Privacy
Privacy policy
Who holds what information, why, for how long, and what you can ask us to do about it.
Who this policy covers
This policy explains how Square Sync Inc. ("SquareSync", "we") handles personal information in connection with the SquareSync platform and this website. It is written to meet our obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Ontario privacy law.
Three parties are involved and their roles are different, which matters for who you should contact:
- The condominium corporation is accountable for the personal information of its owners, residents and occupants. It decides what is collected and why.
- The management company processes that information on the corporation's behalf, under its management agreement.
- SquareSync is the service provider. We process personal information on documented instructions from the corporation and its operator, and we do not use it for our own purposes.
If you are an owner or resident and want your information corrected or removed, your first contact is your corporation or its manager. If they cannot resolve it, contact us and we will help.
What we collect
From platform users
- Identity and contact details: name, email address, telephone number, mailing address, and the unit or units you are associated with.
- Account and security data: password hashes, multi-factor authentication enrolment, session and device information, IP address, and sign-in history.
- Operational content you or your corporation put into the platform: work requests, tickets, bids, approvals and votes, notices, correspondence, rule-violation records, amenity bookings, documents and attachments.
- Vendor records: business details, insurance, WSIB clearance and licence documents and their expiry dates.
- Audit records: the actions taken in the platform, by whom, and when.
From this website
- Information you submit through the demo request or notification forms.
- Standard server and security logs, including IP address and user agent.
We do not sell personal information, we do not use it to train machine-learning models, and we do not serve advertising.
Why we use it
We use personal information only for the purposes for which it was provided:
- To operate the platform and provide the services the corporation and its operator have contracted for.
- To authenticate users and secure accounts, including detecting and investigating suspicious activity.
- To deliver notices and transactional email on behalf of a corporation, from that corporation's own mailbox.
- To maintain the audit record the corporation relies on for governance and record-keeping.
- To provide support, and to diagnose and fix faults.
- To meet our own legal, tax and regulatory obligations.
Where we rely on consent — for example, electronic delivery of notices — that consent is recorded, is specific to the purpose, and can be withdrawn.
Who we share it with
We disclose personal information only in these circumstances:
- Within your corporation. Access is governed by role and scope. Owners see their own unit and their corporation's available documents; managers see the corporations they operate; nobody sees another corporation's records.
- To service providers who process data on our behalf under written agreements limiting them to our instructions. Our current sub-processors are the cloud hosting provider, Microsoft 365 for corporation mailboxes, and our transactional email and error-monitoring providers. A current list is available on request.
- Where required by law, on a valid legal demand. We will notify the affected corporation unless we are prohibited from doing so.
We do not disclose personal information to any other third party without the corporation's instruction.
Where it is held
Application data is hosted in a Canadian region. Corporation mailboxes sit in a Microsoft 365 tenant configured with a Canadian data location.
Some of our service providers may access data from outside Canada for support purposes. Where that happens, the data remains subject to contractual protections, and it may also be subject to lawful access requests in the country where the provider operates. We will tell you which providers apply to your corporation on request.
How long we keep it
Retention is set to the purpose. Records a condominium corporation is required to keep — constating documents, minutes, the record of owners, agreements, financial records, the reserve fund study — are retained according to the corporation's retention schedule and the requirements of the Condominium Act, 1998.
Authentication and audit logs are retained for a defined security period. Account records for a user who leaves a corporation are deactivated and then disposed of under the corporation's schedule.
On termination, the corporation can export its data. After the agreed transition window, we delete it from live systems and, on the backup cycle, from backups, and we will provide written confirmation.
How we protect it
Encryption in transit and at rest, tenant isolation enforced in the authorisation layer and covered by automated tests, role-based access with multi-factor authentication required for privileged roles, append-only audit logging, encrypted off-site backups with restore testing, and independent penetration testing.
The security page sets these out in more detail. We describe controls we have implemented and do not claim certifications we do not hold.
If a breach of security safeguards creates a real risk of significant harm, we will notify the affected corporation without unreasonable delay and support the reporting obligations that follow.
Your rights
Subject to the limited exceptions in PIPEDA, you may:
- Ask what personal information we hold about you and how it has been used and disclosed.
- Ask us to correct information that is inaccurate or incomplete.
- Withdraw a consent you have given, such as consent to electronic delivery of notices.
- Ask for information to be deleted, where we are not required to retain it.
- Complain about how your information has been handled.
Write to privacy@squaresync.ca. We will respond within 30 days. Some requests must be directed to your corporation, as it is accountable for its own records; where that is the case we will say so and tell you who to contact.
If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada.
Cookies
This website uses only the cookies and local storage needed to make it work: your light or dark theme preference, and, if you sign in to the platform, your session. We do not use advertising or cross-site tracking cookies, and we do not run third-party analytics that profile you across other websites.
Children
The platform is not directed at children. Accounts are created by a corporation or its manager for owners, residents, staff and vendors, and are verified against the corporation's records.
Changes and contact
We will post any change to this policy here with a new "last updated" date. Where a change is material, we will notify the corporations using the platform in advance.
Privacy Officer, Square Sync Inc., Mississauga, Ontario — privacy@squaresync.ca. Security matters: security@squaresync.ca.