Privacy Policy
Hanif Accounting & Advisory, CPA • Effective date: [INSERT DATE] • Last updated: [INSERT DATE]
Important.This document is a template prepared to reflect general requirements under Canada’s Personal Information Protection and Electronic Documents Act(PIPEDA) and related guidance. It is not legal advice. Bracketed text marked[LIKE THIS] must be reviewed and completed by you, and the final document should be reviewed by a qualified Ontario lawyer before publication.
Hanif Accounting & Advisory, CPA (“we”, “us”, “our”, or the“Firm”) is a professional accounting practice registered in Ontario and with the Chartered Professional Accountants of Ontario (“CPA Ontario”). We are committed to protecting the privacy and confidentiality of the personal information entrusted to us by our clients, prospective clients, website visitors and other individuals.
This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, the circumstances in which it may be accessed or processed outside Canada (including by our delivery team located in Pakistan), and the choices and rights available to you. It applies to personal information we handle in the course of our commercial activities, including through our website at hanifadvisory.ca (the “Website”).
1. Who we are and how to contact us
Privacy Officer: Hasan Hanif
Email: hasan@hanifadvisory.ca
Address: 5 – 2000 Thurston Drive, Ottawa, Ontario, K1G 4K7, Canada
Our Privacy Officer is accountable for the Firm’s compliance with this Privacy Policy and with applicable privacy law. If you have a question, arequest, or a concern about how we handle your personal information, please contact the Privacy Officer using the details above.
2. What we mean by “personal information”
“Personal information” means information about an identifiable individual. It does not include the business contact information of an employee of an organisation that we collect, use or disclose solely to communicate with that person in relation to their employment or profession. Aggregated orde-identified information that can no longer be associated with an individualis not personal information.
3. The personal information we collect
The personal information we collect depends on our relationship with you and the services you ask us to provide. It may include:
Identification and contact details — name, postal address, email address, telephone number, and similar contact information.
Client and engagement information — information needed to provide bookkeeping, tax, controllership and CFO (Chief FinancialOfficer) services, which may include social insurance numbers, business numbers, tax identifiers, income and expense records, payroll details, banking and payment information, and other financial records relating to you or to individuals connected with your business (such as your employees, owners ordirectors).
Information you provide through the Website —details you submit through our contact forms or by emailing us, such as your name, email address, organisation and the content of your message.
Technical information — limited information automatically collected when you visit the Website, such as your IP address, browser type, and pages viewed, where applicable (see the “Cookies” section below).
Where you provide us with personal information about other individuals (for example, your employees, contractors, family members orbusiness associates), you confirm that you are authorised to provide that information to us and that those individuals are aware of how it will be used as described in this Privacy Policy.
4. Why we collect, use and disclose personal information (purposes)
We identify the purposes for which we collect personal information at or before the time of collection. We use personal information for purposes such as:
- Identification and contact details — name, postal address, email address, telephone number, and similar contact information.
- Client and engagement information —information needed to provide bookkeeping, tax, controllership and CFO (Chief Financial Officer) services, which may include social insurance numbers, business numbers, tax identifiers, income and expense records, payroll details, banking and payment information, and other financial records relating to you or to individuals connected with your business (such as your employees, owners ordirectors).
- Information you provide through the Website — details you submit through our contact forms or by emailing us, such as your name, email address, organisation and the content of your message.
- Technical information — limited information automatically collected when you visit the Website, such as your IPaddress, browser type, and pages viewed, where applicable (see the “Cookies”section below).
5. Consent
In most cases we collect, use and disclose personal information with your knowledge and consent. By engaging us to provide services, or by providing personal information to us, you consent to our handling of that information as described in this Privacy Policy. Depending on the sensitivity of the information, your consent may be express (for example, given in writing in an engagement letter) or implied (for example, reasonably inferred from your provision of information for a clearly stated purpose).
You may withdraw your consent at any time, subject to legal, professional and contractual restrictions and reasonable notice. If you withdraw consent that is necessary for us to provide a service, we may be unable to continue providing that service. To withdraw consent, contact our Privacy Officer.
6. International processing and access — our delivery team in Pakistan
Please read this section carefully. Some of the work involved in delivering our services is performed by our delivery team located in Pakistan. This means that personal information we hold may be accessed and processed from outside Canada.
To deliver our services efficiently, members of our delivery team located in Pakistan access and process personal information on our behalf. Bydefault, your information is hosted on cloud servers located in Canada, the United Kingdom or the European Union, and is accessed remotely by our delivery team; we do not, as a default practice, store client personal information onservers or devices located in Pakistan.
Under PIPEDA, transferring personal information to a third party(including our own personnel located abroad) for processing is a “use” of that information and does not require separate consent. However, we remain accountable for that information at all times, and we use contractual and other means designed to provide a comparable level of protection while it is being processed on our behalf.
You should be aware that, while personal information is being accessed or processed in another jurisdiction, it may be subject to the laws of that jurisdiction, and may be accessible to the courts, law enforcementagencies, regulatory authorities and national security authorities of that jurisdiction. Pakistan is not the subject of an adequacy decision by Canadian, United Kingdom or European Union authorities and, at the date of this Policy, does not have a comprehensive general data-protection law equivalent to PIPEDA.
The safeguards we apply to this processing include written confidentiality and data-protection obligations binding on all personnel, restrictions limiting access to those who need it to perform their work, encryption of information in transit and at rest, multi-factor authentication, and controls designed to prevent the local storage of client information ondevices in Pakistan. If you would like more information about how we protect personal information that is processed outside Canada, please contact our Privacy Officer.
7. Disclosure to third parties
We do not sell personal information. We may disclose personal information to third parties only as necessary for the purposes described in this Policy, including:
Service providers and cloud platforms that we use to deliver our services and operate our practice — for example, accounting and bookkeeping software, tax-preparation software, secure document exchange, email and productivity platforms, and IT and hosting providers. These may include providers such as [e.g., Microsoft 365, Xero, QuickBooks Online, CaseWare, TaxPrep, Webflow, Google Workspace, Calendly, Zoom, ZohoBooks, Hubspot, Smartleads];
Government and tax authorities, where authorised by you or required by law;
Professional advisers, and CPA Ontario or otherregulatory bodies, where required for regulatory, quality-assurance or professional-conduct purposes; and
Other parties where we are required or permitted to disclose by law, or where necessary to establish, exercise or defend legalclaims.
Where we engage service providers, we require them to protect personal information in a manner consistent with this Policy and applicable law. We can not, however, control the internal systems of independent third-party providers, and the use of any such provider involves a degree of risk that is inherent in entrusting data to any external platform.
8. Safeguards and security
We maintain physical, organisational and technological safeguards appropriate to the sensitivity of the personal information we hold. These include restricted and role-based access, confidentiality agreements with personnel and contractors, secure storage and transmission, encryption where appropriate, and multi-factor authentication. No method of transmission or storage is completely secure, and we cannot guarantee absolute security;however, we take reasonable steps designed to protect personal information against loss, theft, and unauthorised access, use, disclosure, copying or modification.
9. Retention and destruction
We retain personal information only for as long as necessary to fulfil the purposes for which it was collected and to meet our legal, regulatory and professional obligations. In particular, we retain certain records in accordance with the requirements of the Canada Revenue Agency and applicabletax legislation, which generally require business and tax records to be kept for a minimum period (commonly six years from the end of the last tax year towhich they relate), and in accordance with the record-retention requirements of CPA Ontario. When personal information is no longer required, we take reasonable steps to securely destroy, erase or anonymise it.
10. Accuracy and your right to access and correct
We take reasonable steps to keep personal information accurate, complete and up to date for the purposes for which it is used. You have the right to request access to the personal information we hold about you, to be told how it has been used and to whom it has been disclosed, and to request correction of inaccurate or incomplete information. We will respond to yourrequest within the time required by law (generally within 30 days). We may need to verify your identity before responding, and in limited circumstances permitted by law we may be unable to provide access (for example, where doing so would reveal personal information about another person or is subject to legal privilege). If we deny a request, we will explain why.
11. Electronic communications and marketing
We will only send you commercial electronic messages, such as newsletters or information about our services, where we have your consent to do so or where otherwise permitted under Canada’s Anti-Spam Legislation (CASL). Every commercial electronic message we send will identify us and include a way for you to unsubscribe. You can withdraw your consent to marketing communications at any time by using the unsubscribe mechanism in the message or by contacting our Privacy Officer. Withdrawing marketing consent will not affect the communications we need to send you to provide our services.
12. Cookies and the Website
Our Website may use cookies and similar technologies to enable the site to function, to remember your preferences, and to understand how the site is used so that we can improve it. You can set your browser to refuse some or all cookies, or to alert you when cookies are being used; if you do so, some parts of the Website may not function properly. Our Website may contain links to third-party websites that are not operated by us; we are not responsible for the privacy practices of those websites, and we encourage you to read their privacy policies.
13. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The current version will always be available on our Website, and the “Last updated” date at the top indicates when it was last revised. Material changes will take effect when the updated Policy is posted.
14. How to make a complaint
If you have a concern about how we have handled your personal information, please contact our Privacy Officer first so that we can try to resolve it. If you are not satisfied with our response, you have the right to make a complaint to the Office of the Privacy Commissioner of Canada:
Office of the Privacy Commissioner of Canada — www.priv.gc.ca — 1-800-282-1376