PIPEDA (federal)
Canada’s federal private-sector privacy law applies to most commercial activity, including the routine account, contact, and ticket data this kind of delivery touches.
Canadian context Contexte canadien
Know the frame before context crosses systems.
This page is orientation, not legal advice. It names the frames a Canadian channel partner generally benefits from having already discussed with its own counsel before client information starts moving between your practice and a delivery partner.
Three frames worth knowing about
Québec’s Law 25
Québec has its own private-sector privacy regime, with its own consent, breach-notice, and cross-border-transfer-assessment expectations layered on top of any federal one. A Québec client changes the conversation your counsel needs to have.
Provincial overlays
A few provinces, including British Columbia and Alberta, run their own private-sector privacy statutes for certain classes of organization. Whether one applies to your practice is a question for counsel, not a default assumption.
What this brand can tell you
The delivery-model page names what stays with your practice and what crosses into delivery, and the contact page names what should never enter a brief: passwords, tenant secrets, sensitive access, unnecessary personal data.
What only your written engagement decides
Data residency, retention periods, and any sub-processor terms are confirmed in the scoped agreement your practice signs — never assumed from this page or any other public marketing content.
Language of service, not just language of delivery
Québec’s Charter of the French Language sets expectations for how businesses communicate with consumers in the province, independent of whatever language your own delivery happens to run in internally. If your client base includes Québec consumers, that is a question for your own counsel — the bilingual-delivery page describes how account language is tracked operationally, which is a starting point for that conversation, not a substitute for it.
Questions worth raising with your own counsel before context crosses
- Which privacy statute or statutes actually apply to a given client, based on where the affected individuals are located.
- Whether a client relationship needs a documented privacy-impact or transfer assessment before delivery starts.
- What your engagement says about data residency, retention, and deletion on exit.
- Whether Québec consumer-facing communication needs to default to French for a given client.
- Who inside your practice is the point of contact if a privacy question or request ever needs an answer.
What this brand does not provide
- Legal advice, a privacy-officer-of-record service, or a compliance certification.
- A guarantee that any specific privacy statute has been satisfied for your practice or your client.
- A data-residency commitment beyond what your own written engagement states.