Privacy Policy

14710011 Canada Inc., carrying on business as Moyano & Co. ("Moyano & Co.," "I," "me," or "my") provides bookkeeping services to contractors and trades businesses. This Privacy Policy explains how I collect, use, disclose, protect, retain, and provide access to personal information in the course of commercial activities.

I am accountable for personal information under my control, including information processed by service providers on my behalf. Privacy questions and requests are handled by the Privacy Officer identified in section 13.

1. Scope

This policy applies to personal information collected through the Moyano & Co. website, consultations, Books Assessments, cleanup projects, monthly bookkeeping engagements, communications, billing, and government-filing administration. It does not replace a client engagement agreement. Where an engagement agreement contains a more specific term, that term governs the engagement to the extent permitted by law.

2. Personal Information I Collect

2.1 Enquiries and prospective clients

• Name, business name, trade, location, phone number, email address, and preferred contact method
• Information about bookkeeping software, approximate volume, payroll, subcontractors, filing status, and the condition of the books
• Consultation notes, correspondence, proposals, and reasons for accepting or declining an engagement

2.2 Clients and people connected with a client

• Business and contact details, business numbers, fiscal year-end, registration and filing information
• Bank and credit-card statements, transaction records, invoices, bills, receipts, loans, payroll records, tax documents, and accounting data needed for the agreed services
• Information about owners, employees, subcontractors, customers, suppliers, and authorized approvers where needed to perform the engagement
• Access permissions provided through named user invitations, accountant access, secure portals, and government representative authorizations
• Billing information and records of payments

I do not ask clients to send or disclose their personal online-banking, CRA, email, or accounting-platform passwords.

2.3 Website information

The website and hosting provider may process technical information needed to deliver and secure the site, such as IP address, device and browser information, requested pages, timestamps, and security logs. Optional Google Analytics is loaded only after a visitor accepts analytics through the privacy-choice control. Analytics is used to understand website traffic and improve the site, not for behavioural advertising.

3. How Information Is Collected

Information may be collected directly from you, from an authorized representative, from the accounting and workflow systems you authorize, from your external accountant or other professional with your direction, from government portals where representative access has been granted, and from service providers used to deliver the engagement.

Clients are responsible for ensuring they are authorized to provide employee, subcontractor, customer, supplier, and other third-party information to Moyano & Co. for the agreed services.

4. Purposes for Collection, Use, and Disclosure

• Respond to enquiries, assess fit, prepare proposals, and establish an engagement
• Provide the bookkeeping, cleanup, payroll, A/P, A/R, HST, T5018, WSIB, EHT, reporting, and year-end handoff services expressly selected by the client
• Verify instructions, obtain approvals, communicate questions, and manage deadlines
• Create invoices, process authorized payments, maintain business records, and collect amounts owing
• Maintain, secure, troubleshoot, and improve systems and service delivery
• Prevent misuse, investigate security incidents, and protect legal rights
• Comply with legal, regulatory, tax, insurance, professional, and record-keeping obligations
• Send marketing communications only where consent or another lawful basis exists, with an unsubscribe option where required

5. Consent and Choices

I seek consent in a form appropriate to the sensitivity of the information and the circumstances. Some information is necessary to respond to an enquiry or perform an engagement. If required information is not provided, I may be unable to quote, accept, or continue the work.

You may withdraw consent for optional uses, including optional analytics and marketing, subject to legal, contractual, security, and record-retention requirements. Withdrawing consent does not affect uses or disclosures already lawfully made.

Website visitors can accept, decline, or revisit optional analytics using the “Privacy choices” control on the site.

6. Service Providers and Disclosures

I do not sell or rent personal information. I may disclose information only as reasonably necessary for the purposes above, including:

• Authorized people: the client, authorized employees or representatives, and the client’s external accountant or adviser as directed
• Bookkeeping and workflow providers: platforms such as QuickBooks Online, Xero where applicable, Dext, Wagepoint, and Plooto when used for the selected engagement
• Business infrastructure: email, cloud storage, website hosting, scheduling, e-signature, security, backup, analytics, billing, and payment providers
• Professional advisers and insurers: where reasonably necessary for legal advice, risk management, claims, or practice operations
• Authorities or other parties: where required or permitted by law, to respond to lawful process, investigate fraud or security incidents, protect rights or safety, or complete an authorized government submission
• Business transaction: in connection with a proposed or completed sale, financing, reorganization, or transfer of the practice, subject to appropriate confidentiality and lawful-use restrictions

Some service providers may process or store information outside Canada. Information in another country may be accessible to courts, law-enforcement, or national-security authorities under that country’s laws. Moyano & Co. remains accountable for personal information transferred to a service provider for processing and uses contractual or other reasonable measures appropriate to the sensitivity of the information.

7. Safeguards

I use administrative, technical, and physical safeguards appropriate to the sensitivity of the information. Depending on the system and engagement, safeguards may include:

• Named user accounts, role-based or least-privilege access, and multi-factor authentication where available
• Secure portals or approved platforms for sensitive documents instead of ordinary email where appropriate
• Encrypted connections, managed devices, screen locks, software updates, malware protection, and secure backups
• Access reviews, prompt removal of unnecessary access, confidentiality obligations, and documented workflows
• Incident-response, breach-record, retention, and secure-disposal procedures

No safeguard or electronic system can guarantee absolute security. Clients should not send passwords or sensitive banking credentials by email or text.

8. Retention and Disposal

I retain personal information only as long as reasonably necessary for the identified purposes and legal obligations. The applicable period depends on the record:

• Prospective-client enquiries and declined proposals: generally up to 24 months after the last meaningful interaction, unless a longer period is required for a dispute or requested follow-up
• Client agreements, billing records, bookkeeping working papers, filing confirmations, and engagement correspondence: generally for at least the period required by applicable tax, legal, insurance, and professional obligations; many engagement records are retained for approximately seven years after the engagement ends
• Privacy requests and complaint records: generally at least two years after completion
• Security-breach records: at least 24 months from the date the Firm determines a breach occurred, or longer where required
• Website analytics: according to the configured analytics-retention setting or until the data is no longer reasonably required

Some corporate, ownership, property, litigation, tax, or other records may need to be kept longer. When information is no longer required, it is deleted, anonymized, or securely destroyed using methods appropriate to the format and sensitivity.

9. Access and Correction

You may ask whether I hold personal information about you, request access to it, and ask for inaccurate or incomplete information to be corrected. I may need to verify your identity before responding. Access may be limited where permitted or required by law, including where disclosure would reveal another person’s information, confidential commercial information, or legally privileged material.

I generally respond to a written access request within 30 calendar days, subject to any extension or exception permitted by applicable law. Any permitted extension and the reason for it will be communicated.

10. Privacy and Security Incidents

Suspected privacy or security incidents are assessed, contained, documented, and remediated. Where required by applicable law, Moyano & Co. will report a breach to the Office of the Privacy Commissioner of Canada and notify affected individuals when the breach creates a real risk of significant harm. Breach records are maintained whether or not notification is required.

11. Complaints

Please contact the Privacy Officer first so the concern can be investigated and addressed. You may also contact the Office of the Privacy Commissioner of Canada about a concern that falls within its jurisdiction.

12. Third-Party Links and Children

The website may link to third-party sites or services. Their privacy practices are governed by their own policies. Moyano & Co. does not knowingly collect personal information from children through its business services, which are intended for adults acting for businesses.

13. Privacy Officer and Contact

Privacy Officer: Franco Moyano
14710011 Canada Inc., carrying on business as Moyano & Co.
Barrie, Ontario, Canada

• Email: franco@moyanoco.com
• Phone: (705) 500-2632

Privacy requests should describe the information or issue with enough detail to locate and address it. Do not include passwords or unnecessary sensitive information in an initial email.

14. Changes to This Policy

This policy may be updated to reflect changes in services, systems, providers, or legal requirements. The current version will be posted on this page with its effective date. Material changes will be communicated where required.