Privacy Policy

Two roles, and which applies

For information about our own customers and website visitors, such as the person who signs up, their name, email, billing details and how they use the site, we decide why and how it is handled. In privacy law terms we are the controller, and this policy governs.

For information an association puts into the service about its owners, residents and vendors, the association decides why it is there and what happens to it. We handle it on the association's instructions. In privacy law terms the association is the controller and we are the processor or service provider, and the data processing addendum governs. If you are an owner or resident with a question about your own records, ask your association or its manager first, because they control that information; we will support them in answering you.

What we collect, and why

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do not use resident information an association has entrusted to us to market to those residents.

Why we are allowed to handle it

• To perform our contract with you, which covers creating your account, providing the service and billing it.
• For our legitimate interests in keeping the service secure, preventing abuse, and understanding how it is used so we can improve it, where those interests do not override your rights.
• With your consent, where consent is the appropriate basis, such as optional marketing email, which you can withdraw at any time.
• To comply with a legal obligation, such as tax and accounting record keeping.

Who we share it with

We use service providers to run the service, and they may handle personal information on our behalf under contract: hosting and infrastructure, database and backup, email delivery, payment processing, error monitoring and analytics, and customer support tooling. A current list of the categories, and of our sub-processors for association data, is in the data processing addendum.

We also disclose information where we are legally required to, to protect our rights or someone's safety, or in connection with a reorganisation or sale of the business, in which case the recipient remains bound by this policy or one no less protective. We will tell you about a legally compelled disclosure unless we are prohibited from doing so.

Where it is processed

We operate from Canada and use providers that may process information in Canada, the United States and other countries. Where information is transferred out of its home jurisdiction we rely on appropriate safeguards, which depending on the destination may include standard contractual clauses or an adequacy decision.

If you need your association's data to stay in a particular country, ask us before you sign up. We would rather tell you we cannot guarantee it than find out later that you needed it.

How long we keep it

• Account and billing records: for as long as you hold an account, and afterwards for as long as we need them for tax, accounting and limitation-period purposes.
• Association data: as directed by the association, and on termination for the wind-down period in the data processing addendum, then deleted or anonymised.
• Logs and audit records: for a limited period appropriate to security and troubleshooting, then deleted or aggregated.
• Support correspondence: for as long as needed to handle the matter and to show how we handled it.

Security

We use encryption in transit, access controls and role separation, audit logging, least-privilege administrative access, and backups. We review access and we restrict who in our team can see customer data to those who need to for support and operations.

We do not hold a SOC 2, ISO 27001 or similar certification, and we will not imply that we do. If a certification is a requirement for you, tell us before you sign up so you are not disappointed later.

If a breach affects your personal information or your association's data, we will notify you without undue delay, tell you what we know and what we are doing, and support any notification you are required to make.

Your rights

Depending on where you live you may have the right to access the personal information we hold about you, to correct it, to delete it, to object to or restrict how we use it, to withdraw consent, to receive a portable copy, and not to be discriminated against for exercising those rights.

To exercise a right, email info@fourcents.ca. We will verify who you are before acting, and we will respond within the time the applicable law requires. If your request concerns records an association holds in the service, we will direct you to that association, because it controls them.

In Canada you may complain to the Office of the Privacy Commissioner of Canada or to your provincial regulator. In the United Kingdom or the European Economic Area you may complain to your supervisory authority. In other places, to whichever regulator has authority over us or you.

Children

The service is for boards, managers and residents acting in connection with a property, and is not directed to children. We do not knowingly collect personal information from a child. If you believe a child's information has been put into the service, tell us and tell the association that controls it.

Cookies and similar technologies

We use cookies and similar technologies that are necessary to sign you in and keep the service working, and a limited set that help us understand usage so we can improve it. Where consent is required for non-essential cookies we ask for it and you can change your choice later. You can also control cookies in your browser, though blocking necessary ones will stop you signing in.

Changes and contact

We will update this policy as the service changes, and the date at the top shows when. For a change that materially affects how we handle your personal information we will give notice before it takes effect.

Questions, requests and complaints: info@fourcents.ca, or by mail to hoa.to, c/o Four Cents, 49 Thorncliffe Park Drive, East York, Toronto, Ontario, M4H 1J6, Canada.