Legal

Privacy Policy

Brencur Systems is the operating name of Nestbase Financial Inc.

Effective date: [TO CONFIRM: the date this policy is published]
Last updated: [TO CONFIRM]

This policy explains what personal information we collect, why we collect it, what we do with it, how long we keep it, and how to reach us about it. It covers our website and the advisory work we carry out for Condominium Corporations, Condo Boards and Property Managers.

It is written to be read, not to be survived. If anything in it is unclear, email us and we will answer plainly.

Read this before publishing

This policy is a draft for review. It is not ready to publish.

It is written from what the website and the engagement provably do, and it is accurate on those points. Everywhere a fact could not be established from the build it carries a [TO CONFIRM] marker rather than a guess. Search the page for that marker and answer every one.

The HubSpot contact form is now live, so sections 2, 6 and 11 name it, list the six fields it actually asks for, and say plainly that enquiries are stored in the United States. Those markers are closed. The rest are not.

Have it reviewed by a lawyer before it goes live. It is drafted against PIPEDA for an Ontario practice, but this is a template, not legal advice, and the open items change what several sections are allowed to claim.

Delete this whole block in Elementor when the policy is final.

1. Who we are

Brencur Systems is the operating name of Nestbase Financial Inc., an independent technical and financial advisory practice for Condominium Corporations. Our office is in Hamilton, Ontario. We work across the Greater Toronto and Hamilton Area and the Niagara Region.

We are independent of every vendor bidding the work we review. We hold no vendor affiliations, take no commissions, and sell no equipment. Our fee comes from the Corporation we act for, and nowhere else.

That independence extends to information. We do not sell, rent or trade personal information. We do not pass what you give us to vendors, and we do not use one client’s records to serve another.

We are responsible for the personal information under our control, including information handled on our behalf by any service provider. Because we operate in Ontario and handle personal information in the course of commercial activity, we are governed by the federal Personal Information Protection and Electronic Documents Act, known as PIPEDA.

2. What we collect

This section is short because we collect very little.

From the website. Our website carries no analytics, no advertising pixels, no session recording and no third-party fonts. We do not build a profile of you from your visit, and reading most of this site does not report you to anyone else.

There is one exception, and we would rather name it than bury it. Our contact form is provided by HubSpot and loads from HubSpot’s servers on the contact section of our home page. That means HubSpot can see that your browser requested the form. Section 11 sets out what it does with that.

As with any website, the server that hosts ours records standard access logs as part of delivering the page. These typically contain an IP address, a browser identifier and the time of the request. We do not use them to identify you. [TO CONFIRM: the hosting provider, whether access logs are retained, and for how long.]

When you contact us. If you email info@brencursystems.com or submit our contact form, we receive whatever you choose to tell us.

The form asks for six things. Four are required: your first name, the corporation or building you are calling about, your email address, and a description of the service you need. Two are optional: your last name and a phone number. It asks for nothing else, and we do not want anything else at this stage. What you send is delivered to us through HubSpot and stored there.

During an engagement. To run a bid normalization or a Forensic Cost Recovery Audit, we receive documents from you: competing vendor bids, requests for quotation and their technical appendices, and mechanical and capital spend ledgers. These are business records. They can contain personal information incidentally, such as the names, titles, signatures and contact details of directors, property managers, vendor representatives and trades staff. Section 9 sets out how we handle them.

What we do not want. We do not ask for government identifiers, banking credentials, or personal financial information about individual unit owners, and we do not need them to do the work. If a file you send us contains that kind of information incidentally, tell us and we will agree how to remove or protect it.

3. Why we collect it

We collect personal information for these purposes and no others:

To answer an enquiry and arrange a discovery call.
To decide, with you, whether an engagement makes sense at all.
To carry out the work you engage us for: normalizing competing bids onto common terms, identifying omitted manufacturer specifications, and examining ledgers for vendor leakage and historical billing errors.
To produce and deliver what you receive at the end, whether that is a two-page financial summary for the Board or a certified audit report.
To communicate with you during an engagement.
To invoice, and to keep the business and tax records the law requires us to keep.
To meet our legal and professional obligations.

If we ever want to use your information for a purpose outside this list, we will ask you first and you are free to say no.

4. Consent

PIPEDA is built on consent. We rely on it in three ways.

Express consent. When you send us a message through the contact form or by email, you consent to us contacting you about that enquiry. Our contact form says so directly, next to the submit button, rather than hiding it in a document nobody opens.

Implied consent. When you send us bids, RFQs or ledgers for an engagement, your consent to us using those documents for that engagement is implied by the act of sending them for that purpose. It does not extend to any other purpose.

Consent under our engagement terms. Once we are engaged, our engagement letter governs confidentiality and the handling of what you give us. Where that letter and this policy differ on an engagement matter, the engagement letter controls. [TO CONFIRM: whether the engagement letter contains confidentiality and information-handling terms, so this policy can point to them rather than restate them.]

Withdrawing consent. You can withdraw consent at any time by emailing info@brencursystems.com, subject to legal and contractual limits and to reasonable notice. If withdrawing consent means we can no longer complete the work, we will tell you plainly what the consequence is before it takes effect. Withdrawal does not reach backwards over work already performed, and it does not override records we are required by law to retain.

We do not make consent to any secondary use a condition of doing business with you.

5. How your information is used

Enquiries are read by the people at Brencur Systems who can answer them. Engagement documents are read by the people working on that engagement. That is the whole distribution list.

We do not add you to a marketing list you did not ask to join. We do not sell your information. We do not feed it to any advertising system.

The analysis behind our findings is done by people. We do not use automated decision-making or profiling to reach the conclusions in a bid normalization or an audit report, and we do not use your documents to train any system that serves anyone other than you.

6. Disclosure to third parties

We do not disclose personal information to vendors, to contractors bidding your work, or to anyone else with a commercial interest in the outcome. Independence is what we sell. Disclosure would destroy it.

We disclose personal information only in these circumstances.

Service providers. We use ordinary business software to run the practice. These providers process information on our behalf, under contract, only for the purpose we give it to them, and with a comparable level of protection to our own.

The one we can name precisely today is HubSpot, which provides our contact form and holds the enquiries submitted through it. HubSpot is a United States company and our account sits in its North America region, so an enquiry you send us is stored in the United States. See the note on information held outside Canada below. [TO CONFIRM: the remaining providers, being the email host, the file storage used for client documents, and the call scheduling tool if one is added.]

At your direction. If you ask us to send a summary, a finding or a report to your Board, your Property Manager, your auditor, your engineer or your counsel, we will.

Where the law requires it. In response to a valid court order, subpoena, regulatory demand or other lawful requirement. Where we are permitted to tell you that we received one, we will.

A business transaction. If the practice is sold, merged or reorganized, information may transfer as part of that transaction, under an agreement that carries the protections in this policy forward.

Information held outside Canada. If a service provider stores or processes information outside Canada, that information is subject to the laws of the country it sits in and may be accessible to that country’s courts and law enforcement. [TO CONFIRM: which providers are used and where they store data.]

7. How long we keep it

We keep personal information only as long as we need it for the purpose it was collected for, or as long as the law requires, whichever is longer. We do not keep files indefinitely simply because storage is cheap.

Enquiries that do not lead to an engagement: [TO CONFIRM: retention period.]
Engagement records, including working files, source documents and the report or summary we issue: [TO CONFIRM: retention period. Set this one deliberately. The 24 months quoted elsewhere on this site is the audit look-back window, not a retention period, and the two must not be confused.]
Invoices and other business and tax records: retained for the period required by Canadian law.

When a retention period ends, we securely destroy the records or render them anonymous. [TO CONFIRM: the destruction method, for digital files and for any paper.]

8. Safeguards

We protect information with safeguards proportionate to how sensitive it is. Capital spend ledgers and unopened competing bids sit at the sensitive end, and we treat them that way.

Our measures include:

Access limited to the people working on your engagement.
Encrypted transmission of our website, so anything you send through it is protected in transit. [TO CONFIRM: confirm the certificate is live on the production domain before this line is published, and delete the line if it is not.]
Encrypted storage and access controls on the systems that hold client documents.
Separation of client files, so one Corporation’s records are not visible in the course of another Corporation’s work.
Retention limits and secure destruction, as set out in section 7.
If a breach creates a real risk of significant harm, prompt notification to you and to the Privacy Commissioner of Canada, and a record of the breach kept as the law requires.

[TO CONFIRM: how documents actually reach us. Email attachment, a secure upload link, or a client portal. The honest answer changes what this section can claim, and it is the first practical question a Board will ask before sending a ledger.]

No system is perfect and we will not pretend otherwise. What we can commit to is that we do not move confidential ledgers over unsecured channels, and we ask you not to either. If you need a secure way to send us a file, ask and we will arrange one.

9. Your documents: ledgers, RFQs and vendor bids

This is the section that matters most to the Corporations we act for, so it is the most specific one in this policy.

The documents you send us during an engagement are the confidential business records of your Corporation. They belong to you, not to us. Specifically:

Mechanical and capital spend ledgers.
Requests for quotation and their technical appendices.
Competing vendor bids, including pricing, terms and exclusions.

We treat all of it as confidential, whether or not it contains any personal information.

What we will not do with it:

We do not disclose bid pricing, terms or exclusions to competing bidders, at any point, including after an award.
We do not share one Corporation’s rates, findings or ledgers with another Corporation, with a Property Manager who is not engaged on that file, or with anyone bidding the work.
We do not use your ledgers to build a benchmarking database, a market rate product, or anything else we sell or publish.
We do not accept payment, commission or consideration of any kind from a vendor, and that rule covers information as much as it covers money.

Where these records contain personal information, most often the names, titles and contact details of directors, managers and vendor staff, that information is handled under the rest of this policy.

Where a record contains no personal information at all, PIPEDA does not apply to it. Our duty of confidentiality to you still does, it is contractual as well as professional, and it does not expire when the engagement does.

10. Your rights under PIPEDA

You have the right to:

Know what personal information we hold about you, why we hold it, and to whom it has been disclosed.
Access it. Write to us and we will respond within 30 days. In most cases there is no charge. If we need more time, or if a fee would apply, we will tell you before we do anything and you can withdraw the request.
Correct it. If information we hold about you is wrong or incomplete, tell us and we will fix it, and where it matters we will tell anyone we disclosed it to.
Withdraw your consent, as described in section 4.
Complain, as described in section 13.

There are limits, and it is fairer to state them here than to spring them on you later. We may not be able to give you access to information that would reveal personal information about someone else, that is subject to solicitor-client privilege, that would reveal confidential commercial information belonging to another party, or that we are legally prohibited from disclosing. In a capital procurement file that comes up regularly, because a single ledger or bid package concerns many people and more than one organization.

If we refuse a request in whole or in part, we will tell you in writing, explain why, and tell you how to challenge the decision.

To make a request, email info@brencursystems.com. We may ask you to confirm your identity first. That protects you rather than us.

11. Cookies and analytics

We do not use analytics or advertising pixels. There is no Google Analytics on this site, no Meta pixel, no LinkedIn Insight Tag, no heatmap and no session recording. We do not know who visits, how long you stayed, or what you looked at, and we have not built any way to find out.

Our fonts are served from our own domain rather than from a third-party font network, so loading this page does not announce your visit to anyone else.

We do not set cookies to follow you across other websites. The site software sets cookies only for people who sign in to administer it, which is not you.

Our contact form is supplied by HubSpot. Loading the contact section of our home page fetches that form from HubSpot, and HubSpot may set its own cookies on your browser and record that the form was requested. That is HubSpot’s processing under HubSpot’s own privacy policy, not ours, and it happens whether or not you go on to submit anything. If you would rather not involve them at all, email us directly at info@brencursystems.com and no form is loaded.

Our “Book a Call” buttons currently scroll to the contact section on this site. They do not open a third-party scheduler. [TO CONFIRM: if a scheduler is connected later, name it here on the day it goes live, not afterwards.]

If we ever add analytics, we will say so here, and we will say what it is.

The LinkedIn link in our footer is an ordinary link. Nothing loads from LinkedIn while you are on our site. If you follow the link, LinkedIn’s own policies apply from that point.

12. Changes to this policy

We may update this policy as the practice changes. The version posted here is always the current one, and its effective date is at the top.

If a change is significant, we will make that obvious rather than quietly amending the text. Adding analytics, adding a third-party form or scheduling tool, or beginning to use a service provider that stores information outside Canada all count as significant. Where a change materially affects how we handle information you have already given us, we will seek your consent before applying it to that information.

13. How to contact us, and how to complain

Questions, access requests and complaints all go to the same place. We would rather hear about a problem directly than read about it later.

Privacy Officer
Brencur Systems
Nestbase Financial Inc.
[TO CONFIRM: named individual, and a mailing address. The site publishes only Hamilton, Ontario, with no street address and no phone number.]
Hamilton, Ontario
info@brencursystems.com

We will acknowledge your complaint, investigate it, and tell you in writing what we found and what we did about it. [TO CONFIRM: the service commitment, for example acknowledgement within 5 business days and a substantive written response within 30 days. Commit to something you can actually meet.]

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada, which oversees PIPEDA. [TO CONFIRM: verify the Commissioner’s current address and telephone number at priv.gc.ca before publishing.]

Office of the Privacy Commissioner of Canada
30 Victoria Street
Gatineau, Quebec K1A 1H3
Toll free: 1-800-282-1376
priv.gc.ca