Privacy Policy
Milinchuk CPA Professional Corporation ("Milinchuk CPA", "I", "me") is the CPA practice of Anton Milinchuk in Toronto, Ontario. I provide accounting, bookkeeping, payroll, Canadian and US tax, and advisory services. This policy explains how I collect, use, share, and protect personal information. I follow the Personal Information Protection and Electronic Documents Act (PIPEDA) and the confidentiality rules of the CPA Ontario Code of Professional Conduct.
1. Who is responsible
I, Anton Milinchuk, CPA, am my own Privacy Officer and am responsible for this policy. Contact: info@milinchukcpa.com, 647-801-2969, 17 Festival Drive, Toronto, ON M2R 3T9.
2. What this policy covers
This policy covers personal information about my clients, prospective clients, people who contact me, and visitors to milinchukcpa.com. It does not cover information that cannot identify a person.
3. What I collect
- Contact details: name, email, phone number, mailing address, preferred language.
- Identity information when required by law: date of birth, Social Insurance Number, US taxpayer identification numbers, ID documents, immigration or residency status.
- Financial and tax information: income slips, bank and investment statements, tax returns and notices, business records, and information about family members or shareholders needed for your file.
- Website and communications information: what you send me through my contact form, email, phone, WhatsApp, or Telegram, and the technical information described in section 6.
4. Why I collect it
I use personal information to:
- answer your questions and arrange consultations;
- provide the services set out in your engagement letter, including bookkeeping and payroll services, and preparing and filing returns with the Canada Revenue Agency, the Internal Revenue Service, and other authorities on your instructions;
- verify identity and meet my legal and professional obligations, including CPA Ontario requirements;
- bill for my services and keep proper records;
- protect my website and systems from spam and misuse.
I do not use your information for other purposes without your consent unless the law requires or permits it.
5. Consent
I collect, use, and share personal information with your consent, except where the law allows otherwise. Consent may be express (for example, signing an engagement letter) or implied (for example, sending me your tax slips so I can prepare your return). You can withdraw consent by contacting me, subject to legal and contractual limits. If you do, I will explain how this affects my ability to serve you.
6. My website
- Contact form. When you send a message, I receive your name, email, phone (optional), message, and the language of the page. It is emailed to info@milinchukcpa.com. To limit spam, my server keeps a short record linked to a scrambled (hashed) version of your IP address, not the address itself.
- Secure document upload. If you use my secure upload page, I receive your name, email, phone (optional), note (optional), the files you send, and the language of the page. Files travel over an encrypted connection (HTTPS) and are kept temporarily on my hosting server in Canada or the United States, outside the public part of the website. I get an email notice without your files attached. I then move the files to secure client storage, and the server copy is deleted automatically within 30 days. Files that become part of your client file are kept as described in section 10. To limit misuse, my server keeps a short record linked to a scrambled (hashed) version of your IP address.
- Online booking. My booking calendar is provided by Google Calendar appointment scheduling. When you book, Google receives the details you enter and handles them under Google's privacy policy. The meeting takes place on Google Meet.
- Fonts and icons. My pages serve fonts and icons from my own website, so no outside font or icon provider receives your IP address when a page loads.
- Hosting and email. My website and email are hosted by GoDaddy, and my business mailboxes forward to Google Gmail.
- Search Console. I use Google Search Console to see how my site appears in Google search. It gives me summary data, not information about individual visitors.
- Google Analytics. I use Google Analytics 4 to understand how visitors use my site. Using cookies, it records page views and your approximate location, device, and browser information. I have turned on IP anonymization and turned off Google's advertising features, so I do not use it for advertising or remarketing. Google processes this information and may store it outside Canada, including in the United States. I do not use it to identify individuals, and I do not link it to client files. You can opt out through your browser settings or by installing the Google Analytics opt-out browser add-on. A small notice at the bottom of the page lets you accept or decline. If you decline, analytics stops and I remember your choice in your browser. Change my choice. If you have questions, write to info@milinchukcpa.com.
- Performance monitoring. My hosting provider, GoDaddy, automatically adds a performance-monitoring script to my pages. It may collect technical information, such as your IP address and browser details, to measure site speed. I do not use it to identify visitors or for advertising.
- Messaging apps. If you contact me on WhatsApp or Telegram, those services process your messages under their own privacy policies. Please do not send identity documents or tax slips through them; ask me for a secure method instead.
- Links. My site links to other websites. I am not responsible for their privacy practices.
7. Confidentiality and sharing
Client information is confidential under the CPA Ontario Code of Professional Conduct. I share it only:
- with your consent, for example with your lawyer, banker, or a tax authority when I file on your behalf;
- with service providers who help me run the practice, such as email, hosting, cloud storage, and tax software providers, who may use it only to provide their service to me;
- when required by law, a court order, or a regulator, including CPA Ontario practice inspection or discipline processes;
- to establish or defend legal claims, or as otherwise permitted by law.
I do not sell personal information.
8. Safeguards
I protect personal information with measures that fit its sensitivity, including password-protected and encrypted devices and accounts, multi-factor authentication, access limited to those who need it, and secure storage and destruction of paper records. No method of transmission over the internet is fully secure, so please use my secure upload page or ask me for another secure way to send sensitive documents. If a breach creates a real risk of significant harm, I will notify you and the Office of the Privacy Commissioner of Canada as the law requires.
9. Information outside Canada
Some of my service providers, including Google and GoDaddy, store or process information outside Canada, mainly in the United States. That information may be accessed by courts and authorities in those countries under their laws. For Canada-US cross-border clients, I send information to US authorities such as the IRS when you instruct me to file there.
10. Retention
I keep client files for at least six years after the end of the last tax year they relate to, or longer when tax law, CPA Ontario standards, or an open matter requires it. Website enquiries that do not lead to an engagement are deleted within 24 months. When I no longer need information, I securely delete or shred it. Copies of files sent through my secure upload page are deleted from my web server within 30 days.
11. Accuracy, access, and correction
You may ask to see the personal information I hold about you and ask me to correct it. Send a written request to my Privacy Officer. I will reply within 30 days, or tell you if I need more time as the law allows. Access is free or at minimal cost, and I will tell you any cost first. In limited cases I may refuse access, for example where it would reveal another person's information or is protected by legal privilege, and I will explain why.
12. Electronic messages
I send commercial electronic messages, such as newsletters or service updates, only with your consent or where Canada's Anti-Spam Legislation allows it. Every such message identifies me and lets you unsubscribe.
13. Children
My website is not directed to children, and I do not knowingly collect information from children through it. I collect information about minor dependants only when needed for a client's tax file.
14. Questions and complaints
Contact my Privacy Officer first. If you are not satisfied, you may contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca or 1-800-282-1376.
15. Changes
I may update this policy. The current version and its date will always be on this page. If a change materially affects how I use client information, I will tell active clients.
See also my Terms of Use.