Data Retention Policy

This policy sets out how long Cybercana Consulting Inc. (“Cybercana”) keeps information held in the Clientaly platform. It forms part of the Terms of Service and is referred to by the Privacy Policy and the Data Processing Terms, so that retention periods are stated in one place. Words defined in the Terms of Service have the same meaning here.

Whose job retention is

Cybercana keeps Subscriber Data only as long as this policy says. It does not act as any advisor’s records keeper.

Each advisor decides how long they must keep records — for their regulator, insurers, MGAs, errors-and-omissions insurer and clients — and is responsible for exporting what they need before their account ends. Periods differ by province, product and contract, so Cybercana does not set one for them.

While an account is active

Subscriber Data is kept for as long as the account is active. Advisors can export their records at any time.

Suspended accounts

If an account is suspended — for example for non-payment — its data is kept unchanged, so nothing is lost while the issue is resolved.

When an account ends

• Export window. For 60 days after an account ends, the advisor can obtain an export of their data, on request to privacy@clientaly.com if their access has ended.
• Scheduled deletion. After the export window, the data is scheduled for deletion.
• Deletion on request. Where the Authorized User whose Tenant holds the data asks in writing, Cybercana deletes or anonymizes it within 90 days of the request, subject to the License Agreement section “Records when an advisor leaves”. An agency cannot, by itself, require deletion of an advisor’s records.
• Backups. Backups are taken daily and kept for 7 days. Deleted data disappears from backups as they roll over; individual records cannot be removed from a backup.

Exceptions

Data may be kept longer where Cybercana is required to by law, where a legally binding direction requires it, or where it is reasonably needed to establish or defend a legal claim. It is kept only as long as that reason lasts.

Cybercana’s own records

• Breach records — at least 24 months, as PIPEDA requires.
• Legal acceptances (which version of which agreement a person accepted, when, and a fingerprint of the exact text) — for the life of the account, and afterwards for as long as needed to establish or defend a legal claim.
• Security audit log (administrator actions, support access, two-factor resets, and changes to client, family and policy records) — as for legal acceptances.
• Billing and tax records — as long as tax law requires, generally six years after the end of the tax year to which they relate.
• Enquiries sent through clientaly.com — as long as needed to respond and follow up, then deleted.
• Google Calendar connection (access tokens, connected email address, event identifiers) — tokens are deleted when the advisor disconnects; the rest is deleted with the account’s other data.

Changes

Cybercana may update this policy. Material changes are notified to subscribers at least 30 days in advance and require renewed acceptance, in the same way as the Terms of Service.

Cybercana Consulting Inc., 12 Fairmont Ridge Trail, Nobleton, Ontario L7B 0A4, Canada — privacy@clientaly.com