Privacy Policy

1 Who We Are

This Privacy Policy applies to Haystax Mortgage (ON) Inc. Lic.#13169, operating as Haystax Mortgage Canada ("we," "us," or "our"), a licensed mortgage brokerage regulated by the Financial Services Regulatory Authority of Ontario (FSRA).

Our registered address is in Ontario, Canada. We can be reached at ontario@haystax.ca or by phone at +1 (365) 659-1619.

This policy explains how we handle personal information collected through our website at multifamily.haystax.ca and any related services, in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Ontario privacy legislation.

2 Information We Collect

Information You Provide Directly

When you complete our qualification form, we collect:

• Full name (first and last)
• Email address
• Phone number
• Project type and details (acquisition, construction, CMHC, etc.)
• Estimated project size and number of units
• Financing timeline

Information Collected Automatically

When you visit our website, we may automatically collect:

• IP address and approximate geographic location
• Browser type and version
• Device type (desktop, mobile, tablet)
• Pages visited and time spent on each page
• Referring URL (how you found us)
• UTM parameters and Google Click ID (GCLID) from advertising campaigns

Information We Do Not Collect

We do not collect credit card numbers, Social Insurance Numbers, banking credentials, or any sensitive financial account information through this website.

3 How We Use Your Information

We use the information we collect for the following purposes:

• To respond to your inquiry — contacting you to discuss your financing needs within 24 hours of form submission
• To provide mortgage brokerage services — assessing your project's financing eligibility and connecting you with appropriate lenders
• To personalize your experience — tailoring our recommendations to your specific project type, size, and timeline
• To improve our services — analysing how visitors use our website to enhance user experience
• To measure advertising effectiveness — understanding which marketing channels generate qualified leads
• To comply with legal obligations — meeting FSRA regulatory requirements for mortgage brokerage record-keeping

We will not use your information for any purpose incompatible with those listed above without obtaining your consent.

4 Legal Basis for Processing

Under PIPEDA, we process your personal information on the following bases:

• Consent — by submitting our qualification form, you consent to us contacting you regarding mortgage financing services
• Contractual necessity — to fulfil our obligations when providing mortgage brokerage services
• Legitimate interests — to operate and improve our business, provided these interests are not overridden by your privacy rights
• Legal obligation — to comply with FSRA regulations and applicable Canadian law

You may withdraw consent at any time by contacting us at ontario@haystax.ca. Withdrawal will not affect the lawfulness of any processing carried out prior to withdrawal.

5 Information Sharing & Disclosure

We do not sell, rent, or trade your personal information to third parties. We may share your information only in the following circumstances:

Service Providers

We use trusted third-party service providers to operate our business, including:

• Formspree — form submission and data routing (formspree.io)
• GoHighLevel (GHL) — CRM and lead management platform
• Google LLC — analytics and advertising services

These providers are contractually obligated to protect your data and may not use it for any purpose other than providing services to us.

Lenders & Financial Institutions

With your explicit consent, we may share your project information with lenders, financial institutions, or CMHC for the purpose of obtaining mortgage financing on your behalf.

Legal Requirements

We may disclose your information if required by law, court order, or government authority, or to protect the rights, property, or safety of Haystax Mortgage Canada, our clients, or the public.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the successor entity, subject to equivalent privacy protections.

6 Cookies & Tracking Technologies

Our website uses cookies and similar technologies to enhance your experience and measure performance. Types of cookies we use:

• Essential cookies — required for the website to function (session management)
• Analytics cookies — Google Analytics 4 to understand visitor behaviour
• Advertising cookies — Google Ads to measure campaign performance and enable remarketing

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of our website. For more information, visit allaboutcookies.org.

7 Google Ads & Analytics

We use Google Analytics 4 and Google Ads to measure website traffic and advertising performance. These services may collect:

• Pages visited and actions taken on our website
• How you arrived at our website (organic search, paid ad, referral)
• Aggregated demographic information (age range, interests) — not linked to personally identifiable information
• Google Click ID (GCLID) to attribute conversions to specific ad campaigns

Google's data collection is governed by Google's Privacy Policy. You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on.

We use Google Ads remarketing features to show relevant advertisements to previous website visitors. You can manage your Google ad preferences at adssettings.google.com.

8 Data Retention

We retain your personal information for as long as necessary to fulfil the purposes described in this policy, or as required by FSRA regulations for mortgage brokerage record-keeping.

• Lead inquiries (no engagement) — 12 months from date of submission
• Active client files — 7 years from the date of last transaction, as required by FSRA
• Analytics data — as per Google's standard retention periods (up to 26 months)

After the applicable retention period, your personal information will be securely deleted or anonymised.

9 Your Rights

Under PIPEDA, you have the following rights regarding your personal information:

• Right to access — request a copy of the personal information we hold about you
• Right to correction — request correction of inaccurate or incomplete information
• Right to withdrawal of consent — withdraw your consent to our use of your information at any time
• Right to deletion — request deletion of your personal information, subject to our legal retention obligations
• Right to complain — lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca

To exercise any of these rights, please contact us at ontario@haystax.ca. We will respond to all requests within 30 days.

10 Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, disclosure, alteration, or destruction, including:

• HTTPS encryption for all data transmitted through our website
• Secure third-party platforms (Formspree, GoHighLevel) with industry-standard encryption
• Access controls limiting who within our organization can access personal data
• Regular review of our data handling practices

While we take all reasonable precautions, no method of transmission over the internet is 100% secure. In the event of a data breach that poses a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner as required by PIPEDA.

11 Third-Party Links

Our website may contain links to third-party websites (such as haystax.ca, haystax.ca, or lender websites). We are not responsible for the privacy practices of these external sites. We encourage you to review the privacy policies of any third-party sites you visit.

12 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will post the updated policy on this page with a revised "Last Updated" date. For material changes, we may notify you by email if you have provided us with your contact details.

Your continued use of our website after any changes constitutes your acceptance of the updated policy.

13 Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Privacy Officer: