Privacy Policy

Tomola CPAs ("we," "our," or "us") is committed to protecting the privacy and security of your personal and financial information. As a certified public accounting firm, we understand the sensitive nature of the information you entrust to us and take our responsibility to safeguard it seriously.

This Privacy Policy explains how we collect, use, disclose, and protect your information in compliance with the Gramm-Leach-Bliley Act (GLBA), the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), and other applicable privacy laws. This policy applies to current and former clients of Tomola CPAs.

1. Information We Collect

In order to provide professional accounting, tax preparation, and financial advisory services, we collect various types of information from and about you:

1.1 Personal Information

• Identification Information: Name, date of birth, Social Security number, driver's license number, passport number, or other government-issued identification
• Contact Information: Mailing address, email address, telephone number, and fax number
• Demographic Information: Age, gender, marital status, dependents, occupation, and employer information
• Account Credentials: Username, password, and security questions for accessing our client portal

1.2 Financial Information

• Income Information: W-2 forms, 1099 forms, K-1 forms, salary information, business income, investment income, and rental income
• Banking Information: Bank account numbers, routing numbers, credit card information, and transaction history
• Investment Information: Brokerage account information, stock holdings, bonds, mutual funds, retirement accounts (401(k), IRA, etc.)
• Asset Information: Real estate holdings, vehicle information, business ownership interests, and other valuable assets
• Liability Information: Mortgage information, loan details, credit card debt, and other financial obligations
• Insurance Information: Health insurance, life insurance, property insurance, and other coverage details

1.3 Tax-Related Information

• Prior year tax returns (federal, state, and local)
• Tax payment and refund information
• Estimated tax payments and withholding information
• Tax credits and deductions claimed
• Business expenses and deductions
• Charitable contributions
• Educational expenses and student loan information
• Healthcare and medical expense information

1.4 Business Information (for Business Clients)

• Business structure and ownership information
• Financial statements (balance sheets, income statements, cash flow statements)
• Payroll information and employee data
• Vendor and customer information
• Business licenses and permits
• Contracts and legal documents

1.5 Information Collected Automatically

• Usage Data: Information about how you access and use our website and client portal, including IP address, browser type, device information, pages visited, and time spent on pages
• Cookies and Tracking Technologies: We use cookies, web beacons, and similar technologies to enhance your experience and gather information about usage patterns
• Log Files: Server logs that record system activity and user actions for security and troubleshooting purposes

1.6 Information from Third Parties

• Information from the IRS, state tax authorities, and other government agencies
• Credit reports and financial information from credit bureaus (with your consent)
• Information from financial institutions, employers, and other third parties necessary to provide our services

2. How We Use Your Information

We use the information we collect for the following purposes:

2.1 Providing Professional Services

• Preparing and filing federal, state, and local tax returns
• Providing tax planning and advisory services
• Performing accounting, bookkeeping, and financial statement preparation
• Conducting audits, reviews, and compilations
• Offering business consulting and financial planning services
• Representing you before tax authorities

2.2 Client Communication and Support

• Responding to your inquiries and requests
• Sending appointment reminders and service-related notifications
• Providing customer support and technical assistance
• Communicating about your account and our services

2.3 Billing and Payment Processing

• Processing payments for services rendered
• Sending invoices and billing statements
• Managing accounts receivable
• Detecting and preventing fraud

2.4 Legal and Regulatory Compliance

• Complying with federal, state, and local laws and regulations
• Meeting professional standards and ethics requirements
• Responding to legal process (subpoenas, court orders, etc.)
• Maintaining required records and documentation
• Conducting internal audits and quality control reviews

2.5 Business Operations and Improvement

• Maintaining and improving our website and client portal
• Analyzing usage patterns to enhance user experience
• Conducting research and data analysis
• Training staff and quality assurance purposes
• Protecting against security threats and fraudulent activity

2.6 Marketing and Communications (with consent)

• Sending newsletters and educational materials
• Providing updates on tax law changes and financial planning opportunities
• Informing you about new services and offerings

3. Information Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share your information only in the following limited circumstances:

3.1 With Your Consent

We may share your information with third parties when you have given us explicit permission to do so.

3.2 Service Providers and Business Partners

We may share information with trusted third-party service providers who assist us in operating our business and providing services to you, including:

• Tax software providers and e-filing services
• Cloud storage and data backup services
• Payment processors and merchant services
• IT support and cybersecurity services
• Document management and secure file-sharing platforms
• Professional liability insurance carriers

These service providers are contractually obligated to maintain the confidentiality and security of your information and are prohibited from using it for any purpose other than providing services to us.

3.3 Government Agencies and Tax Authorities

We share information with government agencies as necessary to provide our services, including:

• Internal Revenue Service (IRS)
• State and local tax authorities
• Securities and Exchange Commission (SEC)
• Other regulatory bodies as required by law

3.4 Legal Requirements and Protection of Rights

We may disclose your information when we believe in good faith that disclosure is necessary to:

• Comply with a legal obligation, court order, subpoena, or other legal process
• Enforce our Terms of Service or other agreements
• Protect the rights, property, or safety of Tomola CPAs, our clients, or others
• Detect, prevent, or address fraud, security, or technical issues
• Respond to claims that content violates the rights of third parties

3.5 Professional Advisors and Consultants

We may share information with:

• Attorneys for legal advice and representation
• Other CPAs and accounting professionals for consultation and peer review
• Professional organizations for ethics and quality control purposes

3.6 Business Transfers

If Tomola CPAs is involved in a merger, acquisition, asset sale, or bankruptcy proceeding, your information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

3.7 Aggregated and De-Identified Information

We may share aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you for research, marketing, or other business purposes.

4. Your Rights

You have certain rights regarding your personal information. These rights may vary depending on your location and applicable laws.

4.1 Right to Access

You have the right to request access to the personal information we hold about you. We will provide you with a copy of your information in a readily usable format.

4.2 Right to Correction

You have the right to request that we correct any inaccurate or incomplete personal information we maintain about you. We will make reasonable efforts to correct the information promptly.

4.3 Right to Deletion

You have the right to request deletion of your personal information, subject to certain exceptions. We may be required to retain certain information for:

• Legal and regulatory compliance (e.g., IRS requires retention of tax records)
• Completion of ongoing services
• Detection of security incidents and fraud prevention
• Exercise of free speech or legal rights
• Internal research and development

4.4 Right to Data Portability

You have the right to request that we provide your personal information in a structured, commonly used, and machine-readable format for transfer to another service provider.

4.5 Right to Opt-Out

You have the right to opt out of:

• Marketing communications and newsletters
• Information sharing with certain third parties (see Section 9 for GLBA opt-out rights)
• Sale of personal information (we do not sell personal information)

4.6 Right to Non-Discrimination

You have the right to exercise your privacy rights without receiving discriminatory treatment, including:

• Denying goods or services
• Charging different prices or rates
• Providing a different level or quality of services

4.7 How to Exercise Your Rights

To exercise any of these rights, please contact us using the information provided in Section 12. We may need to verify your identity before processing your request. We will respond to your request within the timeframe required by applicable law (typically 30-45 days).

5. Data Security Measures

We implement comprehensive administrative, technical, and physical safeguards to protect your personal and financial information from unauthorized access, use, disclosure, alteration, and destruction.

5.1 Technical Safeguards

• Encryption: All data transmitted between your device and our servers is encrypted using industry-standard SSL/TLS protocols (256-bit encryption)
• Data Encryption at Rest: Sensitive information stored in our databases is encrypted using AES-256 encryption
• Secure Access Controls: Multi-factor authentication (MFA) for client portal and staff access
• Firewalls: Advanced firewall protection to prevent unauthorized network access
• Intrusion Detection: Real-time monitoring systems to detect and respond to security threats
• Regular Security Audits: Periodic vulnerability assessments and penetration testing
• Secure File Transfer: Encrypted document upload and download through our secure client portal
• Antivirus and Malware Protection: Enterprise-grade security software on all systems

5.2 Administrative Safeguards

• Access Limitations: Information is accessible only to authorized personnel who need it to provide services to you
• Background Checks: All employees undergo background checks before hiring
• Confidentiality Agreements: All staff members sign confidentiality and non-disclosure agreements
• Privacy Training: Regular training for all employees on data privacy and security best practices
• Incident Response Plan: Documented procedures for responding to data breaches and security incidents
• Vendor Management: Careful vetting and monitoring of third-party service providers
• Data Minimization: We collect and retain only the information necessary to provide our services

5.3 Physical Safeguards

• Secure Facilities: Controlled access to office premises with keycard entry and surveillance
• Locked Storage: Physical documents containing sensitive information are stored in locked cabinets
• Secure Disposal: Shredding of physical documents and secure erasure of electronic media
• Clean Desk Policy: Sensitive documents must not be left unattended on desks

5.4 Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you and any applicable regulatory authorities within the timeframe required by law. Our notification will include:

• A description of the incident and the information involved
• Steps we are taking to investigate and mitigate the breach
• Recommendations for steps you can take to protect yourself
• Contact information for questions and assistance

6. Data Retention

We retain your personal and financial information for as long as necessary to provide our services and comply with legal and professional obligations.

6.1 Retention Periods

• Tax Records: Minimum of 7 years from the date of filing, as required by IRS regulations and professional standards
• Accounting Records: Minimum of 7 years from the date of service
• Audit Documentation: Minimum of 7 years from the report release date
• Client Communication: Duration of the client relationship plus 7 years
• Billing and Payment Records: 7 years from the date of transaction
• Legal and Compliance Records: As required by applicable law or regulation

6.2 Extended Retention

We may retain information for longer periods when:

• Required by law or regulation
• Necessary to resolve disputes or enforce our agreements
• Needed for ongoing litigation or investigations
• You have consented to longer retention
• Required for backup and disaster recovery purposes

6.3 Secure Destruction

When information is no longer needed, we securely destroy it using methods appropriate to the medium:

• Electronic Records: Secure deletion or degaussing of storage media
• Paper Records: Cross-cut shredding or incineration
• Backup Media: Secure erasure or physical destruction

6.4 Former Clients

This Privacy Policy continues to apply to information we retain about former clients. We maintain the same level of protection for former client information as we do for current clients.

7. Third-Party Services

In providing our services, we may use various third-party software, platforms, and service providers. We carefully select and monitor these vendors to ensure they maintain appropriate security and privacy standards.

7.1 Categories of Third-Party Services

• Tax Software: Professional tax preparation and e-filing platforms
• Accounting Software: Cloud-based accounting and bookkeeping systems
• Document Management: Secure file storage and sharing platforms
• Payment Processing: Credit card processing and ACH payment services
• Communication Tools: Email services, video conferencing, and client portals
• Cloud Infrastructure: Web hosting and data storage providers
• Cybersecurity: Security monitoring and threat protection services

7.2 Third-Party Responsibilities

Our third-party service providers are required to:

• Maintain appropriate security measures to protect your information
• Use your information only for the specific purposes we authorize
• Comply with applicable privacy laws and regulations
• Notify us of any security incidents or data breaches
• Return or destroy information when services are terminated

7.3 Third-Party Websites and Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of these external sites. We encourage you to review the privacy policies of any third-party websites you visit.

7.4 Social Media

If you interact with us through social media platforms (Facebook, LinkedIn, Twitter, etc.), please be aware that your interactions may be governed by the privacy policies of those platforms in addition to this Privacy Policy.

8. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).

8.1 CCPA/CPRA Rights

California residents have the right to:

• Know: Request information about the categories and specific pieces of personal information we collect, use, disclose, and sell
• Delete: Request deletion of personal information we have collected from you (subject to certain exceptions)
• Opt-Out: Opt out of the sale or sharing of personal information (we do not sell personal information)
• Correct: Request correction of inaccurate personal information
• Limit: Limit the use and disclosure of sensitive personal information
• Non-Discrimination: Not receive discriminatory treatment for exercising your privacy rights

8.2 Categories of Personal Information Collected

In the preceding 12 months, we have collected the following categories of personal information:

• Identifiers (name, address, SSN, etc.)
• Financial information (bank accounts, tax records, etc.)
• Commercial information (transaction history, billing records)
• Internet or network activity (website usage, log data)
• Professional or employment information
• Education information
• Inferences drawn from personal information

8.3 Business Purposes for Collection

We collect and use personal information for the business purposes described in Section 2 of this Privacy Policy.

8.4 Categories of Third Parties

We may share personal information with the categories of third parties described in Section 3 of this Privacy Policy.

8.5 Sale of Personal Information

We do not sell personal information and have not sold personal information in the preceding 12 months.

8.6 Sensitive Personal Information

We collect and use sensitive personal information (such as Social Security numbers, financial account information, and tax records) only for the purposes of providing our professional accounting and tax services. We do not use or disclose sensitive personal information for purposes other than those specified in CPRA regulations.

8.7 Exercising Your California Rights

To exercise your rights under CCPA/CPRA, you may:

• Email us at: privacy@tomolacpas.com
• Call us at: (555) 123-4567
• Submit a request through our client portal

We will verify your identity before processing your request. You may designate an authorized agent to make a request on your behalf by providing written authorization.

8.8 Response Time

We will respond to verifiable consumer requests within 45 days of receipt. If we need additional time (up to 90 days total), we will inform you of the reason and extension period.

8.9 Shine the Light Law

California Civil Code Section 1798.83 permits California residents to request information about our disclosure of personal information to third parties for their direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes.

9. Opt-Out Rights

Under the Gramm-Leach-Bliley Act (GLBA), you have the right to opt out of certain information sharing practices.

9.1 GLBA Opt-Out Right

Federal law gives you the right to limit some but not all sharing of your personal information. You have the right to opt out of our sharing of your personal information with non-affiliated third parties for purposes other than providing services to you.

9.2 Information We Must Share

We cannot offer you the ability to opt out of sharing information:

• With service providers who perform services on our behalf (e.g., tax software providers)
• As required or permitted by law (e.g., with the IRS for tax filing)
• To protect against fraud or unauthorized transactions
• With regulatory authorities or law enforcement

9.3 Marketing Communications Opt-Out

You may opt out of receiving marketing communications from us at any time by:

• Clicking the "unsubscribe" link in any marketing email
• Emailing us at: privacy@tomolacpas.com
• Calling us at: (555) 123-4567
• Updating your preferences in our client portal

Please note that even if you opt out of marketing communications, we will still send you important transactional and service-related messages (such as appointment confirmations, billing statements, and tax deadlines).

9.4 Cookie Preferences

You can control cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our website and client portal.

10. Children's Privacy

Our services are not directed to individuals under the age of 18, and we do not knowingly collect personal information from children. While we may collect information about dependents as part of providing tax and accounting services to parents or guardians, we do so only with parental consent and in accordance with applicable laws.

If you believe we have inadvertently collected information from a child without proper consent, please contact us immediately, and we will take steps to delete such information.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational, legal, or regulatory reasons.

11.1 Notice of Changes

When we make changes to this Privacy Policy, we will:

• Update the "Last Updated" date at the top of this policy
• Post the revised policy on our website
• Notify you via email if the changes are material (for current clients)
• Provide you with a new opt-out notice if required by GLBA

11.2 Material Changes

If we make material changes that significantly affect your privacy rights or how we handle your information, we will provide prominent notice and, where required by law, obtain your consent before implementing the changes.

11.3 Your Continued Use

Your continued use of our services after we post changes to this Privacy Policy indicates your acceptance of the updated policy. If you do not agree with the changes, you may discontinue using our services, subject to any ongoing obligations under our engagement agreements.

11.4 Review Recommendation

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

12. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

Response Time

We will respond to your inquiry within a reasonable timeframe, typically within 5-10 business days. For formal privacy rights requests (access, deletion, correction), we will respond within the timeframe required by applicable law.

Complaints and Regulatory Authorities

If you believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with the appropriate regulatory authority:

• Federal Trade Commission (FTC): ftc.gov/complaint
• Consumer Financial Protection Bureau (CFPB): consumerfinance.gov/complaint
• California Attorney General (for CA residents): oag.ca.gov
• State CPA Board: Contact your state's Board of Accountancy