Legal

Privacy Policy

How Medeiros IT Consulting collects, uses, shares, and protects personal information across our website, managed IT services, and software products.

Last updated September 29, 2026

1. Who we are and what this policy covers

Medeiros IT Consulting ("Medeiros IT", "we", "us", or "our") is an IT company based in Ottawa, Ontario, Canada. We provide managed IT support, remote support and device backup, project work, custom software, hardware, and software products such as Lawnlite and Strux.

This Privacy Policy explains how we collect, use, share, and protect personal information when you:

Visit medeirosit.com or any other website we operate that links to this policy
Contact us, request a quote, or book a call
Become a client of our managed IT services, projects, or hardware sales
Sign in to the myMedeirosIT portal or use our remote support and backup software
Use one of our software products, unless that product publishes its own privacy policy

If a product has its own privacy policy, that policy applies to that product, and this one applies to everything else. Your written agreement with us (such as a service agreement, order form, statement of work, or data processing agreement) may contain additional privacy commitments. Where it does, the agreement takes precedence for the services it covers.

2. The short version

We collect what we need to support your business, run our software, bill you, and stay in touch.
When we manage your computers, accounts, or software on your behalf, the information on them belongs to your organization. We handle it only to deliver the services you have asked for.
We do not sell personal information, and we do not use your organization's data to advertise to anyone.
We use trusted service providers for things like hosting, sign-in, payments, email, and storage, and they may only use your information to help us serve you.
You can ask to see, correct, or delete your personal information, and you can opt out of marketing email at any time.

3. Our role: when we decide, and when we act for you

Privacy laws distinguish between the organization that decides why and how personal information is used, and the organization that handles it on someone else's behalf.

We are responsible for the information we collect about our own website visitors, prospects, clients' contacts, portal users, and billing relationships. This policy describes how we handle that information.
We act on your behalf when we manage your devices, email platform, accounts, backups, and files, and when your organization stores information about its own customers, employees, or suppliers in our software. We call this "Client Data". Your organization decides what Client Data it collects and why, and is responsible for having the notices and consents it needs. We process Client Data only under your instructions and our agreement with you.

If you are an employee or customer of one of our clients and have a question about how your information is handled, please contact that organization first. We will help them respond.

4. Information we collect

4.1 Information you give us

Contact and enquiry details, such as your name, business name, role, email address, phone number, team size, and the details you include when you fill in a form, request a quote, or book a call.
Account information, such as your name, email address, organization, role, and sign-in preferences when you or your organization creates an account for you.
Billing information, such as billing contact, billing address, tax details, purchase history, and the payment method you choose. Card and bank details are collected and stored by our payment processor. We do not store full card numbers.
Support requests, including the messages, screenshots, files, and call details you share when you ask us for help.
Onsite and project information, such as office addresses, access instructions, floor plans, and the requirements you share when we scope and deliver work.

4.2 Information from managed IT services

When we provide managed IT services, the software we install on your computers and the tools we use to administer your systems collect information needed to support and secure them, including:

Device and inventory details, such as device name, manufacturer, model, serial number, operating system, installed software, hardware health, storage, network details, IP addresses, and the name of the signed-in user.
Monitoring and security data, such as patch status, antivirus and security alerts, system events, error logs, performance measurements, and online status.
Remote support records, such as when a remote session started and ended, which technician connected, which device they connected to, and actions taken. Remote sessions are started through our support tools and the access approvals described in your agreement.
Device backups, which contain copies of the files on your computers that are included in your backup plan. Backup data is encrypted before it leaves the device, and we access its contents only to restore files, investigate a problem you ask us to look at, or as described in your agreement.
Administrative access and documentation, such as account lists, licence assignments, network settings, and the credentials we need to administer your systems. This documentation is available only to our staff who support you, and credentials are stored encrypted.
Email and collaboration platforms, such as Microsoft 365 or Google Workspace, where we may see account names, group memberships, mailbox settings, sign-in and audit logs, and, when needed to resolve a problem you report, individual messages or files.

All of this is Client Data. We use it to deliver, secure, and improve the services for your organization, and not for any unrelated purpose.

4.3 Information in our software products

When your organization uses one of our software products, you or your team may store information such as customer names and contact details, service addresses, job notes, photos, messages, invoices, schedules, time records, and vehicle or device locations. Depending on the features your organization enables, this may also include voice requests and transcripts, location while a work device is in use, and information exchanged with connected accounting or communication services. This is Client Data.

4.4 Information collected automatically

Usage and log data, such as IP address, browser and device type, operating system, pages visited, features used, referring pages, dates and times, and errors.
Device information for our apps and kiosks, such as device identifiers, app version, and diagnostic data.
Cookies and similar technologies, described in section 8.

4.5 Information from other sources

Sign-in providers, when you sign in with a work account such as Microsoft or Google, which may share your name, email address, and organization.
Payment processors, which tell us whether a payment succeeded and share limited billing details.
Distributors and vendors, when we order licences, hardware, or warranty service for you.
Services you connect, such as accounting software, when you authorize the connection.
Your colleagues, when an administrator at your organization invites you or adds you as a user or contact.
Public and business sources, such as your business website or professional directories, when you ask us to get in touch.

5. How we use information

We use personal information to:

Respond to enquiries, prepare quotes, and schedule calls and visits
Provide, operate, maintain, and support our services and products
Create and manage accounts, verify identity, and control access
Monitor, patch, secure, back up, and restore the systems we manage for you
Detect, investigate, and respond to security incidents, fraud, and misuse
Process orders, subscriptions, invoices, and payments
Send service messages, such as confirmations, alerts, maintenance notices, security notices, and billing reminders
Send updates about our services where the law allows, with an easy way to opt out
Understand how our website and products are used so we can fix problems and improve them
Keep business records and meet our legal, tax, accounting, and regulatory obligations
Establish, exercise, or defend legal claims

We use Client Data only to provide the services to your organization, to keep those services secure, and as your organization instructs. We may create aggregated or de-identified information that does not identify you or your organization, for example to understand overall product usage, and use it to operate and improve our services.

In Canada, we rely on your consent to collect, use, and disclose personal information, which may be express or implied depending on the information and the circumstances. For example, when you send us an enquiry, you consent to us using your details to reply. You may withdraw consent at any time, subject to legal or contractual restrictions, but doing so may mean we can no longer provide some services.

Where European, UK, or similar laws apply, we rely on the following legal bases: performing a contract with you or your organization; our legitimate interests in running, securing, and improving our business, balanced against your rights; complying with legal obligations; and your consent, where we ask for it.

7. AI and automated features

Some of our products include features such as voice assistants, speech transcription, and suggestions. When you use them, the relevant input (for example, a voice request) is processed by us and by service providers that perform speech recognition or language processing on our behalf. We choose providers whose terms restrict them from using this data to train their own models, and we do not sell Client Data or use it to train publicly available AI models. We do not use automated processing to make decisions that have legal or similarly significant effects on you.

8. Cookies and similar technologies

We use cookies and similar technologies to:

Keep you signed in and remember your preferences
Protect forms and sign-in pages from abuse and automated attacks
Understand how our websites are used, so we can improve them

You can set your browser to block or delete cookies. Some features, such as signing in, will not work without essential cookies. Where the law requires it, we ask for your consent before using cookies that are not essential.

We do not sell or rent personal information. We share it only as follows:

Service providers that host and operate our services on our behalf, such as cloud hosting and storage, sign-in and identity, payment processing, email and text message delivery, telephony, mapping, speech and language processing, bot protection, and customer support tools. They may use the information only to provide their services to us and must protect it.
Vendors and distributors of the licences, hardware, and warranty services we purchase or manage for you, such as Microsoft or Google, limited to what they need to provision and support those products.
Services you connect or ask us to integrate with, such as accounting software.
Your organization. If you use our services through an organization, its administrators can see information about your account and activity within its services.
Professional advisors, such as lawyers, accountants, auditors, and insurers, under duties of confidentiality.
Legal and safety reasons, when we believe in good faith that disclosure is required by law, court order, or other legal process, or is necessary to protect the rights, property, or safety of our clients, our staff, the public, or us.
Business transfers, if we are involved in a merger, acquisition, financing, or sale of all or part of our business, in which case personal information may be transferred under confidentiality commitments and remain subject to this policy.
With your consent or at your direction.

10. Where information is stored

We are based in Canada, and some of our service providers store or process information in the United States or other countries. When information is stored outside your province or country, it is subject to the laws of that jurisdiction and may be accessible to its courts, law enforcement, and national security authorities. We use contractual and technical safeguards to protect information wherever it is processed. If your organization needs data kept in a particular region, talk to us before you sign up and we will tell you what we can offer.

11. How long we keep information

We keep personal information only as long as we need it for the purposes described here, or as required by law. As a guide:

Enquiries and leads are kept for up to two years after our last contact, unless you become a client.
Account and client relationship records are kept for the life of the relationship and a reasonable period afterwards.
Billing, tax, and accounting records are kept for the period required by Canadian tax law, generally seven years.
Monitoring data and logs are kept for limited periods needed to support and secure your systems.
Device backups follow the retention settings of your backup plan and are deleted after your service ends, as described in the Terms of Service.
Client Data in our software products is kept while your subscription is active and deleted after it ends, following an export period described in the Terms of Service.

When information is no longer needed, we delete it or de-identify it. Deleted information may remain in backup copies for a limited time before it is overwritten.

12. How we protect information

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including:

Encryption of information in transit and, for sensitive information such as backups and stored credentials, at rest
Multi-factor authentication and role-based access for our staff
Access limited to staff who need it to do their jobs, bound by confidentiality obligations
Logging and review of administrative and remote access
Separation of each client organization's data
Regular updates, security monitoring, and vendor review

No system is perfectly secure. We cannot guarantee that information will never be accessed, disclosed, altered, or destroyed by a breach of our safeguards, but we work hard to prevent it and to respond quickly if it happens.

13. Security incidents

If we become aware of a breach of security safeguards involving personal information under our control that creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada, and any other authorities as required by law. If an incident affects Client Data, we will notify your organization without undue delay and provide the information we reasonably can so that it can meet its own obligations. We keep a record of security incidents as required by law.

14. Your rights and choices

Depending on where you live, you may have the right to:

Ask whether we hold personal information about you, and request access to it
Ask us to correct information that is inaccurate or incomplete
Withdraw consent to our use of your information
Ask us to delete your information, subject to legal and contractual obligations
Receive a copy of information you provided in a structured, commonly used format
Object to or ask us to restrict certain uses of your information
Be informed about, and ask for a review of, decisions made using automated processing

Residents of Quebec have the rights set out in the Act respecting the protection of personal information in the private sector. Residents of the European Economic Area, the United Kingdom, and certain U.S. states have rights under their local laws. We will not treat you differently for exercising your privacy rights.

To make a request, contact us using the details in section 20. We will respond within 30 days, or tell you if we need more time and why. We may need to verify your identity before acting on a request. If your request concerns Client Data, we will refer it to the organization that controls that data and help them respond.

15. Marketing communications

We send marketing email only where Canada's Anti-Spam Legislation and other applicable laws allow it. Every marketing message includes a way to unsubscribe, and you can also ask us to stop at any time. Even if you unsubscribe, we will still send service messages about your account, your services, and your invoices.

15.1 Text messages

If you agree to receive text messages from Medeiros IT, we collect your mobile number and a record of your consent: when you agreed, how you agreed (the checkbox in myMedeirosIT or your answer on a support call), and the wording you agreed to. If you opt out, we record that too. We use this information only to send you support verification codes, support ticket updates and replies, appointment and onsite visit reminders, hardware installation dates, and invoices, and to show that you agreed to receive them. Message frequency varies, and message and data rates may apply. Reply HELP for help or STOP to opt out at any time.

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. Our text message provider receives your mobile number and messages only to deliver them for us.

16. Employees of our clients

When we manage the computers and accounts your employer provides, we may see information about how you use them, such as device activity, security alerts, and files that are backed up. We handle this on behalf of your employer, only to support and secure their systems. Your employer is responsible for telling you how it monitors its systems. Questions about workplace monitoring should go to your employer.

17. Children

Our services are designed for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, please contact us and we will delete it.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada. Residents of Quebec may contact the Commission d'accès à l'information du Québec, and residents of other jurisdictions may contact their local data protection authority.