How we work
From first email to signed documents, in writing all the way
We work by email, so every question, answer and decision is on file. No meetings are needed, no software is installed, and nothing is signed or filed for you. Most of the effort on your side is gathering what you already have.
The timeline
The dates shown are the latest that still get you signed documents before January 1, 2027.
- Day 1 · any time
You email us
Your institution’s name, and your name and role. Nothing else.
- Within 2 business days
Free privacy notice check
A one-page PDF on the notice of collection on your public forms, plus three website checks. See a sample. No obligation.
- When you ask
Written quote and the full terms
A one-page quote: scope, fixed price, what is not included, who does what, the delivery date, payment terms and how to accept. The service agreement comes with it. The quote is valid for 30 days.
- By Monday, November 30, 2026
You accept
Reply “yes”, or send a purchase order that names the quote. We then send the intake list and the questionnaire, and confirm in writing which providers will hold your documents and in which countries, before any paid work starts.
- Within 5 business days of accepting
You send what you have
Forms, notices, policies, your retention by-law, a list of systems and outside services, and the questionnaire answers. Gaps are normal; we list what is missing.
- The day we start
We tell you work has begun
Until that email, either side can end the agreement and nothing is owed.
- About 3 weeks
We prepare; a certified privacy professional reviews
We write each document around your forms and practices. Questions come by email as they arise. Before anything reaches you, a certified privacy professional checks every judgment call.
- By Monday, December 21, 2026
Delivery
All ten documents, in editable files you keep. Then the invoice, net 30.
- Within 10 business days of delivery
You review
Tell us if anything is wrong or missing and we correct it at no charge. Your solicitor or clerk confirms the legal authority line in each assessment.
- Before Friday, January 1, 2027
Your head signs
Council, your board, or the person they named in writing reviews, changes what they want and signs. We never sign anything for you.
What we need from you
- One contact person: name, title, email and phone.
- Who your head is under MFIPPA, and any written delegation, for example to the clerk.
- Every form that collects personal information, online or paper: links or copies.
- Your privacy notices, privacy policy and the link to your privacy page.
- Your records retention by-law and schedule.
- A list of the main systems and outside services that hold personal information, with each vendor’s name.
- Anything you already have: a breach protocol, past assessments, privacy training.
- Answers to our short written questionnaire.
- The collection you want as your first completed assessment, with its forms, the system it uses, who can see the information, how long it is kept, and the legal authority you rely on.
Scans, phone photos, spreadsheets and PDFs are all fine. We work from copies; you keep the originals.
What we never ask for
- Passwords, logins or one-time codes to any system, portal or bank account.
- Personal information about residents, students, patrons or staff. The documents describe what you collect, not the records themselves.
- Social Insurance Numbers or payment card numbers.
- Access to your network, email or file shares.
If a login is ever sent to us by mistake, we tell you to change it and delete the message.
Who does what
| Who | Does | Does not |
|---|---|---|
| Maple Privacy Desk | Prepares every document from your information; asks questions by email; corrects anything wrong or missing | Give legal opinions; sign, adopt or file anything; contact the IPC |
| Certified privacy professional | Reviews every judgment call before the pack reaches you, under a written confidentiality agreement | Give legal conclusions, or represent you before the IPC |
| Your contact person | Gathers documents, answers the questionnaire, passes questions to the right department | Need privacy expertise |
| Your solicitor or clerk | Confirms the legal authority you cite for each collection | Need to draft anything |
| Your head or delegate | Reviews, changes what they want, and signs | Hand the decisions to anyone else |
How your documents are handled
The short version of sections 5 and 6 of our service agreement. The privacy notice has the rest.
- Where
- In access-controlled accounts with multi-factor sign-in, used only for your work and seen only by the people working on it.
- Which providers
- Before any paid work starts, we tell you in writing which providers will hold or process your documents and in which countries. Some providers may store data outside Canada.
- If you need Canada only
- Tell us before you send anything. We agree in writing how that will work, or tell you plainly that we cannot, and you may end the agreement with a full refund.
- Confidentiality
- Your information is used only for your work, disclosed only to the people working on it, the reviewer and our providers, or where the law requires. We never name you as a client without your written permission.
- After the work
- Working files with your information are returned or securely deleted within 30 days. We keep a copy of what we delivered and our business records for six years, as the Canada Revenue Agency requires.
- If something goes wrong
- If a breach of our safeguards affects your information, we tell you as soon as we know, so you can meet your own duties.
After January 1
The pack gives you the method; you run it. If you want help later, we prepare additional assessments from CA$1,500 as new collections come up, and your yearly breach statistics report from CA$750 before each March 31. Each is quoted in writing first.
Start with a free check, or ask for a quote
Email your institution’s name to:
hello@mapleprivacydesk.caWe reply within 2 business days. Please do not send personal information about residents or staff. We do not need it.
What to put in your email
- Your institution’s name.
- Your name and role, so we know who the check or quote is for.
That is all we need. We find your public forms and privacy pages ourselves.