# PIPEDA Access Request Response

**From:** NorthernTech Solutions Inc.
Privacy Office
200 Bay Street, Suite 3400
Toronto, ON M5J 2J1

**Date:** 14 March 2026

**To:** Robert Tremblay
85 Rue Saint-Jean
Quebec City, QC G1R 1N4

**Reference:** PIPEDA-AR-20260212

**Subject:** Response to Your Request for Access to Personal Information Under PIPEDA

---

Dear Mr Tremblay,

Thank you for your request received on 12 February 2026 under the Personal Information Protection and Electronic Documents Act (PIPEDA), Schedule 1, Clause 4.9. We have verified your identity and are providing the following information about the personal information we hold about you.

## 1. Personal Information Held

| Category | Details |
|----------|---------|
| Identifiers | Full name, email (r.tremblay@email.ca), postal address, phone number, account ID (NT-284719) |
| Financial | Payment card on file (Visa ending 3847), billing history since March 2023 |
| Service records | Subscription plan (Enterprise), service tickets (14 total), usage logs |
| Technical data | IP addresses from login sessions, device type, browser information |
| Communication records | Customer support correspondence (email and chat transcripts) |

## 2. Purposes of Collection and Use

| Purpose | PI Categories Used | Clause |
|---------|-------------------|--------|
| Service delivery | Identifiers, financial, service records | 4.2 |
| Account management and billing | Identifiers, financial | 4.2 |
| Technical support | Identifiers, service records, communication records | 4.2 |
| Platform security | Technical data | 4.7 |
| Service improvement analytics | Service records (aggregated) | 4.5 |

## 3. Disclosure History

| Recipient | PI Disclosed | Purpose | Legal Basis |
|-----------|-------------|---------|-------------|
| Stripe Inc. (payment processor) | Payment card details, billing address | Payment processing | Service provider under contractual obligations |
| Amazon Web Services (hosting) | All categories (encrypted at rest) | Cloud infrastructure | Service provider under contractual obligations |
| Canada Revenue Agency | Billing records for GST/HST remittance | Tax compliance | Required by law (Section 7(3)(c)) |

We have not sold, rented, or leased your personal information to any third party.

## 4. Cross-Border Transfers

Your personal information is processed on servers located in Canada (AWS Canada Central Region, Montreal). Payment processing through Stripe involves transfer to the United States. Stripe is bound by contractual obligations to protect your information to a standard comparable to PIPEDA. Personal information transferred to the United States may be accessible to US government authorities under lawful authority.

## 5. Retention Period

| Category | Retention Period | Basis |
|----------|-----------------|-------|
| Account and service records | Duration of account plus 2 years | Business purpose and limitation period |
| Financial and billing records | 7 years from transaction date | Canada Revenue Agency requirements |
| Technical logs | 12 months rolling | Security monitoring purposes |
| Support correspondence | Duration of account plus 1 year | Service quality |

## 6. Your Rights Under PIPEDA

You have the right to:
- **Challenge accuracy** — request correction of inaccurate or incomplete personal information
- **Withdraw consent** — withdraw your consent for non-essential processing at any time
- **File a complaint** — if you are unsatisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada

**Office of the Privacy Commissioner of Canada**
30 Victoria Street, Gatineau, QC K1A 1H3
Toll-free: 1-800-282-1376
Website: www.priv.gc.ca

If you wish to request a correction or have questions about this response, please contact our Privacy Officer.

Sincerely,

**Marie-Claire Dubois**
Chief Privacy Officer
NorthernTech Solutions Inc.
privacy@northerntech.ca
1-888-555-0147