Privacy policy
Who we are
Karl Erfle inc. (« the firm ») provides bookkeeping, accounting, tax and payroll services to small businesses in Québec. This policy explains how we handle personal information, as required by Québec's Act respecting the protection of personal information in the private sector (Law 25) and Canada's PIPEDA.
Person in charge of personal information
Karl Erfle, President. Contact: security@karlerfle.com. Write to this address to exercise any right described below or to ask a question about this policy.
What we collect
Information our clients give us to deliver our services: names and contact details of their representatives, their accounting records, invoices and receipts, payroll and tax documents, and correspondence with government agencies. When a client chooses to link a business bank account through Plaid: the posted transactions, balances, account names and the last digits of account numbers for that client's accounts. We do not receive bank passwords when the client links directly, and we do not collect full account or transit numbers or identity data through Plaid. Our website sets no cookies and uses no analytics or tracking.
Why we use it
Only to deliver the services the client engaged us for: keeping and reconciling their books, preparing tax and government filings, payroll, and advice. We do not sell personal information, do not use it for marketing, and do not use bank data for lending, credit decisions or any purpose other than that client's bookkeeping.
Consent
We collect personal information with the client's consent, given when they engage us and, for bank data, when their authorized user links their accounts in Plaid Link. Consent can be withdrawn at any time by writing to us; we then remove the bank connection and stop collecting the data.
Service providers and data outside Québec
We use a limited set of providers to deliver our services, each bound by its own terms and used for the client's engagement only: Plaid (bank data; see Plaid's End User Privacy Policy at https://plaid.com/legal/#end-user-privacy-policy), Intuit QuickBooks Online (accounting files), Microsoft 365 and Google Workspace (e-mail and documents), and Anthropic (AI assistance in our bookkeeping work, with use of our data for model training turned off). Some of these providers store or process information outside Québec, including in the United States. Before communicating personal information outside Québec, we assess whether it will receive adequate protection, as Law 25 requires.
Security
Client information is kept on physically secured servers the firm owns and controls, with encryption in transit, encryption at rest for all bank data received through Plaid, multi-factor authentication on administrator accounts, access limited per client, and encrypted backups. Details are in our information security policy, available on request.
Retention and deletion
We keep information as long as needed for the engagement and for the record-keeping periods required by law (generally six years under Canadian and Québec tax law). When an engagement ends, bank connections are removed, and information is returned or securely destroyed once the legal period expires.
Your rights
You may ask to access the personal information we hold about you, to have it corrected, to withdraw consent, and to be told how it was collected and used. Write to security@karlerfle.com; we answer within 30 days. If you are not satisfied with our answer, you may contact the Commission d'accès à l'information du Québec (www.cai.gouv.qc.ca).
Confidentiality incidents
If an incident involving personal information presents a risk of serious injury, we notify the people affected and the Commission d'accès à l'information, and keep a register of incidents, as Law 25 requires.
Changes
We update this policy when our practices change. The date below shows the latest version.
Effective 2026-10-24