Privacy Policy

Who this policy applies to

In this policy, “Golden Leaf Management,” “we,” “us” and “our” refer to Golden Leaf Management. This policy applies to personal information we handle about prospective and current clients, website visitors and other individuals who communicate with us.

We handle personal information in accordance with applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial laws where they apply.

Information we collect

Depending on your interactions with us, we may collect your name, contact details, account and communication information, business and financial details, tax information, documents you submit, and information needed to verify your identity or administer an engagement.

When you use our website or portal, technical information such as device, browser, security and access logs may be generated or collected to operate, secure and troubleshoot those services. Please do not send sensitive records through a public inquiry form; use the client portal or another method we have approved.

How we use information

We use personal information to respond to inquiries, assess and deliver requested accounting, bookkeeping and tax services, administer client relationships and portal access, communicate with you, process payments where applicable, protect our systems, comply with legal and professional obligations, and establish or defend legal claims.

We collect and use information with your knowledge and consent where required, or on another lawful basis permitted by applicable law. You may withdraw consent subject to legal or contractual restrictions and reasonable notice; doing so may affect our ability to provide a service or retain records we are required to keep.

Service providers and storage

We use Supabase to support portal authentication and database functions, and Cloudflare R2 to store uploaded documents. These providers process information on our behalf to operate the services. Depending on provider configuration and infrastructure, information may be stored or processed outside your province or Canada and may be subject to the laws of those jurisdictions.

We may also use other service providers for website hosting, communications, payment processing, security and professional operations. We limit access to information to people and providers who need it for their work and require appropriate confidentiality and security protections.

Disclosure, security and retention

We do not sell personal information. We may disclose it to service providers described above, with your consent, when needed to provide requested services, or where disclosure is required or permitted by law, including to protect our rights, clients or systems.

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information. No website, transmission method or storage system can be guaranteed completely secure. We retain information only as long as reasonably necessary for the purposes described in this policy and for applicable legal, tax, accounting, insurance and professional recordkeeping requirements, after which it is securely deleted or de-identified where practicable.

Your privacy rights

Subject to applicable law and identity verification, you may request access to personal information we hold about you, ask us to correct information that is inaccurate or incomplete, or ask questions about our privacy practices. Some information may be retained or withheld where the law permits or requires it.

To make a privacy request or raise a concern, contact us using the details below. You may also contact the Office of the Privacy Commissioner of Canada or the applicable provincial privacy regulator.

Changes to this policy

We may update this policy as our practices or legal obligations change. The revised version will be posted on this page with an updated effective date. Where required by law, we will seek your consent to material changes.