Updated October 13, 2026

Koja portal privacy policy

This policy explains how Koja Property Management protects the personal information handled in this portal: tenant, owner and staff accounts, maintenance requests, the property management software, and messages sent with the website's forms. It follows Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

Who is accountable

President, Koja Property Management. For any question, request or complaint: info@kojapropertymanagement.ca.

What we collect

• Your account: name, email address, phone (optional), language, and when you gave your consent.
• Tenants: the link between your account and your unit, as your property manager already recorded it (name, unit, lease dates, contact details), your maintenance requests (title, description, photos, permission to enter) and your messages.
• Building owners: the buildings you can see and your access requests.
• Owners who use the software: the portfolio data you enter (buildings, tenants, rents, expenses, notices).
• The website's forms (contact, rental assessment, pre-application, repair, showing, listing alerts, moving waitlist): what you wrote, your name and email, and the form's language and page. Not your IP address.
• Security: sign-in times, your IP address for important actions (audit log), and counters that slow down repeated attempts. One session cookie and one language cookie. No advertising or tracking tools.

Uploaded photos are cleaned: we remove their metadata, including the GPS location where they were taken.

Why

To create and protect your account, receive and follow maintenance requests, let owners see their buildings, run the software, and meet our legal obligations. We don't use this information for anything else, and we don't sell it.

Who can see it

• A tenant sees only their own requests.
• Property management staff see the requests for the buildings they manage.
• An owner sees the buildings they own and those buildings' requests, but not tenants' contact details.
• Messages sent with the website's forms: Koja Property Management staff.
• An owner's portfolio is visible only to them and the people they invite. Koja accesses it only if you ask for support, or if the law requires it.

Where it's kept

On our hosting provider's servers in the United States (Railway). Information stored outside Canada is protected by our contract with the provider, but it may be accessed by the courts, law enforcement and national security authorities of that country under its laws. Notification emails go through our email provider; they contain only your name and a link to the portal, never what your requests say.

How long

• Unused invitation links: deleted 90 days after they expire. Email and password links: 7 days.
• Accounts never confirmed: deleted after 30 days.
• Completed maintenance requests (conversation and photos): deleted after 7 years, which is how long a manager may need them as maintenance records.
• Messages sent with the website's forms: deleted after 365 days, or sooner if you ask.
• Audit log: 3 years.
• Backups: 14 days, in the same place as the data. Information that's deleted is gone from the backups after that time too.
• Your account: until you delete it. An owner's portfolio is deleted with their account.

Security

Encrypted connections (HTTPS), hashed passwords, access based on each person's role, a log of important actions, and daily backups. If a breach of security safeguards creates a real risk of significant harm, we report it to the Office of the Privacy Commissioner of Canada and notify the people affected. Every breach is recorded in our register and kept 24 months.

Your rights

• Access: download your information in a common format (JSON) from My account.
• Correction: edit your profile, or ask your property manager to correct your lease information.
• Withdrawing consent and deletion: delete your account from My account, or write to us.
• Complaints: write to the person in charge above. You can also contact the Office of the Privacy Commissioner of Canada.

We answer written requests within 30 days.