Legal

Privacy Policy

Last updated: 21 August 2026

The short version: I collect the minimum I need to reply to you and do the work you hire me for. I don't sell anything to anyone. Client data stays in the client's own systems wherever possible. You can ask me to delete your information at any time and I will.

1. Who this applies to

HF Virtual is a sole proprietorship operated by Honey Fortin, based in Calgary, Alberta, Canada. This policy covers personal information handled through hfvirtual.com and in the course of providing services to clients.

As a Canadian business, HF Virtual handles personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA).

2. What I collect

From website visitors

Contact form submissions — your name, email address, company name if you provide it, and the content of your message.
Booking requests — handled by NeetoCal, my scheduling provider. Information you enter there is subject to their privacy practices as well as this policy.
Basic technical data — my host, Netlify, records standard server logs such as IP address and browser type. I do not use advertising or tracking cookies.

From clients

To deliver executive assistance I am typically granted access to systems containing personal information — email accounts, calendars, CRMs, contact databases, and travel documents. This may include information about people other than the client, such as their staff, customers, or contacts.

I access this information only as needed to perform the agreed work.
I act on the client's instruction and on their behalf in respect of that information.
I do not copy client data into my own systems except where it is necessary to do the work.
I do not use client data for any purpose other than delivering the service.

3. Why I collect it

To respond to enquiries and arrange calls
To prepare proposals and agreements
To deliver the services a client has engaged me for
To issue invoices and keep records required by Canadian tax law

I do not send marketing emails unless you have specifically asked to receive them, and every such message includes a way to stop.

4. What I never do

Sell, rent, or trade personal information to anyone
Share client information with other clients
Use client data to build lists, train tools, or generate leads
Keep credentials in plain text — see below

5. How information is protected

No plaintext passwords. Credentials are handled through an encrypted password manager owned by the client, or through delegated access that does not require sharing a password at all.
Delegated access is preferred wherever a platform supports it, so my access can be revoked without the client changing anything.
Access is inventoried. Each client receives a written record of every system I can reach and how to revoke it.
Devices are secured with full-disk encryption, screen locks, and current software.
Two-factor authentication is enabled on my own accounts, including email and password management.
A signed non-disclosure agreement is in place before client work begins.

No method of transmission or storage is perfectly secure, and I do not claim otherwise. What I can commit to is minimising what is held, controlling who can reach it, and making my access easy to remove.

6. Service providers

HF Virtual uses third-party tools to operate. Each has its own privacy practices:

Netlify — website hosting and contact form processing
NeetoCal — appointment scheduling
Google Workspace — email, documents, and file storage
Password management — 1Password, Bitwarden, or LastPass, depending on client preference

Some of these providers store data outside Canada, including in the United States. Information held there may be subject to the laws of those jurisdictions.

7. How long information is kept

Enquiries that don't become clients — deleted within 12 months.
Client working files — retained for the engagement and archived afterwards, unless the client asks for deletion.
Contracts and invoices — retained for the period required by Canadian tax and business record rules.
Access to client systems — revoked at the end of an engagement, with written confirmation once removed.

8. Your rights

Under PIPEDA you may:

Ask what personal information I hold about you
Ask for it to be corrected
Ask for it to be deleted, subject to legal record-keeping requirements
Withdraw consent to further contact
Make a complaint about how your information has been handled

Email honey@hfvirtual.com and I will respond within 30 days. There is no charge for a reasonable request.

If you are not satisfied with my response, you may contact the Office of the Privacy Commissioner of Canada.

9. Clients outside Canada

If you are located in a jurisdiction with its own privacy legislation — such as the European Union or certain US states — I will work with you to meet any additional obligations that apply to your data. Raise it during onboarding and it will be addressed in the engagement terms.

10. Changes to this policy

If this policy changes materially, the updated version will be posted here with a new date. Active clients will be told directly.

11. Contact

Honey Fortin
HF Virtual
Calgary, Alberta, Canada
honey@hfvirtual.com