Privacy Policy

FIRSTCARE Financial Services Ltd.
Original policy effective date: December 20, 2025 · Version 1.0

FIRSTCARE Financial Services Ltd. (“FIRSTCARE,” “we,” “us” or “our”) respects the privacy of the individuals whose information we handle. This policy explains how we collect, use, disclose, protect and retain personal information when providing accounting, bookkeeping, payroll, tax preparation and related services, and how individuals can exercise their privacy rights.

Document control	Detail
Original policy effective date	December 20, 2025
Version	1.0
Policy owner	Privacy Officer, FIRSTCARE Financial Services Ltd.
Approved by	Sachindra Naik, Principal Accountant
Review cycle	Annually, or sooner following a material change

Scope and accountability

This policy covers personal information relating to clients, prospective clients, authorized representatives, business owners, directors, shareholders, partners, trustees, beneficiaries, family members, dependants, and other individuals whose information is necessary for our engagements. It applies to information received in person, on paper, by telephone, by email or text, through websites and forms, through document-upload services, and through software used in our work.

Information about an identifiable individual can remain personal information even when contained in a business file. We also protect confidential business information under our engagements; this policy does not give anyone access to another person’s information or another client’s confidential records.

Our Privacy Officer oversees this policy, privacy inquiries, access and correction requests, complaints, and incident response. FIRSTCARE remains responsible for personal information under its control, including information transferred to service providers for processing, as required by applicable law (PIPEDA, Schedule 1, clause 4.1.3).

We apply the Personal Information Protection and Electronic Documents Act (“PIPEDA”) where it governs our activities and applicable provincial privacy laws where they govern. Alberta, British Columbia and Québec have substantially similar private-sector privacy laws, and different laws can apply to different aspects of a transaction, including interprovincial or international transfers (Office of the Privacy Commissioner of Canada: provincial laws).

This policy does not replace engagement terms, tax-filing approvals, government representative authorizations, or a valid consent required for a particular use or disclosure. Employment and recruitment information about FIRSTCARE’s own personnel is addressed separately; information about a business client’s personnel that we process for payroll or tax services falls within this policy.

Personal information we collect

We collect information reasonably necessary for an identified service or other permitted purpose. The information required depends on the engagement and may include:

• Identity and contact information: Names, addresses, telephone numbers, email addresses, dates of birth, signatures, identification details where necessary, and information needed to verify identity or representative authority.
• Tax identifiers and account information: Social Insurance Numbers (“SINs”), tax identification numbers, business and program account numbers, tax residency, and government correspondence relevant to the work.
• Personal and family circumstances: Marital status, spouse or partner information, dependants, residency changes, and other circumstances relevant to tax reporting, deductions, credits or benefits.
• Financial and tax records: Tax returns, notices of assessment or reassessment, income slips, income and expenses, bank and investment statements, assets and liabilities, capital transactions, rental information, shareholder transactions, and supporting documents.
• Payroll and worker information: Employee or contractor names, contact details, SINs where required for reporting, compensation, benefits, deductions, banking instructions, and records needed for payroll, remittances or information slips.
• Sensitive supporting information: Medical-expense records, disability-related documentation, support payments or other sensitive records only when relevant to an agreed service. Please provide the necessary supporting material rather than an entire medical or unrelated personal file.
• Engagement and billing information: Services requested, instructions, authorizations, consents, invoices, payments, account balances, disputes and collection-related correspondence.
• Communications and service records: Emails, messages, correspondence, meeting notes, uploaded documents, delivery confirmations, approvals and records of actions taken on an engagement.
• Digital and security information: Information generated when using our digital services, such as IP addresses, timestamps, device or browser information, authentication events and activity logs, to the extent collected by the particular service.

We do not need passwords to your personal CRA, banking or email accounts. Use the applicable representative-authorization process or approved secure connection rather than sharing personal passwords or multi-factor authentication codes.

How we obtain information

We normally obtain information directly from you or an appropriately authorized representative. With the necessary authority, we may also obtain it from government tax accounts, previous accountants or bookkeepers, financial institutions, payroll systems, business records, legal representatives, or other relevant sources.

Where you provide information about another individual, we ask you to have the authority to provide it and to give any required notice or obtain any required consent. FIRSTCARE may independently verify that authority, request additional consent, or decline information that is unnecessary or not properly authorized.

We do not assume that one adult can consent for another simply because they are spouses, relatives, business partners or shareholders. Information concerning children, incapable adults or estates is handled through the individual or representative legally entitled to give the relevant instructions; the appropriate authority depends on the circumstances and applicable law.

Why we use personal information

We use personal information for identified purposes connected to the engagement and the lawful operation of our practice:

• Providing services: Preparing and reviewing tax returns, financial information, bookkeeping records, payroll, remittances, information slips, registrations and other agreed deliverables.
• Government dealings: Submitting approved filings, obtaining relevant account information, responding to reviews or audits, and communicating with the CRA, Revenu Québec or another authority within the scope of the engagement and valid authorization.
• Service administration: Establishing the client relationship, verifying instructions and identity, assigning work, tracking deadlines, requesting documents, coordinating approvals and communicating about services.
• Related-business work: Reusing specified information for an identified business engagement only within an existing valid purpose and authorization, or after obtaining additional consent where required, as explained below.
• Billing and payment: Issuing invoices, processing payments, reconciling accounts, resolving billing questions and collecting amounts lawfully owed to FIRSTCARE within the limits described below.
• Quality and security: Reviewing work, resolving errors, maintaining reliable systems, managing access, investigating suspected misuse, and using limited information for appropriate quality-control purposes.
• Legal and regulatory responsibilities: Meeting applicable recordkeeping obligations, responding to legally binding demands, obtaining legal advice, and establishing, exercising or defending legal rights where permitted by law.

We do not treat “other related work” as unlimited permission to use a tax file. A materially different purpose will be explained and any necessary consent obtained before the new use or disclosure.

Consent and your choices

We seek consent in a form appropriate to the information, purpose and circumstances. Sensitive financial and tax information, unexpected secondary uses, and activities creating a meaningful residual risk of significant harm generally require express consent (OPC consent guidance).

Consent may be documented through an engagement form, a separate authorization, an electronic signature, an affirmative selection or another clear recorded instruction. A signature acknowledging receipt of this policy is not, by itself, permission for every possible collection, use or disclosure.

We distinguish information necessary to provide a requested service from optional uses. We do not make consent to an unrelated optional purpose a condition of receiving that service, and we explain when declining necessary information would prevent us from carrying out particular work.

You may withdraw or limit consent by contacting our Privacy Officer, subject to applicable legal or contractual restrictions and reasonable notice. We will explain the effect on future work, any service we can no longer provide, and any information we must still retain or handle under a lawful exception; withdrawal does not undo processing already lawfully completed (PIPEDA, Schedule 1, clause 4.3.8).

Where the law permits or requires action without consent, we rely only on the applicable legal authority and its conditions. We do not infer consent from silence, an unpaid invoice, or a person’s ownership of another client business.

Using information for your other businesses

You may ask us to coordinate services for you and one or more businesses in which you are involved. For example, authorized coordination may involve reporting salary or dividends on your personal return, preparing a corporation’s information slips, reconciling shareholder transactions, or coordinating an identified intercompany transaction.

Our approach is to:

• Identify the files: Record the individual, the legal names of the businesses, the relevant engagements, and the direction in which information will be used or shared.
• Specify the information and purpose: Explain which information is needed, why it is needed, and whether it will appear in a business filing or be disclosed to an authorized recipient.
• Verify authority: Confirm the person’s authority to instruct us for each business and obtain each affected individual’s consent when required. Corporate signing authority is not automatically personal consent on behalf of employees, co-owners or family members.
• Limit access: Give personnel and representatives only the information needed for their authorized role. Access to one company’s file does not automatically include another company’s file or an owner’s personal return.
• Reconfirm changes: Review authorization when a business is added, ownership or representatives change, the purpose expands, or consent is withdrawn.

We use a separate related-business authorization where additional consent is necessary. That authorization can be limited to named businesses, specified information, stated purposes and a defined period.

We do not automatically combine personal and corporate records, send an entire personal return to a business contact, or carry permissions over to a newly incorporated company. Where a record contains another person’s information, we assess that person’s rights separately and redact information that should not be shared.

Billing, overdue accounts and debt collection

We may use relevant engagement, contact, invoice, payment and account information to administer fees, follow up on overdue amounts, resolve disputes and pursue lawful recovery of amounts owed to FIRSTCARE. Where appropriate and lawful, we may disclose the minimum necessary information to legal advisers, a debt-collection service provider legally entitled to act, a court, or another participant in the recovery process.

Under PIPEDA, a specific exception permits disclosure without consent for the purpose of collecting a debt owed by the individual to the organization; it is not an unrestricted permission to disclose everything in a client file (PIPEDA, section 7(3)(b); OPC debt-collection findings).

Our collection safeguards are:

• Correct debtor: We identify who owes the debt and the basis of any asserted personal liability before using an individual’s information to pursue a business invoice. We do not treat ownership, directorship, contact-person status or receipt of the invoice as sufficient, by itself, to establish personal liability.
• Limited collection package: Information normally considered for disclosure includes the debtor’s name and relevant contact details, engagement or guarantee documents where applicable, invoices, payment history, the amount claimed and relevant correspondence. Documents are reviewed and unrelated information removed.
• Sensitive tax information: We do not routinely disclose SINs, complete tax returns, notices of assessment, medical information, banking details, or spouse and dependant information for collections. Any proposed exceptional disclosure requires a documented legal basis, necessity assessment and Privacy Officer approval, with legal advice where appropriate.
• No pressure through unrelated people: We do not disclose debt information to relatives, other clients, unrelated business associates or the public to embarrass someone or pressure payment.
• No automatic cross-business disclosure: A debt on one file does not automatically authorize access to or disclosure from another personal or business file.
• Disputes and corrections: We record relevant disputes, verify the accuracy of the information we disclose, and communicate corrections to collection recipients where appropriate. Access and privacy complaints are not refused merely because fees are outstanding.

This policy does not create a personal guarantee, establish liability for another person’s debt, authorize a bank debit, or provide blanket permission for credit checks or credit-bureau reporting. Those activities require their own valid authority and compliance with applicable law.

If we are engaged to assist a business client with its accounts receivable, that is a separate engagement with defined instructions and privacy responsibilities. Information obtained for an individual’s unrelated tax engagement is not automatically available to help that business collect a debt.

Social Insurance Numbers and government authorizations

We limit SIN handling to necessary tax, payroll, statutory reporting and other specifically authorized lawful purposes. As a firm policy, we do not use SINs as routine client numbers, portal usernames, general authentication answers or routine collection identifiers; this reflects the OPC’s recommendation against using SINs as general identifiers (OPC SIN guidance).

Government representative authorizations and filing approvals are obtained separately where required for the service. Access to a government account for tax work is not permission to search it for unrelated debt-collection information or to share its contents across client files.

When information is shared

Personal information may be shared only as reasonably necessary for an authorized purpose or where the law permits or requires it. Potential recipients include:

• FIRSTCARE personnel: Employees and contractors whose assigned responsibilities require the information and who are subject to confidentiality and access restrictions.
• Government bodies: Tax and other government authorities within valid authorizations, approved filings, or a lawful requirement.
• Your authorized recipients: Representatives, financial institutions, lenders, advisers, purchasers or other recipients you specifically authorize, subject to verification of scope and recipient identity.
• Operational service providers: Providers of document storage and upload services, tax or accounting software, workflow and client-management systems, communications, scheduling, electronic signatures, payment processing, IT support, backup and security.
• Professional advisers and collection recipients: Legal advisers, insurers where appropriate, and lawful collection participants, subject to the limits in this policy.
• Legal recipients: Persons to whom disclosure is required or permitted by a valid legal obligation or a specific statutory exception, after appropriate review.

Service providers acting for us are restricted to the purposes for which we engage them and are subject to appropriate contractual or other safeguards. We remain accountable for information under our control rather than transferring that responsibility to a vendor.

We do not sell client personal information for advertising or authorize unrelated marketing by service providers. Any future practice sale, merger or transfer involving client information will be reviewed separately and handled only within applicable legal requirements, confidentiality protections and required notices or consents.

Processing locations and cross-border services

Our digital services and authorized service providers may involve storage, processing, technical support or access outside your province or outside Canada. Remote access from another country is included in our assessment, even where a server is located in Canada.

You can request details of the processing locations and service-provider categories relevant to your engagement from our Privacy Officer before submitting information. We will provide any additional location-specific notice required by the law that applies to the service.

Information handled in another jurisdiction may be subject to access under that jurisdiction’s laws by courts, law-enforcement or national-security authorities; a contract cannot override those laws (OPC cross-border processing guidance). We assess the relevant arrangements and use contractual and other safeguards designed to provide a comparable level of protection.

Where Québec’s private-sector law applies, we conduct the required privacy impact assessment and put the required written agreement in place before covered processing or communication outside Québec (Québec private-sector privacy statute, section 17). Separate tax-record location requirements remain applicable; this policy is not permission to disregard them.

Contact our Privacy Officer with questions about processing locations or service-provider practices. If you have restrictions, tell us before submitting information so that we can discuss whether an appropriate service arrangement is available.

Electronic communications, websites and automation

We use electronic communications and workflow tools to request documents, coordinate work, send reminders, manage approvals and communicate about services and accounts. These processes may generate message-delivery records, activity logs and other service records.

Please use our designated document-upload method for sensitive documents where available. Ordinary email and text messaging can be misdirected, forwarded, intercepted or viewed on shared devices; we limit sensitive details in such messages and do not treat a client’s preferred communication method as a waiver of our safeguarding responsibilities.

Our websites and online services may use essential technologies for security, forms, sessions and functionality. Any analytics, advertising, profiling or other optional tracking must be accurately disclosed and accompanied by the consent or controls required by applicable law.

Our contact page includes Google Maps and a ClickUp form. Loading or using embedded third-party services may disclose technical information, such as your IP address and browser details, to their providers, and information entered into a form is processed through the form provider for the stated purpose. External links and embedded services can be subject to their providers’ privacy notices. You can contact us by telephone instead of using an embedded form, and ask our Privacy Officer about the technologies and choices relevant to the service you use.

If a call or meeting will be recorded or transcribed, we provide an appropriate notice and obtain consent where required, including an explanation of the purpose. Availability of a non-recorded alternative can be discussed with us.

Automation is used only within an authorized purpose and approved access arrangements. Identifiable client information is not to be entered into unapproved public AI tools or used for unrelated model training; any approved AI-enabled processing must undergo privacy and vendor review and be disclosed as necessary before use.

If recording, transcription or AI-enabled processing is proposed for your engagement, you can ask our Privacy Officer about the purpose, provider, human review and available choices. We provide any additional notice and obtain any additional consent required before a new use begins.

Where Québec law applies to a decision based exclusively on automated processing, we provide the required notice and, on request, information about the personal information used and the principal reasons, factors and parameters, together with an opportunity to submit observations to someone able to review the decision (Québec private-sector privacy statute, section 12.1).

Optional promotional messages are separate from necessary service communications. Where we offer marketing subscriptions, we provide an appropriate choice and a way to unsubscribe; choosing not to receive marketing does not opt you out of communications necessary to an ongoing engagement.

Safeguarding information

We apply administrative, technical and physical safeguards appropriate to the sensitivity of the information and the risks involved. Our safeguard program addresses:

• Access control: Role-based permissions, individual user accounts, authentication, timely access changes and restrictions on shared or public links.
• People and procedures: Confidentiality obligations, privacy training, recipient verification, approval requirements for unusual disclosures and escalation of suspected incidents.
• Digital security: Appropriate encryption, secure transfer methods, device protection, updates, backups, monitoring and recovery arrangements.
• Physical and disposal security: Controlled access to paper records and devices, secure storage, and appropriate destruction or disposal.
• Vendor oversight: Privacy and security review, contractual protections and response procedures for service-provider incidents.

No system or transmission method is completely secure. We do not guarantee absolute security, but we investigate suspected problems and take appropriate corrective action.

Retention and secure disposal

We retain personal information only as long as reasonably necessary for the identified purposes and applicable legal, contractual or legitimate recordkeeping requirements. Retention depends on the type of record, the engagement, any open tax issue, and any complaint, claim or legal hold.

Tax records are commonly subject to a minimum period of six years from the end of the last tax year to which they relate, with important exceptions such as late-filed returns, objections or appeals and long-term property records; this is not a universal six-year destruction rule for every document (CRA record-retention guidance).

Our retention schedule distinguishes tax and engagement files, billing records, consents, complaints, security records, routine communications and temporary working copies. When retention is no longer justified, information is securely destroyed, erased or anonymized using an appropriate method; identifiable backup copies remain protected until expiry under the applicable backup cycle.

Termination of services or withdrawal of consent does not necessarily require immediate deletion. We preserve information needed to meet legal obligations, resolve a dispute, maintain an applicable legal hold or allow available recourse following an access request.

You should retain your own required tax and business records. Do not assume FIRSTCARE will hold the only copy indefinitely; any agreed custodial or document-return arrangements should be documented in your engagement.

Access, correction and other requests

You may contact our Privacy Officer to ask whether we hold personal information about you, request access to it, obtain an account of its use and disclosure, or challenge its accuracy or completeness. We may request information reasonably necessary to verify your identity or your representative’s authority, and we will assist if you need help making a request.

Where PIPEDA applies, we respond to written access requests within 30 days of receipt, subject only to a permitted extension with the required notice, reasons, revised deadline and complaint information (PIPEDA, section 8). Where a provincial law applies, we follow its applicable deadline and requirements.

Access may be limited by a specific legal exception, including protection of another person’s information or applicable legal privilege; we assess whether protected material can be severed and provide the remaining information where required (PIPEDA, section 9). Where permitted, we explain any refusal in writing and identify available recourse.

Requests are handled at no or minimal cost under applicable law, with advance notice of any permitted charge. We do not require payment of outstanding service invoices as a condition of exercising statutory privacy-access rights.

We correct substantiated inaccuracies or incompleteness and communicate corrections where appropriate. If a disagreement cannot be resolved, we record the unresolved challenge as required.

You may also request deletion, restriction, portability or cessation of particular uses, and we will assess the rights available under the law that applies. These are not unlimited rights to erase records that must be retained; where Québec law applies, qualifying computerized information collected from you can be requested in a structured, commonly used technological format, subject to the statutory conditions (Québec private-sector privacy statute, section 27).

Privacy incidents

If you suspect that information has been lost, misdirected or accessed without authorization, contact our Privacy Officer promptly and avoid further circulation of the information. We assess the incident, contain it where possible, preserve relevant evidence, evaluate potential harm and implement appropriate corrective measures.

Where PIPEDA applies, breaches presenting a real risk of significant harm are reported to the OPC and notified to affected individuals as soon as feasible after determination, subject to the Act’s requirements; all breaches of security safeguards involving personal information under our control must be recorded (PIPEDA, sections 10.1–10.3). We follow applicable provincial incident-assessment, reporting, notification and recordkeeping requirements where they apply.

Contacting us and making a complaint

Please direct privacy questions, consent changes, requests and complaints to the contact below. Provide enough information to explain the issue, but do not include a SIN or sensitive attachment in an initial ordinary email; we can arrange an appropriate way to receive supporting documents.

Privacy contact	Details
Responsible role	Privacy Officer
Privacy Officer	Sachindra Naik, Principal Accountant
Organization	FIRSTCARE Financial Services Ltd.
Email	snaik@firstcarefinancial.ca
Mailing address	1087 Meyerside Dr, Units 4–5, Mississauga, ON L5T 1M5, Canada
Telephone	(905) 232-8041

We review complaints fairly, investigate as appropriate and explain our response and any corrective steps. Raising a privacy concern does not waive your rights or prevent you from contacting the relevant privacy regulator.

For matters under PIPEDA, the regulator is the Office of the Privacy Commissioner of Canada. Depending on the applicable law, the appropriate provincial authority may be the Office of the Information and Privacy Commissioner of Alberta, the Office of the Information and Privacy Commissioner for British Columbia, or the Commission d’accès à l’information du Québec; the OPC provides a guide to these provincial laws and authorities.

Changes to this policy

We review this policy periodically and identify the effective date of each adopted version. Material changes will be communicated appropriately, and any additional consent required for a new purpose will be obtained before that purpose is implemented.

A policy update does not retroactively authorize an earlier collection, use or disclosure, and continued use of our services is not treated as blanket consent to new sensitive-information uses. This policy does not limit rights or obligations imposed by applicable law.