Privacy policy

1. Our commitment and responsibilities

Candid Management Group Ltd. (“Candid,” “we,” “us” or “our”) respects the privacy of owners, tenants, strata council members, clients, document requesters, employees and others who deal with us. This policy explains our handling of personal information through our website, forms, private business applications, correspondence and property-management services.

Personal information is information about an identifiable individual. Certain business contact and work-product information is excluded from that definition under British Columbia’s Personal Information Protection Act (“PIPA”). We follow PIPA and other applicable privacy laws, including federal privacy requirements where they apply, together with applicable professional and recordkeeping obligations.

We are responsible for personal information under our control, including information processed for us by service providers. When acting for a strata corporation or another property-management client, we also handle records on that client’s behalf. The client may have its own privacy policy and legal responsibilities. We will help identify the organization responsible for a request where necessary.

2. Information we collect and why

We limit collection to information reasonably needed for an identified purpose. Depending on your relationship with us, this may include:

• Inquiries and proposals: your name, contact details, organization or role, property address, building characteristics and message, so we can respond, assess your needs and prepare a management proposal.
• Property and resident records: owner, tenant and authorized-agent details; strata plan, lot and unit information; tenancy dates; and relevant correspondence, maintenance, account or bylaw matters, to administer the property and meet the client’s legal obligations.
• Document orders: requester and property details, documents selected, service and delivery choices, charges, invoice and payment status, order notes, authorization records and, where required, title-search or conveyancing information. We use these to verify authority, process and deliver the order, communicate expected delivery, invoice and resolve questions or disputes.
• Form K and related resident information: landlord and tenant details, signatures and acknowledgements, and optional emergency-contact, pet, vehicle, parking or intercom details supplied for the relevant management purpose.
• Pre-authorized debit (“PAD”) arrangements: account-holder and property details, payment instructions, signatures, acknowledgements and the void cheque or bank-issued document you provide, to establish, administer and document authorized payments.
• Employment: application, résumé, qualification, reference and employment information reasonably needed for recruitment and the employment relationship.
• Technical and security records: request times, IP addresses or derived identifiers, browser and device information, error records, submission references and security events, to operate the services, prevent duplicate or abusive submissions, investigate problems and protect information.

We also use relevant records for accounting, legal and regulatory compliance, complaints, investigations, debt administration and establishing or defending legal claims, where permitted by law. We do not sell or rent personal information.

3. Sources and submission responsibilities

We generally receive information from you or someone authorized to act for you. We may also receive relevant information from clients, strata councils, landlords, previous managing agents, real estate professionals, lawyers, notaries, financial institutions, contractors and other sources where consent or the law permits.

If you submit information about another person, such as an owner, purchaser, tenant, joint account holder or emergency contact, you must have the authority or other lawful basis to provide it. Tell that person about the relevant collection and this policy where appropriate. Provide accurate information and only documents needed for the request. Do not include passwords, unrelated financial records or unnecessary identification numbers. Contact us if you are unsure what is required.

4. Consent and your choices

We identify our purposes when or before collecting personal information and obtain consent where required. Consent may be written, electronic or oral. It may be implied where the purpose is obvious and you voluntarily provide information for that purpose. Sensitive information calls for an appropriate form of consent. Acknowledging this policy does not authorize unrelated uses of your information.

We do not make you consent to handling information beyond what is necessary to provide a product or service as a condition of receiving it. Optional fields may be left blank. If required information is not provided, we may be unable to verify authority, process a request or provide the requested service.

You may contact our Privacy Officer to withdraw or change consent on reasonable notice, subject to legal restrictions. We will explain the likely effect on your services. Withdrawal does not reverse lawful prior handling, remove required records or prevent handling authorized or required without consent. A change to privacy consent does not by itself cancel a payment authorization or contractual obligation; the applicable cancellation process must also be followed.

Where the law permits or requires it, we may handle information without consent, for example to comply with a legal requirement, respond to a qualifying emergency, conduct a permitted investigation or administer a debt. We assess the applicable legal conditions rather than treating these as unrestricted exceptions.

5. Online orders, forms and email

Submitted orders and forms are sent to Candid’s business systems for authorized staff to review and process. Records may include submitted details, completed documents, signatures, attachments, acknowledgements, timestamps and subsequent workflow or correspondence history.

We use Resend for automated confirmation emails. It processes the recipient address and email content needed for delivery. Order confirmations contain order and requester information; uploaded authorization and banking attachments are not included in those order receipts. Form K and PAD submission confirmations may include a copy of the completed signed form. The separate supporting banking document is not included in the routine PAD confirmation.

Confirm that the email addresses and recipient details you provide are correct. Email can be forwarded or accessed by others with access to the receiving mailbox and is not guaranteed to be confidential. Use the designated submission process for banking and authorization documents instead of sending them in an ordinary inquiry email. Contact us promptly if an email or document appears to have reached the wrong person.

Service confirmations and necessary account communications are separate from marketing. Submitting a service form does not automatically subscribe you to a marketing list. If we send marketing communications, we will follow applicable consent and unsubscribe requirements.

6. Address suggestions

As you type in an address-search field on the document-order form, the address text is sent through our website to Geoapify, or to the B.C. Address Geocoder as a fallback, to obtain matching suggestions. This happens before the order is submitted. Names, email addresses, other order fields and uploaded documents are not included in those lookup requests.

Suggestions may fill in the street, city, province and postal code where available. They are not a verification of ownership, identity or delivery accuracy. You can edit suggested information or complete missing fields manually. Please check the address before submitting.

7. When we share information

We share personal information only for the identified purpose with appropriate consent, or as otherwise permitted or required by law. Depending on the service, recipients may include:

• Authorized Candid personnel and contractors who need the information for their responsibilities.
• The relevant strata corporation, council, landlord or other client, and persons lawfully entitled to receive the relevant records.
• Your authorized representatives, and lawyers, notaries, real estate professionals, insurers, auditors or other advisers where the matter requires their involvement.
• Banks, payment and accounting providers for authorized payments, reconciliation and invoicing. Where an approved QuickBooks Online integration is connected, relevant customer, order, invoice and payment-status information may be exchanged with Intuit.
• Technology providers that support hosting, storage, security, address lookup, email and business administration.
• Courts, tribunals, regulators, law enforcement or other recipients when a valid legal basis for disclosure exists.

Strata records are also subject to the Strata Property Act and other applicable requirements. Some records must be made available to people entitled to access them. We cannot promise that every submission, complaint, name or item of correspondence will remain confidential in all circumstances. We assess the entitlement, applicable exceptions and appropriate scope of disclosure.

If a business transaction involving Candid is proposed or completed, relevant information may be disclosed or transferred only in accordance with applicable law, including required confidentiality, use restrictions and notice requirements. This is not permission to sell personal information as a separate product.

8. Service providers and processing locations

Our online services use hosting and application infrastructure including OpenAI Sites and Cloudflare; Microsoft Azure storage and Defender malware scanning for the upload-scanning service; Resend for automated emails; and the address providers described above. Microsoft and other approved business-service providers may also support correspondence and administration. Which providers receive information depends on the service you use.

Service providers process information needed to perform their functions. For example, email providers receive email content and delivery details, address providers receive address queries, and storage and security services process uploaded files and related security records. We seek appropriate contractual and security protections and remain responsible for meeting our obligations for information under our control.

Not all information is processed exclusively in Canada. Information may be stored, transmitted or accessed in Canada, the United States or other countries where our providers and their support operations are located. This includes email delivery, hosting and technical support. Information processed abroad may be subject to that jurisdiction’s laws and lawful access by its courts or authorities. You can contact our Privacy Officer with questions about these arrangements.

9. Website technology and external services

Our website and its infrastructure process technical information to serve pages, maintain security and diagnose errors. Essential cookies or similar session technologies may be used by hosting or authentication services. Browser settings can limit cookies, although this may affect sign-in or other functionality.

Rental listings embedded on our website and external owner or resident portals are provided through third-party platforms. When an embedded listing loads, or you open an external service, that provider may receive your IP address and browser information and use its own cookies. Review the provider’s privacy notice before submitting information there. External sites have their own practices; this does not remove Candid’s responsibilities for information we receive or control.

10. Safeguards and privacy incidents

We use reasonable administrative, physical and technical safeguards appropriate to the sensitivity of the information. These include restricting access to authorized purposes, protecting business accounts and records, using secure transmission for online submissions, and checking uploads through the connected malware-scanning service. Records must be handled and disposed of securely by people working for us.

No website, email system, scan or storage service can guarantee complete security or uninterrupted availability. A scan is a security measure, not a guarantee that a file is harmless. Report suspected unauthorized access, a lost document, a misdirected email or another privacy incident to us promptly. We will assess and respond to incidents, take appropriate containment and remedial steps, and provide notifications required by law and otherwise appropriate to the risk.

11. Retention and secure disposal

We retain personal information for the period reasonably needed for the identified purpose and applicable legal or business requirements. The period depends on the record, including strata and tenancy requirements, professional obligations, tax and accounting records, payment authorizations, disputes, insurance and legal holds. Client records are also handled according to lawful client instructions.

When we use personal information to make a decision directly affecting an individual, PIPA requires us to retain that information for at least one year after using it so the individual has a reasonable opportunity to request access. Other requirements may require longer retention.

When the purpose is no longer served and retention is no longer needed for legal or business purposes, we securely destroy the information or remove its association with an identifiable individual. Deletion from an active system may not immediately remove protected backup, recovery or legally retained copies. Closing an account or withdrawing consent does not automatically erase records we must retain.

12. Access, accuracy and correction

We take reasonable steps to keep information accurate and complete where it is likely to be used to make a decision affecting you or disclosed to another organization. Please tell us when relevant details change.

You may make a written request to our Privacy Officer for access to your personal information under our control, information about how it has been used, and the names of persons or organizations to which it has been disclosed, subject to applicable law. You may also request correction of an error or omission. Provide enough detail to locate the records, such as your relationship with Candid, the property or order reference, and relevant dates. We may reasonably verify your identity or your representative’s authority before releasing information.

We respond to access requests within 30 business days, subject to extensions and other provisions permitted by PIPA. If an extension is required, we will provide the notice required by law. A minimal access fee may apply where permitted; we will provide a written estimate before proceeding and may request a deposit. We do not charge a fee for access to your employee personal information. Requests for strata records may follow a separate statutory process and fee rules.

Access may be limited or refused where the law permits or requires it, including to protect another person’s information, legal privilege or certain investigations. Where possible, we provide accessible portions. We explain a refusal in writing and provide information about review rights as required by law.

If a correction is justified, we will make it and notify organizations to which the information was disclosed in the preceding year as required by PIPA. If a correction is not made, we will annotate the record with the requested correction as required. You may also ask about deletion, but there is no unrestricted right to erase records we are lawfully required or entitled to retain.

13. Employment information

Employment information is handled for reasonable purposes connected with establishing, managing or ending an employment relationship. Where PIPA permits handling employee personal information without consent for these purposes, we provide the notice required by law. Other uses or disclosures require an appropriate legal basis. Employees and applicants may contact our Privacy Officer about their information.

14. Changes and applicable rights

We may update this policy as our services, practices or legal obligations change. The revised policy and its date will appear here. Where a material change requires notice or new consent, we will provide that notice or obtain consent as required; posting a revision alone does not authorize a new, unrelated use of previously collected information.

Nothing in this policy or our website terms removes privacy rights or obligations that cannot lawfully be excluded. Specific form authorizations and service agreements apply alongside this policy, subject to applicable law.

15. Questions, requests and complaints

Address privacy inquiries, access or correction requests, and complaints to:

Please identify the nature of your concern and the relevant property, service or record. Avoid including unnecessary sensitive information in the initial email; we can arrange an appropriate way to verify identity or receive supporting material. We will review the concern and respond with our findings or next steps.

If your concern is unresolved, you may contact the Office of the Information and Privacy Commissioner for British Columbia (OIPC) about its complaint or review process. Applicable time limits and procedures may apply.

For the governing legislation, see British Columbia’s Personal Information Protection Act.