Privacy Policy

Last updated: May 2026

BOMCAS Canada (\"we\", \"us\", \"our\") respects your privacy and is committed to protecting personal information in accordance with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws including Alberta\'s Personal Information Protection Act.

1. Information we collect

We collect personal information that you voluntarily provide through:

Contact, consultation, and inquiry forms on this website (name, email, phone, business name, location, service interest, message)
Documents you upload to our secure client portal in the course of a professional engagement (tax records, financial statements, banking information, government identification)
Direct correspondence by email, phone, or video meeting
Web server logs that automatically capture IP address, browser type, and pages visited for security and analytics purposes

2. How we use information

Information is used solely to:

Respond to your inquiry or consultation request
Prepare and file the tax returns, financial statements, payroll filings, and other accounting deliverables you have engaged us to prepare
Communicate with you about your engagement
Represent you with the Canada Revenue Agency or other government authorities under your written authorization
Comply with our professional, legal, and regulatory obligations

3. Disclosure of information

We do not sell, rent, or trade personal information. We disclose personal information only in the following circumstances:

To the Canada Revenue Agency (CRA) and provincial tax authorities as required for filings you have engaged us to prepare and submit under your written authorization (RC59, AUT-01, or equivalent)
To service providers that support our delivery (secure portal hosting, e-signature platforms, cloud accounting software) under contractual confidentiality and security obligations
When required by law, court order, or in response to lawful regulatory request

4. Security

We use encryption in transit (TLS) and at rest for documents stored in our client portal, multi-factor authentication for staff access to client data, role-based access controls, and regular security review. No method of internet transmission or electronic storage is 100% secure, but we apply industry-standard safeguards.

5. Retention

Tax and accounting records are retained for the periods required by Canadian tax law (generally six years from the end of the relevant tax year) plus a reasonable additional period for professional and regulatory purposes. Inquiry-form data is retained only for as long as needed to respond and complete any resulting engagement, then is securely destroyed.

6. Your rights

You have the right under PIPEDA to:

Access personal information we hold about you
Correct inaccurate personal information
Withdraw consent for future use of your personal information (subject to legal and professional obligations)
File a complaint with the Office of the Privacy Commissioner of Canada

7. Cookies and analytics

This website uses minimal technical cookies necessary for form security (CSRF protection) and may use server-side analytics to measure aggregate traffic. We do not use third-party advertising trackers.

8. Contact

To exercise any of the rights above or to ask questions about this Privacy Policy, contact:

BOMCAS Canada — Privacy
6063 88 St NW, Edmonton, AB T6E 5T4, Canada
Phone: 780-667-5250
Email: info@bomcas.ca

Detailed Privacy Practices at BOMCAS Canada

BOMCAS Canada is a Canadian-owned and Canadian-operated accounting practice, and we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial private-sector privacy statutes, including Alberta's Personal Information Protection Act (PIPA), British Columbia's PIPA, and Quebec's Act respecting the protection of personal information in the private sector (Law 25). This expanded section explains how those laws translate into our day-to-day handling of your personal and tax information.

Categories of personal information we collect

The personal information we collect falls into four categories: (1) contact and identification information (name, email, phone, business name, postal address, Canadian province or territory of residence); (2) tax and financial information required to prepare your filings (Social Insurance Number, Business Number, GST/HST account number, T-slips, bank and investment statements, accounting software exports); (3) engagement information (services requested, communications with our team, signed engagement letters); and (4) technical information collected by our website and client portal (IP address, browser type, pages viewed, form submissions). We collect only what we genuinely need to deliver the service you have asked us to provide and to meet our regulatory and CRA recordkeeping obligations.

How information is used

Personal information is used to prepare and electronically file your Canadian tax returns (T1, T2, T3, T4, T5, GST/HST, payroll, and other CRA and Revenu Québec filings), to provide bookkeeping and payroll services, to communicate with you about your file, to respond to CRA correspondence on your behalf when you have authorized us as your representative, to issue invoices and collect payment, and to meet legal recordkeeping obligations including the Income Tax Act's six-year retention rule.

Consent

We rely on express written consent for most processing — typically through a signed engagement letter and CRA Form AUT-01 (Authorize a Representative for Access by Phone and Mail) or Form RC59 (where applicable). For website use we rely on implied consent for essential cookies and explicit checkbox consent before form submission. You may withdraw consent at any time by emailing info@bomcas.ca, subject to legal and contractual limitations (for example, we cannot withdraw an already-filed T1 return from the CRA, but we can stop further processing and revoke our representative access).

Disclosure to third parties

BOMCAS Canada does not sell, rent, or trade personal information. We disclose information only to the CRA and Revenu Québec when filing on your behalf, to provincial tax authorities where applicable, to your authorized advisors when you instruct us in writing, to our processors (Canadian-hosted accounting software providers and our Canadian payment processor), and where required by Canadian law (for example, a court order or a CRA Requirement to Provide Information). All processors are bound by written agreements that limit their use of your data and require comparable safeguards.

Data location and cross-border transfer

Wherever practical we use Canadian-hosted services. Some processors store data in the United States or other jurisdictions; in those cases your information may be subject to the laws of that jurisdiction, including lawful access requests by foreign authorities. We disclose any material cross-border transfer in our engagement letter and you may request a current list of processors at any time.

Security safeguards

We apply administrative, physical, and technical safeguards proportionate to the sensitivity of tax information. Administrative safeguards include written policies, role-based access, mandatory training, and confidentiality agreements with every team member. Physical safeguards include locked premises and secure shredding of any paper documents. Technical safeguards include encrypted transit (TLS 1.2+), encrypted storage where supported, two-factor authentication on our client portal and accounting software, complex passwords, network firewalls, anti-malware tools, regular patching, and offsite encrypted backups. No system can guarantee absolute security, and Canadians should always use a unique strong password and enable two-factor authentication on their CRA My Account and CRA My Business Account.

Retention

We retain working papers, signed engagement letters, supporting documents, and copies of filed returns for a minimum of seven years from the end of the relevant tax year, which exceeds the CRA's standard six-year requirement and aligns with limitation periods in most provinces. Some documents (for example, those related to a real estate adjusted cost base or to the principal residence exemption) are kept indefinitely because they remain relevant for future filings. When records are no longer required, paper is shredded and electronic data is securely deleted.

Your rights under Canadian privacy law

Under PIPEDA and provincial equivalents, you have the right to (a) access the personal information we hold about you, (b) request correction of inaccurate information, (c) withdraw consent (subject to legal and contractual limits), (d) be informed of any disclosure to third parties, and (e) file a complaint with our Privacy Officer or with the Office of the Privacy Commissioner of Canada (priv.gc.ca). Quebec residents also have specific rights under Law 25 including the right to data portability for automated processing. To exercise any of these rights, write to our Privacy Officer at info@bomcas.ca.

Cookies and website analytics

Our website uses only first-party cookies strictly necessary for the contact form (CSRF token cookie and session cookie). We do not use advertising cookies, do not run remarketing pixels, and do not sell visitor data. We may use privacy-respecting server-side analytics that record aggregate page-view counts without any cross-site tracking. If we ever add a third-party analytics provider we will update this policy and present a cookie banner that allows you to opt in.

Children's privacy

Our services are directed at Canadian adults, businesses, and parents/guardians filing on behalf of minors. We do not knowingly collect personal information directly from children under the age of majority in the applicable Canadian province or territory. Parents filing children's tax returns or RESP-related documents should use their own accounts to submit information.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in Canadian privacy law, our services, or our processors. The "Last updated" date at the top of the policy will always indicate the most recent revision. We encourage you to review the policy periodically and to contact us with any questions.