Privacy policy
Draft for legal review. Last updated: [date].
[Legal entity name] (“NorthMerit”, “we”) respects your privacy. This policy explains what we collect, why, who we share it with and your choices. It is designed to meet the Personal Information Protection and Electronic Documents Act (PIPEDA).
What we collect
- Contact details: name, email, phone, and for mortgage requests, address and date of birth.
- Request details: the amount and type of financing, its purpose and timeline.
- Business details, including information from public business registries.
- Financial information you provide, such as revenue, income or existing obligations.
- Technical information such as device, browser and pages visited, collected with cookies. See “Cookies” below.
Why we collect it
- To verify your identity, your business and your authority to request financing.
- To match your request with one financing partner suited to it.
- To operate, secure and improve our services.
- To meet legal obligations.
Who we share it with
With your consent, we share your request and contact details with one financing partner, such as a lender, broker or licensed mortgage professional, who may contact you about your request. NorthMerit is compensated by its financing partners, including for the requests we match with them. We never share your request with more than one partner.
We also use service providers (for example hosting, verification and messaging providers) who process information on our behalf under contract. [List categories and, where applicable, locations outside Canada.]
Your choices and rights
You may withdraw consent, request access to or correction of your information, or ask questions by writing to our Privacy Officer at privacy@example.com. Withdrawing consent does not affect information already shared with a partner, who handles it under their own privacy policy.
Retention
We keep personal information only as long as needed for the purposes above or as required by law. [Specify retention periods.]
Cookies
[Describe cookies and analytics tools used, and how to refuse them.]
Contact
Privacy Officer, [Legal entity name], privacy@example.com. You may also contact the Office of the Privacy Commissioner of Canada.
