Sheldon & Xu CPA Professional Corporation (“we”, “us” or “our”) respects your privacy. This policy explains how we handle personal information collected through snxca.com and related enquiries. Personal information is information about an identifiable individual.
This policy addresses our website and initial enquiries. If you engage us for accounting, tax or advisory services, we will explain any additional information requirements and uses for that engagement. Our privacy and professional confidentiality obligations continue to apply to information entrusted to us.
Information we collect · Website technology · Your choices and rights · Contact Thomas Xu
1. Information we collect and why
Our Contact form requires your name, email address, telephone number and message so that we can respond to your enquiry. We also receive information you choose to provide by email or telephone.
We use enquiry information to understand and respond to your request, discuss whether we can help, and provide the services you request. We do not use Contact form submissions to add you to a newsletter or marketing list, and we do not sell enquiry information.
Please provide only the information needed to explain your enquiry. Do not send Social Insurance Numbers, tax returns, banking details, passwords or confidential client documents through the general Contact form. Contact us first to arrange an appropriate way to exchange sensitive information. If you provide information about another person, ensure that you have authority to do so.
2. Consent and your choices
When you send an enquiry, you are asking us to use the information you provide to respond and assist with your request. We will seek appropriate consent for additional purposes unless the law permits or requires otherwise. We will not make unnecessary uses of your personal information a condition of receiving a service.
You may decline to provide optional information. You may also ask to withdraw consent to a particular use or disclosure by contacting Thomas Xu. Withdrawal is subject to reasonable notice and applicable legal or contractual restrictions. We will explain any consequences, such as being unable to complete a requested service. Withdrawal does not require us to remove records we must lawfully retain.
3. Website technology, cookies and external services
Our website uses WordPress and is hosted by GoDaddy. When you visit, our hosting and website service providers may process your IP address, browser and device information, pages requested, access times and technical or security logs. This information supports delivery, maintenance, troubleshooting and protection of the website.
Your privacy choices: optional services are blocked until you allow them. Select “Accept optional”, “Reject optional” or “Choose settings” in the consent banner. You can choose the TrustedSite badge and external fonts separately. Rejecting optional services does not prevent you from browsing our pages or using the Contact form.
Use the Privacy choices button at the bottom of any page to review or change your selection at any time. Withdrawing optional consent stops those services from loading on subsequent page loads; the site may reload to apply the change. Withdrawal does not undo information already sent while a service was enabled. Browser settings can also be used to remove previously stored cookies and site data.
- Necessary website and security functions: Cloudflare’s
__cf_bmcookie helps distinguish legitimate visits from automated traffic and normally expires after 30 minutes of inactivity. WordPress may use browser storage for basic feature checks, and authorised users who sign in may receive cookies for authentication and account preferences. These necessary functions are not controlled by the optional-service switches. See Cloudflare’s cookie information. - Contact form spam protection: we use Cloudflare Turnstile to help distinguish people from automated bots and protect our contact forms from spam and abuse. Turnstile processes technical signals such as your IP address, browser and connection information, and the website you are visiting. Cloudflare uses these signals to provide and improve its bot-detection service. Turnstile does not collect the contents of your enquiry fields. This security check is required to submit a web enquiry and operates independently of the optional-service choices. You can contact us by telephone or email if you prefer. See Cloudflare’s Turnstile Privacy Addendum.
- Remembering your choices: our Complianz consent tool stores cookies beginning with
cmplz_to remember the categories you allow, the policy version and whether you have responded to the banner. These settings are configured to last up to 365 days. You can change your choice sooner using Privacy choices, or remove these cookies in your browser. - TrustedSite badge — optional: if you allow this category, the TrustedSite script loads to display its badge and count visits. The provider receives connection and request information, including your IP address. The script uses a
trustedsite_visitcookie and browser storage for up to 24 hours to avoid counting repeat activity as a new visit during that period. It may also usetrustedsite_tm_float_seenfor up to five minutes to control badge display behaviour. If you decline, the badge script is blocked and the badge is not displayed. See how TrustedSite counts visits and its privacy policy. - External fonts — optional: if you allow this category, fonts are requested from Google. Google receives your IP address and request information when delivering those fonts. Google states that Google Fonts information is not used to build profiles for targeted advertising. If you decline, remote font loading is blocked and available fallback fonts are used. See Google’s explanation of Google Fonts privacy.
Our consent tool is configured to respect supported Do Not Track and Global Privacy Control signals. Browser privacy settings, blocking software or deleting site data can affect how choices are stored and may cause the banner to appear again. Restricting all cookies may affect necessary website functions. You can contact us by telephone if you prefer not to use the web form.
Links to other websites are provided for convenience. Their operators are responsible for their own privacy practices. Our responsibilities for information under our control are not removed by using an outside provider.
4. Sharing information and processing outside Canada
Enquiries submitted through the Contact form are sent to the firm by email. We use service providers to support website hosting, email delivery and other technical functions. They may process information needed to perform those functions. We limit access within the firm to people who need it for their work and require providers handling information on our behalf to protect it and use it for authorised purposes.
We may disclose information with your consent, as necessary to provide a service you have authorised, or where permitted or required by law. This may include responding to a lawful demand or meeting applicable professional obligations. We limit disclosures to what is appropriate for the purpose.
Service providers may store or process information outside Canada. Information processed in another country may be accessible to courts, law enforcement or other authorities under that country’s laws. We remain responsible for personal information under our control and for using appropriate contractual or other safeguards when it is processed on our behalf. Contact Thomas Xu for information about our service-provider arrangements.
5. Retention and accuracy
We retain personal information only for as long as needed for the purposes for which it was collected and applicable legal, professional or contractual requirements. Relevant factors include whether an enquiry remains active, whether it becomes a client engagement, the type of record, applicable recordkeeping requirements, and any unresolved complaint, dispute or access request.
Retention periods can differ between an initial enquiry and an accounting or tax engagement record. When information is no longer needed, it is securely destroyed, erased or anonymised, subject to applicable obligations. Contact us about retention of your information or to request deletion; we will explain any reason we must retain it.
We take reasonable steps to keep information accurate and complete for its intended use. Please tell us when information you have provided needs to be corrected.
6. Protecting information
We use safeguards appropriate to the sensitivity and amount of personal information, including controls over access, use and disclosure. The website uses HTTPS to protect information in transit between your browser and the website. This does not mean that ordinary email or every subsequent transfer is encrypted. No transmission or storage method can be guaranteed completely secure.
If a privacy incident occurs, we will assess and respond to it, maintain required records, and notify affected individuals and report to the appropriate authority when required by law.
7. Access, correction and privacy concerns
You may ask whether we hold personal information about you, request access, ask how it has been used or disclosed, or request a correction. Send a written request to Thomas Xu using the email or postal address below. If you need assistance preparing a request, please contact us. We may need to verify your identity using only information necessary for that purpose.
We will respond to an access request within 30 days, subject to extensions permitted by law. If an extension is needed, we will notify you within that initial period, explaining the reason, the new deadline and your right to complain. Access is provided at minimal or no cost; we will advise you of any proposed cost before proceeding. If access is restricted or refused, we will explain the reason and available recourse as required by law.
You may also contact Thomas Xu about our privacy practices, withdrawal of consent, deletion or a complaint. We will investigate privacy complaints and take appropriate steps to address them. You may raise a concern with the Office of the Privacy Commissioner of Canada.
8. Our privacy contact
Thomas Xu — Privacy Contact
Sheldon & Xu CPA Professional Corporation
10-1170 Sheppard Avenue West
Toronto, ON M3K 2A3, Canada
Email: thomas@snxca.com
Telephone: 416-900-8074
9. Changes to this policy
We will update this policy when our practices or applicable requirements change and identify the effective date of the revised version. Where a change involves a new use or disclosure requiring consent, we will seek that consent rather than treating publication of the revised policy as consent.