Privacy Policy

Coast Mountain Accounting Ltd. and Coast Mountain Bookkeeping Ltd.
6-1366 Aster Street, Pemberton, BC V0N 2L1 | 778-887-4664 | coastmountainaccounting.com

Effective date: October 20, 2026 | Last reviewed: October 20, 2026

1. Who we are and what this policy covers

Coast Mountain Accounting Ltd. provides accounting, tax and advisory services. Coast Mountain Bookkeeping Ltd. provides bookkeeping services. Together we call ourselves “we”, “us” or “the Firm”. The two companies are separate legal entities that work closely together. This policy applies to both. It covers the personal information of our clients, prospective clients, and people who use our website or contact us. Employee information is covered by a separate internal policy.

We are based in British Columbia and follow British Columbia’s Personal Information Protection Act (PIPA) and, where it applies, Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). As CPAs we are also bound by the confidentiality rules in the CPABC Code of Professional Conduct.

“Personal information” means information about an identifiable individual, such as a name, address, Social Insurance Number (SIN), income or banking details. Business contact information (such as a business name, title, work phone and work email) is not personal information under PIPA.

2. Our Privacy Officer

Our Privacy Officer is Jonathan Cook, Principal. He is responsible for making sure we follow this policy and PIPA.

Phone: 778-887-4664
Email: jonathan@coastmountainaccounting.com
Mail: Privacy Officer, 6-1366 Aster Street, Pemberton, BC V0N 2L1

Please contact him with any privacy question, request or complaint.

3. What personal information we collect

What we collect depends on the services you ask for. It may include:

• Contact and identity details: name, address, phone, email, date of birth, and identification we need to verify who you are. For tax and CRA filings we also need your Social Insurance Number, and for businesses a Business Number (see section 9).
• Tax and financial information: income slips, receipts, tax returns and notices of assessment, bank and credit card statements, invoices, payroll information, loan and investment records, and corporate records such as share structure and shareholder details.
• Information about other people that you give us, such as spouses, dependants, employees, directors and shareholders.
• CRA account information, if you authorize us as your representative.
• Billing and payment information, including payment method details processed by our payment providers.
• Communications: emails, messages, forms, call notes, and files you upload to our client portal.
• Website information: browser type, device, pages visited, referring site, IP address, and the date and time of visits. See section 16.

We collect most information directly from you. We may also collect it from the CRA (with your authorization), your financial institutions, your other advisors, or your bookkeeping and accounting software, again with your authorization.

4. Why we collect it and how we use it

We collect, use and disclose personal information only as reasonably necessary to perform our engagement with you and to meet our legal and professional obligations. Specifically, we use it to:

• confirm your identity and set up your engagement;
• prepare tax returns, financial information and bookkeeping records, and give advice;
• file returns and communicate with the CRA and other authorities on your behalf, as you authorize;
• send invoices, collect payment and manage our accounts;
• communicate with you about your engagement;
• keep records as the law and our professional standards require, including CPABC practice review and, where they apply to us, anti-money-laundering requirements;
• protect our systems and detect fraud or misuse; and
• improve our internal processes and our website.

We do not sell or rent personal information. We do not currently use client information for marketing. If that changes, section 17 explains how we will do it.

5. Your consent

We collect, use and disclose personal information with your consent, except where PIPA allows or requires us to do so without it. When you sign an engagement letter and give us your information to do the work, you agree to the uses in this policy. This is “implicit” consent where the purpose is obvious, and “express” consent where we ask you to agree in writing.

We will tell you why we are collecting your information, either before we collect it or at the time. If we want to use it for a new purpose, we will ask you first.

You can withdraw your consent at any time by giving us reasonable notice in writing. We will explain what that means for you. For example, we may no longer be able to provide some services. We cannot stop using information where the law or our professional standards require us to keep or disclose it.

If you give us information about another person (for example a spouse, dependant, employee or shareholder), you confirm that you have their permission, or are otherwise entitled, to give it to us for this purpose.

6. Who we share information with

We share personal information only when needed, and only with:

• Our staff and contractors. Our staff and authorized contractors may access client information, including SINs and BNs, as needed to provide our services. All client information is confidential. Our staff are bound by written confidentiality obligations in their employment agreements, and our authorized contractors are bound by written confidentiality obligations in their contractor agreements.
• Our service providers, who help us deliver services. They include:
  • accounting and bookkeeping software: QuickBooks Online and Hubdoc;
  • tax preparation software: TaxCycle;
  • our secure client portal: TaxFolder (included with TaxCycle);
  • proposals, engagement letters, e-signature, billing and payments: Ignition;
  • practice management and client communication: Karbon;
  • electronic signatures: Dropbox Sign;
  • financial reporting and analytics: Syft Analytics;
  • design and marketing: Canva;
  • PDF tools: Adobe Acrobat;
  • video meetings: Google Meet and Zoom;
  • office software: Microsoft 365 (Copilot);
  • email and file storage: Google (Google Workspace);
  • website hosting and security: GoDaddy (website hosting), Cloudflare (website delivery and security) and TrustedSite (a website security and trust-badge service);
  • website analytics: Google Analytics (see section 16); and
  • AI tools, as described in section 11.
    Some of these providers may store or process information outside Canada (see section 7).
• Government bodies, including the CRA and provincial agencies, when we file or communicate on your behalf or when the law requires.
• Professional advisors and insurers, such as our lawyers, and our professional regulator, CPABC, which may review our files in a practice inspection or investigation. Reviewers are bound by confidentiality.
• Each other. Coast Mountain Accounting Ltd. and Coast Mountain Bookkeeping Ltd. may share your information with each other when it is reasonably necessary for services either company provides to you. Our engagement letters ask for your consent to this, and you can withdraw it by written notice.
• Others you authorize, such as your lender, your other accountant or your legal representative.
• Where the law requires or permits, for example to comply with a court order or subpoena, or to a lawyer representing us.

If we sell or reorganize our business, we may share information with a buyer or its advisors under confidentiality agreements, and PIPA’s rules about notice to clients will apply.

We remain responsible for personal information we give to service providers. We choose providers with care and look for contractual or other protections for confidentiality, security and breach notice.

7. Where your information is stored and accessed

We use cloud service providers. Information may be stored in Canada or elsewhere in the world, depending on the provider. Some providers store or process information in Canada. Others may store or process information outside Canada, including in the United States. This may include QuickBooks Online, Hubdoc, Ignition, Karbon, Dropbox Sign, Syft Analytics, Google (Workspace email and file storage, Google Meet and Google Analytics), Canva, Adobe, Zoom, Microsoft, our website hosting and security providers, and AI tool providers. Our client portal, TaxFolder, may store uploaded documents in Canada or elsewhere, and data may pass through other locations and jurisdictions while in transit. Wherever information is stored or processed, it is subject to the laws of that place.

Team members working outside Canada. Some of our staff and contractors work remotely from outside Canada, including from Mexico, and may access, store or process client information from there. When they do, they use only our business accounts and systems, protected by multi-factor authentication; they are bound by written confidentiality agreements; and they do not keep local copies of client information on personal devices. The same confidentiality obligations and safeguards apply as in our office (section 8).

Information stored, accessed or processed in another country is subject to the laws of that country, which may allow courts, law enforcement or national security authorities there to access it. We use safeguards such as encryption and access controls, but we cannot override foreign laws. PIPA does not prohibit storing or accessing information outside Canada, but we want you to know. If you have concerns, contact our Privacy Officer.

8. Safeguards

PIPA requires us to protect personal information with reasonable security arrangements. Our safeguards include:

• recommending that sensitive documents be sent through a secure client portal rather than regular email, and providing one (TaxFolder);
• encryption of data in transit and, where available, at rest;
• unique accounts, strong passwords and multi-factor authentication for our systems;
• treating all client information as confidential: access is limited to our own staff and authorized contractors, and our staff are bound by written confidentiality obligations in their employment agreements, and our authorized contractors are bound by written confidentiality obligations, in line with CPABC Rule 208;
• reviewing our service providers; and
• keeping our software up to date and securing our devices and office.

No system is completely secure. Email in particular is not a secure channel. We advise against sending SINs, BNs, banking details or other sensitive information by regular email, text message or website form, and recommend our client portal (TaxFolder), phone or an in-person visit instead (section 9). We cannot prevent anyone from emailing information to us, and if you do, we protect it with the same safeguards and confidentiality as other client information. We will never ask you to change payment instructions by email alone. If something looks wrong, phone us at 778-887-4664.

9. Social Insurance Numbers (SINs) and Business Numbers (BNs)

Your Social Insurance Number is one of the most sensitive pieces of information we handle, because it can be used for identity theft. Business Numbers (BNs) are also needed for CRA filings and we treat them with care.

When we ask for them. We ask for a SIN or BN only where it is required by law or needed to do the work you have engaged us to do. For example, we need a SIN to prepare and file a personal (T1) tax return, and we need SINs or BNs for corporate (T2) filings, payroll and information returns and slips (such as T4, T5 and T5018), and to deal with the CRA on your behalf, including through EFILE and Represent a Client. We do not ask for a SIN or BN on quote requests, general enquiries or our website questionnaires, and we do not use a SIN to verify your identity. We verify identity with other documents. Where a SIN is not legally required for a particular service, providing it is optional, and we will tell you so.

How you give it to us. Our website forms and questionnaires do not collect SINs or BNs. We recommend that you give them to us through our secure client portal (TaxFolder), by phone, or in person. We advise against sending a SIN or BN, or other sensitive information, by regular email, text message or website form, because those channels are not secure. We cannot prevent you from emailing it to us. If you do, or if one reaches us that way, it is protected by the same safeguards and confidentiality as all other client information. Where practical, we may move it to a secure location and delete the message, and we may ask you to use a more secure channel in future. Our staff do not ask you to send a SIN or BN by email, and we advise against it.

How we use them. Our staff use SINs and BNs to prepare and file returns and slips and to deal with the CRA for you. We use a SIN only for the purpose for which you gave it to us, and we do not use or share it for any other purpose unless the law requires or authorizes it, or you give us your written consent. This follows PIPA’s rule that information is used only for the purposes we disclose, and the Income Tax Act’s restrictions on using or communicating a SIN. We do not use your SIN as a client number, file name, login or other general identifier.

Where they are stored and who can see them. SINs and BNs, and the rest of your client file, may be stored in our Google email and file storage (Google Workspace) and in our tax preparation software (TaxCycle) for preparing your returns, and may be held in TaxFolder if you upload them there. Our staff and authorized contractors may access them as needed to provide our services. All client information is confidential, our staff are bound by written confidentiality obligations in their employment agreements, and our authorized contractors are bound by written confidentiality obligations. See section 7 for storage outside Canada.

Additional protections. We make every effort to keep SINs, BNs and other personal information out of AI tools (section 11). We mask SINs (for example, showing only the last three digits) in internal notes, emails and other documents, and we do not put them in file names or email subject lines. Our accounts for email, the cloud file system and website administration use multi-factor authentication.

A breach involving SINs is treated as high risk in our breach response (section 14).

How long we keep them. We keep SINs and BNs as part of the engagement file for seven (7) years after the engagement ends, then securely destroy them (section 12).

10. Website forms and questionnaires

We use online forms on our website. They fall into two groups. Neither group collects SINs or BNs. Submissions from all of our website forms are delivered to our staff.

(a) Quote Request form

• What we collect: the details you enter, usually your name, email address, phone number, the service you are interested in, and your message.
• Why: to respond to you, prepare a quote, and follow up on your enquiry.
• How long we keep it: if you do not become a client, we delete the enquiry after 12 months. If you become a client, the information is transferred to your client file (section 12) and the copy stored in our website database is deleted within 30 days after the transfer.

(b) Client questionnaires

• What they are: our Personal Tax Questionnaire, New Business Onboarding Questionnaire, Corporate Year-End Questionnaire, Rental Property Tax Questionnaire and Work-Space-In-The-Home Questionnaire.
• What we collect: the details we need to prepare your return or financial statements, or to set up your engagement. For personal tax this may include your name, address, date of birth, marital and family details, and income and deduction information, including details about a rental property or a home workspace. For a business or corporation this may include owner, director and shareholder details, business and year-end information, and banking details. Questionnaires do not ask for a SIN or BN, and please do not enter one; we will collect them separately (section 9).
• Why: to prepare tax filings and financial statements, set up your engagement, and meet our legal and professional obligations.
• How long we keep it: if you become a client, as part of your engagement file for seven (7) years after the engagement ends (section 12). The copy stored in our website database is deleted within 30 days after it is transferred to your client file, or after 12 months if you do not become a client.

How form information is sent and stored. Information you enter in our website forms is submitted over an encrypted (HTTPS) connection. Our forms use the Ninja Forms plugin on our WordPress website. Responses are stored in our website’s database at our website hosting provider (GoDaddy), which may store it outside Canada, including in the United States (section 7). Our website hosting provider is one of the service providers described in section 6. Once a form becomes part of your client file, it is stored with your other client records. We do not use form responses for marketing other than as described in section 17.

11. Our use of artificial intelligence (AI)

We use AI tools, including AI assistants, to help with internal administration, drafting, research and analysis. Some of these tools may handle client information, for example when they help us summarize a document, draft a letter or analyze financial records. Our approach:

• A CPA is always responsible. AI does not make decisions about you. AI outputs are drafts and suggestions. A CPA or other qualified person at the Firm reviews and approves any work before it affects a client, and we remain professionally responsible for our work.
• No automated decisions. We do not use AI to make final decisions about clients, such as tax positions, filings, fees or whether to accept or end an engagement, without human review.
• Approved tools only. We use only AI tools that we have reviewed and approved, on business-grade plans. We do not enter confidential client information into public or consumer AI tools, or into personal AI accounts. The AI tools we have approved currently include Grok (xAI) on a business (Teams) plan, and the AI features built into QuickBooks Online (Intuit Assist), Hubdoc, TaxCycle, TaxFolder (our client portal, included with TaxCycle), Google Workspace (Gemini), Google Meet (Gemini meeting notes), Zoom (AI Companion), Microsoft Copilot, Adobe Acrobat (AI Assistant), Canva (Magic Studio), Karbon, Dropbox Sign, Syft Analytics and Ignition. Our engagement letters describe how we use AI tools, and we will update this list before we add a new one.
• Vendor terms review. Before we use an AI tool with client information, we review the vendor’s terms and settings, including where data is processed and stored, how long it is kept, who can access it, and whether it is used to train AI models. We choose settings that stop the vendor from training its models on our data where that option is available. We review these terms again from time to time because vendors change them. We cannot guarantee how a vendor will behave, but we remain responsible for the information we share with it.
• SINs, BNs and other identifiers. We make every effort to keep Social Insurance Numbers, Business Numbers and other personal information out of AI tools, and we redact or mask them before using a tool. When we use AI, we comply with applicable privacy legislation (British Columbia’s PIPA and, where it applies, PIPEDA) and with the professional standards of CPABC. We oversee any use of AI: our staff review AI outputs, and we remain accountable for the results.
• Sharing as little as practical. We remove or mask names, account numbers and other identifying details where it is practical to do so, and we share only what the task requires.
• Where data is processed. AI providers may process information outside Canada. Information processed in another country is subject to that country’s laws. See section 7.
• Records. We keep records of our significant uses of AI in client work, including the tool used and the CPA review, as our professional standards require.
• Security. Access to AI tools is limited to authorized people, and we apply the safeguards described in section 8.
• Your choices. If you would prefer that we not use AI tools with your information, tell us at any time (contact our Privacy Officer, section 2). We will note it on your file and will not use AI tools with your information for your engagement. Some of our software, such as accounting software, may include built-in AI features. If you opt out, we will also not use those features on your file where we are able to turn them off.

If you have questions about our use of AI, contact our Privacy Officer. We review our AI practices regularly as the technology and the guidance from privacy regulators and CPABC change.

12. How long we keep information

We keep working papers and records relating to an engagement for seven (7) years after the engagement ends. This is longer than the CRA’s six-year record-keeping requirement. After that we securely destroy them, or remove information that identifies individuals. Your original documents remain yours and will be returned to you on request or when the engagement ends.

We keep some information for shorter periods. For example, website enquiries from people who do not become clients are deleted after 12 months, and website analytics data is kept for 14 months. Where the law requires, we keep information at least one year after using it to make a decision that directly affects you, so you can request access to it.

You remain responsible for keeping your own books and records for the periods required by law.

13. Your right to see and correct your information

You can ask us:

• for access to your personal information we hold, how we have used it, and who we have disclosed it to; and
• to correct an error or omission in it.

Please make your request in writing to our Privacy Officer, with enough detail for us to identify you and what you are asking for. We may need to verify your identity first. We will respond within 30 days of receiving your request (PIPA counts days without Saturdays and holidays), and we may extend that for up to another 30 days in some circumstances, in which case we will tell you why. We may charge a minimal fee for access, and will give you a written estimate first. We will not charge for corrections.

PIPA sets out limited reasons we may or must refuse access, such as information protected by solicitor-client privilege, information that would reveal personal information about someone else, or information collected for an investigation that is not finished. If we refuse, we will explain why and tell you how to ask the Information and Privacy Commissioner for BC to review our decision. If we decide not to make a correction, we will note your requested correction on the record.

Our working papers are our property. Where they contain your personal information, we will provide access to that information as PIPA requires.

14. If something goes wrong: privacy breaches

If we learn that personal information has been lost, stolen, or accessed or disclosed without authority, we will act quickly to contain it, assess the risk, and fix the cause. We follow the steps recommended by the Office of the Information and Privacy Commissioner for BC: contain, evaluate the risk, notify, and prevent.

Where the breach creates a real risk of harm to you, we will notify you as soon as reasonably possible, directly where we can. We will tell you what happened, what information was involved, what we have done, what you can do to protect yourself, and who to contact. We may also notify the Office of the Information and Privacy Commissioner for BC, the CRA (including when the breach involves information handled through EFILE), CPABC, our insurer, and the police, as appropriate or required.

PIPA does not currently require private-sector organizations to report breaches, but we treat reporting and notification as good practice.

If you think there has been a breach involving your information, tell our Privacy Officer right away.

15. Security of your CRA authorization

If you authorize us through the CRA’s Represent a Client service or My Account, we will use the access only for the services in your engagement letter. You can cancel the authorization at any time, and at the end of the engagement we will remove our access on your request.

16. Our website, cookies and analytics

What we collect. When you visit coastmountainaccounting.com, our website and hosting systems automatically record technical information such as your browser type, device, language, referring site, pages visited, IP address, and the date and time of your visit. If you complete one of our forms, we collect the details you enter (see section 10). Our website does not offer public user accounts, registration or comments. The only accounts on the site are for our own staff who manage it.

Cookies and analytics. A cookie is a small file that a website stores in your browser. Our website uses:

• Google Analytics (through the MonsterInsights plugin) to understand how visitors use our site, for example which pages are visited. Google Analytics uses cookies and similar technologies, and the information it collects, which may include your IP address, device and browser details and pages visited, is sent to Google and may be stored or processed outside Canada, including in the United States. We use it to improve our website. We keep Google Analytics data for 14 months, and the retention period is not reset when you return to the site. We have turned off Google signals and we do not use Google’s advertising features or share this data for advertising.
• Security and delivery cookies. Our website security and delivery provider (Cloudflare) and our website security and trust-badge provider (TrustedSite) may set cookies or collect technical information to protect the site and show our security badge. The badge is loaded from TrustedSite’s servers through a third-party script, so TrustedSite may receive technical information, such as your IP address and browser details, when our pages load.

We do not use advertising or social media tracking pixels on our website.

Cookie notice and your choices. Our website shows a short notice about cookies and analytics, with a link to this policy and a way to opt out of analytics. We do not use a consent pop-up that blocks the site. You can opt out of analytics at any time in either of these ways:

• install Google’s Analytics opt-out browser add-on (https://tools.google.com/dlpage/gaoptout), which stops Google Analytics from collecting data about your visits in that browser; or
• block or delete cookies in your browser settings. Some features may not work without them.

Our client portal and other sites. Our client portal (TaxFolder) and other third-party sites we link to have their own privacy practices. Please review them. TaxFolder’s website is https://taxfolder.com/.

We advise against sending a SIN, BN or other sensitive information through any website form. Please use our secure client portal (TaxFolder), phone or an in-person visit instead (sections 9 and 10).

17. Keeping in touch (email and Canada’s anti-spam law)

We send emails that are part of your engagement, such as invoices, requests for documents, deadlines and answers to your questions. These are not marketing.

We do not currently send marketing emails or newsletters. If we send marketing emails or newsletters in the future, we will do so only with your consent as Canada’s Anti-Spam Legislation (CASL) requires, or where CASL otherwise permits. Each message will clearly identify us and include our contact information and a simple way to unsubscribe. We will act on unsubscribe requests within 10 business days, and we will keep a record of your consent. You can withdraw your consent at any time. We do not sell or give your email address to others for their marketing.

18. Children and minors

Our services are for adults and businesses, and our website is not directed to children. We prepare tax returns for children and dependants only through a parent, guardian or other authorized adult, and we deal with that adult.

19. Changes to this policy

We review this policy regularly. When we make a significant change we will post the updated policy on our website with a new effective date, and make it available to current clients through a link on our website questionnaires and forms and through the privacy policy link on our regular website pages. We will not use your information for a new purpose without your consent where PIPA requires it.

20. Questions and complaints

If you have a question or concern about how we handle your personal information, contact our Privacy Officer, Jonathan Cook, Principal (section 2). We will acknowledge your complaint promptly, look into it, and respond to you in writing within 30 days. If we find a problem we will correct it.

If you are not satisfied with our response, you may complain to the Office of the Information and Privacy Commissioner for British Columbia:
PO Box 9038 Stn. Prov. Govt., Victoria, BC V8W 9A4
Phone: 250-387-5629 (elsewhere in BC, call Service BC toll-free at 1-800-663-7867 and ask to be transferred)
Email: info@oipc.bc.ca | Website: oipc.bc.ca

You may also have a right to contact CPABC about professional conduct concerns.

21. Contact us

Coast Mountain Accounting Ltd. and Coast Mountain Bookkeeping Ltd.
Attention: Privacy Officer, Jonathan Cook, Principal
6-1366 Aster Street, Pemberton, BC V0N 2L1
778-887-4664 | jonathan@coastmountainaccounting.com