Privacy Policy

Who this policy covers

Trillium CPA Professional Corporation ("we", "us", the "firm") is a licensed CPA practice based in Brampton, Ontario, serving clients across Canada. This policy explains how we collect, use, disclose, and protect personal information — both the information you send us through this website and the information we handle in the course of professional engagements.

It applies to visitors to this website, to prospective clients who contact us, and to clients whose tax, accounting, and business affairs we handle.

Our commitment

We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA), the federal privacy law that governs private-sector organizations in Ontario.

Separately, and independently of any privacy legislation, we are bound by the confidentiality obligations that CPA Ontario imposes on its members. Information about a client is not discussed, confirmed, or disclosed outside the firm without the client's consent, except where a professional or legal obligation requires it. In practice this is the stricter of the two standards, and it is the one we work to.

Information we collect

From visitors to this website, when you choose to give it:

• Your name, email address, and phone number, and whatever you tell us in the message field of the contact form.
• The subject you select and the page you were on when you got in touch, so we can reply in context.
• If you tick the box to receive occasional updates, a record of that consent — what you agreed to and when.
• Aggregate, non-identifying traffic statistics (see "Cookies and analytics" below).

From clients and prospective clients, in the course of an engagement, we collect what the work requires. For personal tax that typically includes your Social Insurance Number, date of birth, information slips, receipts, and details of your household where credits depend on them. For businesses it typically includes financial records, bank and payroll data, GST/HST information, corporate documents, and details about directors, shareholders, and employees. We collect this directly from you wherever possible, and from third parties such as the Canada Revenue Agency only where you have authorized us to do so.

Why we collect it

We use personal information only for the purposes it was collected for, namely:

• To respond to your enquiry and, if you become a client, to establish and administer the engagement.
• To prepare, review, and file returns and financial information, and to correspond with the CRA and other authorities on your behalf where you have authorized us to.
• To meet our professional, regulatory, and legal obligations, including record-keeping and client identification requirements.
• To send you updates you have asked to receive, and to invoice and administer the practice.

We do not sell personal information, we do not rent or trade mailing lists, and we do not use client information for advertising.

Consent

In most cases we rely on your consent. Giving us your information in order to receive a service is itself consent to use it for that service. Where information is sensitive, we seek your express consent.

Marketing email is separate and always opt-in. We add you to a mailing list only if you expressly ask us to, we keep a record of the wording you agreed to and the date, and every message includes an unsubscribe link. You can withdraw that consent at any time without it affecting the professional services we provide to you.

You may withdraw consent to other uses of your information at any time, subject to legal and professional restrictions and to reasonable notice. Withdrawing consent may mean we can no longer provide a particular service — we will tell you if that is the case.

When we disclose information

We disclose personal information outside the firm only in these circumstances:

• To the Canada Revenue Agency and other tax or government authorities, in the course of filings and correspondence you have authorized.
• To service providers who help us operate — for example secure document handling, email delivery, and website hosting — who are permitted to use the information only to provide that service to us.
• To your other advisors — a lawyer, banker, or financial advisor — where you have asked us to, or with your consent.
• To CPA Ontario, where the regulator exercises its right to inspect our practice or files. Its inspectors are themselves bound by confidentiality.
• Where required or permitted by law — for example under a court order, subpoena, or a statutory reporting obligation we cannot decline.

If the practice is ever sold or merged, client information may transfer to the successor firm; you would be notified, and the successor would be bound by obligations no weaker than these.

Where information is stored

Contact-form submissions from this website are stored in a database hosted in Canada. Email notifications and any newsletters are delivered by a third-party email provider located in the United States, and this website is hosted and protected by a global content delivery network.

This means some information may be stored or processed outside Canada. While it is in another country it is subject to that country's laws, and may be accessible to its courts and law-enforcement or national-security authorities. We choose providers that offer appropriate contractual and technical protections, and we give them only the information they need.

How we protect it

We maintain physical, organizational, and technical safeguards appropriate to the sensitivity of the information: encrypted connections to this website, access restricted to those who need it to do the work, and secure storage for both paper and electronic records.

This website does not process payments and never asks for banking, credit card, or Social Insurance Number information through the contact form. Please do not send sensitive documents or identifiers through the form or by ordinary email — we will arrange a secure method once we are working together.

No method of transmission or storage is perfectly secure. If a breach occurs that creates a real risk of significant harm, we will notify affected individuals and the Privacy Commissioner as the law requires.

How long we keep it

Engagement records are retained for at least six years after the end of the tax year to which they relate, which is the period the Income Tax Act requires, and longer where a professional standard or an unresolved matter calls for it. Enquiries that do not become engagements are kept only as long as needed to follow up.

When information is no longer needed for the purpose it was collected for, or for a legal or professional obligation, it is securely destroyed, erased, or anonymized.

Your rights

You may ask what personal information we hold about you, what we have used it for, and to whom it has been disclosed. You may ask us to correct anything inaccurate or incomplete. We will respond within 30 days.

There are narrow limits: we may not be able to release information that would reveal another person's personal information, that is subject to solicitor-client or litigation privilege, or that we are legally prohibited from disclosing. If we refuse a request, we will explain why.

There is no charge for a reasonable request. If a request would involve significant cost, we will tell you the estimate first and give you the chance to withdraw it.

Cookies and analytics

We use a privacy-focused analytics service that reports aggregate traffic — page views, referrers, approximate region — without cookies and without building a profile of you. We do not use advertising trackers, cross-site tracking pixels, or social media tracking.

Our hosting provider may set strictly necessary cookies for security and to keep the site available. These are not used to track you across other websites.

Links to other websites

This site links to external resources, including government pages. We are not responsible for the privacy practices of sites we do not operate, and we encourage you to read their policies.

Changes to this policy

We may update this policy as the practice, the technology, or the law changes. The revised version takes effect when posted here, and the date at the top of this page tells you when it was last changed. Material changes affecting how we handle existing client information will be communicated directly.

Questions or concerns

Nikhil Garg is the firm's Privacy Officer and is responsible for our compliance with this policy. To ask a question, request access to your information, or make a complaint, contact us at trilliumcpacorp@gmail.com, +1 (905) 334-8598, or 71 Morton Way, Brampton, ON L6Y 2P4.

We take complaints seriously and will investigate every one. If you are not satisfied with our response, you have the right to contact the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376.