Legal
Privacy Policy
How Heartwood collects, uses, discloses and protects your personal information.
Who we are
Heartwood Investments (“Heartwood”, “we”, “us”) is an investment manager focused on the living sector. This policy explains how we collect, use, disclose and protect personal information through this website and in our dealings with investors, advisors and others who contact us. It is based on our internal Cyber Security, Data and Privacy Policy, effective August 2026.
Accountability
Heartwood is accountable for the personal information under its control. Our designated privacy contact is Jordan Winter, VP, Finance, who is responsible for our compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where we work with investors in the European Union or United Kingdom, the General Data Protection Regulation (GDPR).
Information we collect
We collect the personal information you choose to give us, such as your name, email address, phone number, company, investor type and the content of your message, when you subscribe to our newsletter or podcast, request a meeting, register for an event or contact us. If you invest, we also collect the information required to verify your identity and investor status and to administer your investment, as described in the applicable offering documents. When you visit the site, we and our service providers may collect technical information such as your device, browser, pages viewed and approximate location through cookies and similar technologies.
How we use it
We use personal information to respond to your enquiries, send the newsletters, podcast updates and event invitations you ask for, assess and administer investments, meet our legal and regulatory obligations, and understand how our website is used so we can improve it. We do not sell personal information.
Consent and marketing emails
We collect, use and disclose personal information with your consent, or as permitted or required by law. We send commercial electronic messages only with your consent, in line with Canada’s Anti-Spam Legislation, and every message includes a way to unsubscribe. You may withdraw your consent at any time, subject to legal or contractual restrictions.
Service providers and disclosure
We share personal information only with service providers that help us operate, such as our IT, cloud storage, email and website form providers, and with fund administrators, dealers and professional advisors where needed to administer an investment. These parties must protect the information and use it only for the services they provide to us. We may also disclose information where required by law or to regulators. Some of our providers store or process information outside Canada, including in the United States, where it may be subject to the laws of that country.
How we protect it
We protect personal information with safeguards appropriate to its sensitivity. These include encryption of data in transit and at rest, multi-factor authentication for access to our systems, managed endpoint and network security, regular independent backups, and ongoing staff training on security and phishing. Access is limited to people who need it to do their work.
How long we keep it
We keep personal information only as long as needed for the purposes described here, or as required by law. Business and investor records are generally retained for at least seven years.
Your rights
You may ask to access the personal information we hold about you, ask us to correct it, or withdraw your consent to its collection, use or disclosure. Please make your request in writing to our privacy contact. We will verify your identity first and respond within 30 days, or tell you in writing if we need an extension permitted by law. If you are in the European Union or United Kingdom, you also have rights of erasure, restriction of processing, data portability and objection under the GDPR.
Privacy breaches
If a breach of our security safeguards involving your personal information creates a real risk of significant harm, we will notify you directly as soon as feasible and report it to the Office of the Privacy Commissioner of Canada. Where the GDPR applies, we will notify the relevant supervisory authority within 72 hours. We keep a record of every breach for at least 24 months.
Contact us
Questions, requests or concerns about this policy can be sent to our privacy contact, Jordan Winter, VP, Finance, at info@heartwoodinvestments.ca or 25 King St W, Toronto, Ontario. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.
Changes to this policy
We review this policy at least annually and will post any updates on this page. Last updated October 2026.