This policy covers the personal information Trust Financials Limited collects through this website, through the client portal, and in the course of advising on a financing.
The short version: we collect what a lender is going to need, we do not sell or rent it to anyone, and we do not send it to a lender until you have approved that lender in writing.
Who is responsible
Trust Financials Limited is responsible for the personal information under its control. Questions, requests for access, and complaints go to the address at the end of this page.
What we collect
Depending on how far a file goes, that can include:
- Contact details: name, business name, email address, telephone number, province.
- Request details: the amount sought, the purpose, the timing, the industry, time in business, existing facilities, and what security is available.
- Financial records you send us: financial statements, tax returns, bank statements, receivable and payable ageings, debt schedules, appraisals and corporate records.
- Account information if you use the client portal: your email address, a hashed session token, and the times you signed in.
- Technical information: the IP address a request came from, the browser user agent, and the page you arrived from. This is kept for security and rate limiting.
- Anything you type into the message widget or send us by email.
Why we collect it
To assess whether a financing request is viable, to prepare the file a lender needs, to present that file to lenders you have approved, to keep you informed while it is in progress, and to meet our own record keeping obligations.
We do not use your information for automated decision making. A person reads every file.
Consent
You give consent when you submit a form, when you send documents, or when you ask us to act. Consent for lender outreach is separate and specific: we ask for it in writing, against a named list, each time.
You can withdraw consent at any time, subject to legal and contractual restrictions and to reasonable notice. Tell us and we will explain what withdrawing means for a file in progress.
Who we share it with
We share personal information only in these situations:
- With lenders, lessors and licensed mortgage brokerages you have approved by name, and only the material needed to assess the request.
- With service providers who host or operate parts of this service, under contract, and only to the extent they need it. These include our hosting provider, our database provider and our email delivery provider.
- Where the law requires it, or to establish, exercise or defend a legal claim.
What we never do
- We do not sell, rent or trade personal information.
- We do not send your file to a lender you have not approved.
- We do not use your financial records for anything other than the engagement they were sent for.
Where it is held
Information is stored on servers operated by our hosting and database providers. Some of those servers may be located outside Canada, which means the information can be subject to the laws of the country it is held in, including lawful access requests by authorities there. If that matters to you, tell us and we will discuss what can be kept out of the online system.
How long we keep it
- Enquiries that do not become engagements: two years, then deleted.
- Financing files: seven years from the end of the engagement, which is the ordinary Canadian business record period.
- Portal accounts: for as long as the account is open, then two years.
- A copy of every email we send you, including the confirmation and any document list: 90 days, then deleted automatically.
- Our record of who did what inside the system: two years.
- Notifications you have already read: 60 days. Sign in sessions and sign in links: a week past expiry.
- Rate limit counters: two days. They hold an address and a count and nothing else.
Security
No system is perfect. If we become aware of a breach that creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and tell the people affected, as PIPEDA requires.
- The site is served over HTTPS with a strict transport policy and a content security policy.
- Portal sessions use an opaque token stored in an httpOnly cookie. The token is hashed before it is stored on our side, so a copy of the database does not let anyone sign in as you.
- Passwords, where used, are hashed with scrypt. We never store or see a plaintext password.
- Sessions expire after 30 minutes of inactivity and cannot be extended past 12 hours without signing in again.
- Access to client files is limited to the people working on them and is logged.
Cookies
This site sets two first party cookies and no third party cookies. One holds your portal session when you are signed in. One holds an anonymous key so a support conversation started before you sign in can be continued afterwards. Neither is used for advertising and neither is shared.
There is no advertising or cross site tracking on this site, so there is no consent banner. The full detail is in the cookie notice.
We do not operate a newsletter or a marketing list, and we do not send general mailings. The only email we send is about a file you asked us to look at, or a confirmation of something you submitted. If that ever changes, any general mailing will carry our identity, a postal or electronic address, and a working unsubscribe link that we action within ten business days, as CASL requires, and we will keep a record of when and how consent was given.
Your rights
We respond to access requests within 30 days. There is no charge unless a request is unusually large, in which case we will tell you the cost before doing the work.
- Ask what we hold about you and get a copy.
- Ask us to correct anything inaccurate or incomplete.
- Ask us to delete what we are not required to keep.
- Withdraw consent, subject to legal and contractual restrictions.
- Complain to us, and if you are not satisfied, to the Office of the Privacy Commissioner of Canada.
Children
This is a service for businesses. It is not directed at anyone under 18 and we do not knowingly collect information from anyone under 18.
Changes
If this policy changes materially we will change the date at the top and, where the change affects a file in progress, tell the people affected directly.
Contact
- Trust Financials Limited
- Toronto, Ontario, Canada
- Trustfinancialslimited@gmail.com
- 416-841-8468