Mango IT Privacy Policy

How We Collect, Use, and Protect Your Information

For Clients, Website Visitors + Business Partners in British Columbia + Alberta

VERSION 2.4 | MAY 2026

 

 

1. Policy Overview + Scope

1.1 Purpose

This Privacy Policy describes how Mango IT (“we”, “us”, or “our”) collects, uses, stores, and discloses personal information. We are committed to protecting the privacy of our website visitors, clients, and business partners in accordance with Canadian privacy law.

1.2 Legal Framework

This policy is designed to comply with:

• Personal Information Protection and Electronic Documents Act (PIPEDA) — federal

• Personal Information Protection Act (PIPA) — British Columbia provincial legislation

• Freedom of Information and Protection of Privacy Act (FOIPPA) — applicable to government-related work

• Industry-specific requirements applicable to our clients (medical, dental, legal, and other regulated professions)

1.3 Scope

This policy applies to:

• All personal information collected through our website (mangoit.ca)

• Personal information collected in the course of providing managed IT, consulting, and communications services

• Data processed on behalf of clients under managed service agreements

• Information collected via email, phone, or in-person consultations

1.4 Our Commitment

We believe that privacy is a right, not an afterthought. As a technology company working with sensitive industries — including medical, dental, legal, and financial services — we hold ourselves to a high standard. We collect only what we need, protect it carefully, and never sell or rent personal information to third parties.

​

2. Information We Collect

2.1 Website Visitors

When you visit mangoit.ca, we may collect:

• Contact form submissions: name, email address, phone number, and message content

• Technical data: browser type, operating system, IP address, and pages visited (via cookies and analytics tools — see Section 6)

• Booking and consultation requests submitted through the website

2.2 Clients + Service Recipients

In providing managed IT and consulting services, we may collect or have access to:

• Business contact information: names, email addresses, phone numbers, and job titles

• Technical environment data: hardware inventories, software configurations, network topology, and system logs

• Protected information stored or processed on client systems (handled under separate service agreements)

• Billing and payment information (we do not store full credit card numbers)

2.3 Information We Do Not Collect

We do not knowingly collect:

• Personal information from individuals under the age of 18

• Sensitive health, financial, or legal records belonging to your clients, except as required to perform contracted services and under explicit authorization

• Information through any deceptive or covert means

​

3. How We Use Your Information

3.1 Primary Purposes

We use your information to:

• Respond to inquiries and provide quotes or consultations

• Deliver, manage, and improve our managed IT and consulting services

• Communicate with you about your account, service updates, and scheduled maintenance

• Process invoices and payments

• Comply with legal and regulatory obligations

3.2 Secondary Purposes

With your knowledge or consent, we may also use your information to:

• Send relevant service updates, newsletters, or technology tips (you may unsubscribe at any time)

• Conduct satisfaction surveys to improve our service quality

• Develop anonymized case studies or service documentation (no personally identifying information is shared without explicit consent)

3.3 Legal Basis for Processing

Under PIPEDA and BC’s PIPA, we collect and use personal information only with your knowledge and consent, except where the law permits otherwise (e.g., legal obligations, fraud prevention, or emergency situations).

​

4. Sharing + Disclosure of Information

4.1 We Do Not Sell Your Data

Mango IT does not sell, rent, trade, or otherwise transfer personal information to outside parties for commercial purposes. Ever.

4.2 Authorized Disclosures

We may share your information only in these limited circumstances:

• Service delivery: with trusted technology partners who assist us in operating our business (see Section 10), under strict confidentiality agreements

• Legal requirements: when required by law, court order, or governmental authority

• Business protection: to investigate fraud, security incidents, or violations of our service agreements

• With your consent: for any purpose you have explicitly authorized

4.3 Client Data Handling

When we access data on your systems in the course of providing IT services, that data remains yours. We access it only as necessary to perform the agreed services and do not retain or use it for any other purpose. All Mango IT staff and contractors are bound by confidentiality agreements.

​

5. Data Security + Protection

5.1 Security Measures

We protect personal information using safeguards appropriate to its sensitivity, including:

• AES-256 encryption for all stored protected information

• TLS 1.2 or higher for all data in transit

• Multi-factor authentication for all administrative access

• Role-based access controls and least-privilege principles

• Continuous endpoint monitoring via Datto EDR and Huntress

• Regular security assessments and vulnerability scanning

5.2 Breach Response

In the event of a privacy breach that poses a real risk of significant harm, we will:

• Notify affected individuals as soon as reasonably possible

• Report to the Office of the Privacy Commissioner of Canada as required under PIPEDA

• Take immediate steps to contain and remediate the breach

• Maintain a breach record as required by law

5.3 Limitations

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially reasonable means to protect your personal information, we cannot guarantee its absolute security. We encourage clients to use strong passwords and report any suspected security incidents to us promptly.

​

6. Cookies + Website Tracking

6.1 What Are Cookies?

Cookies are small text files placed on your device when you visit a website. Our website (mangoit.ca) is built on the Wix platform, which uses cookies to operate and improve the site.

6.2 Types of Cookies We Use

Essential Cookies:

• Required for the website to function properly (e.g., contact forms, navigation)

• Cannot be disabled without affecting website functionality

Analytics Cookies:

• Used to understand how visitors interact with our site (e.g., pages visited, time spent)

• Data is aggregated and anonymized where possible

6.3 Managing Cookies

You can control or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our website. For more information about cookies set by Wix, visit Wix’s Privacy Policy at wix.com/about/privacy.

​

7. Client Data + Confidentiality

7.1 Sensitive Industry Clients

Mango IT serves clients in regulated industries including medical, dental, legal, accounting, and education. In these contexts, we may encounter information subject to additional privacy protections. We handle such information with heightened care, consistent with:

• BC College of Physicians and Surgeons privacy guidelines (medical)

• Law Society of British Columbia confidentiality requirements (legal)

• BC College of Dental Surgeons standards (dental)

• CPA Canada guidelines (accounting)

 

7.2 Service Agreements

Our managed service agreements include explicit provisions about data confidentiality, access controls, and incident notification. These agreements take precedence where they are more specific than this general privacy policy.

7.3 Staff + Contractor Obligations

All Mango IT personnel and subcontractors with access to client data are required to:

• Sign confidentiality agreements before accessing any client systems

• Complete annual privacy and security awareness training

• Adhere to minimum necessary access principles at all times

​​

8. Data Retention

8.1 Retention Periods

We retain personal information only as long as necessary for the purposes for which it was collected, or as required by law:

• Client contact and billing records: 7 years after end of service relationship (consistent with CRA requirements)

• Website contact form submissions: 2 years from date of submission, unless a client relationship is established

• System logs and security event data: 90 days minimum, up to 1 year for incident investigation purposes

• Employee and contractor records: duration of engagement plus 7 years

8.2 Secure Disposal

When personal information is no longer required, we securely destroy it using methods appropriate to its sensitivity — including digital data wiping per NIST 800-88 standards and physical destruction of media where applicable.

​

9. Your Privacy Rights

9.1 Rights Under PIPEDA + PIPA

You have the right to:

• Access: request a copy of the personal information we hold about you

• Correction: request that inaccurate or incomplete information be corrected

• Withdrawal of consent: withdraw consent to our use of your personal information (subject to legal or contractual limitations)

• Complaint: lodge a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the BC Office of the Information and Privacy Commissioner (oipc.bc.ca)

9.2 How to Exercise Your Rights

To exercise any of these rights, please contact us using the information in Section 12. We will respond to all requests within 30 days, or notify you if we require additional time as permitted by law. We will not charge a fee for reasonable access requests.

​

10. Third-Party Tools + Partners

10.1 Technology Partners

We use trusted third-party tools to deliver and manage our services. These partners process data on our behalf under confidentiality obligations:

• Microsoft 365 / Azure: email, cloud storage, productivity, and identity management

• Datto: backup, disaster recovery, RMM, and endpoint detection

• Huntress: 24/7 threat detection and managed security operations

• NinjaRMM: remote monitoring and device management

• net2phone: business communications and VoIP

• Wix: website hosting and contact form processing

10.2 Data Residency

Some of our technology partners may store or process data outside of Canada (including in the United States). We take reasonable steps to ensure that any such transfers are subject to appropriate protections, including contractual safeguards consistent with Canadian privacy law requirements.

10.3 Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies before providing any personal information.

​

11. Changes to This Policy

11.1 Policy Updates

We review this privacy policy at least annually and whenever there are material changes to our practices or applicable law. When we make significant changes, we will:

• Update the effective date at the top of this document

• Post the updated policy on our website at mangoit.ca

• Notify active clients by email where the changes materially affect how we handle their data

11.2 Continued Use

Your continued use of our website or services following notification of changes constitutes acceptance of the updated policy.

​

12. Contact Information + Privacy Inquiries

12.1 Privacy Contact

For any privacy-related questions, access requests, corrections, or complaints, please contact us:

 

Mango IT Head Office

37A 11th Avenue South, Cranbrook, BC  V1C 2N9

hello@mangoit.ca

250-419-7616

mangoit.ca

 

12.2 Regulatory Authorities

If you are unsatisfied with our response to a privacy concern, you may contact:

Federal:

• Office of the Privacy Commissioner of Canada — priv.gc.ca  |  1-800-282-1376

• Provincial (BC):

• Office of the Information and Privacy Commissioner for BC — oipc.bc.ca  |  250-387-5629

 

 

​

​

​

​

​

​

​

​