Built with PIPEDA Principles for Canadian Agents
How Realtor Desk supports PIPEDA obligations for Canadian real estate agents: data hosted in Canada, encryption and per-account access controls.
Realtor Desk is built to support PIPEDA work: encryption, consent date and source recorded on every contact, data export, and a production database that runs in Canada. Meeting PIPEDA still depends on how you collect consent and handle requests.
What is PIPEDA?
The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada's federal privacy law that governs how private-sector organizations collect, use, and disclose personal information. Real estate agents must comply with PIPEDA when handling client data.
10 Fair Information Principles
PIPEDA is based on 10 principles including accountability, consent, limiting collection, safeguards, and individual access.
Penalties for Non-Compliance
A privacy complaint can lead to an investigation by the Privacy Commissioner, and some offences carry fines.
What Realtor Desk does that helps with PIPEDA
Six things the product does or does not do. None of them makes you compliant; they support the work you and your brokerage remain responsible for.
1. Canadian Data Residency
The production database and file storage run in Canada, in the ca-central-1 region. Some features send content to outside providers, such as SMS, email delivery and AI-assisted drafting, which may process it outside Canada.
✅ What this means for you:
- • You can tell a client where their record is stored
- • PIPEDA does not require data to stay in Canada, but it does expect you to be open about transfers
- • Tell clients that some processing, such as SMS and email delivery, may happen outside Canada
2. Encryption in Transit and at Rest
Data is encrypted in transit and at rest by the hosting platform. This is not end-to-end encryption: the application can read the data in order to show it to you.
- • One part of the safeguards PIPEDA expects, not all of them
- • Each account can only read its own records
- • Your own passwords, devices and staff access still matter
3. Consent Management
Each contact carries a consent record: when consent was given and where it came from. You can also record that a contact has withdrawn it.
- • Consent date and source recorded on each contact
- • No inbox message or text to a contact with no consent on file
- • Imported contacts arrive with no consent; you record it yourself
4. Data Access & Portability
When a client asks what you hold about them, you can export your data from Settings as a JSON file and export contacts to CSV from the Leads page. That helps you answer the request; answering it is still your job.
- • PIPEDA expects a response to an access request within 30 days
- • Export client data for portability
- • Your data as a JSON file from Settings; contacts as a CSV from the Leads page
5. Data Retention & Deletion
You decide how long to keep a contact. There is no automatic retention schedule today; you can delete a contact and its records yourself, including when a client asks you to.
- • Delete a contact and its records from inside the app
- • Act on a deletion request yourself; handling it stays your responsibility
- • No automatic retention schedule yet, so set your own review routine
6. Security Practices
Realtor Desk holds no third-party security certification and has not been independently audited. Any certification will be listed here only once it exists.
- • Encryption at rest and in transit by default
- • Consent tracking and data-export flows built in
- • No certifications claimed today
What every email we send actually carries
Sender identification. Physical mailing address. A consent-basis line. A functional one-click unsubscribe. Here is the exact footer that ships with every system email — welcome, re-auth, trial, payment, winback — no exceptions.
Contact: support@realtordesk.ai · realtordesk.ai
This is a transactional message related to your RealtorDesk AI account.
Unsubscribe from these emails
The unsubscribe link is HMAC-signed and opts the recipient out immediately. No "reply with the word unsubscribe" — the button writes the suppression to the database and every future send checks that list before hitting Resend.
PIPEDA Compliance Checklist for Real Estate Agents
Use this checklist to review your own practice. It applies whichever CRM you use:
Your brokerage has designated a privacy officer and documented your privacy policy.
You clearly explain why you're collecting client information (e.g., "to send you property alerts").
You obtain explicit consent before collecting personal information (checkboxes on web forms, signed agreements).
You only collect information necessary for your stated purposes (no collecting unnecessary data).
You only use client data for its intended purpose and delete it when no longer needed.
You keep client information up-to-date and accurate (regular data cleansing).
You use tools that encrypt client data and tell you where it is stored.
Your privacy policy is publicly accessible on your website.
You respond to client data access requests within 30 days.
You have a process for clients to challenge your compliance (complaints procedure).
Need help? RealtorDesk keeps your client data in Canada and honours unsubscribe requests immediately; the remaining obligations here are yours to operate. Book a demo to see how.
PIPEDA Compliance FAQs
Is Realtor Desk PIPEDA compliant?
No software makes you PIPEDA compliant, and we will not tell you otherwise. Realtor Desk is built to support the work: the production database runs in Canada (ca-central-1), data is encrypted in transit and at rest, and the date and source of consent are recorded on every contact. Your own obligations, such as obtaining meaningful consent, answering access requests and reporting breaches, stay with you and your brokerage.
Where is my data stored?
The production database and file storage run in Canada, in the ca-central-1 region. Features that call outside services, such as SMS delivery, email delivery and AI-assisted drafting, send the relevant content to those providers, which may process it outside Canada. So the database location answers where your records are stored, not where every processing step happens.
Can I export client data for PIPEDA compliance?
Yes. You can export your data from Settings and export contacts to CSV, which helps when you answer an access request. PIPEDA expects a response within 30 days, and handling the request itself remains your responsibility.
How does Realtor Desk handle data deletion requests?
You can delete a contact and its records from inside the app. There is no exportable audit log of deletions today, so keep your own record of when you received and completed each request.
Do I need a separate privacy policy if I use Realtor Desk?
Yes. Your brokerage still needs its own privacy policy describing how you collect and use client information. Realtor Desk's privacy policy covers how we handle data on our side; it does not replace yours.
What if I'm also subject to provincial privacy laws (PIPA)?
It depends on where and how you operate. Alberta, British Columbia and Quebec have their own private-sector privacy laws that the federal privacy commissioner treats as substantially similar to PIPEDA, and those provincial laws generally govern collection within the province. Ask your brokerage's privacy officer or a lawyer which applies to you. Realtor Desk records consent date and source per contact and lets you export or delete a contact. Those are inputs to meeting your obligations, not a guarantee that you meet them.
Protect Your Clients. Protect Your Business.
Realtor Desk keeps a consent record on each contact and its database in Canada. See it on your own contacts during the 14-day trial.
Questions about compliance? Email privacy@realtordesk.ai