Data Security and Privacy

You are handing us your corporate bank records, payroll data, and CRA correspondence. Please read exactly how we hold it, how long we keep it, and what protection stands behind our work.

Who we are

Gondaliya CPA Professional Corporation is registered with CPA Ontario under Firm ID 61330051. We operate from Toronto and serve incorporated businesses across Canada. Every file is handled by our own Canadian CPA team. We do not outsource client data offshore.

PIPEDA compliance

We collect, use, and disclose personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA).

We collect only what is required to prepare and file your corporate returns, maintain your books, run your payroll, and meet our professional obligations as a CPA firm. We do not sell client data. We do not share it with third parties for marketing. We do not use your financial records for any purpose outside your engagement.

Your information is disclosed only in these situations:

Situation	Detail
To the Canada Revenue Agency	Filing your returns and responding to reviews, under the authorization you sign on Form AUT-01
To the software we use to serve you	TaxCycle, TaxDome, QuickBooks Online, Xero, and our payroll platform, each under their own privacy and security terms
Where the law requires it	Court order, statutory demand, or CPA Ontario practice inspection
On your written instruction	Sending records to your lawyer, banker, lender, or a successor accountant

You have the right to ask what personal information we hold about you, to have it corrected, and to know how it has been used. Please email our Privacy Officer at info@gondaliyacpa.ca. We respond within 30 days, as PIPEDA requires.

Record retention

We retain client records for seven years from the end of the tax year to which they relate. The CRA requires six years from the end of the last tax year the records apply to. We hold one additional year as our own margin, so that a late reassessment or objection never finds us short of supporting documents.

Record type	Retention period
Corporate tax returns and working papers	7 years
Bookkeeping files and source documents	7 years
GST/HST filings and supporting schedules	7 years
Payroll records and T4 filings	7 years
Engagement letters and client correspondence	7 years
Records under active CRA review, audit, or objection	Held until the matter is fully closed, then 7 years

Once the retention period ends, digital records are permanently deleted and any paper is cross-cut shredded.

How your documents are stored

Client documents are held in TaxDome, the secure client portal we use for every engagement. TaxDome encrypts data in transit and at rest, hosts on enterprise cloud infrastructure, and maintains its own independent security certification. You can read TaxDome’s published security standards on their website.

Please send documents through the portal rather than by email. Email is not encrypted end to end, and a corporate bank statement sitting in an inbox is the weakest link in the chain.

Additional controls in place across the firm:

Control	Detail
Access	Limited to the team members assigned to your file
Authentication	Two-factor authentication on firm accounts and tax software
Devices	Firm devices only, encrypted and password protected
Payments	Interac e-Transfer to info@gondaliyacpa.ca. We never request card numbers by email or text
Your CRA credentials	We never ask for your My Business Account password. We work through Represent a Client authorization instead

Professional liability

Gondaliya CPA Professional Corporation carries professional liability insurance meeting the requirements that CPA Ontario places on registered firms. Particulars of our coverage are available to clients on request.

As a CPA Ontario firm we are also bound by the CPA Ontario Code of Professional Conduct, subject to mandatory practice inspection, and held to the confidentiality obligations that apply to every Chartered Professional Accountant in Ontario. If you ever have a concern about our conduct, CPA Ontario provides a formal complaints process that is open to you.

If something goes wrong

If we have reason to believe your personal information has been accessed without authorization in a way that creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada, as PIPEDA requires. We will tell you what was affected, when it happened, and what we are doing about it. We will not wait to be asked.