Privacy Policy
Melissa Lukings, operating as Lukings Law (“we”, “our”, “us”), is an Ontario-based sole practice lawyer. Lukings Law is committed to protecting personal information in accordance with applicable Canadian privacy laws and professional obligations, including the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s Anti-Spam Legislation (CASL), and (when we handle personal health information) Ontario’s Personal Health Information Protection Act (PHIPA). We also comply with the Law Society of Ontario (LSO) Rules of Professional Conduct, including duties of confidentiality and securely safeguarding client information.
This Privacy Policy explains how we collect, use, disclose, and protect personal information through our website (the “Site”), by email/SMS and other communications, and in the course of providing legal services.
Lukings Law: Privacy Policy
Who We Are and How to Contact Us
Firm name: Melissa Lukings o/a Lukings Law
Privacy Officer: Melissa Lukings
Email: melissa@lukingslaw.ca
Phone: 613-319-1933
Contact our Privacy Officer to ask questions, request access/correction, or submit a complaint.
What This Policy Covers
-
Visitors to our Site (including contact forms, newsletter sign-ups, scheduling tools, and SMS sign-ups).
-
Prospective, current, and former clients and related individuals (e.g., authorized representatives, witnesses).
-
Communications we send (email, SMS/text, phone, mail) that relate to our services.
This Policy does not limit solicitor-client privilege or our professional duties. Where this Policy conflicts with applicable law or tribunal/court orders, the latter govern.
What Personal Information We Collect
Depending on your interaction with us, we may collect:
​
-
Identifiers & contact details: name, address, email, phone/mobile number, preferred pronouns.
-
Matter information: facts, documents, and communications necessary to assess/advise/represent you (which may include sensitive information).
-
Personal health information (PHI): when relevant to your matter (e.g., Consent and Capacity Board or health-law work), we may receive PHI from you or third parties.
-
Technical & usage data: IP address, device/browser type, pages visited, timestamps, and cookies or similar technologies.
-
Marketing preferences & consent records: how/when you opted in/out of emails/SMS, and your preferences.
We generally collect information directly from you. We may also receive it from third parties (e.g., courts/tribunals, opposing counsel, hospitals/clinics, government bodies, publicly available sources) where permitted or required by law.
Identified Purposes: How We Use Personal Information
We use personal information to:
​
-
Provide, manage, and bill for legal services; open and manage client files; verify identity as required by the LSO; prevent fraud and manage risk.
-
Communicate with you about your matter and our services (including scheduling, reminders, service updates).
-
Operate, maintain, and improve our Site and user experience (including analytics and security).
-
Meet legal, regulatory, professional, and insurance obligations.
-
With your consent (or as permitted by law), send newsletters, updates, invitations, and other information that may interest you.
We do not sell your personal information.
Consent
We obtain consent as required by PIPEDA/PHIPA—express or implied, depending on context. You may withdraw consent at any time (subject to legal/contractual limits and reasonable notice). Withdrawal may affect our ability to provide services.
SMS/Text Messaging Policy (CASL & Service Texts)
When you provide your mobile number and opt in to receive SMS/text messages from Lukings Law, you agree to the following:
​
-
Consent to receive messages.
-
You are consenting to receive SMS/text messages from Lukings Law at the mobile number you provide. Messages may include appointment reminders, scheduling/coordination, service updates, security verifications, and (if you opt-in) newsletters or alerts.
-
-
No third-party marketing.
-
We do not sell or share your mobile number or personal information with third parties for their own marketing purposes. We may use service providers (e.g., messaging platforms) only to deliver our messages on our behalf, under contracts that limit their use and require safeguards.
-
-
Message frequency.
-
Message frequency varies and may be recurring (e.g., [1–4 messages/month], or as needed for service communications).
-
-
Opt-out by reply.
-
You may reply STOP to any message to opt out. We also honour common opt-out keywords (e.g., STOP, CANCEL, END, UNSUBSCRIBE, QUIT). We will process your opt-out promptly and in any case within CASL timelines.
-
-
HELP keyword.
-
Reply HELP for help or contact melissa@lukingslaw.ca / 613-319-1933
-
-
Message & data rates.
-
Message and data rates may apply. Charges depend on your mobile plan.
-
-
Identification.
-
Our SMS will identify Lukings Law as the sender and provide contact information or a link to this policy.
-
-
Record-keeping.
-
We maintain records of consent/opt-out as required by CASL.
-
Important:
Legal advice is not provided by SMS. Do not send confidential or time-sensitive information by text unless we instruct you to do so; use secure channels we provide.
Email and Other Electronic Messages (CASL)
Our commercial electronic messages identify us and include a working unsubscribe mechanism. You can unsubscribe at any time (instructions are in every message) or by contacting our Privacy Officer. Service/transactional messages related to your matter may continue where permitted by law. Our CEMs include our postal address (see Section 1).
Cookies, Analytics, and Similar Technologies
We may use cookies or similar technologies to operate the Site, remember preferences, and gather aggregate analytics (e.g., pages visited, time on page). You can adjust browser settings to refuse or delete cookies; some Site features may not function properly without them. If we use analytics tools or embedded services (e.g., maps, fonts, scheduling widgets), those providers may collect limited data subject to their own privacy policies.
Disclosure of Personal Information
We disclose personal information only in the following circumstances:
​
-
Within the firm on a need-to-know basis to deliver services.
-
Service providers/agents (e.g., IT hosting, email/SMS delivery, secure file storage, dictation/transcription, process servers, accountants) under contractual safeguards.
-
As required or authorized by law (e.g., to comply with court/tribunal orders, regulatory requests, LSO requirements, prevent harm or fraud).
-
Fee collection. We may disclose limited information to collect fees, enforce agreements, or manage accounts in arrears (e.g., to payment processors, collection agents, or legal counsel).
-
Publicly available information. We may collect, use, or disclose information that is publicly available as defined by regulation (e.g., public registries, court records), consistent with applicable law.
-
With your consent to third parties you authorize.
We do not permit service providers to use personal information for their own marketing.
Cross-Border Transfers
Some service providers may process or store information outside Ontario/Canada. While we use contractual and technical safeguards, personal information may be accessible to foreign courts, law enforcement, or national authorities in those jurisdictions.
Safeguards
We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information. Examples include secure premises, role-based access controls, encryption in transit/at rest where feasible, firewalls and endpoint protection, strong authentication, vetted off-site records storage, and confidentiality undertakings. We continuously assess risks and update controls.
​
Electronic communications risk:
No method of transmission or storage is 100% secure. Email, SMS, fax, and internet transmissions carry inherent risks of misrouting or interception. For sensitive or urgent communications, we may use secure portals or alternative methods.
Retention & Destruction
We retain personal information only as long as necessary for the identified purposes, to meet legal/regulatory/professional obligations (including LSO file-retention requirements), and to resolve disputes. When no longer required, we securely destroy or de-identify the information.
Your Rights: Access, Collection & Accuracy
Access & correction.
-
Subject to limited exceptions under law/privilege, you may request access to and correction of your personal information in our custody/control. Contact our Privacy Officer to make a request; we may ask for information to verify your identity.
Accuracy.
-
We rely on you to help keep your information accurate and up to date. Please notify us promptly of any changes, and we will make corrections where appropriate.
Access timelines & fees.
-
We respond to access requests within 30 days (or as permitted by law). A reasonable fee may apply; we will tell you in advance.
Limited exceptions.
-
We may refuse access where required or authorized by law, including where information is subject to solicitor-client privilege; relates to existing/anticipated legal proceedings; would reveal confidential commercial information; would unreasonably affect another person’s privacy; would prejudice negotiations; is necessary to protect our rights or property; or the request is frivolous or vexatious. If we refuse, we will explain why and outline available recourse.
For PHI requests (where applicable), we will process in accordance with PHIPA.
Client Confidentiality, Privilege, & LSO Compliance
Independent of privacy legislation, lawyers in Ontario owe strict duties of confidentiality and must protect solicitor-client privileged information. We follow LSO requirements and guidance on technology, cloud services, file management, and confidentiality. Nothing in this Policy limits those professional obligations.
Recruitment & Employment
If you apply for a role, we use the information you provide to assess your candidacy and manage recruitment. If hired, your information will be handled in accordance with our HR privacy practices and shared internally on a need-to-know basis (e.g., payroll/benefits). We will not disclose employee information to third parties except as required by law, with consent, or to service providers under contract.
Children & Vulnerable Persons
Our Site is not directed to children. If you are a parent/guardian and believe a minor has provided personal information, please contact us to request deletion or appropriate handling.
Links to Other Sites
Our Site may link to third-party sites. Their privacy practices are governed by their own policies. We are not responsible for the privacy practices of third parties.
Accountability & Training
Our Privacy Officer oversees compliance. All personnel receive privacy/confidentiality training appropriate to their role. We monitor compliance and address incidents in accordance with our internal policies (including breach response, where applicable).
Changes to this Policy
We may update this Policy from time to time. The “Effective date” above shows when it last changed. Material changes will be posted on the Site; if required by law, we will also notify you and obtain consent.
Questions, Concerns, or Complaints
Contact our Privacy Officer (details in Section 1).
If we cannot resolve your concern, you may contact:
​
Office of the Privacy Commissioner of Canada
30 Victoria Street, Gatineau, QC K1A 1H3
1-800-282-1376
​
Information and Privacy Commissioner of Ontario (for PHIPA matters)
2 Bloor Street East, Suite 1400, Toronto, ON M4W 1A8
1-800-387-0073
