Data Privacy & Security Policy

---

Protecting Canadian Cypress's financial information is a priority. No matter what your business is, your organization is growing, your CPA firm is expanding, or your public accounting firm is expanding, we are dedicated to ensuring that the information you share with us remains confidential, secure and intact.

Canadian Cypress is an accounting firm in Victoria, British Columbia, that offers bookkeeping, payroll, accounts payable and accounts receivable services to companies in Canada and the U.S. This Privacy & Security Policy will outline how we collect, manage, store and protect your information through trusted security practices and industry practices.

Privacy at a Glance

Transparency, responsible data handling and only the information necessary to provide our services are principles that we believe in.

Privacy Principle	Our Commitment
No Data Sales	Your information is not sold, rented, leased or shared with other third parties for commercial purposes.
Responsible AI Practices	Client financial data is never used to power public AI systems or LLMs.
Regulatory Compliance	We conform to the Canadian PIPEDA, BC PIPA and relevant US GLBA Safeguards requirements.
Secure Access Controls	Role-based permissions and multi-factor authentication ensure sensitive information is protected.

Information We Collect

We only ask for information that is necessary to be able to offer our bookkeeping, payroll and accounting service effectively. We may collect the following information:

• Corporate Contact Data: Business names, Business Contact Persons, Business Addresses, Professional Email Addresses, and Business Telephone Numbers.
• Financial & Accounting Data: General ledger, bank statements, transaction data, invoices, accounts payable information, accounts receivable data.
• Payroll & HR Sensitive Data: Employee names, Social Insurance Numbers (SIN) or Social Security Numbers (SSN), payroll tax documents (e.g. T4s & W-2s), salary information, and banking information (for direct deposits).
• Tax Documentation: Corporate tax returns, GST/PST/HST records, state and federal tax returns and any other tax documentation related to that.
• Digital Identifier Data: Information provided on the website through the contact forms on www.canadiancypress.ca, email communications and IP addresses and cookies that are necessary for the operation and usability of the website.

How We Use Your Information

We only collect your details for business purposes and to provide services that you have requested. This includes:

• Ensuring bookkeeping records and financials are accurate and in sync.
• Preparing financial reports.
• Employer payroll and direct deposit for employees.
• The management of accounts payable and receivable.
• Assist in meeting requirements of Canada Revenue Agency (CRA) and Internal Revenue Service (IRS).
• Making website more functional and answering client support requests.

Your data is never shared for other than the purpose of the services without your approval.

AI Data Governance & Trust Statement

Canadian Cypress ensures that all financial records, personal information and proprietary corporate data that a client submits to us is not exposed to any public Artificial Intelligence (AI) model or LLM for training.

All automated classification and digitization systems used are in isolated enterprise-class, encrypted environments where your corporate intelligence is completely proprietary.

Our Security Standards

To ensure information safety you need multiple layers of protection. We have a robust security strategy to minimize the possibility of unauthorized access, cyber attacks and data breaches.

• Strong Encryption: For protection of sensitive information, AES 256-bit encryption is used when the information is in storage and when it is transmitted.
• Controlled User Access: Authorized personnel only have access to client data with Role Based Access Control (RBAC) and Multi-Factor Authentication (MFA).
• Trusted Technology Providers: We only use trusted platforms and applications from the cloud accounting community with a high-security infrastructure and industry-standard security measures.
• Secure Workplace Practices: Our Victoria, BC office adheres to strict workplace safety protocols such as clean desks and secure disposal of electronic equipment and storage devices.

Cross-Border Jurisdictional Compliance

Canada: Federal PIPEDA & BC PIPA

Canadian Cypress is based in Victoria, British Columbia, so our data handling is done in accordance with the British Columbia Personal Information Protection Act (PIPA) and the federal Personal Information Protection and Electronic Documents Act (PIPEDA). We will ensure that we are accountable, collect information only for specific purposes and respect your right to access and correct your personal information.

United States: GLBA Safeguards & State Frameworks

Our data management practices are consistent with the recognized data privacy and security practices for our clients, CPA firms and accounting partners in the United States.

• GLBA Safeguards Rule: The internal security measures, administrative controls, and policies for access to data are in place to accommodate the confidentiality and security expectations provided by the Gramm-Leach-Bliley Act (GLBA).
• State Privacy Regulations: We value any applicable state privacy laws and regulations, such as the CCPA and CPRA, and adopt a transparent approach, restrict data collection to business purposes, and protect data when transferred across borders.

Cross-Border Infrastructure

We apply the same security controls and data protection measures when client information is securely transferred or stored across Canada and the United States while using trusted, cloud-based infrastructure, to help ensure your information is protected wherever it is processed.

Data Retention & Secure Disposal

We do not keep financial or personal information for longer than is necessary to provide our services or to meet legal or regulatory requirements.

Financial records may be kept for up to seven years or as required by law or the CRA, IRS or other authorities.

When no longer needed for legal, operational or business reasons, the information is securely destroyed by cryptographic erasure and/or professional digital data destruction practices.

Your Privacy Rights

Under applicable privacy laws and regulations in your jurisdiction, you may be able to access or control your information.

If you have any questions or comments, please contact us at: enquiry@canadiancypress.ca

• Access Your Information – Obtain a copy of the personal or business information that we hold.
• Accurate Information – Request to correct incorrect or incomplete information.
• Request Deletion – Request deletion of information, as permitted by law, in compliance with applicable CRA, IRS, or other legal retention requirements.
• Data Portability – Request a secure transfer of your data to another authorized accounting professional/financial representative.

Contact Our Privacy Team

Under the relevant laws and privacy laws, you might be able to request access to or control over your information.

Canadian Cypress INC.
Address: 734 Tyee Road, Victoria, BC V9A 6X4, Canada

Phone: +1 250-268-3946
Email: enquiry@canadiancypress.ca