Privacy Policy

1. About this policy

BossKit ("BossKit", "we", "us", or "our") is operated from Canada and provides legal-first business incorporation and related document services. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws (including Alberta's PIPA, British Columbia's PIPA, and Quebec's Law 25).

By using our website (bosskit.co) or services, you consent to the practices described below.

2. Personal information we collect

• Identity & contact data: name, email, phone number, mailing address.
• Business information: proposed corporate name, directors and shareholders, addresses, share structure.
• Identity verification: government-issued ID where required for our legal/KYC obligations.
• Payment data: processed by our payment processor (Stripe). We do not store full card numbers.
• Communications: messages, intake forms, and documents you submit to us.
• Technical data: IP address, device/browser information, cookies and similar technologies, usage analytics.

3. Purposes for which we use your information

We collect, use, and disclose personal information only for purposes a reasonable person would consider appropriate, including:

• providing incorporation, document preparation, and related legal services;
• verifying identity and meeting "know your client" and anti-money-laundering obligations;
• processing payments and issuing receipts;
• communicating with you about your file, account, or service updates;
• improving our website and services, including analytics;
• complying with legal, regulatory, and professional (e.g., law society) obligations.

We will obtain your consent before using your personal information for any new purpose, unless otherwise required or permitted by law.

4. Solicitor–client privilege

Information you provide in connection with legal services provided by or through a licensed Canadian lawyer is treated as subject to solicitor–client privilege and the duty of confidentiality. We protect this information as required by the applicable provincial law society rules.

5. How we share information

We share personal information only as needed to deliver the service, including with:

• licensed Canadian lawyers and law firms providing legal services to you;
• government registries (e.g., Corporations Canada, provincial corporate registries) for filings;
• service providers acting on our behalf (e.g., cloud hosting, payment processing, email delivery, analytics) under contractual confidentiality obligations;
• authorities where required by law, subpoena, or court order.

We do not sell your personal information.

6. International transfers and storage

Some of our service providers may store or process data outside of Canada (including in the United States). When this happens, your personal information is subject to the laws of those jurisdictions, including lawful access by foreign authorities. We use contractual and technical safeguards to protect your information consistent with PIPEDA and applicable provincial law.

7. Retention

We retain personal information only as long as necessary to fulfil the purposes for which it was collected, to comply with our legal, accounting, and professional obligations (including law society record-keeping requirements), and to resolve disputes and enforce our agreements. When no longer needed, information is securely destroyed, erased, or anonymized.

8. Safeguards

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including access controls, encryption in transit, and vendor due diligence. No method of transmission or storage is 100% secure, but we work to protect your information against loss, theft, and unauthorized access, disclosure, or modification.

9. Your rights

Subject to applicable law, you may:

• access the personal information we hold about you;
• request correction of inaccurate or incomplete information;
• withdraw consent to certain uses (subject to legal or contractual restrictions);
• make a complaint about our handling of your personal information.

To exercise these rights, contact our Privacy Officer at info@bosskit.co. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca, or your provincial privacy regulator (e.g., the CAI in Quebec, the OIPC in Alberta or BC).

10. Cookies and analytics

We use cookies and similar technologies to operate the site, remember preferences, and measure usage. You can control cookies through your browser settings; disabling them may affect site functionality.

11. Anti-spam (CASL)

Commercial electronic messages we send comply with Canada's Anti-Spam Legislation (CASL). Every commercial message identifies us and includes an unsubscribe mechanism that we honour promptly.

12. Children

Our services are intended for individuals 18 years of age or older. We do not knowingly collect personal information from children.

13. Changes to this policy

We may update this Privacy Policy from time to time. The "Effective date" above will reflect the most recent version. Material changes will be brought to your attention where required by law.

14. Contact us

Privacy Officer — BossKit
Email: info@bosskit.co