Your information, and what we do with it.

PIPEDA requires one named person to be accountable for how an organisation handles personal information. Ours is [PRIVACY OFFICER NAME], reachable at [PRIVACY OFFICER EMAIL].

Those brackets are not a typo. The designation is being confirmed with our brokerage and the name will be published here when it is. Until then, a privacy question sent to info@tdotlending.com or phoned through to (905) 462-8646 reaches the person responsible, and we will tell you who that is when we answer.

One form on this website collects personal information: the pre-qualification and enquiry form. Nothing else on the site sends anything about you to us. The form is built as an allow-list — the code names the fields it will accept, and anything else is refused rather than ignored.

The second group is deliberately banded. A range tells an agent as much as an exact number does about whether we can help, and a range cannot be used to impersonate you. There is no box on this website for your income, your employer, your debts, your assets or the address of a property.

Alongside the form we record the evidence that makes your permission provable: the date and time, your IP address, your browser’s user agent string, and the address of the page you submitted from. Your IP address is also used briefly, in memory, to cap how many submissions can come from one place in an hour.

If you use the calculators, the numbers you type stay in your browser. That page makes no network call at all — nothing you enter there is sent to us, stored or logged.

No Social Insurance Number. No date of birth. No credit score. No bank account, transit or institution numbers. No document uploads. We also do not run a credit inquiry from anything you do on this website.

This is enforced rather than promised, in four places. The form accepts only the fields listed above. A submission carrying a field named like a Social Insurance Number, a date of birth, a credit score, a bank account or a routing number is rejected outright with an error, and the attempt is logged. The lead table in our database has no column for any of them, so there is nowhere to put one. And if digits shaped like a Social Insurance Number or a card number appear in the free-text message box, the database replaces them with “[redacted]” before the message is stored and records that it did so.

When a lender formally needs that information, you give it to the lender directly through its own secure system, or through our brokerage’s application system — never through this website. What our records keep is a reference that an application exists there, and its status. They do not keep its contents.

Later in a file, once you are a client, an agent may record financial detail — income, debts, a credit score a lender pulled, a property address — to place your mortgage. That lives in a separate, locked part of our database that this website has no access whatsoever to: not filtered access, no access. It is reachable only by a signed-in agent working on your file.

Permission is asked for separately, one tick per channel and per purpose. Replying to your enquiry is not permission to text you about your file, and neither of those is permission to email you rate updates. No box is ever pre-ticked, and none of them is required to submit the form. If you tick nothing, we have no basis to contact you and the confirmation message says so plainly rather than implying a callback that is not coming.

When you do tick a box, we write a permanent record of it containing:

• the date and time,
• the channel (email, text or phone) and the specific purpose,
• how it was given — in this case, a web form,
• the exact wording that was on the screen in front of you, word for word,
• your IP address and browser, and the page you were on.

The wording is stored literally, not as a pointer to a version, because a version can be edited afterwards and then the evidence means nothing. If you have a page open when we change that wording, the submission is refused and you are asked to refresh — so what we record is always what you actually read.

That record is never edited and never deleted. The database refuses updates and deletions on it outright, for every account including our own administrators. Withdrawing consent adds a new record saying so; it does not erase the old one. Our answer to “may we contact this person” is always worked out from the most recent record, never from a checkbox somebody could flip.

To withdraw: use the unsubscribe link in any email, reply STOP to any text, or tell us by phone or email. The unsubscribe link is inserted by the system that sends the message rather than by whoever wrote it, so it cannot be left out, and it stays valid for at least 60 days. A withdrawal does two things at once: it records the withdrawal, and it adds your address to a suppression list that is checked last, after every other test, before anything is sent. Suppression outranks any permission record, including a newer one — so re-consenting by accident somewhere else will not restart messages you stopped. The law allows 10 business days to action a withdrawal; ours are actioned at the moment you make them.

We use your information to answer your enquiry, to work out which lenders and products might suit you, to place and administer your mortgage if you ask us to, and — only where you specifically agreed — to send you rate updates.

We do not sell your information. We do not rent it. We do not hand it to anyone for their own marketing. Every outbound message we send passes a permission check first, in code that refuses rather than warns, so a campaign tool cannot route around it.

Lenders. Placing a mortgage means submitting your file to lenders, and where a mortgage is insured, to the insurer. That sharing is the service you hired us for. We will tell you which lender a file is going to.

Our brokerage. Navneet Vaid is a licensed mortgage agent, not a brokerage. The Mortgage Alliance Company of Canada Inc. holds the licence, supervises the file and is required by Ontario law to keep records of it. Your information is the brokerage’s record as much as ours.

Service providers. The companies that run the software this business operates on. They process your information on our instructions, for the job named beside them and nothing else.

We will also disclose information where the law requires it — a court order, a regulator exercising its authority, or a lawful demand we cannot refuse.

The providers listed above may store or process your information outside Canada, including in the United States. That has a consequence worth stating plainly rather than burying: while your information is in another country, it is subject to that country’s laws, and courts, law enforcement and government authorities there may be able to obtain access to it under those laws — without notice to you or to us.

We are telling you this because it is true of essentially every cloud-hosted business in Canada and is routinely left out. We are not telling you exactly which country, because the storage regions are a deployment setting that is not fixed in our configuration today, and we would rather say so than name a region we have not confirmed. [The specific processing regions for each provider are being confirmed and will be named here.]

Our retention periods come from what the brokerage is obliged to keep under Ontario’s mortgage brokering rules, not from a number we picked:

• Client files — 6 years after the end of the mortgage term.
• Consent records — 10 years. A record proving what you agreed to is only useful if it outlives any argument about it.
• Advertising and marketing records — 6 years, so “what was published on this date” is answerable.

[We have not yet set a retention period for an enquiry that never becomes a client file. Rather than invent one here, we are confirming it, and it will be published in this section.] These periods are also with our lawyer for confirmation before this policy is final.

This website sets no cookies of its own, and runs no analytics, advertising or tracking scripts. There is no Google Analytics, no Meta pixel, no session cookie, no visitor profile. The typefaces are served from this site rather than fetched from Google when you visit, so loading a page does not tell a third party that you were here. There is no consent banner because there is nothing to ask you to consent to.

When something goes wrong saving an enquiry, our code records which step failed — never the details you typed. That is deliberate: it is how personal information ends up in a log system nobody scoped to hold it. Our hosting provider keeps ordinary server logs, which include IP addresses, as any web server does. If we ever add analytics, this section changes first and the change will be obvious.

You can ask us to:

• tell you what personal information we hold about you and who we gave it to,
• give you a copy of it,
• correct anything that is wrong,
• withdraw a consent you gave us,
• stop contacting you entirely.

Email info@tdotlending.com or call (905) 462-8646 and say which one you want. There is no charge and you do not have to explain why. There is no login on this website, so a person handles your request rather than a form — we will confirm who you are first, because handing your file to someone claiming to be you would be the worse failure.

We aim to answer within 30 days. Where a legal retention obligation means we cannot delete something you asked us to delete, we will say so plainly, tell you why, and stop using it for anything other than the obligation that requires us to keep it.

Withdrawing consent is always available to you, but some of it has consequences we should be honest about: if you withdraw permission for us to contact you while we are placing your mortgage, we may be unable to continue acting for you on that file.

Raise it with our privacy officer first — [PRIVACY OFFICER NAME] at [PRIVACY OFFICER EMAIL], or through the phone number and email address above. Tell us what happened and what you want done. We will investigate and write back to you.

If our answer does not satisfy you, you can complain to the Office of the Privacy Commissioner of Canada, which oversees PIPEDA and can investigate independently of us. Its complaint process is at priv.gc.ca. You do not need our permission to go there, and nothing in this policy limits that right.

A complaint about how your mortgage file itself was handled can also go to the brokerage, and to the Financial Services Regulatory Authority of Ontario (FSRA).

Mortgage services provided through The Mortgage Alliance Company of Canada Inc., FSRA Brokerage Licence #10530.

Navneet Vaid is a mortgage agent. The licensed brokerage he deals through is The Mortgage Alliance Company of Canada Inc., which is part of M3 Mortgage Group. The brokerage supervises every file, and Ontario law makes it responsible for the records of that file — so your information is held by us as part of the brokerage’s business, not separately from it.

[If the brokerage requires its own privacy policy to govern the files it supervises, that policy governs and this page becomes a summary with a link to it. We are confirming this, and this section will say which policy applies.]

Office: 1200 Derry Road E, Unit 21, Mississauga, ON.

This policy is kept in the same version control as the website itself, so every change has a date, an author and a visible difference from what came before. When we change it we update the effective date at the top. If a change materially affects how we handle information you have already given us, we will tell the people affected rather than rely on you noticing a new date.

Effective date: [EFFECTIVE DATE]. This version is pending review by our lawyer and by the brokerage’s compliance officer.