions asked / answers generated	Yes
Type of truck sought, budget, make, purchase timeline	No
Name, email, telephone, city	No

Technology suppliers (general use)

Microsoft 365 (email), Google (analytics and advertising), Meta (advertising), Microsoft Clarity (website usage measurement and analysis), SugarCRM (customer relationship management), as well as the chatbot suppliers listed in section 6. Any significant change to this list is reflected in the policy.

Indicative retention periods

Category	Period
Chatbot conversation	365 days
Qualified prospect	730 days
Technical logs	30 days
Other (web request, active customer, financing, analytics)	According to the purpose or legal/regulatory obligations

Glossary

Chatbot: virtual assistant using AI to answer visitors.
Explicit consent: given clearly through a positive action. Implied consent: inferred from behaviour in the cases provided by law.
LocalStorage: mechanism for storing data in the user's browser.
RPRP (Privacy Officer): the person responsible for the protection of personal information.