Privacy Policy
How Guava Systems collects, uses and protects the information of the businesses we sell to and support.
The short version
- We don't sell your data.No data brokers, no advertisers. It stays in the systems we use to run the business.
- Hosted in Canada.Our Microsoft and Zoho environments are in Canada. Card payments run through Stripe in the US.
- Kept for 7 years.Or for as long as your account is active, whichever is longer.
- Ask us anything.Access, correction and deletion requests go to privacy@guava.pro.
On this page
Who we are and what this covers
Guava Systems Ltd. ("Guava Systems", "we") sells Microsoft cloud licences, software and managed IT services through guava.pro and guavasystems.ca. This policy explains what personal information we collect, why, who we share it with, and the choices you have.
It applies to our website, online store, customer portal, quotes, orders, support and managed services. It does not cover third-party sites we link to, or Microsoft's own services once your licences are active; Microsoft's privacy statement governs those.
We handle personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25), and other applicable provincial laws.
Information we collect
We collect only what we need to sell, provision and support what you buy.
| Category | Examples | Source |
|---|---|---|
| Contact and account | Name, business email, phone, company name, job title, billing and shipping address, portal login | You |
| Order and quote | Products, quantities, licence terms, quotes, invoices, order history | You, our systems |
| Tenant and provisioning | Microsoft tenant ID, domain, global admin contact, licence assignments needed to activate your subscriptions | You, Microsoft |
| Payment | Payment confirmation, last four digits, transaction ID. Full card numbers are handled by our payment processor, not stored by us | Stripe |
| Support and managed services | Tickets, emails, call notes, and any system data you give us access to while we work on your environment | You |
| Technical | IP address, browser and device type, pages viewed, referring site, cookie identifiers | Your browser |
| Marketing preferences | Newsletter sign-ups and opt-outs | You |
We do not knowingly collect sensitive information (health, biometric, government ID numbers) and ask you not to send it to us.
How we use it
- Process quotes, orders, payments, renewals and refunds
- Provision and manage your Microsoft licences and subscriptions
- Deliver support and managed IT services you contract us for
- Run your customer portal account and send service notices (renewals, expiries, outages, policy changes)
- Prevent fraud and secure our systems
- Meet tax, accounting and legal obligations
- Improve our website and catalogue using aggregated usage data
- Send marketing, only where you've consented, and stop when you opt out
We do not sell personal information. We do not use it for automated decisions that have legal or similarly significant effects on you.
Consent
By placing an order or creating an account, you consent to the uses above that are needed to deliver what you bought. Marketing emails require separate, express opt-in under Canada's Anti-Spam Legislation (CASL); every message has an unsubscribe link.
You can withdraw consent at any time, subject to legal or contractual limits. If you withdraw consent we need to provision or bill a service, we may not be able to continue providing it, and we'll tell you before that happens.
Where your information is stored
Guava Systems is based in Canada, and our Microsoft and Zoho environments are hosted in Canada. Stripe processes payments in the United States, and some provider support and security services may process limited data outside Canada. Information held abroad is subject to that country's laws and may be accessible to its authorities.
Before transferring information outside Quebec, we assess whether it will be adequately protected, as Law 25 requires. Our contracts require equivalent protection wherever data is held.
How long we keep it
| Information | Kept for |
|---|---|
| Invoices, payments and tax records | 7 years (Canada Revenue Agency requires at least 6) |
| Account and order history | 7 years, or as long as your account is active, whichever is longer |
| Support tickets and service notes | 7 years, or as long as your account is active, whichever is longer |
| Access to your systems for managed services | Removed when the service ends |
| Marketing list | Until you unsubscribe |
| Analytics data | 14 months |
When we no longer need information, we securely delete or anonymize it.
Security and breaches
We protect personal information with multi-factor authentication, role-based access, encryption in transit and at rest where our providers support it, and least-privilege access for staff. Access to customer environments uses Microsoft's granular delegated admin privileges (GDAP), time-limited where possible.
No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada (and Quebec's Commission d'accès à l'information where applicable) as soon as feasible, and keep a record of every breach as the law requires.
Your rights
You can ask us to:
- Confirm what personal information we hold about you and get a copy
- Correct information that is inaccurate or incomplete
- Delete information we no longer need, or stop using it for marketing
- Receive your information in a structured, commonly used format (Quebec residents)
- Withdraw consent
- Explain how we use your information
Send requests to our Privacy Officer at privacy@guava.pro. We respond within 30 days and may need to verify your identity first. If we can't fulfil a request, for example because the law requires us to keep records, we'll explain why.
If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.
Data in your systems
When we provide managed services, we may access data stored in your Microsoft 365, Azure or other environments, including your employees' and customers' information. For that data, your organization decides how it is used and we act as your service provider: we access it only to perform the services you request, under your instructions and our service agreement.
Your organization is responsible for its own privacy notices to its users. Privacy requests about that data should go to your organization first; we will help you respond. If our service agreement with you conflicts with this policy, the agreement governs.
Children
Our services are for businesses and adults. We do not knowingly collect information from anyone under 18.
Changes to this policy
We will post updates here with a new effective date. For material changes, we'll notify account holders by email before they take effect.
Contact our Privacy Officer
Questions, requests or complaints about how Guava Systems Ltd. handles your information.
Email privacy@guava.pro