Privacy Policy

Effective 2026-07-28

This policy explains what personal information TaxWorkbooks (“we,” “us,” “our”) collects through taxworkbooks.ca and in selling our Templates, why we collect it, who we share it with, and what rights you have. We publish it under Québec’s Act respecting the protection of personal information in the private sector, CQLR c. P-39.1 (“Law 25”), which requires a confidentiality policy in clear and simple language (art. 8.2).

It applies to anyone whose personal information we process: a site visitor, a purchaser, someone who emails us, or a mailing-list subscriber once that list is active. It is separate from our Terms of Use and Licence, which govern buying and using a Template.

1. Who We Are

TaxWorkbooks operates from Québec, Canada, as a sole proprietorship. Its business registration is pending, and the registration details will be added to the table above once assigned.

2. What Is Collected, and When

Newsletter email address. If you sign up for our mailing list, we collect the email address you give us. The list is not yet operating; this describes how it will work.

Purchase information. When you buy a Template, we collect your name, email address, billing country, and payment metadata such as an order reference and payment confirmation. We never receive or store your full card number — card details go directly to our payment processor, never to or through us. That processor is Stripe; PayPal may also be offered (Section 5).

Email correspondence. When you email [email protected] or [email protected], we collect your message, your email address, and anything else you include, such as an order number.

Rights-request correspondence. When you email the Privacy Officer (Section 10) to exercise a right in Section 8, we collect your message and whatever you send to verify your identity. That is often more identity-dense than routine correspondence, by the nature of a rights request.

Payment processor account notifications. Once the store is open, our payment processor will send payout confirmations — and a dispute notice if a cardholder disputes a charge — to an internal address we do not publish. A dispute notice can name the cardholder and describe the disputed payment.

Server connection information. Loading any page on this site necessarily sends your device’s IP address to our host, Cloudflare, as part of ordinary request delivery. Cloudflare holds it to route and secure the request; we do not collect, store, or look at it.

Aggregate site analytics. Cloudflare Web Analytics measures aggregate visits. Cloudflare describes it as using no cookie and no fingerprinting — Section 9 says how far we have checked.

3. Purposes

Each category above is collected for one purpose, and no other:

We use each category only for the purpose listed against it. We do not use purchase information for marketing, and we do not add someone who emails us to the mailing list without a separate sign-up.

4. Consent and How to Withdraw It

Newsletter. We collect your mailing-list email address on the basis of your consent. Withdraw it at any time — by unsubscribing once the list is active, or by emailing the Privacy Officer (Section 10). That stops future newsletter emails, but not records we must keep separately, such as the suppression record in Section 7.

Purchase information. We collect this because it is necessary to complete a transaction you initiate and to meet legal record-keeping obligations (Section 7), not on the basis of consent. You cannot withdraw consent to a completed purchase; the rights in Section 8 still apply.

Email and rights-request correspondence. Given voluntarily. You can ask us to delete it, subject to Section 7 — though we cannot delete a rights-request record before answering it.

Payment processor notifications and server connection information. Neither rests on consent; each is inherent to running a payment relationship and a website. Section 7 gives how long each is kept.

Aggregate analytics. Cloudflare Web Analytics is designed not to identify you individually (Section 9), so we do not treat it as needing individual consent.

If you decline. You are never required to give us anything. Without a newsletter email address we cannot send the newsletter; without the purchase information in Section 2 we cannot process an order or deliver a Template. None of this affects browsing the site.

5. Service Providers

This table lists every service provider that processes personal information on our behalf, including those not yet in use (Section 6).

6. Processing Outside Québec

Every service provider we have assessed (Section 5) is outside Québec, so personal information reaching any of them is processed outside Québec — including Stripe, whose probable contracting entity is Canadian, not Québec-based. Art. 17 of Law 25 requires a privacy impact assessment, and reasonable steps toward equivalent protection, before that happens. We made that assessment on July 26, 2026 and keep it on file. For each of the four providers it covers, it records what is communicated, how sensitive it is, why, what protects it, the receiving jurisdiction’s legal framework, and whether a written agreement is in place. PayPal and the email list provider are not covered, because neither is enabled or selected; each will be assessed before it receives anything.

Not every provider is in use yet, and the timing matters:

• Cloudflare Email Routing and Web Analytics, and the forwarding into the Google mailbox in Section 5, all started on July 26, 2026 — the same day as the assessment.
• Cloudflare hosting for this site was set up a day earlier, on July 25, 2026, so for hosting the assessment followed rather than preceded.
• Payhip and Stripe are in our design but not yet live; neither account has been created. No purchase information has reached either, so the assessment precedes any transfer to them.
• PayPal and the email list provider are not in use at all (Section 5).

Whether those jurisdictions and terms in fact give protection equivalent to Law 25 is still under review; making the assessment does not settle it. For a question about how your information crosses a border, contact the Privacy Officer (Section 10).

7. Retention and Deletion

The suppression-list row looks inconsistent with the rest of the table, so it is worth explaining. When someone unsubscribes, we keep their email address and the fact of the opt-out indefinitely. That record is what stops us re-mailing them by mistake. We keep it for that purpose only, never for marketing.

8. Your Rights

Under Law 25 you have these rights over personal information we hold about you:

• Access — a copy of the personal information we hold about you.
• Rectification — correction of information that is inaccurate, incomplete, or equivocal.
• Deletion — removal of information that is obsolete or not justified by the object of the record, or that we collected without authorization by law. Where the law requires us to keep a record (see the retention table in Section 7), we will tell you which record and why.
• Written comments — filing written comments in the record we hold about you, to be kept with it. This right stands alongside the others, and is often the practical answer where a record must be retained.
• Withdrawal of consent — where our basis for holding the information is consent (Section 4).
• Portability — to receive computerized personal information you gave us in a structured, commonly used technological format, or have it sent to another organization where feasible.
• Cessation of dissemination or de-indexing — where applicable to personal information we have made public.

To exercise any of these rights, email the Privacy Officer at [email protected]. We will respond within 30 days.

If you are not satisfied with our response, complain to us first at that address, then to the Commission d’accès à l’information, Québec’s privacy regulator.

9. Cookies and Analytics

We do not set any cookie ourselves. Nothing in this site’s own code uses a cookie, browser storage, or similar persistent identifier to track visitors.

Cloudflare Web Analytics, which measures aggregate visits, is designed by Cloudflare to be cookieless; we have not independently audited that. Separately, Cloudflare may set its own cookie for security purposes (for example, __cf_bm) — outside this site’s code and outside our control.

Because our own analytics use no cookie, there is no cookie banner and no opt-out link to click. To stop the script running in your browser, block static.cloudflareinsights.com with any ad or script blocker, or disable JavaScript for this site.

10. Privacy Officer

Privacy Officer · [email protected]

This is the title and contact published under art. 3.1 of Law 25 for the person in charge of protecting personal information at TaxWorkbooks. Send any question, concern, or rights request there.

11. Effective Date and Revision History

This policy takes effect on the date it is first published on taxworkbooks.ca, which is the date recorded against v1 in the table below. We will add a row for every material change, and never silently edit past versions.

Contact: [email protected]