Privacy
Privacy policy
Effective November 1, 2026
We handle a great deal of sensitive personal and financial information. This policy explains what we collect, why, who else sees it, and what you can ask us to do about it.
We are subject to Alberta's Personal Information Protection Act (PIPA). Where information crosses provincial or national borders in the course of commercial activity, the federal Personal Information Protection and Electronic Documents Act (PIPEDA) may also apply. Separately from either statute, we are bound by the confidentiality rules of the CPA Alberta Rules of Professional Conduct, which in several respects are stricter than privacy legislation.
1. Who is responsible
Darren Vucurevich is our Privacy Officer, the individual responsible for privacy compliance at this firm. Questions, access requests, and complaints all go to:
Darren Vucurevich, B.Mgt, CPA, CMADarren Vucurevich Professional Corporation
30 - 2810 Fairway Street South
Lethbridge, Alberta T1K 6T9
403-327-0042 · office@dvpc.ca
2. What we collect
From website visitors
If you use the contact form, we collect the name, email address, phone number, and message you enter, along with whether you identified yourself as an existing client. If you book an appointment, our booking provider collects your name, email, and the time you selected.
Our website does not set cookies and does not build a profile of you across sites. We do not use advertising trackers, and we do not sell or share information with advertisers. If we measure site traffic, we use only aggregate, cookieless statistics that cannot identify you.
From clients
In the course of an engagement we collect what the work requires. Depending on the engagement that can include your name, address, and contact details; Social Insurance Number and business numbers; dates of birth; marital and family information; income, deduction, and credit information; banking and investment details; property and asset information; corporate records; payroll information; and information about your spouse, dependants, shareholders, partners, or beneficiaries where their information is necessary to complete your work.
Where you give us information about another person, we rely on you having the authority to do so.
3. Why we collect it
To provide the accounting, tax, assurance, bookkeeping, and advisory services you have engaged us for; to file returns and correspond with the Canada Revenue Agency, Alberta Tax and Revenue Administration, and other authorities on your behalf; to bill you and collect payment; to meet our own legal, regulatory, and professional obligations, including practice inspection by CPA Alberta; and to respond to enquiries.
We do not use your information for any purpose beyond these without asking you first.
4. Consent
For most of what we do, providing us with your information in order to receive our services is your consent to our using it for those purposes. Where the information is particularly sensitive, or where we want to use it for something new, we will ask.
You can withdraw consent at any time by contacting us, subject to legal and professional restrictions and reasonable notice. Withdrawing consent may mean we can no longer act for you. It does not affect information we are required to retain.
5. Who else sees your information
Tax and government authorities, where you have authorised us to file or correspond on your behalf.
Our service providers, who process information on our behalf under contract and are not permitted to use it for their own purposes. These include our practice management, tax preparation, working paper, accounting, document storage and backup, email, AI assistant, website hosting, and payment processing providers.
Others you direct us to, such as your bank, lender, lawyer, or financial advisor — on your instruction.
Where the law requires it, including a court order, subpoena, or the exercise of statutory authority by a regulator or tax authority.
We do not sell your personal information. We do not disclose it for marketing.
6. Information stored or processed outside Canada
Most of what we hold stays in Canada. Our email, documents, and working files are held in Microsoft's Canadian data centres. Our practice management system stores its data in Canada. Our tax preparation and working paper software runs on our own computers, and its files are kept in our Microsoft document storage in Canada.
Some of the service providers we use store or process information outside Canada, for the purposes described here:
Cloud accounting software. QuickBooks Online is hosted in the United States, with a backup copy held in Canada. Xero is hosted outside Canada, including in the United States, and may process data in New Zealand and Australia. Where your books are kept in either platform — including a subscription set up through us — your financial records and the personal information in them are stored there so that the books can be kept and we can work in them.
Website hosting. This website and its contact form are hosted by a provider in the United States. What you type into the contact form passes through that provider on its way to our mailbox.
Payment processing. Invoices paid online are processed by a payment processor in the United States, which handles the payment details you enter.
AI tools. We use AI assistants from outside service providers to help prepare working papers, correspondence, and analysis. Where client information is used with these tools, it may be processed in the United States and, for some providers, in other countries named in our list of service providers outside Canada, which our Privacy Officer will provide on request. We use only settings that prevent the provider from using your information to train its models, and we review all work these tools help produce.
Microsoft support. Microsoft stores our data in Canada, but limited technical and support data relating to our Microsoft services may be handled in the United States and other countries where Microsoft or its subprocessors operate.
While your information is in another country it is subject to that country's laws, and may be accessible to that country's courts, law enforcement, and national security authorities under legal process there.
If you would like more detail about which providers we use, where information is held, and our practices and policies for information handled outside Canada, contact Darren Vucurevich using the details in section 1.
7. How we protect it
We use multi-factor authentication on all firm accounts, encrypted email, encrypted storage and transmission, managed and encrypted devices, access limited to those who need it for your work, and secure disposal of paper and electronic records.
Anything sensitive we send you goes by encrypted email. You will receive a notification with a link, and you open the message through a secure sign-in rather than as an ordinary attachment. If you reply to one of those messages, your reply comes back to us encrypted as well — so once we have started an encrypted thread, it is safe to send documents back along it.
An email you start yourself is not encrypted. Ordinary email travels in the clear and can be intercepted or misdirected. Please do not send us your Social Insurance Number, banking details, or other sensitive documents in a message you compose from your own inbox. Use the secure upload link on our contact page instead, or ask us to start an encrypted thread with you.
No system is perfectly secure, and we do not claim otherwise. If a breach occurs that creates a real risk of significant harm to you, we will notify you and the Office of the Information and Privacy Commissioner of Alberta as required by law.
8. How long we keep it
We keep client records for as long as needed for the purposes above and to meet our legal and professional obligations. In practice this means at least six years from the end of the last tax year the records relate to, which is the retention period the Income Tax Act requires, and generally seven years to satisfy professional documentation requirements. Some records are kept longer where they remain relevant to a continuing matter, such as adjusted cost base or capital dividend account history.
Contact form submissions that do not lead to an engagement are kept only as long as needed to respond, and are then deleted.
9. Your right to see and correct your information
You may ask what personal information we hold about you, how it has been used, and to whom it has been disclosed. You may ask us to correct anything inaccurate. Write to us at the address in section 1.
We will respond within 45 days, or tell you why we need more time. There is no charge for a straightforward request; if a request requires substantial work, we will give you a written estimate before proceeding and you may withdraw the request.
There are limited circumstances where we cannot provide access — for example, where doing so would reveal personal information about another person, or where the information is subject to solicitor-client or litigation privilege. If we refuse, we will tell you why and explain how to complain.
10. Complaints
If you are not satisfied with how we have handled your personal information, contact us first — most concerns are resolved quickly.
If you remain unsatisfied you may complain to:
Office of the Information and Privacy Commissioner of Alberta410, 9925 – 109 Street NW, Edmonton, Alberta T5K 2J8
1-888-878-4044 · oipc.ab.ca
11. Changes
We may update this policy. The current version is always posted here with its effective date. Material changes affecting how we use information already collected will be brought to your attention directly.