Privacy Policy

Books by Jessica Ltd. · Ontario, Canada

For readability, this policy refers to Books by Jessica Ltd. as "Books by Jessica," "we," "us," or "our."

Some engagements are carried out in affiliation with Book Nerds Bookkeeping. Where that is the case, this policy still applies to the information Books by Jessica handles, and information may be shared between the two practices as reasonably necessary to deliver and bill for the work.

Purpose of this policy

This privacy policy explains how Books by Jessica collects, uses, shares, retains, and protects personal information in connection with our services and online systems, including the Books by Jessica client portal ("the portal") and our tax interview forms.

We provide bookkeeping services and the preparation and electronic filing of Canadian personal income tax returns (T1), corporate income tax returns (T2), and related information returns and slips. The portal and interview forms may be used to submit tax information, confirm information we already hold, upload supporting documents, review action items on an engagement, review invoices, arrange payments, and communicate with us.

Our forms and portal may also be used by an authorized representative acting for a client, such as a spouse or common-law partner filing together, a business owner or officer, an executor or power of attorney, or another person authorized to act on a client's behalf.

What we collect

We collect personal information that you provide to us, that is provided to us on your behalf, or that is reasonably necessary to provide and administer our services.

Depending on the service, this may include:

• your name, email address, phone number, and mailing address;
• your date of birth, marital status, and residency information;
• your Social Insurance Number and, where applicable, the Social Insurance Numbers of a spouse or common-law partner and dependants;
• information about dependants, including names, dates of birth, and relationship;
• income information, including employment, self-employment, investment, rental, pension, benefit, and other income, and related slips (such as T4, T4A, T5, and T3);
• deduction and credit information, including RRSP contributions, child care, medical expenses, donations, tuition, disability tax credit status, home office and rental details, and similar items;
• self-employment and business information, including business name and address, revenue, expenses, and bookkeeping records;
• bookkeeping and accounting records, including bank and credit card transactions, receipts, invoices, payroll information, and GST/HST information;
• prior-year return information and Canada Revenue Agency correspondence, notices of assessment or reassessment, and review letters;
• documents, files, notes, and correspondence you upload or send to us;
• CRA representative authorization details;
• invoices, deposits, payments, account balances, and transaction records;
• portal account, authentication, and access information used to provide secure access; and
• technical information reasonably necessary to operate, secure, troubleshoot, and maintain our online systems.

We do not intentionally collect more personal information than is reasonably necessary for the service or business purpose involved.

Why we collect it

We may use personal information to:

• respond to inquiries and onboarding requests;
• determine whether we can assist and what service is appropriate;
• prepare and provide quotes, engagement details, and deposit requests;
• prepare, review, and electronically file tax returns and information returns;
• perform bookkeeping, reconciliation, payroll, and GST/HST work;
• obtain and act on Canada Revenue Agency representative authorization;
• respond to CRA reviews, requests for information, assessments, and reassessments;
• maintain client, return, and engagement history from year to year;
• communicate with clients and authorized representatives;
• prepare and deliver invoices, and request or record deposits and payments;
• maintain business, accounting, tax, and professional records;
• investigate or resolve billing, service, or filing disputes;
• protect our clients, staff, systems, and business from fraud, misuse, unauthorized access, or security incidents; and
• meet legal, regulatory, contractual, and other legitimate business obligations.

We do not sell or rent personal information. We do not use information collected through the portal or interview forms for unrelated marketing.

Social Insurance Numbers and sensitive tax information

A Social Insurance Number is required to prepare and file a Canadian tax return. We collect it, and other sensitive tax information, only for that purpose and for related CRA correspondence, record-keeping, and professional obligations.

Social Insurance Numbers are encrypted where stored in our systems, and staff access to full numbers is restricted. When a number is displayed back to staff for verification, it is normally masked so that only the last digits are shown.

Returning clients and information on file

If you have had a return prepared by us before, our interview may show you information we already hold, such as identity, residency, marital status, dependant, and disability tax credit details, and ask you to confirm whether it is still correct. Sensitive values are masked when shown back to you. Confirming that information is still correct allows us to carry it forward to the current year's return.

CRA representative authorization

To file returns and deal with the Canada Revenue Agency on your behalf, we ask you to authorize Books by Jessica as your representative through CRA's online services or an authorization form. This allows CRA to share your tax information with us and allows us to act for you on tax matters. You may cancel this authorization with CRA at any time, though doing so may affect our ability to continue the work.

Documents you upload

The portal allows clients and authorized representatives to upload supporting documents, such as slips, receipts, and statements, against a specific engagement. Uploaded files are stored in a client folder, organized by engagement, and are accessible to Books by Jessica staff working on that engagement and, where the engagement is run in affiliation with Book Nerds Bookkeeping, to that practice. Please upload only documents that are relevant to the work and that you are authorized to provide.

If document upload is not working for you, you may send documents by email to contact@booksbyjessica.com. Ordinary email is not a fully secure channel; if you have concerns about sending sensitive information by email, contact us to arrange another method.

Protected documents

Some documents we make available to you through the portal — such as a T4 or a notice of assessment — are marked as protected. To open one you must request a one-time code, which we email to the address on your account and which is valid for a short time. This is an added safeguard for documents that contain personal tax information.

Electronic signatures

When a document needs your signature — for example a T183 electronic-filing authorization or an engagement letter — we use DocuSeal, an electronic-signature tool that Books by Jessica hosts on its own systems. When you sign, the following are recorded as part of the completed document and its audit trail: your name and email address, your typed or drawn signature, the date and time of each action (opened, signed, declined), and the IP address from which you signed. The completed, signed document and its audit trail are stored on your engagement file and retained with our other records for the periods described in this policy. We do not use a third-party signing service, and your signing information is not sent to one.

Invoices, deposits, and payments

The portal may allow certain clients to review invoices and arrange payment. We retain appropriate records of invoices, deposits, payments, credits, balances, and related transactions for accounting, tax, dispute-resolution, and other legitimate business purposes.

Where an engagement is billed to Book Nerds Bookkeeping rather than to the client directly, invoices for that engagement are not shown to the client through the portal. Where a person on a business account does not have billing rights for that account, that person is not shown the account's invoices.

Where electronic payment processing is offered, payment information may be collected or processed by a third-party payment provider. The information available to Books by Jessica depends on the payment method and provider used. Third-party payment providers have their own privacy policies, terms, and security practices.

Information provided by or about others

In some situations, information about one person is provided to us by another, for example where a spouse or common-law partner provides information for a return filed together, where a business owner provides information about employees for payroll, or where a client provides information about dependants. A person providing information about another individual should only provide information they are authorized or reasonably entitled to provide. Where appropriate, we may contact the individual concerned directly to confirm information or authorization.

Consent

By providing personal information to Books by Jessica, using the portal, submitting an interview or intake form, uploading documents, approving an engagement, making a payment, or otherwise interacting with our services, you consent to the collection, use, and handling of personal information for the purposes described in this policy, where consent is required. Consent may also be provided by an authorized representative acting on your behalf.

You may withdraw consent to certain uses of your personal information, subject to legal, contractual, professional, accounting, and other legitimate requirements. Withdrawing consent may affect our ability to respond to a request, provide portal access, prepare or file a return, perform bookkeeping work, process a transaction, or continue providing services.

Who may see your information

Personal information may be accessed by Books by Jessica staff, and by Book Nerds Bookkeeping personnel where an engagement is run in affiliation, who reasonably require access to perform their work.

We may also use third-party service providers that support our business, including providers of:

• website and application hosting;
• email and communications;
• document and data storage;
• information technology and security services;
• tax preparation and electronic filing software;
• accounting and bookkeeping software;
• payment processing; and
• other services reasonably required to operate our practice.

These providers may process personal information on our behalf where reasonably necessary to provide their services. Books by Jessica remains responsible for personal information under our control as required by applicable Canadian privacy law. Some service providers may store or process information outside Ontario or outside Canada, in which case that information may be subject to the laws of the jurisdiction where it is held.

When we may disclose information

We may disclose personal information where reasonably necessary to:

• prepare, review, or electronically file a return with the Canada Revenue Agency or another tax authority;
• respond to a CRA review, audit, assessment, reassessment, or request for information;
• act on an authorization you have given us;
• communicate with an authorized representative, spouse, business officer, executor, or other involved party;
• obtain software, technical assistance, or professional advice;
• process a payment or transaction, or collect amounts owing;
• respond to a legal claim, dispute, or professional matter;
• investigate suspected fraud, misuse, or unauthorized access;
• protect our clients, staff, business, or systems;
• respond to a lawful request from a court, government body, regulator, or law-enforcement authority; or
• comply with legal, regulatory, contractual, tax, or other obligations.

We may also disclose information where otherwise permitted or required by law.

How long we keep information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected or for legitimate legal, business, accounting, tax, and record-keeping purposes.

Tax and accounting records are generally retained for the periods required or recommended under the Income Tax Act and related Canada Revenue Agency guidance, which is typically at least six years from the end of the relevant tax year, and longer where reasonably necessary. Return information, prior-year data, and engagement records may be retained for an extended period because they remain relevant to future returns, CRA reviews, reassessments, disputes, and professional obligations.

Some records may be retained even if an individual later requests deletion, where continued retention is required or reasonably necessary for legal, professional, accounting, tax, dispute-resolution, or record-keeping purposes. When information is no longer reasonably required, we may delete, destroy, anonymize, or otherwise dispose of it in accordance with our business practices and applicable requirements.

How we protect information

We use reasonable administrative, technical, and physical safeguards intended to protect personal information against loss, theft, and unauthorized access, disclosure, copying, use, or modification.

These safeguards may include access controls, account authentication, encryption of sensitive identifiers such as Social Insurance Numbers, two-factor authentication for staff accounts, restricted administrative access, system logging, backups, software and security updates, and secure hosting arrangements.

No website, application, network, email system, or electronic storage method can be guaranteed to be completely secure.

Portal account and access security

Where the portal provides authenticated, private access, you are responsible for taking reasonable steps to protect your account, including your password, your email account, and any device you use. Do not share your portal access or give another person access to private information unless they are authorized to receive it.

If you believe someone has gained unauthorized access to your information or your account, please contact us promptly.

We may maintain technical logs and security information where reasonably necessary to operate the portal, authenticate users, investigate technical problems, detect or prevent misuse, and protect the security of our systems and users.

Email and electronic communications

We may communicate with clients and authorized representatives by email, telephone, text message, or through the portal. Electronic communications may contain information about returns, engagements, documents, invoices, or accounts. While we take reasonable precautions, ordinary email and text messaging are not guaranteed to be secure. If sensitive information requires another method of communication, please contact us.

Accuracy

We rely on clients and authorized representatives to provide accurate and complete information. Please let us know if your contact details, marital status, dependants, residency, business information, or other relevant information changes or is incorrect so we can update our records and, where necessary, your return.

Your privacy rights

Subject to applicable law and limited exceptions, you may ask:

• whether we hold personal information about you;
• to access personal information we hold about you;
• for inaccurate or incomplete information to be corrected;
• questions about how your information has been used or disclosed;
• to withdraw consent where applicable; or
• to raise a concern about our privacy practices.

We may need to verify your identity before responding to a privacy request. Access may be limited or refused in circumstances permitted or required by law, including where providing access would reveal personal information about another person or information that cannot lawfully be disclosed. Certain information may need to be retained despite a request for deletion or withdrawal of consent where retention is required or reasonably necessary.

Privacy responsibility and contact

Jessica Arcaro-Ingram is responsible for privacy matters at Books by Jessica. Privacy questions, access requests, correction requests, withdrawals of consent, and concerns may be directed to:

Books by Jessica Ltd. Ontario, Canada

Email: contact@booksbyjessica.com Phone: 905-380-6269 Web: www.booksbyjessica.com

Changes to this policy

We may update this privacy policy from time to time to reflect changes to the portal, our services, technology, business practices, or applicable legal requirements. The current version will be made available through the portal, our website, or another reasonable means.