Privacy Policy — Protection of Sensitive Tax Information

At J. Oakley Tax and Accounting LLC, protecting your personal and financial information is our top priority. This Privacy Policy explains how we collect, use, transmit, store, and safeguard sensitive tax and client data. We commit to industry-standard security practices, strict access controls, and transparent handling of your confidential information.

1. Scope This policy applies to all personal, financial, and tax-related information we collect from clients, prospective clients, and third parties in the course of providing tax, accounting, and related services.

2. Information We Collect

• Personal identification: names, addresses, dates of birth, Social Security numbers or taxpayer identification numbers.

• Financial and tax records: income statements, tax returns, bank and investment account information, payroll details, and related documentation.

• Business information: employer identification numbers, business financials, and corporate documents when applicable.

• Communications and support data: emails, phone records, client portal messages, and notes necessary to deliver services.

• Authentication and access data: usernames, password hashes, device identifiers, and activity logs for systems we manage.

3. How We Use Your Information

• To prepare, file, and manage tax returns and related financial documents.

• To provide tax planning, accounting, payroll, and advisory services.

• To communicate with you about your account, filings, deadlines, and required actions.

• To comply with legal, regulatory, and professional obligations, including audits and record retention.

• To detect, prevent, and respond to fraud, security incidents, or other misuse of services.

4. Data Collection and Transmission Methods

• Secure client portals and encrypted web forms for document submission.

• Encrypted email or other secure messaging for sensitive exchanges when portal use is not possible.

• Secure file transfer tools for large documents.

• Paper or in-person collection only when necessary, followed by prompt secure conversion to digital records and secure disposal of physical copies.

5. Security Measures

• Encryption: We use strong encryption protocols (at-rest and in-transit) to protect data stored on our systems and transmitted between systems.

• Access controls: Role-based access limits data access to authorized personnel only; multi-factor authentication is required for staff access to sensitive systems.

• Network and system protection: Firewalls, intrusion detection/prevention, regular vulnerability scanning, and secure system configurations are maintained.

• Secure backups: Regular, encrypted backups are retained to ensure data availability and integrity.

• Endpoint protection: Anti-malware, patch management, and device security standards are enforced for devices used to access client data.

• Physical security: Office access controls and secure storage for physical records until properly digitized and archived or destroyed.

6. Data Minimization and Retention

• We collect only the information necessary to deliver our services.

• Records are retained in accordance with applicable legal, tax, and professional requirements. When retention periods expire, records are securely destroyed or irreversibly anonymized.

7. Access, Correction, and Portability

• Clients may request access to their personal or tax information maintained by our firm.

• If you identify inaccuracies, we will correct records promptly upon verification.

• Upon request, and where feasible, we will provide copies of your data in a commonly used, machine-readable format for your convenience or for transfer to other providers.

8. Third-Party Sharing and Service Providers

• We do not sell or rent your personal or tax information.

• We may share data with third-party service providers (e.g., e-filing processors, payroll vendors, cloud service providers) solely to perform services on our behalf. These providers are contractually obligated to maintain confidentiality and to use appropriate security measures.

• We may disclose information if required by law, subpoena, or governmental