Skip to content
Contract Flow Solutions Start here

Legal

Privacy notice

Last updated August 13, 2026.

Contract Flow Solutions Ltd. (“CFS”) is committed to protecting your privacy. This notice describes how we collect and use your personal data. It also describes the rights you have and control you can exercise in relation to it.

Who we are

CFS is a legal solution for B2B companies. ("we"/"us"/"our" all mean CFS. Personal data may be collected by CFS.

Which law applies

CFS is based in British Columbia, Canada. This notice is written to meet the Personal Information Protection Act (British Columbia) and the Personal Information Protection and Electronic Documents Act (Canada). Where we hold personal data about people outside Canada we apply the standards set out here to it as well, and you may have additional rights under your own local law.

Our handling of your personal data rests on your consent, except where legislation permits or requires us to act without it — for example the client due diligence and anti-money laundering checks described below, or complying with a court order. You can withdraw your consent at any time: see “Your rights”.

Data collection and usage

We will collect the following personal data:

  • Contact information: your name, position, role, company or organisation, telephone (including mobile phone number where provided) as well as email and postal address;
  • Business information: data identifying you in relation to matters on which you instruct us or in which you are involved;
  • Information from public sources: e.g. Linked in and similar professional networks, directories or internet publications;
  • Subscriptions/preferences: when you subscribe to any of our media;
  • Social media: posts, Likes, tweets and other interactions with our social media presence;
  • Technical information: when you access this website and our technology services being IP address, browser type and version, time zone setting, browser plugin types and versions, operating system you are using (e.g. Vista, Windows XP, MacOS, etc), device type, hardware model, MAC address, unique identifiers and mobile network information;
  • Online data: when you access this website and our technology services, information about your visit including URL clickstream to, through and from our website (including date and time), information about your network as such as information about devices, nodes, configurations, connection speeds and network application performance; pages viewed or searched for, page response times, download errors, length of visits and interaction information (such as scrolling, clicks, mouse-overs) and whether you click on particular links or open our emails.

CFS does not collect personal data about your online activities across third party websites or online services.

  • Criminal record data: where permitted by national law and appropriate to do so, such as existence of prior criminal offences (or conation of clean criminal record)

The above data will be provided to us by you, your employer, the company or organisation who is our client or screening providers who assist us with our legal obligations to conduct under anti-money laundering, sanctions screening and regulatory checks.

Your communications with us

CFS may also collect information that you choose to provide in communications with us. Please do not send us confidential information until we have coned in writing that we represent or act for you or your company or organisation. Unsolicited emails from non-clients do not establish a lawyer-client relationship. They may not be privileged and, therefore, may be disclosed to others.

Information you send us through this website

The enquiry form on this website asks for your name, email address, company, company website, your role, what you need, who the counterparty is, background on the situation and your timing. Only your name, email address, role, what you need and the background are required. The rest can be left blank.

We ask who the counterparty is because we have to run a conflict check before we can act, and we cannot run one without knowing who is on the other side. That makes what you send through this form prospective-client information, and we treat it as confidential from the moment it reaches us, whether or not we go on to act for you.

What you send is transmitted to our own server, recorded in a private spreadsheet held in our Google Workspace account, and notified to us by email so that an enquiry is not missed. We use it to reply to you, to run the conflict check and to price the work. It is not sold, it is not used for advertising, and it is not shared outside CFS except as described in “With whom do we share your data?” below.

How long we keep it is covered under “How long do we keep your data?” below. If you decide not to proceed, or we decline the work, you can ask us to delete what you sent — see “Your rights”.

How we use your personal data

We use your personal data for the following purposes:

  • Service provision: providing services, and legal advice;
  • Business relationship: managing and administering our relationship with you, your company or organisation including keeping records about business contacts, services and payments so we can customise our offering for you, develop our relationship and target our marketing and promotional campaigns;
  • Communication: sending emails, newsletters and other messages to keep you informed of legal developments, market insights and of our services;
  • Events: running legal briefings, roundtables and other events;
  • Client surveys and feedback: including events feedback and client listening exercises as well as answering issues and concerns which may arise;
  • Client legal compliance: client due diligence (under anti-money laundering, sanctions screening and other crime prevention and detection laws and regulatory requirements) which may involve automated screening checks to ensure that clients and contacts are genuine and to prevent fraud or crime and we may not be able take instructions if you do not provide the information we need to do these checks;
  • Website monitoring: to check the website and our other technology services are being used appropriately and to optimise their functionality;
  • Site security: to provide security to our offices and other premises (normally collecting your name and contact details on entry to our buildings);
  • Online security: protecting our information assets and technology platforms from unauthorised access or usage and to monitor for malware and other security threats;
  • Regulatory: compliance with our legal and regulatory obligations as a law including auditing and reporting requirements;
  • Managing suppliers: who deliver services to us;
  • Business interests: to pursue the business interests listed in the “Our business interests” section below.

Our reasons for using your personal data

We will process your personal data for a number of reasons:

  • The processing is necessary for a contract you have with us or because you have asked us to take specific steps before entering into a contract with us.
  • you have given us consent: for example where you share details for particular purposes;
  • this is necessary to comply with legal or regulatory obligations: for example anti-money laundering and mandatory client screening checks or disclosure to law enforcement.
  • this is necessary to deal with legal claims
  • this is necessary for our business interests or those of a third party : provided this does not override any interests or rights that you have as an individual. Those interests are listed in the next section.

Our business interests

We have business interests in:

  • providing legal services;
  • managing our business and relationship with you or your company or organisation;
  • understanding and responding to inquiries and client feedback;
  • understanding how our clients use our services and websites;
  • identifying what our clients want and developing our relationship with you, your company or organisation;
  • improving our services and offerings;
  • receiving information from other CFS legal practices for shared clients;
  • enforcing our terms of engagement and website and other terms and conditions;
  • ensuring our systems and premises are secure;
  • managing our supply chain;
  • developing relationships with business partners;
  • ensuring debts are paid;
  • operating suppressors to exclude you from direct marketing if you unsubscribe;
  • sharing data in connection with acquisitions and transfers of our business.

Our reasons for using sensitive personal information

Sensitive personal information means data such as your racial or ethnic origin, religious beliefs or health data. We may also collect data about criminal convictions. We will handle this data where:

  • we have your explicit consent: for the particular processing;
  • this is necessary to protect your vital interests or those of another person: for example, in medical emergencies; you have manifestly made the data public: for example, where you have published it on social media;
  • this is necessary to deal with legal claims: for example, involving court proceedings;
  • this is necessary for substantial public interest: for example to prevent or detect unlawful acts;
  • as otherwise permitted or required by applicable law.

With whom do we share your data?

We share your information as with others as follows:

  • CFS Personnel. including their management, lawyers, staff and contractors in order to provide legal services;
  • Suppliers: who support our business including IT and communication suppliers, outsourced business support, marketing and advertising agencies, back up and DR suppliers and LPO operations. Our suppliers have to meet minimum standards as to information security and they will only be provided data in line with their function;
  • Shared service centres: operated by CFS or third parties including for client on-boarding, IT services, marketing, risk management and office support services;
  • Law enforcement bodies and our regulators: or other competent authorities in accordance with legal requirements or good practice;
  • Appropriate parties in the event of emergencies: in particular to protect health and safety of our clients, staff and organisations;
  • Your company or organisation: in relation to us providing legal services;
  • Screening service providers: so that we can comply with legal obligations in relation to the prevention or protection of crime, ant-money laundering, sanctions screening and other required checks;
  • Third parties: in the context of the acquisition or transfer of any part of our business or in connection with the business reorganisation;
  • Other delegates: where your name will appear on the attendee list for events where you have told us you plan to attend.

Personal data about others

In some cases, you may provide personal data to us about other people (such as your customers, directors, officers, shareholders or beneficial owners). You must ensure that you have given those individuals an appropriate notice that you are providing their information to us and have obtained their consent to that disclosure.

How long do we keep your data?

We generally keep your information as needed to provide our legal services and to deal with claims. This will depend on a number of factors such as whether you or your company or organisation are an existing client or have interacted with recent client mailings or bulletins or attended recent events. We will retain your information as necessary to comply with legal, accounting or regulatory requirements. Typical retention periods will range from 3 to 15 years.

Your rights

Whatever your position under the law that applies to you, these are things you can ask us for, and what we will do:

  • Ask what we hold: we will tell you what personal data we hold about you and what we are using it for.
  • Ask us to correct it: if something we hold about you is wrong or out of date, tell us and we will put it right.
  • Ask us to delete it: we will, unless we are required to keep it to meet a legal, regulatory or professional obligation. If that is the case we will tell you which obligation and how long it lasts, rather than simply refusing.
  • Ask us to stop sending you marketing: see “Direct marketing” below. This one takes effect whatever else we hold and whatever else we are doing.
  • Withdraw your consent: where we are relying on your consent, you can withdraw it at any time. That does not make anything we did beforehand unlawful.
  • Complain: to us first. If our answer does not satisfy you, you can take it to the Office of the Information and Privacy Commissioner for British Columbia, or to the Office of the Privacy Commissioner of Canada.

Write to hello@contractflowsolutions.com and we will respond within 30 days at no charge to you. We may need to confirm who you are before we act on a request, so that we do not disclose your information to somebody else.

Direct marketing

As described above, you can opt-out of receiving direct marketing from us at any time.

We may use the information you give us on our website or other means for direct marketing purposes to provide emails, newsletters and other messages to keep you informed of legal developments, market insights and of our services including events that we think may interest you.

You can opt-out of receiving direct marketing from us at any time. You can do this by clicking on the "unsubscribe" link included at the end of any marketing email we send to you, or by writing to us at hello@contractflowsolutions.com .

Cookies

This website sets no cookies of its own. It is a static site that runs no analytics, no advertising or tracking pixels and no scripts in your browser, so there is nothing for a cookie banner to ask you about and none is shown. We do not track you between visits and we do not build a profile of you from your use of this site.

One page is an exception. Our booking page embeds a third-party scheduling tool (Cal.com) in a frame, so that you can choose a time without leaving this site. That tool is operated by its provider rather than by us, and it may set its own cookies within that frame when you use it. Those cookies are governed by the provider’s own privacy policy and not by this notice. If you would rather not use it, email us and we will arrange a time directly.

The enquiry form on this site is sent to our own server, which records what you tell us so that we can respond to you. It sets no cookie.

Links to third party websites

Our website, newsletters, email updates and other communications may, from time to time, contain links to and from the websites of others. The personal data that you provide through these websites is not subject to this privacy notice and the treatment of your personal data by such websites is not our responsibility.

If you follow a link to any other websites, please note that these websites have their own privacy notices which will set out how your information is collected and processed when visiting those sites.

Children

We do not knowingly collect information from children or other persons who are under 16 years old. If you are under 16 years old, you may not submit any personal data to us.

Changes to this Notice

This notice may be changed from time to time.

If we change anything important about this notice (the information we collect, how we use it or why) we will highlight those changes at the top of the notice and provide a prominent link to it for a reasonable length of time following the change.

Questions about this notice, or to exercise any of the rights described above: hello@contractflowsolutions.com.