Privacy policy

1. Who this policy applies to

This policy describes how Vincent J. Deleo Professional Corporation ("the firm", "we", "us") handles personal information collected through www.deleoaccounting.com and through enquiries made by email or telephone.

The firm is based in Vaughan, Ontario, Canada, and handles personal information in accordance with the federal Personal Information Protection and Electronic Documents Act (PIPEDA), together with the confidentiality obligations imposed on chartered professional accountants by CPA Ontario.

Vincent J. Deleo is the individual accountable for the firm's compliance with this policy. His contact details are in section 15.

2. What information is collected

Personal information reaches the firm in three ways.

Information you submit through the contact form

Your name, email address, an optional company name, the service category you select, and the content of your message. All of it is optional in the sense that you choose whether to use the form at all.

Information you send directly

Anything contained in an email you send, or discussed in a telephone call you make — including any details about your business or finances that you volunteer.

Technical information recorded automatically by the web host

Like every website, this one is served by a hosting provider that records standard server request data: IP address, approximate region, browser and device type, the page requested, and the date and time. This is generated by the infrastructure rather than collected by the firm, and is used for security, abuse prevention and reliability. It is not linked to your identity by the firm and is not used to build a profile of you.

If you go on to engage the firm as a client, considerably more information will be collected in the course of that engagement. That collection is governed by your engagement letter and by professional standards, not by this website policy.

3. What is not collected

Stated plainly, because most privacy policies leave it ambiguous:

• No cookies are set by this website.
• No advertising, remarketing, or cross-site tracking technology is used.
• The site is set in a typeface already installed on your device, so no font files are downloaded at all. Images, stylesheets and scripts are served from this site's own domain — nothing is loaded from a third-party content delivery network, so your visit is not disclosed to any font, script or CDN provider.
• There are no social media tracking pixels, embeds, or "like" buttons.
• No behavioural or profiling analytics are in use. If aggregate, cookie-free visitor statistics are introduced in future, this policy will be updated to say so before they are enabled.
• Personal information is never sold, rented, traded, or disclosed for anyone else's marketing purposes.

4. Why the information is collected

Information is collected and used only for these purposes:

• To respond to your enquiry and arrange an introductory conversation.
• To assess whether the firm can appropriately act for you, including identifying any conflict of interest or independence issue before an engagement begins.
• If you become a client, to perform the professional services set out in your engagement letter, and to communicate with you about them.
• To meet legal, regulatory, tax and professional obligations, including record retention requirements and any obligation to respond to a lawful demand.
• To protect the security and integrity of the website and the firm's systems.

Your information is not used for any purpose materially different from the one it was collected for without your consent, unless the law requires or permits it.

5. Consent

By sending an enquiry through the contact form, by email, or by telephone, you consent to the firm collecting and using that information to respond to you as described in section 4.

You may withdraw your consent at any time, subject to legal and professional restrictions and to reasonable notice. Withdrawing consent may mean the firm can no longer provide a service to you. To withdraw consent, use the contact details in section 15.

The firm does not send marketing or promotional email. If that ever changes, any commercial electronic message will comply with Canada's Anti-Spam Legislation (CASL), will be sent only with the consent it requires, and will contain a working unsubscribe mechanism.

6. Service providers and storage outside Canada

The firm uses a small number of third-party providers to operate the website and its communications. Each has access only to what it needs to perform its function.

Website hosting and content delivery

The site is hosted on Cloudflare Pages. Cloudflare operates a global network and processes server request data, including IP addresses, as described in section 2.

Contact form delivery

Messages sent through the contact form are transmitted by Formspree, a form-processing service, which forwards them to the firm's email address.

Email

The firm's email is provided through Microsoft 365.

Information may be stored or processed outside Canada, including in the United States. While it is in another country, it is subject to that country's laws, and may be accessible to that country's courts, law enforcement and national security authorities under a lawful demand. This disclosure is made so that your consent to using the contact form is informed. If you would prefer your enquiry not pass through these providers, telephone the firm instead, on the number in section 15.

7. Cookies and browser storage

This website sets no cookies of any kind — not for analytics, not for advertising, and not for preferences.

It makes one use of your browser's sessionStorage: a single value named vjd-intro, which records that the opening logo animation has already played, so that it does not replay on every page you visit. It contains no personal information, is not transmitted anywhere, and is erased by your browser when you close the tab. Blocking it affects nothing except that the animation may replay.

8. How long information is kept

• Enquiries that do not lead to an engagement are kept only as long as needed to deal with them and to check for future conflicts of interest — generally no more than twenty-four months — and are then deleted.
• Client records are retained for as long as required by law, by the Canada Revenue Agency, and by CPA Ontario's professional standards. In practice that is normally at least seven years after the end of the engagement.
• Server request data is retained by the hosting provider for a short period under its own retention schedule.

9. How information is protected

The firm maintains safeguards appropriate to the sensitivity of the information it holds. The website is served over HTTPS with strict transport security, and applies a content security policy that prevents third-party scripts from running on it. Access to client information is limited to those who need it to do the work.

No method of transmitting information over the internet is completely secure. Please do not send sensitive personal information — a Social Insurance Number, banking details, or complete financial statements — through the website contact form. Once an engagement begins, the firm will tell you a secure way to send those.

10. Professional confidentiality

Separately from, and in addition to, this privacy policy, Vincent J. Deleo is bound by the duty of confidentiality that CPA Ontario's Code of Professional Conduct imposes on chartered professional accountants. Information you disclose in confidence is not disclosed to anyone else without your consent, except where disclosure is required or permitted by law or by the profession's own regulatory processes.

11. Your rights

Under PIPEDA you may, on written request:

• Ask what personal information about you the firm holds, and how it is used.
• Obtain a copy of that information.
• Ask that inaccurate or incomplete information be corrected.
• Withdraw your consent, subject to section 5.
• Ask that information no longer needed for a lawful purpose be deleted.

Requests are answered within thirty days. There is no charge in the ordinary case; if a request would take substantial work, you will be told the cost first and given the chance to withdraw it. Access may be refused in the limited circumstances PIPEDA allows — for example where granting it would reveal personal information about somebody else — and if it is refused, you will be told why.

12. Links to other websites

This site links to a small number of external sites, including LinkedIn. Those sites have their own privacy practices, which the firm does not control and is not responsible for. Once you follow a link away from this site, this policy no longer applies to you.

13. Children

The firm's services are directed at businesses and adults. The website is not intended for children, and the firm does not knowingly collect personal information from a child. If you believe a child has sent personal information through this site, please make contact and it will be deleted.

14. Changes to this policy

This policy may be updated from time to time to reflect changes in the firm's practices or in the law. The effective date at the top of the page shows when it was last revised. Material changes — in particular any change to what is collected or who it is shared with — will be reflected here before the change takes effect.

15. Contact and complaints

Questions about this policy, requests for access or correction, and privacy complaints should go to:

Vincent J. Deleo, CPA, CA, CFA, MBA

Vincent J. Deleo Professional Corporation
Vaughan, Ontario, Canada
vincent.deleo@deleoaccounting.com
416-274-8006

Every complaint is investigated and answered. If you are not satisfied with the response, you may bring the matter to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or by telephone on 1-800-282-1376.

Concerns about professional conduct may also be raised with CPA Ontario at cpaontario.ca.