This Privacy Policy describes the practices of Jur Consulting Limited, a computer integrated systems design practice based in Mississauga, Ontario. It explains what personal information we collect, why we collect it, how we hold it and what choices you have. The policy is written in plain English so that a reader without a legal background can follow it end to end.
This website and the advisory file work behind it were prepared by the developer JUR Consulting on behalf of the company. The developer JUR Consulting built the pages, the styling and the small amount of browser scripting that runs here, and the company remains the party responsible for the personal information described in this policy.
We take the view that a consultancy built around disciplined records must apply the same discipline to personal information. A client file that is complete and accurate is only acceptable if the personal data inside it is collected for a stated purpose, kept no longer than necessary and protected from casual access. This policy sets out how we meet that standard in ordinary operations.
Jur Consulting Limited is the organisation responsible for the personal information described in this policy. Our registered place of business is 5236 Alicante St, Mississauga - L5V 1S9, Canada (CA). The company is registered in Canada and serves clients across the Greater Toronto Area and beyond.
Enquiries about privacy may be directed to clients@jurconsulting.lat or by telephone at +15822634345 during normal business hours. Written enquiries are preferred because they create a record that both sides can refer to later. We aim to acknowledge every privacy enquiry within two business days.
Where a client organisation supplies personal information to us in the course of a systems engagement, that client is usually the party that determines the purpose of the processing, and we act on documented instruction. In such cases the client organisation is the appropriate first point of contact for the individuals whose data is involved, and we cooperate fully with that organisation.
This policy covers personal information handled through this website, through email and telephone contact with our team, through proposals and engagement briefs, and through the delivery of advisory file services. It also covers personal information contained in client memos, retainer reviews, disclosure checks and closing notes that we prepare.
The policy does not cover the internal practices of client organisations, nor does it cover third party websites that you may reach from a link on our pages. Those destinations publish their own privacy statements, and we encourage you to read them before sharing information.
Certain client matters may involve data that is subject to specific contractual terms, such as a confidentiality schedule in a retainer letter or a written data handling agreement. Where those terms are stricter than this policy, the contract terms take priority for the information in question.
We collect a limited set of information needed to answer enquiries and deliver engagements. The categories below describe what we typically hold.
Name, job title, employer, email address, telephone number and postal address, provided by you when you enquire, sign a proposal or attend a meeting.
Meeting notes, brief material, scope statements, decision authority tables, memo text, review sheets and closing notes relating to a client matter. These records may include the names and roles of client staff.
Limited technical data generated by ordinary web requests, such as the type of browser, the referring page and the date and time of a visit. Our site is deliberately light and does not attempt to fingerprint visitors.
The content of emails, letters and written messages sent to us, together with our replies, kept as part of the matter file where relevant.
Invoice references, purchase order numbers, billing contacts and payment status. We do not store full payment card numbers on our website or in our general file system.
Most of the personal information we hold comes directly from you. You may provide it through the contact form on this site, by sending an email, by telephoning the room, or by taking part in a scheduled meeting. We record what you tell us and we do not add speculative detail to the file.
Some information arrives through a client organisation, for example when a project manager introduces the staff who will take part in a disclosure check. In that situation we ask the introducing organisation to confirm that those individuals are aware their details will be shared with us.
A small amount of technical information is generated automatically when a page is requested from our web server. Our hosting arrangement relies on standard server logging so that ordinary security and availability questions can be answered. We do not use those logs to build profiles of individual visitors.
We use personal information for the following purposes, and nothing beyond them without a fresh justification recorded on file.
We do not sell personal information. We do not rent contact lists. We do not use personal information to train public models, and we do not pass client files to advertisers or data brokers under any circumstances.
Where Canadian privacy law applies, we handle personal information in line with recognised fair information principles, including the need for a reasonable purpose, meaningful consent and appropriate safeguards. Consent may be express, as when you tick a box or send a written request, or implied by the circumstances, as when you send us an email asking for a reply.
Where the General Data Protection Regulation of the European Union applies to a particular client relationship, we rely on one of several bases. These include the performance of a contract, compliance with a legal obligation, legitimate interests in running a professional practice, and consent where consent is the appropriate route. We record the basis used for each main purpose in our internal privacy register.
You may withdraw consent at any time where consent is the basis for processing. Withdrawal does not affect the lawfulness of processing that already took place, nor does it override a separate obligation that requires us to keep a record.
We keep website measurement to a minimum. Our hosting provider aggregates request counts so that we can see whether pages load reliably and whether a broken link appears. Aggregated counts are not linked to individual visitors in our reporting.
We may review search console statistics offered by search engines, which show how often our pages appear in results and which queries brought visitors in. Those reports are summary level and do not reveal the identity of any person.
If we adopt a more detailed measurement tool in future, we will choose one that allows us to disable personalised advertising and to keep retention short. This section will be updated before any such change takes effect.
We use a small number of service providers to run the practice, and each is chosen for reliability rather than scale. Typical providers include a web host, an email host, an accounting platform and a backup service. Each receives only the information needed to perform its function.
Our agreements with providers require confidentiality, security controls appropriate to the data involved and a prohibition on using our information for their own marketing. Where a provider processes personal data on our instruction, the contract names the processing purpose and the deletion terms.
We review the list of providers once a year. A provider that cannot demonstrate adequate safeguards is replaced, and the replacement is recorded in the review sheet for the quarter in which the change happened.
Our practice is based in Canada, and most personal information is stored on servers located in Canada or the United States. Some providers may process data in other countries as part of their normal infrastructure. Where that happens, we take reasonable steps to ensure the transfer is governed by contractual protections.
If you are located in the European Economic Area, the United Kingdom or Switzerland, you should be aware that your information may be transferred outside those regions. We rely on appropriate contractual clauses or an equivalent recognised mechanism for such transfers, and we will explain the mechanism on request.
For clients with a specific data residency requirement, we can arrange a matter so that its files stay within a named region. That arrangement is written into the brief bay before work begins.
We keep client matter files for seven years after the closing sitting, which matches the period our insurer and professional advisers consider prudent for a consultancy of this kind. After that period the file is reviewed and either destroyed or retained for a further defined purpose recorded in writing.
Enquiries that do not become matters are kept for two years and then deleted, unless they contain a record of a refusal or a conflict check that must be retained. Billing records are kept for the period required by Canadian tax law, which is currently six years from the end of the relevant tax year.
Where a client asks us to delete a record earlier, we will do so if no legal or contractual obligation prevents it. Such a request is recorded in the file, and the deletion is confirmed in writing once it has been completed.
Access to the brief room is limited to team members who need it for their work. Digital files are held in accounts protected by strong passwords and multi factor authentication. Laptops use full disk encryption, and backups are encrypted at rest and in transit.
Physical documents, where they exist, are stored in locked cabinets in a room that is not open to visitors. Paper that is no longer needed is cross cut shredded rather than placed in ordinary recycling. Devices that reach the end of their life are wiped to a recognised standard before disposal.
We train team members on phishing, password hygiene and secure file handling at least once a year. A short incident drill follows the training so that the response to a suspected breach is familiar rather than improvised.
Subject to the law that applies to you, you may have the following rights regarding your personal information.
To exercise a right, write to clients@jurconsulting.lat with enough detail for us to identify the record. We may ask for proof of identity before releasing personal information, because releasing it to the wrong person would itself be a privacy failure.
We acknowledge access requests within two business days and aim to provide a substantive response within thirty days. If a request is complex, we will explain the reason for any extension and give a revised date. There is normally no charge for a first copy of your information.
Where we cannot release part of a record because it contains information about another person, we will redact that part and explain the basis for the redaction. Where a request concerns information held on behalf of a client organisation, we will forward the request to that organisation and tell you that we have done so.
Correction requests are handled in the same way. If we agree the record is wrong, we correct it and note the change. If we disagree, we record your view beside the original entry so that the file shows both positions.
Our services are provided to organisations, and this website is not directed at children. We do not knowingly collect personal information from anyone under the age of sixteen. If you believe a child has sent us information, write to us and we will remove it promptly.
Where a client engagement happens to involve data about minors, for example a scheduling system in a school or a clinic, we handle that data only on the documented instruction of the client and under the safeguards set out in the relevant contract. We do not use such data for any secondary purpose.
We do not run a mass marketing list. From time to time we may write to existing clients about a change to our services or an item we think is relevant to a matter in progress. Those messages are sent because of an existing relationship and always include a simple way to opt out.
If you ask not to receive further updates, we record that preference and honour it. Opting out of updates does not affect messages that are necessary to deliver a matter you have commissioned, such as a memo run or a closing note.
We do not make decisions with legal or similarly significant effects about individuals by automated means alone. Our work involves judgement, and that judgement is exercised by named people who can explain their reasoning.
Some internal reporting is generated automatically from project trackers so that the team can see which memos are overdue. Those reports support human decisions and do not decide anything by themselves.
If we become aware of a breach involving personal information, the delivery lead convenes a short response meeting the same day. The team establishes what happened, what data was involved and whether the risk is serious enough to require notification.
Where notification is required, we inform affected clients and the relevant regulator without undue delay. Our notice explains what happened, what we have done and what the recipient can do to reduce risk. We also record the incident, the response and the lessons learned in a closing note that is reviewed at the next quarterly meeting.
Our pages may link to tools or resources operated by other organisations. We do not control those destinations and cannot vouch for their privacy practices. A link is not an endorsement of how another organisation handles your information.
When you leave our site, we encourage you to check the privacy statement of the destination before providing personal details. If a link on our site leads somewhere that looks unsafe or out of date, please tell us at clients@jurconsulting.lat.
We review this policy at least once a year and whenever a material change occurs in our practice. The date at the top of the page shows when the current version took effect. Material changes are summarised in a short note that is easy to read.
If a change affects how we use information already held, we will tell affected clients before the change takes effect, unless the law requires a faster update. Continuing to use the site after a published change means you accept the revised policy.
If you are unhappy with how we have handled your information, please tell us first. Most concerns can be resolved quickly once the facts are clear. Write to clients@jurconsulting.lat with the details and mark the message as a privacy complaint so that it reaches the right person.
We will acknowledge the complaint within two business days and give a substantive reply within thirty days. If you are not satisfied with our response, you may raise the matter with the Office of the Privacy Commissioner of Canada or with the supervisory authority in your own country, as applicable.
Privacy is part of the same discipline that governs the brief room. A record is only useful if it can be trusted, and it can only be trusted if the people behind it are careful about what they collect and how they hold it. This policy is our plain statement of that care.
If anything here is unclear, ask. We would rather answer a question early than correct a misunderstanding later. The developer JUR Consulting built these pages with that principle in mind, and the company maintains the record in the same spirit.