Privacy Policy

What this website collects about you, why, where it is kept, and how to ask us about it.

Version 1.0 · Effective 16 October 2026

Who is responsible

This policy covers the Canadian pages of this website (the pages under /ca), which are operated by UM Tax and Accounting Inc. It also covers the request information our hosting provider records when you visit the country page at the home address (/) before you choose a country.

Email: hello@umairmanzoor.com
Phone: +1 647 434 6730
Address: Mississauga, ON L5V 2G4

This policy describes only how UM Tax and Accounting Inc. handles personal information. Umair Manzoor PC, UM Tax and Accounting Inc. and Umair Manzoor & Co. Chartered Accountants are separate entities. Each is responsible only for its own work.

Person in charge of the protection of personal information

Under Quebec law, the person with the highest authority in a business is responsible for the protection of personal information unless that role is delegated to someone else in writing. PIPEDA also requires a business to name who is accountable for the personal information it holds.

The person in charge of the protection of personal information at UM Tax and Accounting Inc. is Mashad, Chief Executive Officer. You can write to him at hello@umairmanzoor.com, with “Privacy” in the subject line.

What we collect and why

Today the website collects very little:

Technical information about each visit. Our hosting provider, Render Services, Inc., may record information about the requests its servers receive, such as the time, the page requested, the IP address and the browser type, in its operating logs. Such logs are used to run the site and keep it secure. The site itself writes no log of your visit; it only counts visits, as the next item describes.
Visit counts without cookies. We also count visits on our own server, without cookies: the pages read, the site you came from, and your browser, device type, screen size and language. Your IP address is used briefly, to estimate your country and to tell one visit from another, and is not stored. None of this is sent to another company. This happens whatever you choose in the cookie settings, because it uses no cookies and identifies no one.
Your region choice. If you choose a country on the country page or with the footer’s region switcher, a cookie called region_pref remembers that choice so the home address opens that country’s site. The Cookie Policy lists every cookie the site sets.
What you send us. If you email hello@umairmanzoor.com, phone +1 647 434 6730 or message us on WhatsApp, we receive what you choose to send, such as your name, your contact details, your question or a CV, and we use it to reply and to deal with what you ask. Email is received in our business mailbox, which an email service provider runs for us.
Staff sign-in. Authorized staff sign in to a private admin area of the site with Microsoft Entra ID. Visitors never sign in.
Enquiries through our form. If you send the enquiry form, we keep what you enter: your name, email address, phone number if given, where you’re based, what you’re interested in, your message, and any other details the form asks for, such as your company, revenue, timeline or how you heard of us. We also keep the page and any campaign link that brought you to the form, your browser type and a keyed hash of your IP address, never the address itself. Your email address and phone number are stored encrypted. We use them to reply to you and to keep a record of the enquiry. We email you a confirmation through Microsoft 365. A security check by Cloudflare Turnstile helps stop automated spam. We keep enquiries that don’t lead to an engagement for 24 months after our last contact, and spam for 30 days. If you tick the reminders and updates box, we keep a record of that consent for 3 years after you unsubscribe.
Deadline reminders and occasional tax updates by email, if you ask for them. If you tick the reminders and updates box on our enquiry or booking form, or sign up on our Tax deadlines page, we keep your email address, the wording you agreed to and when you agreed, and send you an email about once a month listing the tax deadlines due in the next 45 days, and occasional tax updates. Every email has an unsubscribe link, and unsubscribing takes effect at once. We first email you once to confirm, and send nothing else until you do.
Calls you book. If you book a call on the site, we keep your name, email address, phone number if given, your notes and your time zone as part of your enquiry, with your email address and phone number encrypted. We set up the call in our Microsoft 365 calendar with a Microsoft Teams link, and email you a confirmation, reminders and a link to reschedule or cancel. If you lose that email, Find my booking sends the link again, only to the address on the booking. A booking is kept with your enquiry, on the same timetable.
Privacy requests. If you use our privacy request form, we keep the type of request, your email address, your name and details if you give them, and a keyed hash of your IP address, never the address itself, with your address, name and details encrypted. We email you a link to confirm the request comes from you. We delete a request you never confirm after 30 days, and keep a request we have answered for 3 years after we close it, as a record of our answer.

The site does not run advertising or social media tags, a chat widget, embedded maps or videos, or an error-monitoring service. It uses Google Analytics as the cookie policy describes, and only as your choices allow. Besides Google Analytics, one thing from another company loads, and only on the pages with our enquiry and booking forms, including Find my booking, and on our Tax deadlines page, which has a sign-up box: Cloudflare Turnstile, a security check that helps stop automated spam. It runs in its own frame, may store what it needs for that check in your browser, and does not see what you type into the form. Everything else, including the fonts and images, is served from this site.

The WhatsApp chat button on every page and the WhatsApp mark in the footer are plain links. Nothing from WhatsApp loads until you choose to follow one. If you do, WhatsApp opens a chat with +1 646 372 3934.

That number is shared with the separate US practice named under “Who is responsible” above, and a message you send to it is received on that shared WhatsApp account. If you would rather your message reach only UM Tax and Accounting Inc., phone us on +1 647 434 6730 instead.

WhatsApp is a service of WhatsApp LLC, part of Meta Platforms, Inc. It is not one of our service providers. What you send through it is handled by WhatsApp under its own terms and privacy policy, and may be processed outside Canada. Please do not send tax documents or identification numbers by WhatsApp.

The LinkedIn, Facebook and Instagram marks in the footer are plain links too. Once you follow one, that site’s own privacy policy applies.

We use personal information only for the purposes described above: to run and secure the site, to remember your region choice, to answer you when you contact us, send an enquiry or book a call, and, if you ask for them, to send you deadline reminders and occasional tax updates. When you email, phone or message us, you consent to our using what you send for that purpose. We do not use it for anything else without asking you first.

We do not sell personal information, we do not share it for advertising, and we do not make decisions about you by automated means.

If we add advertising or any other feature that collects personal information, we will update this policy first. These rules apply:

Visitors in Quebec: no tracking technology is switched on until you choose to turn it on. Every optional category is off by default.
Visitors elsewhere in Canada: no analytics and no advertising without your consent.
Any choice to receive marketing email will be a separate, unticked option, never part of an enquiry.

Where your information is stored

The site and its database are hosted by Render Services, Inc. in its Ohio, United States region. Personal information collected through the site is therefore stored outside Quebec and outside Canada, and information held in the United States may be accessible to authorities there under United States law.

Quebec law allows personal information to be communicated outside Quebec only after a privacy impact assessment shows that it will be adequately protected there.

These are the service providers that handle personal information for the site:

Provider	Purpose	Information	Location
Render Services, Inc.	Hosting the site and its database	Request information the host may record in its operating logs, such as the time, page, IP address and browser type, and what you send through our enquiry, booking and privacy request forms, with your email address and phone number encrypted	The site is hosted in Ohio, United States
Microsoft Corporation (Microsoft Entra ID)	Staff sign-in to the private admin area	Staff sign-in identities only; no visitor information	May be outside Quebec and Canada
Microsoft Corporation (Microsoft 365)	Our business email: receiving the email you send us, sending the confirmation, reminder and update emails, and our own notice of your enquiry; our calendar, where a call you book is set up with a Microsoft Teams link	Your name, email address and what you send us	May be outside Quebec and Canada
Cloudflare, Inc. (network and security)	Delivers and protects every page of the site; tells the site the country (and US state or Canadian province) a visit comes from	The technical request information: IP address, the page asked for, browser and device	United States and Cloudflare’s worldwide network; may be outside Quebec and Canada
Cloudflare, Inc. (Turnstile)	A security check on the pages with our enquiry and booking forms, including Find my booking	Technical signals from your browser during the check, not what you type	United States; may be outside Quebec and Canada
Google LLC (Google Analytics)	Counting visits and pages read, only as your cookie choices allow	An identifier stored in your browser, the pages you visit, your browser and approximate location	Global; may be outside Quebec and Canada

Every visit to umairmanzoor.com passes through the network of Cloudflare, Inc., which delivers and protects the site on our behalf and on behalf of our hosting provider, Render. Cloudflare handles the technical request information (your IP address, the page you asked for, your browser and device), and its servers may be outside Quebec and Canada. It also tells the site which country you are visiting from, and in Canada or the United States which province or state. We use that only to decide whether analytics runs before you make a choice, as our Cookie Policy explains. It is kept with the record of your cookie choice, never with your IP address. Apart from this, the Turnstile security check described above, and the site’s images, which are stored with Cloudflare R2, the site’s own code loads nothing from Cloudflare.

WhatsApp is not on this list: see “WhatsApp and social media links” above.

How long we keep it

Hosting logs: kept by Render for the period its service sets. The site writes no log of visits of its own beyond the visit counts below.
Visit counts made without cookies (no IP address, nothing that identifies you): 14 months, then deleted.
Emails and messages you send us, including a CV: until we no longer need them for the reason you sent them.
The region_pref cookie: 12 months in your browser, unless you delete it sooner.
A record of your cookie choice (consent ID, the choice, the policy version, the date, your browser type, whether your browser sent a Global Privacy Control signal and, where known, the country and province you visited from, never your IP address): 3 years after it expires or you withdraw it.
Enquiries sent through the form that do not lead to an engagement: 24 months after our last contact with you.
Enquiries that lead to an engagement: 90 days after the engagement starts, then kept only in our client records.
Form submissions marked as spam: 30 days.
A record of your consent to deadline reminders and occasional tax updates: 3 years after you unsubscribe.
A sign-up for deadline reminders and occasional tax updates that you never confirmed: 30 days.
A call you book through the site: with your enquiry, on the same timetable.
A privacy request you never confirmed: 30 days.
A privacy request we have answered: 3 years after we close it.

When information is no longer needed for the purpose it was collected for, we delete it, unless the law requires us to keep it longer, for example while a request about it is open.

Your rights

You can ask us to:

tell you what personal information we hold about you, and give you access to it
correct information that is inaccurate or incomplete
delete information we no longer need
if you live in Quebec, give you the computerized personal information you provided to us in a structured, commonly used technological format

You can also withdraw your consent to a use of your information.

Make your request through our privacy request form, or email it to hello@umairmanzoor.com. We may ask you to confirm your identity before we act on it. We reply in writing within 30 days of receiving your request. If you live in Quebec, that time is not extended. Otherwise, in the limited cases PIPEDA allows, we may extend it; if we do, we will tell you within the 30 days the new date, the reason, and that you can complain to the Office of the Privacy Commissioner of Canada about the extension.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada. If you live in Quebec, you can also complain to the Commission d’accès à l’information du Québec.

Security and incidents

Our hosting provider serves the site over encrypted (HTTPS) connections. Only authorized staff can reach its private admin area, and they sign in with their Microsoft work accounts.

If personal information we hold is lost, used, accessed or disclosed without authorization, we record the incident.

Under PIPEDA, if a breach of security safeguards creates a real risk of significant harm, we report it to the Office of the Privacy Commissioner of Canada and notify the people affected as soon as feasible.

Under Quebec law, if a confidentiality incident involving the personal information of Quebec residents presents a risk of serious injury, we promptly notify the Commission d’accès à l’information du Québec and the people concerned.

Email marketing

We send commercial electronic messages only to people who ask for them by ticking the separate, unticked reminders and updates box on our enquiry or booking form, or by signing up on our Tax deadlines page, and confirming by email, and every message has an unsubscribe link.

If we start sending them, Canada’s anti-spam legislation (CASL) sets the rules we will follow: we send a commercial electronic message only to people who have agreed to receive it; each message identifies UM Tax and Accounting Inc. as the sender and gives a valid mailing address and a way to reach us; and each one carries an unsubscribe link that works for at least 60 days after the message is sent, with every request acted on within 10 business days. Agreeing to marketing email will always be a separate, unticked choice, never part of an enquiry.

Children, and changes to this policy

The site is not directed at children, and we do not knowingly collect personal information from them.

If what the site collects or how we use it changes, we update this policy before the change takes effect, and the date at the top of the page shows when it was last updated.

Version history

Version 1.0, effective 16 October 2026. First published version.