Access, get a copy of what we have
We will provide a copy of the personal information we hold about you, including the categories of data, the sources, and the third parties we share it with.
Request accessPrivacy
Data request
Exercise your rights under PIPEDA and Quebec Law 25. Pick the type of request below, fill in the templated email, and we will respond within 30 days.
Draft, pending final legal review. The procedure below reflects our current PIPEDA and Quebec Law 25 obligations. The templated emails and 30-day SLA will be reviewed by Canadian privacy counsel prior to public launch.
Before you submit
All requests are reviewed by our Privacy Officer, Sean Cavanagh, CPA. To prevent unauthorized disclosure, we may need to verify your identity before acting on a request. Acceptable verification includes confirming the email address on file, providing a government-issued ID for high-risk requests (deletion, full export), or completing a callback to a phone number on file.
We do not charge a fee for a request unless it is manifestly unfounded or excessive. If a fee applies, we will tell you in writing before doing the work.
Service-level commitment
We will acknowledge your request within two business days and complete it within 30 days of receiving sufficient information to act. If we need longer (for example, the request involves a large volume of records), we will tell you the reason and the new expected date.
Pick a request type
Correction, fix something inaccurate
If something we hold about you is incorrect or incomplete, we will correct or supplement it (and notify any third party we previously shared the inaccurate version with).
Request correctionDeletion, erase your data
We will delete the personal information we hold about you, except where we are legally required to retain it (e.g., records attached to a filed CSBFP application, audit logs, tax records).
Retention note: Records attached to a filed financing application are retained to meet lender, CSBFP, and tax-record obligations. We will tell you exactly what we kept and why.
Request deletionPortability, export in a machine-readable format
We will provide your personal information in a structured, commonly-used, machine-readable format (JSON or CSV).
Request exportIf you cannot use email
Mail us a written request to the address listed in our Privacy Policy. Include the same information the templated emails ask for so we can verify your identity and act on the request without back-and-forth.
Right to complain
If you are not satisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, if you are in Quebec, with the Commission d’accès à l’information du Québec (cai.gouv.qc.ca). We would prefer the chance to fix the problem first, but we respect your right to escalate.