Legal Information
Privacy Policy
Effective October 19, 2026
Diplomat Property Management is operated by 13145743 Canada Inc. ("Diplomat", "we", "us"). We manage and rent residential properties in Ottawa, Ontario, and the Outaouais region of Quebec. This policy explains how we handle personal information collected through our website, diplomatpm.com, through rental applications, and through the Diplomat app for tenants and property owners.
Who is responsible
We handle personal information in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). For people and properties in Quebec, we also follow Quebec's Act respecting the protection of personal information in the private sector.
Our Privacy Officer is responsible for how we handle personal information. The Privacy Officer is also our person in charge of the protection of personal information under Quebec law.
- Title: President, Diplomat Property Management
- Email: info@diplomatpm.com
- Phone: 613-797-4452
Information we collect
We collect only what we need to answer your questions, assess rental applications and manage the properties we look after.
| Information | What it includes | Where it comes from |
|---|---|---|
| Website enquiries | Your name, email address, phone number if you give it, what you are interested in or the property you are asking about, and your message | You, through the contact form or a property page, or by email or phone |
| Rental applications | Name, email, phone, date of birth, current address and how long you have lived there, reason for leaving, current landlord's name and contact details, employer, job title, gross monthly income, length of employment, names and ages of other occupants, pets, the property you are applying for, and your authorization for the checks below, with the date and time you gave it. We do not ask for your Social Insurance Number. | You, through the application form |
| Application checks | Your credit report, and confirmation of your employment and rental history | Credit reporting agencies, and the employers and landlords you list, with your authorization |
| App account details | Full name, email address, phone number (optional), and password (stored only in scrambled, unreadable form) | You, when you create an account with the invitation code we give you |
| Lease and property details | Building address, unit number, lease start and end dates, and whether you are a tenant or an owner | Diplomat, from your lease or management agreement |
| Maintenance requests | Title, description, where in the unit, urgency, permission to enter, access notes (for example, pets or how to get in), and preferred contractor | You, when you submit a request; Diplomat staff, when they record a request you phoned in |
| Photos | Photos of the problem, up to 6 per request | You |
| Messages and ratings | Messages on a request, and your rating and comment when the work is done | You, other people on the request, and Diplomat staff |
| Work records | Approvals, estimates, the contractor assigned, visit times, notices of entry, invoices, and a history of each step | Diplomat staff, owners and the app |
| Contractor contact records | That you called or emailed a contractor from the app, and when (not what was said) | The app |
| Notification details | Notifications sent to you, whether you read them, your email setting, and an identifier for your phone used to send push notifications | The app and your phone |
| Technical information | IP address, browser or device type, pages requested and app version, in server logs. When you send a website form, we also keep a scrambled code made from your IP address for 1 day, to block repeated or automated submissions. The code cannot be turned back into your IP address. | Your browser or device, automatically |
| Visit statistics | The page you visit, the page that sent you there, your browser and operating system, your country, and how quickly the page loads | Your browser, on our website and the web version of the app, through Cloudflare Web Analytics |
Our website and the web version of the app use Cloudflare Web Analytics to count visits and see which pages are used. It does not use cookies or store anything on your device, and it does not identify or follow individual visitors. We do not use advertising or tracking cookies. The phone app does not collect your location, contacts or advertising identifiers, and it does not use analytics or advertising tools.
How we use it
- Enquiries: to answer your questions and follow up on your request.
- Rental applications: to confirm your identity and assess your application, including your credit, rental and employment history, as you authorize in the application.
- Leases and accounts: to prepare leases, create your app account, and confirm that you rent or own a unit we manage.
- Maintenance: to receive, approve, schedule and complete maintenance requests, including asking the owner to approve costs above their limit.
- Notice of entry: to give tenants notice before anyone enters a unit, as Ontario's Residential Tenancies Act, 2006 or Quebec's Civil Code requires.
- Updates: to send you updates in the app, by push notification and by email.
- Records: to keep records of applications, work, costs and notices for accounting, legal and dispute purposes.
- Website statistics: to see how many people visit our website and which pages they use, so we can improve it.
- Security: to keep the website and app secure, block unwanted automated submissions, and fix problems.
We assess applications fairly and in line with human rights law. We do not sell personal information, and we do not use it for advertising or marketing. We use it for a new purpose only with your consent or where the law allows.
Who we share it with
Each person sees only what they need for their part of the work.
| Who | What they can see | Why |
|---|---|---|
| Diplomat staff | Information needed for their work | To answer enquiries, assess applications and manage properties |
| The owner of the property | Applications for their property; requests for their property, including the requester's name, description, photos, messages, estimates, visit times and invoices | To choose tenants, and to approve and pay for work. Some owners live outside Canada. |
| Other tenants of your unit | Requests for the unit made during their lease, and notices of entry for the unit | They live in the unit and must receive notice before entry |
| Credit reporting agencies, and the landlords and employers you list | What is needed to verify your application | To check your credit, rental and employment history, with your authorization |
| Contractors | The address, the problem, photos, access instructions, and your contact details when needed | To do the work. Contractors do not use the app; Diplomat or you give them this information. |
| Service providers | Only what they need to provide their service (see the next section) | To host the website and app, and to send messages |
| Tribunals and authorities | What the law requires, or what a tenancy matter needs | For example, a hearing at the Landlord and Tenant Board or the Tribunal administratif du logement, or a court order |
When you call or email a contractor from the app, that conversation is between you and the contractor.
Where it is stored
The app's database, photos and sign-in records, and the forms sent through our website, are stored in Canada, in Montréal. Our company email is hosted by Google, which may store it outside Canada, including in the United States. Emails sent by our website and app, and push notifications, are processed in the United States. Information processed or stored outside Canada may be accessed by courts and authorities there under local law.
Information about people and properties in Quebec may be communicated outside Quebec: to our office in Ontario, to owners who live elsewhere, and to the service providers below.
| Service provider | What it does | What it receives | Where |
|---|---|---|---|
| Cloudflare | Registers our domain names, hosts our website and the web version of the app (app.diplomatpm.com), protects them from attacks, and counts visits (Cloudflare Web Analytics) | Pages you request and forms you send as they pass through, your IP address and browser details in its logs, and the visit statistics described above | The Cloudflare data centre nearest you, and the United States |
| Supabase | Hosts the app's database, photos, invoices and sign-in; stores website forms; and runs the services that receive website forms and send notifications | All information in the app, and website forms | Database and files in Canada (Montréal); the services that receive forms and send notifications may run outside Canada |
| Google (Google Workspace) | Hosts our company email | Emails you send us and our replies, and the email we receive for each website form. For a rental application, that email contains only your name, contact details and the property; the rest of the application stays in our database. | United States and other countries |
| Zoho | Hosts email sent to our former addresses ending in @diplomatpropertymanagement.com, until we finish moving it to Google | Emails you send to those addresses, and our replies | Canada |
| Google Fonts, Tailwind CSS and image services such as Unsplash | Supply fonts, page styling and images when a website page loads, and fonts for some characters, such as emoji, in the web version of the app | Your IP address and browser details | United States and other countries |
| Google (Firebase Cloud Messaging) | Delivers push notifications to Android phones and iPhones | Your phone's push identifier, and the notification's title and short text | United States |
| Apple (Apple Push Notification service) | Delivers push notifications to iPhones | Your iPhone's push identifier, and the notification's title and short text | United States |
| Resend | Sends app emails, including notices of entry, invitation codes and password resets, and the email we receive for each website form | Your name, email address and the email's content | United States |
Push notifications show a short summary, such as the request title; the full details stay in the app. Apple and Google have their own privacy policies for downloading the app from their stores.
How long we keep it
We keep information only as long as we need it, then delete it or remove what identifies you.
| Information | How long we keep it |
|---|---|
| Website enquiries | 2 years after we receive them, unless they become part of a lease or management file |
| Emails we exchange with you | 2 years after our last exchange, unless they become part of a lease or management file |
| Rental applications that do not lead to a lease | 6 months after we receive them |
| Rental applications that lead to a lease | For the length of the tenancy and 7 years after it ends |
| App account details | While your account is open. When you delete your account, we delete these details immediately. When your lease ends, your access to the unit ends, and we delete your account 2 years later unless you sign a new lease. |
| Maintenance records: requests, photos, messages, notices of entry, approvals and invoices | 7 years after the request is closed, for legal, tax and dispute purposes. After you delete your account, we keep only what these records require, with your name and contact details removed where possible. |
| Notifications, email or push delivery records, and used or expired invitation codes | 12 months |
| Scrambled codes made from IP addresses, used to block automated submissions | 1 day |
| Visit statistics | Kept by Cloudflare as counts and totals that do not identify you |
| Server logs | A short period set by each hosting provider, usually a few days |
How we protect it
- Encryption: information is encrypted while it travels between your browser or phone and our servers. App information and website forms are also encrypted while they are stored.
- Limited access: only staff who need information for their work can see it, and each app user can reach only their own unit's or property's information. The database checks this on every request.
- Private photos and invoices: app files are not public. The app shows them through links that expire shortly after they are opened.
- Staff sign-in: Diplomat staff must use two-step sign-in with an authenticator app, including to read website forms and rental applications.
- Passwords: stored only in scrambled form that cannot be turned back into the password.
- Change history: changes to app accounts, leases, requests, approvals, notices and invoices are recorded, with who made them and when.
No system is completely secure. If a privacy breach creates a real risk of significant harm to you, we will tell you. We will also report it to the Office of the Privacy Commissioner of Canada and, for information about people in Quebec, to the Commission d'accès à l'information du Québec.
Your choices and rights
- See your information: ask our Privacy Officer for a copy of the personal information we hold about you.
- Get a portable copy: ask for the information you gave us electronically in a commonly used electronic format.
- Correct your information: ask us to fix anything that is wrong or out of date.
- Withdraw consent: you can withdraw consent at any time, subject to legal or contract limits. Without it, we may not be able to process your application or handle your requests through the app, and we will give required notices another way.
- Delete your app account: in the app, open the menu at the top right, choose Account, then Delete account, or contact our Privacy Officer. We keep only the maintenance records the law or your lease requires.
- Email updates: turn them off in the app under Notifications, with the "Email me updates" switch. Tenants still receive notices of entry by email, because the law requires notice before anyone enters a unit.
- Push notifications: turn them off in your phone's settings.
We respond to requests within 30 days. We may ask you to confirm your identity first.
Children
Our website and app are for adults. A rental application may list other occupants, including children, by name and age. We use this only to assess the application and the unit's occupancy.
Links to other websites
Our website links to other sites, such as Instagram, realtor.ca and our charity calendar page. Those sites have their own privacy policies.
Changes to this policy
When we change this policy, we post the new version with a new effective date. Before an important change takes effect, we tell app users in the app or by email.
Questions and complaints
Contact our Privacy Officer at info@diplomatpm.com or 613-797-4452 with any question or concern.
If we do not resolve your concern, you can contact the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376. If you live in Quebec, or your concern is about a property in Quebec, you can also contact the Commission d'accès à l'information du Québec at cai.gouv.qc.ca.
Contacting Us
If you have any questions about this Privacy Policy, the practices of this site, or your dealings with us, please contact us.
Get in Touch