Privacy Policy

1. Who we are

This website is operated by Harbour & Key Hospitality Management Group Inc. ("Harbour & Key", "we", "us"), a company based in Toronto, Ontario, Canada. Registered office: Harbourfront, Toronto, Ontario, Canada. We are the organization accountable for personal information collected through this site. Our privacy contact is Mahmoud Mussa, Privacy Officer, reachable at [email protected].

We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Canada's Anti-Spam Legislation (CASL).

2. What we collect

Information you give us

• Consultation and contact forms: name, email address, phone number (optional), Toronto neighbourhood, property type, whether the home is your principal residence, City of Toronto registration status, desired start timeline, your message, and your consent choices.
• If you become a client: property address, access details, emergency contact, City registration number, banking details for payouts, condominium documents, insurance information, and records of bookings, guests, expenses and payouts required to deliver our service and meet City record-keeping rules.
• Correspondence: emails, text messages, call notes and meeting notes.

Information collected automatically

• Technical data such as IP address, browser and device type, pages visited, referring page, approximate location derived from IP, and the date and time of visits.
• Form interaction data (for example, that a form was started or submitted) and, where you have consented to cookies, analytics and advertising measurement data described in section 6.

3. How we use it

• To respond to your consultation request or message and to schedule and conduct the consultation.
• To assess whether a home is eligible for short-term rental under City of Toronto rules.
• To deliver and administer our hosting and management services, including guest communications, scheduling, payments, statements and compliance records.
• To send marketing emails only if you have opted in (section 4).
• To operate, secure and improve the website and our services.
• To meet legal obligations, including municipal record-keeping, tax and accounting requirements, and to establish or defend legal claims.

4. Consent and marketing

Our forms ask for two separate consents:

• Follow-up consent (required): permission to contact you about the enquiry you submitted. Without it we can't reply, so we don't accept the form.
• Marketing consent (optional): express consent under CASL to send you commercial electronic messages such as hosting tips, bylaw updates and news. Every such email includes our contact details and an unsubscribe link; unsubscribes take effect within 10 business days as the law requires. We do not send marketing text messages unless you separately opt in to SMS.

We record the date, time, form and wording of each consent in our customer relationship management system. You can withdraw marketing consent at any time by using the unsubscribe link or emailing us. Withdrawing consent doesn't affect messages we must send to deliver a service you've engaged us for.

5. Systems and service providers

We use third-party platforms to run this website and manage enquiries. They process personal information on our behalf under contractual confidentiality and security obligations.

• HighLevel (GoHighLevel). This website, its forms and our customer relationship management system run on the HighLevel platform, provided by HighLevel Inc. (United States). Our HighLevel account is provisioned through Zerofunnel, a HighLevel agency partner that provisions and administers the platform for us. Form submissions are stored as contact records in HighLevel, and emails, SMS (where consented), call logs and notes associated with your enquiry are stored there too. HighLevel stores data on servers located in the United States, which means your information may be accessed by, and subject to the laws of, that jurisdiction. HighLevel's privacy policy is available at gohighlevel.com/privacy-policy. Zerofunnel staff may access the account for technical support only, under confidentiality obligations and with access logged.
• Email and calendar: Google Workspace.
• Booking platforms: Airbnb, Vrbo, Booking.com and similar, under their own privacy policies, for client listings we manage.
• Payments and accounting: Stripe for invoicing and QuickBooks Online for accounting.
• Operations: a smart-lock platform for guest access codes and a cleaning-scheduling tool shared with our cleaning partners.

We do not sell personal information, and we do not permit providers to use it for their own marketing.

6. Cookies and analytics

This site uses:

• Strictly necessary cookies set by the HighLevel platform to deliver pages, protect forms from abuse and remember a form you've started. These don't require consent.
• Analytics and advertising cookies Google Analytics 4 (anonymized traffic measurement), set only after you accept them in the cookie notice. HighLevel's tracking may also link form submissions to your contact record for attribution reporting.

You can change cookie preferences via the cookie notice shown on your first visit or your browser settings. Blocking cookies may affect how forms work.

7. When we share information

We share personal information only: with the service providers above, to the extent needed to deliver our services; with cleaning, photography and trades partners who need access details for a client home (client information only, under confidentiality terms); with the City of Toronto or other authorities when required by law — noting the registered operator, not Harbour & Key, is responsible for City filings; with professional advisers; or in connection with a sale or reorganization of our business, with notice to you.

8. Retention and security

Enquiry records are kept for 24 months after our last contact unless you become a client or ask us to delete them sooner. Client records, including booking and transaction records, are kept for at least three years after the relevant stay as the City's short-term rental bylaw requires, and for seven years where tax rules apply. We protect information with access controls, encrypted connections, platform security provided by HighLevel, and staff confidentiality obligations. No method of transmission or storage is completely secure; if a breach creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as required.

9. Your rights

You can ask to access the personal information we hold about you, correct it, withdraw consent, or have it deleted where we have no legal reason to keep it. Write to [email protected]; we respond within 30 days. You may also complain to the Office of the Privacy Commissioner of Canada.

10. Guests of homes we host

If you stay in a home we manage, your booking details come to us from the platform you booked through, and we use them to deliver the stay (access codes, communications, house manual) and to keep the records the City requires. Homes may have exterior security cameras or noise monitors where disclosed in the listing; we never place cameras inside living spaces.

11. Changes and contact

We'll post updates to this policy here and change the date at the top. Questions: Harbour & Key Hospitality Management Group Inc., Harbourfront, Toronto, ON, [email protected], (416) 555-0188.

Draft for review by a lawyer before publication. Bracketed items must be completed to reflect the actual HighLevel/Zerofunnel configuration, installed tracking tools and retention practice.