Last Updated: August 15, 2026
Lucena Bookkeeping & CFO Solutions Inc. (“Lucena”, “we”, “us” or “our”) respects your privacy and is committed to protecting the personal information entrusted to us.
This Privacy Policy explains how we collect, use, disclose, retain and protect personal information through lucenabookkeeping.ca (the “Site”), when you communicate with us, and in connection with our bookkeeping, payroll and financial administration, management reporting, Fractional CFO Advisory, business financial education, tax preparation and related services (collectively, the “Services”).
We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and other applicable Canadian privacy laws.
1. Accountability and Privacy Officer
Lucena is responsible for personal information under its control.
We have designated a Privacy Officer who is responsible for overseeing our privacy practices, responding to privacy-related questions and requests, and supporting compliance with applicable privacy requirements.
Questions, access or correction requests, withdrawals of consent and privacy complaints may be directed to our Privacy Officer using the contact information provided at the end of this Policy.
This addition is important. Accountability is one of PIPEDA’s core fair-information principles.
2. Personal Information We Collect
The personal information we collect depends on your relationship with Lucena and the Services you request.
Information You Provide Directly
We may collect:
- your name, company name, email address, telephone number and mailing address;
- information submitted through our contact forms, consultation or discovery call requests;
- information provided through email, telephone, WhatsApp or other authorized communication channels;
- identification and tax-related information reasonably required to provide tax preparation or related Services;
- accounting records, general ledgers and transaction information;
- bank and credit card statements and transaction records;
- invoices, receipts and supporting documentation;
- accounts payable and accounts receivable information;
- payroll and employee-related information necessary to provide payroll or bookkeeping Services;
- tax returns, tax slips and other tax documentation;
- information regarding your business, financial operations, budgets, forecasts and internal management reporting;
- information and documentation you authorize third parties to provide to us; and
- other information reasonably necessary to provide the Services you request.
Depending on the Services, some of this information may be highly sensitive.
We seek to collect only personal information reasonably necessary for identified purposes.
Information Collected Automatically
When you use the Site, certain technical information may be collected automatically, including:
- IP address;
- browser and device type;
- operating system;
- pages visited;
- referring website or page;
- approximate geographic information derived from technical data;
- date and time of access; and
- information about how visitors interact with the Site.
This information may be collected through cookies and similar technologies, hosting infrastructure, security tools, analytics services and caching technologies.
3. How We Use Personal Information
We may use personal information to:
- respond to enquiries and communications;
- schedule consultations and discovery calls;
- evaluate prospective client needs;
- prepare quotes, proposals and engagement agreements;
- establish and administer client relationships;
- provide, administer and support the Services;
- maintain bookkeeping and accounting records;
- process or support payroll and financial administration;
- prepare management reports, dashboards and KPI information;
- provide the management support included within our Fractional CFO Advisory Services;
- prepare tax returns and related documentation where included in the engagement;
- communicate with clients regarding their Services;
- process invoices and payments;
- maintain business, tax and other records required by law;
- prevent fraud, misuse and security incidents;
- maintain and improve the functionality, security and performance of the Site and our systems;
- comply with legal, regulatory and governmental requirements; and
- establish, exercise or defend legal rights where appropriate.
We will not use personal information for a materially different purpose without obtaining additional consent where required by law.
Lucena does not sell or rent personal information.
We do not use client financial, payroll or tax records for unrelated advertising or marketing purposes.
4. Consent
Lucena obtains consent for the collection, use and disclosure of personal information where required by applicable law.
The form of consent may vary depending on the circumstances and sensitivity of the information. Consent may be express or implied where permitted by law.
For sensitive financial, payroll, tax or identification information, we will use consent practices appropriate to the sensitivity of the information and the circumstances.
Providing personal information voluntarily through our Site, contacting us regarding Services or entering into an engagement with Lucena may constitute consent to reasonable collection, use and disclosure necessary for the purposes communicated to you, subject to applicable law.
You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice.
Withdrawal of consent will not affect collection, use or disclosure already lawfully undertaken and may prevent Lucena from continuing to provide some or all Services.
5. Disclosure of Personal Information
Lucena does not disclose personal information except as reasonably necessary for identified purposes, with consent, or where permitted or required by law.
We may disclose personal information to:
Service Providers: Accounting, bookkeeping, tax, payroll, payment-processing, document-management, electronic-signature, communication, cloud-storage, hosting, cybersecurity, analytics, automation and information-technology providers that support our operations or Services.
Government and Tax Authorities: Including the Canada Revenue Agency and other government authorities where authorized by the client or required or permitted by law.
Professional Advisers: Accountants, CPAs, lawyers or other professionals where the client has authorized the collaboration or where disclosure is otherwise permitted by law.
Financial Institutions and Other Authorized Parties: Where reasonably necessary to perform Services requested by the client and appropriately authorized.
Legal and Regulatory Authorities: Where disclosure is required or permitted by applicable law, court order, regulatory requirement or lawful governmental request.
Business Transactions: In connection with a proposed or completed financing, sale, merger, acquisition, restructuring or transfer of all or part of our business, subject to applicable legal requirements and appropriate safeguards.
Service providers are permitted to access personal information only as necessary for the applicable purpose and are expected to handle the information in accordance with applicable contractual, confidentiality, privacy and security requirements.
6. Technology, Cloud Services and AI-Assisted Tools
Lucena uses technology to support the efficient delivery and administration of its Services.
This may include accounting and tax software, cloud-based platforms, document-management systems, automation, analytics and artificial intelligence-assisted tools.
AI-assisted tools may be used to support administrative processes, analysis, organization, drafting or other aspects of our operations. Such tools are intended to assist, rather than replace, appropriate human review.
We take the sensitivity of client information into consideration when selecting and using technology and service providers and apply reasonable safeguards appropriate to the circumstances.
We do not intentionally use client financial, payroll, tax or identification information to train publicly available artificial intelligence models.
Where personal information is processed by third-party technology providers, those providers may process information on our behalf subject to applicable contractual, privacy and security arrangements.
7. Processing and Storage Outside Canada
Some service providers used by Lucena may process or store personal information outside Canada.
When personal information is transferred to a service provider for processing, Lucena remains responsible for personal information under its control and uses contractual or other appropriate measures designed to provide a comparable level of protection while the information is being processed.
Personal information processed or stored outside Canada may be subject to the laws of the jurisdiction where it is processed or stored and may be accessible to courts, law enforcement or governmental authorities in accordance with those laws.
PIPEDA continues to apply to organizations subject to it when personal information crosses provincial or national borders, and the federal Privacy Commissioner specifically addresses cross-border processing.
8. Safeguards and Information Security
Lucena uses administrative, technical and physical safeguards appropriate to the sensitivity, amount, format and nature of the personal information under our control.
These measures may include, as appropriate:
- encrypted connections;
- password protection and authentication controls;
- access restrictions based on business need;
- secure cloud and document-management platforms;
- software and system security controls;
- secure backup practices;
- confidentiality requirements;
- restricted access to sensitive client information; and
- procedures for securely disposing of information when it is no longer required.
Clients should use secure document-sharing methods provided or approved by Lucena when transmitting sensitive financial, payroll, tax or identification information whenever reasonably available.
No electronic system, transmission method or storage environment can be guaranteed to be completely secure. Accordingly, while we use reasonable safeguards, we cannot guarantee absolute security.
9. Privacy and Security Incidents
Lucena maintains procedures for responding to suspected or confirmed privacy and security incidents involving personal information.
Where a breach of security safeguards creates a real risk of significant harm, Lucena will notify affected individuals and report the breach to the Office of the Privacy Commissioner of Canada where required by applicable law.
Lucena will also maintain records of breaches of security safeguards as required by applicable privacy legislation.
This was missing from the original policy and I would definitely include it.
10. Retention of Personal Information
Lucena retains personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected, satisfy contractual requirements, maintain appropriate business records and comply with applicable legal, tax and regulatory obligations.
Different categories of information may therefore have different retention periods.
Canadian tax and business records generally must be retained for at least six years from the end of the last tax year to which they relate, although longer retention periods apply in certain circumstances.
Electronic records that are required to be retained for tax purposes may also need to remain available in an electronically readable format.
Where Lucena maintains records on behalf of a client, the client remains responsible for satisfying its own legal record-retention obligations unless otherwise expressly agreed.
When personal information is no longer required and there is no legal or legitimate business requirement to retain it, we will securely destroy, delete or anonymize it, as appropriate.
Essa redação corrige um problema da política atual: não devemos prometer que tudo será destruído automaticamente após seis anos. A CRA tem exceções — alguns registros precisam ser mantidos por períodos diferentes ou até indefinidamente.
11. Cookies and Similar Technologies
The Site may use cookies and similar technologies for purposes such as:
- enabling essential Site functionality;
- maintaining security;
- remembering user preferences;
- understanding Site performance and usage; and
- improving the visitor experience.
Some cookies may be placed by third-party services integrated with the Site.
Where required by applicable law, we will obtain appropriate consent before using non-essential cookies or similar technologies.
You can control or disable cookies through your browser settings. Disabling certain cookies may affect Site functionality.
Additional information may be provided through our cookie notice or consent-management tool, where applicable.
12. Analytics and Third-Party Website Tools
Lucena may use analytics, scheduling, communication, embedded content or other third-party tools on the Site.
These providers may collect technical or usage information in accordance with their own privacy practices.
Where required, we use consent mechanisms for non-essential technologies and encourage users to review the privacy information provided by applicable third-party services.
Aqui, quando revisarmos tecnicamente o site, precisamos conferir exatamente o que o Matheus instalou — Google Analytics, Meta Pixel, Calendly, chatbot etc. A Privacy Policy deve mencionar ou categorizar aquilo que realmente está instalado, não ferramentas hipotéticas.
13. Commercial Electronic Communications
Where required by applicable Canadian anti-spam legislation, Lucena will obtain appropriate consent before sending commercial electronic messages.
You may withdraw consent or unsubscribe from marketing communications at any time by using the unsubscribe mechanism provided in the communication or by contacting us.
Withdrawal from marketing communications does not prevent Lucena from sending service, transactional, security, legal or administrative communications where permitted or required by law.
14. Your Privacy Rights
Subject to applicable law, you may:
- ask whether Lucena holds personal information about you;
- request access to personal information under our control;
- request information about how your personal information has been used or disclosed, where required by law;
- request correction of inaccurate or incomplete personal information;
- withdraw consent, subject to legal or contractual restrictions;
- ask questions about our privacy practices; and
- submit a complaint regarding our handling of personal information.
We may need to verify your identity before responding to an access, correction or other privacy request.
Access may be subject to exceptions permitted or required by applicable law.
We will respond to access requests within the time required by applicable law.
If additional time is legally permitted and required, we will inform you where required.
Eu retirei a promessa absoluta “We will respond within 30 days”. PIPEDA normalmente establishes a 30-day response period, but it also permits extensions in specified circumstances. A Privacy Policy should not accidentally remove flexibility the statute itself gives the business.
15. Children’s Privacy
Our Site and Services are intended for adults and businesses and are not directed to children.
We do not knowingly collect personal information directly from children through the Site without appropriate authorization or consent where required by law.
If we become aware that personal information from a child has been collected in circumstances requiring parental or guardian consent without appropriate consent, we will take reasonable steps to address the situation.
16. Third-Party Links
The Site may contain links to third-party websites or services.
Lucena is not responsible for the privacy, security or content practices of third parties operating independently from us.
We encourage users to review the privacy policies of third-party websites and services before providing personal information to them.
17. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our Services, technology, business practices or applicable legal requirements.
The current version will be posted on this page with the applicable “Last Updated” date.
Where changes materially affect how personal information is collected, used or disclosed, we will provide additional notice or obtain additional consent where required by applicable law.
18. Questions and Complaints
If you have a question, concern or complaint regarding Lucena’s privacy practices, please contact our Privacy Officer first.
We will review privacy complaints and take reasonable steps to investigate and address concerns.
If you are not satisfied with our response, you may have the right to contact the Office of the Privacy Commissioner of Canada.
Office of the Privacy Commissioner of Canada
19. Contact Us / Privacy Officer
Privacy Officer
Lucena Bookkeeping & CFO Solutions Inc.
236 Saint George Street, 2nd Floor
Moncton, NB E1C 1E4
Canada
Email: info@lucenabookkeeping.ca
Telephone: +1 (506) 973-6448
Website: lucenabookkeeping.ca