Halifax R-400 Compliance Software | M-200 Maintenance Plans

1. Accountability

BridgeTrade has designated a Privacy Officer who is accountable for our compliance with this policy and PIPEDA. For any privacy-related inquiries, requests, or complaints, please contact:

Privacy Officer, BridgeTrade

Email: privacy@bridgetrade.ca

Mailing Address: Halifax, Nova Scotia, Canada

2. Information We Collect

Personal Information You Provide

When you use BridgeTrade, we may collect:

Name, email address, and phone number
Property address and project details
Business information (for contractors: license numbers, insurance details, HST registration)
Payment information (processed securely via Stripe — we do not store card numbers)
Communications between you and contractors or tenants
Lease and tenancy information (for landlords and tenants)

Automatically Collected Information

Device information and browser type
IP address and approximate location data
Usage patterns and preferences
Cookies and similar tracking technologies (see Section 8)

3. How We Use Your Information

We collect and use your personal information only for the following identified purposes:

Service Delivery: Connect homeowners with qualified local contractors, process quotes, schedule work, and facilitate communications
Payment Processing: Process payments, escrow holds, and invoicing securely via Stripe
Compliance Services: Generate R400/M200 maintenance plans, lease documents (Form P), condition reports, and tax forms (T776) for landlords
Transactional Communications: Send service updates, appointment reminders, quote notifications, and invoice receipts
Marketing Communications: With your consent, send promotional offers and platform updates (you may opt out at any time)
Platform Improvement: Analyze usage patterns to improve features and user experience
Legal Obligations: Comply with applicable laws, including tax reporting requirements

We will not use your personal information for purposes beyond those identified above without obtaining your further consent, except where permitted or required by law.

4. Consent

We obtain your meaningful consent before collecting, using, or disclosing your personal information. By creating an account and using BridgeTrade, you consent to the collection and use of your information as described in this policy.

You may withdraw your consent at any time by contacting our Privacy Officer, subject to legal or contractual restrictions. Withdrawal of consent may limit our ability to provide certain services to you.

For marketing communications, we rely on express consent obtained at registration. You may opt out at any time using the unsubscribe link in any marketing email or through your account notification settings.

5. Disclosure & Third-Party Service Providers

We share your information only in the following circumstances:

With Contractors: Project details necessary to provide quotes and perform work
With Landlords/Tenants: Lease and property information necessary for tenancy management

Third-Party Sub-Processors:

Stripe (San Francisco, USA) — Payment processing. Stripe is PCI-DSS Level 1 certified. Stripe Privacy Policy
Amazon Web Services (AWS) (Canada — ca-central-1 region) — Cloud hosting, data storage, email delivery (SES), and messaging (SQS/SNS)
Google — OAuth authentication (optional), analytics (with your cookie consent), and geocoding services
OpenAI (USA) — AI-assisted job description generation (no personal data is sent; only anonymized project descriptions)

We never sell your personal information to third parties. We require all sub-processors to protect your information to standards consistent with this policy.

6. Data Residency & Cross-Border Transfers

Your personal information is primarily stored and processed in Canada (AWS ca-central-1, Montreal). However, some of our third-party service providers (Stripe, OpenAI) operate in the United States. When your information is transferred outside Canada, it may be subject to the laws of that jurisdiction.

We take reasonable steps to ensure that your information receives an equivalent level of protection when processed by our sub-processors, regardless of location.

7. Safeguards

We implement security measures appropriate to the sensitivity of the information, including:

TLS/SSL encryption for all data in transit
Encryption at rest for stored data (AWS Aurora, S3)
Role-based access control (RBAC) limiting employee access to personal data
JWT-based authentication with token blacklisting
Web Application Firewall (WAF) and rate limiting
AWS Secrets Manager for credential storage
PCI-DSS compliant payment processing via Stripe (no card data stored on our servers)
Audit logging for administrative actions

8. Cookies & Tracking Technologies

We use cookies and similar technologies to improve your experience. When you first visit our site, you will be presented with a cookie consent banner allowing you to:

Essential Cookies: Always active — required for the website to function
Analytics Cookies: Optional — help us understand how visitors use our site (Google Analytics)
Marketing Cookies: Optional — used for personalized content

You can change your cookie preferences at any time through your browser settings or by clearing your stored consent.

9. Data Retention

We retain your personal information only as long as necessary to fulfill the purposes for which it was collected, or as required by law. Specific retention periods include:

Active accounts: Data retained while your account is active and for 2 years after last activity
Financial records: Retained for 7 years as required by CRA tax regulations
Lease and compliance documents: Retained for the duration of the tenancy plus 6 years
Marketing consent records: Retained for 3 years after last interaction (CASL requirement)
Inactive accounts: Anonymized or deleted after 2 years of inactivity, with 30 days advance notice

10. Your Rights Under PIPEDA

Under PIPEDA, you have the right to:

Access: Request a copy of the personal information we hold about you
Correction: Request correction of inaccurate or incomplete information
Deletion: Request deletion of your personal data (subject to legal retention requirements)
Data Portability: Request your data in a machine-readable format (JSON or CSV)
Withdraw Consent: Opt out of marketing communications at any time
Complaint: File a complaint with our Privacy Officer or with the Office of the Privacy Commissioner of Canada

To exercise any of these rights, contact our Privacy Officer at privacy@bridgetrade.ca. We will respond to your request within 30 days, as required by PIPEDA.

11. Breach Notification

In the event of a breach of security safeguards involving your personal information that creates a real risk of significant harm, we will:

Notify the Office of the Privacy Commissioner of Canada as soon as feasible
Notify you directly, describing the nature of the breach, the information involved, and steps we are taking
Maintain a record of all breaches for a minimum of 24 months

12. Children's Privacy

BridgeTrade is not intended for users under 18 years of age. We do not knowingly collect information from children. If we become aware that we have collected personal information from a minor, we will take steps to delete it promptly.

13. Changes to This Policy

We may update this policy periodically. We will notify you of significant changes via email and through the platform at least 30 days before the changes take effect. Continued use of the platform after the effective date constitutes acceptance of the updated policy.

Contact Our Privacy Officer

If you have questions about this Privacy Policy, wish to exercise your rights, or want to file a complaint:

Email: privacy@bridgetrade.ca

Mailing Address: BridgeTrade, Halifax, Nova Scotia, Canada

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.

Privacy Policy