Privacy Policy
Alzoubi Accounting prepares and files personal tax returns in Ontario. This policy explains what personal information we collect, why we need it, how we protect it, and the choices you have. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
Who is responsible
Our privacy officer is Ahmad Alzoubi. Questions, access requests or complaints: info@alzoubiaccounting.ca · 226-246-6942.
What we collect
- Contact details: your name, phone number and email.
- Booking details: the service you choose, your preferred time and language, and any note you add.
- Tax documents you upload or bring: tax slips, receipts and records. These can include your Social Insurance Number, income, family and address information.
- Payment records: the amount, date and method. Card payments are handled by Stripe; we never see or store your card number.
- Electronic signatures: when you sign a form online (such as the CRA's T183), we keep your signature, the date and time, your IP address and device, and how we confirmed your identity. The CRA asks us to keep this record with the signed form.
- Security records: sign-in and file-access logs for our staff accounts and for client sign-ins to "My files", including IP addresses, to protect your information.
Our website does not use advertising or tracking cookies. It saves your language choice and your document checklist in your own browser only. Staff who sign in to our dashboard receive one essential session cookie.
Visit statistics: to see how many people visit our website, we count visits on our own server: the page, the website that sent you (such as Google), phone or computer, language, and the country from your device's time zone. We use no cookies for this, do not store your IP address, and cannot tell who you are; the visitor number changes every day. These counts are kept for two years and are never shared or sold.
Why we use it
- To prepare, review and electronically file your tax return with the Canada Revenue Agency (CRA).
- To contact you about your appointment, documents and payment, and to send your receipt.
- To meet our legal obligations, including CRA record-keeping and electronic-filing rules.
- To keep your information secure and investigate misuse.
We collect only what we need for these purposes. We do not sell your information, and we do not send marketing emails without your separate consent.
Your consent
By booking or uploading documents, you agree to the uses in this policy. Before we file your return electronically, you will also sign CRA form T183 to authorize the filing. You can withdraw your consent at any time by contacting us. If you do, we may not be able to complete your return, and we may still need to keep some records the law requires us to keep.
Who we share it with
- Canada Revenue Agency, to file your return.
- Service providers that help us run the service under confidentiality obligations: our web host and email provider (Hostinger) and our card payment processor (Stripe). They may store information on servers outside Canada, where it may be subject to the laws of that country.
- Anyone else only with your consent, or when the law requires it.
How we protect it
- Uploaded documents are encrypted as soon as they arrive and kept in a private area of our server that cannot be reached from the web.
- Private notes about your file are encrypted in our database.
- All connections use HTTPS encryption.
- To open "My files", you confirm your email, date of birth and the last 3 digits of your SIN, then enter a one-time code we email you. Sessions end after 15 minutes without activity.
- To sign a form, you open the personal link we sent you and confirm your date of birth and the last 3 digits of your SIN. You can draw your signature or type your name. We record the time, your IP address and device with the signature.
- Email is not encrypted. If you prefer, we send you only a secure link to your files and no attachments.
- Staff accounts use strong passwords, two-step verification and permissions limited to what each person needs. Every file view is logged.
How long we keep it
- Tax documents, returns, signed T183 forms and payment records: six years after the end of the tax year they relate to, which matches CRA record-keeping requirements. Then we delete them securely.
- Booking requests that do not lead to a tax return: deleted within 12 months.
- Security logs: kept as long as needed to protect your information, and breach records for at least 24 months as PIPEDA requires.
Your rights
You can ask to see the personal information we hold about you, ask us to correct it, or ask us to delete information we are not required to keep. We will respond within 30 days. If you are not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.
If something goes wrong
If a breach of our safeguards creates a real risk of significant harm to you, we will tell you and report it to the Privacy Commissioner as soon as feasible, as the law requires. We keep a record of every breach.
Changes
If we change this policy, we will update the version date above. Significant changes will be shown on our website before they take effect.