Privacy Policy

If you request account deletion, we will delete personal information within 30 days except:

• Information required by law (tax records, legal holds)

• Information needed to resolve outstanding disputes

• Anonymized or aggregated data (cannot identify you)

 

6. How Do We Protect Your Information?

We implement industry-standard safeguards:

 

6.1 Technical Measures

• Encryption in Transit: TLS/SSL encryption for all data in motion

• Encryption at Rest: AES-256 encryption for sensitive data stored on servers

• Access Controls: Role-based access; only authorized personnel access data

• Authentication: Multi-factor authentication (MFA) available for accounts

• Regular Audits: Quarterly security assessments and penetration testing

 

6.2 Organizational Measures

• Privacy by Design: Privacy assessments for new features and integrations

• Employee Training: Annual privacy and security training for all staff

• Incident Response Plan: Documented procedures for investigating and responding to breaches

• Data Minimization: We collect only information necessary for the Service

 

6.3 Limitation of Liability

Despite these measures, no security is absolute. GGLR Accounting is not liable for unauthorized access resulting from:

• Your failure to keep credentials confidential

• Breach of third-party services (QuickBooks Online, Google, email providers)

• Your use of unsecured networks (public WiFi)

• Social engineering or phishing attacks

However, we are liable for breaches caused by our negligence or failure to implement reasonable safeguards.

 

7. Cookies and Tracking Technologies

 

7.1 How We Use Cookies

• Session Cookies: Required for authentication; automatically deleted when you log out

• Preference Cookies: Remember your settings (e.g., language, notification preferences)

• Analytics Cookies: Track usage patterns to improve the Service (anonymized; no personal identifiers)

 

7.2 Your Cookie Choices

You can disable cookies in your browser settings, but some features of the Service may not function properly without them.

 

8. Data Subject Rights (PIPEDA)

You have the following rights under PIPEDA:

 

8.1 Right of Access

You can request a complete record of personal information we hold about you, including sources, use, and recipients. We will respond within 30 days.

 

8.2 Right to Correction

If your personal information is inaccurate, incomplete, or outdated, you can request corrections. We will update records within 15 business days.

 

8.3 Right to Deletion (Right to be Forgotten)

You can request deletion of your personal information, except:

• Information required by law (tax records must be kept 6 years under CRA rules)

• Information needed to fulfill a contractual obligation

• Information subject to a legal hold

We will respond within 30 days and explain any retention necessity.

 

8.4 Right to Data Portability

You can request your personal information in a portable format (e.g., CSV, JSON) to transfer to another service. We will provide this within 30 days at no cost.

 

8.5 Right to Withdraw Consent

If we rely on your consent for any processing, you can withdraw it at any time. Withdrawal does not affect the legality of processing before you withdrew consent.

 

8.6 Right to Opt-Out of Marketing

We do not send unsolicited marketing. If you receive any, you can opt-out by clicking "unsubscribe" in the email or contacting us.

 

8.7 Right to Lodge a Complaint

If you believe we have violated your privacy rights, you can:

• Contact us directly (see Section 14)

• Lodge a complaint with the Office of the Privacy Commissioner of Canada

 

9. Cross-Border Data Transfers

Some of your personal information may be processed or stored in the United States (via QuickBooks Online, Google, or cloud providers). By using the Service, you consent to this transfer. We ensure that:

• Transfers comply with PIPEDA and Canadian privacy laws

• Recipient organizations provide protections comparable to Canadian privacy laws

• You retain all rights under Canadian privacy law

 

10. Children's Privacy

The Service is not intended for children under 13. We do not knowingly collect personal information from children. If we become aware that we have done so, we will delete it immediately and notify the parent/guardian.

 

11. Third-Party Services and Links

The Service may integrate with or link to third-party services (QuickBooks Online, Google, email providers). This Privacy Policy applies only to information GGLR Accounting collects. These third parties have their own privacy policies:

• Intuit Privacy Statement

• Google Privacy Policy

We are not responsible for third parties' privacy practices. We recommend reviewing their policies.

​

12. Updates to This Privacy Policy

We may update this Privacy Policy to reflect legal changes, Service improvements, or feedback. Material changes will be communicated:

• By email notification to your account address

• By prominent notice on the Service

• With an effective date clearly marked

Your continued use of the Service after updates constitutes acceptance of the revised policy. We encourage you to review this policy periodically.

 

13. Privacy Officer and Accountability

GGLR Accounting designates a Privacy Officer responsible for:

• Ensuring PIPEDA compliance and adherence to applicable Canadian privacy laws

• Receiving and investigating privacy complaints

• Conducting privacy impact assessments for new features

• Overseeing data breach investigations and notification

• Training staff on privacy practices

 

14. How to Contact Us

If you have questions about this Privacy Policy, wish to exercise any data rights, or report a privacy concern:

 

GGLR Accounting
165-4338 Innes Rd

Ottawa, Ontario, Canada
Telephone: (647) 694-4599

Privacy Officer
Email: admin@gglraccounting.com

​

We will respond to inquiries within 30 calendar days. If your inquiry relates to a data breach, we will prioritize it and respond within 5 business days.

 

Appendix A: Summary of PIPEDA Rights