LEGAL · PRIVACY · YOUR RIGHTS
Privacy Policy
Last updated: October 15, 2026
We wrote this in plain language because legalese benefits no one.
The Short Version
Here's the short version: We collect only the personal information we need to manage your investments and meet our regulatory obligations.
We don't sell your data.
We don't share it with anyone except our custodian (CIBC Mellon), our regulators (the Ontario Securities Commission), and service providers who need it to keep your accounts running.
You can ask us what we have on you anytime, and we'll tell you.
If you want us to delete something, we will — unless the law requires us to keep it.
That's the honest summary. The detailed sections below cover each point thoroughly, because we know some of you (and your lawyers) want the specifics.
1. Information We Collect
Know Your Client (KYC) Data
When you become a client, securities regulation (National Instrument 31-103) requires us to collect specific information about you. This includes:
- Full legal name, date of birth, and residential address
- Social Insurance Number (SIN) — required for tax reporting to the Canada Revenue Agency
- Employment status and occupation
- Financial situation: income, net worth, liquid assets, and liabilities
- Investment knowledge and experience
- Risk tolerance and investment objectives
- Investment time horizon
We collect this during the onboarding process and update it at least annually, or whenever your circumstances change.
Account Information
Account numbers, holdings, transaction history, trade confirmations, and account statements held at our custodian, CIBC Mellon.
Correspondence
Emails, letters, meeting notes, and phone call records related to your account. We keep these because regulators require it — and because they're useful when we need to revisit a conversation from three years ago.
Website Analytics
If you visit our website, we collect anonymized usage data through Google Analytics: pages visited, time on page, browser type, and referring URL. We do not collect personally identifiable information through the website unless you submit it through our contact form.
2. How We Use Your Information
Portfolio Management
Your KYC data drives your Investment Policy Statement, which drives every decision in your portfolio. Without accurate information about your situation, we can't manage your money responsibly.
Regulatory Compliance
We are required under NI 31-103 to maintain current KYC records, document suitability assessments, and produce records for regulatory review. The Ontario Securities Commission can — and periodically does — examine these records.
Tax Reporting
We report investment income, capital gains, and other tax-relevant information to the Canada Revenue Agency as required by law. Your SIN is used exclusively for this purpose.
Client Communication
We use your contact information to send quarterly Open Book reports, trade notifications, market updates, and account-related correspondence.
Service Improvement
Anonymized, aggregated data helps us improve our reporting tools, website, and client experience. No individual client data is used for marketing purposes.
3. Who We Share Your Information With
We share your personal information only when legally required or operationally necessary. Here's the complete list:
CIBC Mellon (Custodian)
Your assets are held at CIBC Mellon, a qualified third-party custodian. They require account holder information to maintain your accounts, process trades, and issue statements. Your accounts are covered by the Canadian Investor Protection Fund (CIPF) up to $1 million per account category.
Ontario Securities Commission (Regulator)
As a registered Portfolio Manager (Registration No. PM-2006-0847) and Investment Fund Manager (Registration No. IFM-2009-1203), we are subject to regulatory examination. The OSC may request client records during compliance reviews.
Canada Revenue Agency (Tax Authority)
We report investment income and tax-relevant information as required by the Income Tax Act.
IT Service Providers
A small number of technology providers support our portfolio management software, reporting systems, and secure communications. Each operates under a confidentiality agreement that prohibits them from using your data for any purpose other than providing services to us.
We do not sell, rent, or trade your personal information. We do not share it with marketing companies, advertising platforms, or data brokers. Full stop.
4. Data Security
We're a small team, so here's how we handle security: with the same rigor we'd want applied to our own financial records.
Encrypted Storage
All client data is stored on encrypted servers with AES-256 encryption at rest and TLS 1.3 encryption in transit.
Access Controls
Client records are accessible only to team members who need them for their role. Access is logged and reviewed quarterly by Saoirse Doherty, our Operations & Compliance Manager.
Annual Security Audits
We conduct an annual security assessment of our systems and procedures. The summary findings are included in our published internal audit report — one of those practices we do that most firms our size don't.
Business Continuity Planning
Our BCP ensures that client records remain accessible and secure in the event of hardware failure, natural disaster, or other disruption. Backups are maintained at a geographically separate facility.
No system is perfectly secure — we're honest about that. But we treat your data with the same seriousness we treat your money.
5. Data Retention
We retain your personal information for a minimum of seven years after account closure.
This isn't our preference — it's a regulatory requirement under securities legislation. The Ontario Securities Commission requires registered firms to maintain client records for this period to support potential compliance reviews and dispute resolution.
After the seven-year retention period, records are securely destroyed unless there is an ongoing legal or regulatory reason to retain them.
Trade records and account statements held at CIBC Mellon are subject to the custodian's own retention policies, which align with securities industry standards.
6. Your Rights
You have real, enforceable rights over your personal information. Here's what you can do:
Access
You can request a complete copy of the personal information we hold about you. We'll provide it within 30 days. No fee, no runaround.
Correction
If any of your information is inaccurate or out of date, tell us and we'll correct it promptly. Keeping your KYC data current is both your right and a regulatory requirement.
Deletion
You can request that we delete your personal information. We'll comply unless the law requires us to keep it — which, for financial records, it usually does for seven years post-closure. We'll tell you exactly what we can and can't delete, and why.
Complaint
If you believe we've mishandled your personal information, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada.
Office of the Privacy Commissioner of Canada
30 Victoria Street, Gatineau, Quebec K1A 1H3
1-800-282-1376 · priv.gc.ca
We'd prefer you talk to us first — but the complaint mechanism exists, and we respect it fully.
7. Cookies
Our website uses a small number of cookies. Here's the full inventory:
Essential Session Cookies
These keep the website functioning — things like remembering your cookie consent choice and maintaining your session if you're logged into the client portal. You can't opt out of these because they're necessary for the site to work.
Analytics Cookies (Google Analytics)
We use Google Analytics to understand how visitors use our website: which pages are visited, how long people stay, and where traffic comes from. This data is anonymized — we don't see individual identities. You can opt out of these via the cookie banner or by using a browser extension.
What We Don't Use
No advertising cookies. No retargeting pixels. No social media tracking scripts. We don't run ads that follow you around the internet. (Honestly, we find that practice a bit unsettling too.)
8. Contact for Privacy Inquiries
For any questions about this policy or your personal information, contact:
Saoirse Doherty
Operations & Compliance Manager
Burnabilly Investments Inc.
990 Colonel By Drive, Ottawa, Ontario K1S 2R2
Email: contact@burnabillyinvestments.com
Phone: (807) 876-1862
We respond to privacy inquiries within 10 business days. Usually faster — we're six people, and Saoirse sits about eight feet from the rest of us.