Data Retention Policy

This Data Retention Policy explains how long NDS Consulting Inc. keeps personal and client information and how it is disposed of. NDS retains information only as long as necessary for the purposes identified in the Privacy Policy, or as required by law, in line with PIPEDA Principle 4.5 (limiting use, disclosure and retention).

• Tax returns, working papers and supporting documents: at least six (6) years from the end of the last tax year to which they relate, consistent with the Income Tax Act and Excise Tax Act record-keeping periods, and longer where a return was filed late, is under objection, audit or appeal, or a legal hold applies.
• Engagement letters, invoices and payment records: seven (7) years after the engagement ends.
• Portal account and profile data: while the account is active and up to seven (7) years after last activity, unless deletion is requested and no legal obligation requires retention.
• Inquiries that do not become engagements: up to twenty-four (24) months.
• Client messages and correspondence: with the related engagement file.
• Security and access logs: generally up to twelve (12) months.
• Breach records: at least twenty-four (24) months, as required by PIPEDA regulations.

Clients keep ownership of their original records and remain responsible for retaining them for the periods CRA requires. NDS copies are kept for professional and legal purposes and do not replace your own records.

When retention ends, information is securely deleted, anonymized or destroyed. Electronic copies are removed from active systems; residual copies in encrypted backups are overwritten on the provider's normal backup cycle. Paper records, if any, are shredded.

Scheduled deletion is suspended where information is relevant to an audit, reassessment, objection, litigation, investigation, regulatory request or professional complaint, until the matter is resolved.

You may request access to, correction of, or deletion of your information by contacting privacy@ndsconsulting.ca. NDS will verify your identity and respond within 30 days where required by law. Some records cannot be deleted before the end of a legally required retention period; we will explain any such limitation.