Privacy Policy

Who we are Toronto Tax & Accounting Solutions Inc. provides tax and accounting services from Office 19, 695 Markham Road, Scarborough, Ontario M1H 2A5. Behroz Rizvi is responsible for privacy enquiries. Contact info@torontax.ca or (437) 410-7999. Please do not include a SIN, password, banking credential or identity document in an initial privacy request; we will arrange an appropriate verification method if needed.

This policy covers our website, enquiries and online client intake. The separate TorontoTax CRM Gmail-integration policy describes that application's Google-account access; it does not replace this policy.

Information we collect and why Our hosting and security providers process technical information such as IP addresses, browser information and request logs to operate and protect the website.

A quote enquiry asks for your name, the service you need, preferred contact method, an email address or phone/WhatsApp number, and an optional message. The national remote-enquiry form also asks for your province or territory. We use these details to respond, assess scope and provide a fee estimate. Sending an enquiry does not subscribe you to marketing or reserve an appointment.

Do not put SINs, passwords, banking credentials, tax documents or other sensitive records in the short enquiry form or ordinary email. We explain how to supply documents through the agreed intake or upload route.

Our separate personal and corporate intake forms request information relevant to the proposed tax/accounting work. Depending on the service, this can include identity/contact details, tax circumstances, corporate information and documents. Provide information about another person only when you are authorized to do so. Intake submission alone does not authorize filing a return or CRA representation; engagement scope and required authorizations are confirmed separately.

Where information goes and who can access it Short enquiries are stored in a private WordPress/Flamingo enquiry log on our ChemiCloud hosting account in Montreal and emailed to info@torontax.ca through Zoho Mail's Canadian service. The log is not a public directory. Behroz Rizvi is the only person at the firm authorized to access these records. Service providers process information to operate the services described here and may have controlled administrative/support access.

Personal and corporate intake use Tally. Tally states that form data is encrypted in transit and at rest and stored in Europe. Our corporate intake notification currently sends all submitted answers to our business-controlled torontotax6@gmail.com account; that creates a separate email copy, including any document links supplied by the notification. We also use Dropbox for client documents where we arrange that upload method with you. Dropbox and Google processing locations depend on their services and account configuration; we do not promise that all copies remain in Canada.

Hosting, email, form, storage and security providers have their own terms and privacy information. Information processed outside Canada may be subject to the laws of the relevant jurisdiction. We measure service and contact-method categories, but do not deliberately send personal contact details, tax information, free-text answers or documents as website analytics event parameters.

Cookies and optional measurement Essential functions support website security, form operation and remembering your cookie choice. The website uses Cloudflare and WordPress security/spam protections. Embedded forms, externally delivered fonts and maps, where present, can also connect your browser to their providers.

Optional Google Analytics and Google Ads tracking remains off until you choose it. The cookie controls offer separate unchecked choices for analytics and advertising, an equally available Reject optional choice, and a cookie-settings control to change your choice later. Rejecting optional tracking will not prevent a quote enquiry or client intake.

When analytics is permitted, we measure page use, service/contact-method categories, successful enquiries and intake completions, and limited campaign information. Enquiry context can include an approved entry-page path, submitting-page path, allowlisted campaign parameters, whether a paid-click identifier was present, and a non-identifying enquiry reference. We do not deliberately send names, email addresses, phone numbers, SINs, documents, messages or CRM notes as these event parameters. Analytics does not establish that a return was filed or a fee was paid. See Google's use of information from partner sites.

Retention We retain unsuccessful enquiries for 12 months after the last contact, then review and delete the enquiry and unnecessary related copies, unless a legal obligation or an active matter requires otherwise. Records that become part of a client engagement are handled under the retention requirements applicable to that engagement, rather than this unsuccessful-enquiry period. Backups and provider copies can follow separate backup/deletion cycles; we do not promise immediate removal from every backup.

Retention covers the website log, email and relevant intake/document copies. A schedule is not the same as automatic deletion: we must review the copies across the services we use. Client records must not be removed merely because a website lead-status field was left unchanged.

Safeguards and your choices We use HTTPS, restricted account access, website firewall/spam protections and provider safeguards. Encryption protects information in transit or storage where supported; it does not make ordinary email end-to-end encrypted or eliminate every risk. We avoid collecting sensitive documents in the short enquiry form. Do not share your CRA password or banking login with us.

Contact the privacy address above to ask about access, correction, retention, deletion or withdrawal of an optional consent. We may need to verify your identity and explain any legal or engagement-related limits. Do not send sensitive identity documents in the initial request. Questions or complaints can also be directed to the Office of the Privacy Commissioner of Canada.

We update this policy when relevant practices change. Effective date: November 7, 2026.