1. Who we are

A Garg CPA Professional Corporation ("A Garg CPA", "we", "us", "our") is a professional accounting firm registered with the Chartered Professional Accountants of Ontario, with its office at 1100 Burloak Drive, Suite 300, Burlington, Ontario L7L 6B2, Canada.

We provide accounting, bookkeeping, payroll, Canadian and U.S. tax preparation, cross-border and expatriate tax services, and Individual Taxpayer Identification Number (ITIN) application assistance as an IRS Certifying Acceptance Agent.

A Garg CPA Professional Corporation is the firm that contracts with you, that prepares your returns and financial statements, and that holds the licences to the tax and accounting software used to do that work. References in this policy to "we," "us" and "our" mean A Garg CPA Professional Corporation. Your engagement letter identifies the contracting party.

This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, who we share it with, and the choices and rights available to you.

Because we handle both Canadian and United States tax matters, we are subject to privacy and confidentiality obligations under more than one legal regime. This policy is written to meet all of them.

2. The laws that apply to us

3. Accountability — our Privacy Officer

Under PIPEDA Principle 1, an organization is responsible for personal information under its control and must appoint an individual accountable for its compliance (Office of the Privacy Commissioner of Canada).

Our designated Privacy Officer is:

The Privacy Officer is responsible for our compliance with this policy, for responding to access requests, and for handling privacy complaints.

4. What personal information we collect

4.1 Information you give us directly

Contact and identity information. Name, mailing address, email address, telephone number, and preferred language.

Tax and financial information. Social Insurance Number, U.S. Social Security Number or Individual Taxpayer Identification Number, date of birth, marital status, dependants, citizenship and residency status, employment and self-employment income, investment income, foreign asset and foreign account details, business financial records, bank account details for direct deposit or pre-authorized debit, and any other information needed to prepare your returns or financial statements.

Identity documents for ITIN applications. As an IRS Certifying Acceptance Agent, we review and certify original identification documents such as passports, national identity cards, birth certificates, visas and U.S. entry stamps in order to complete Form W-7 and the accompanying Certificate of Accuracy, Form W-7 (COA).

Correspondence. Messages you send us by email, through our website contact form, through our client portal, or by telephone.

4.2 Information collected automatically on our websites

Our web servers and analytics tools automatically record IP address, browser type and version, operating system, device type, referring page, pages viewed, and the date, time and duration of your visit.

4.3 Information from third parties

With your authorization, we may receive information about you from the Canada Revenue Agency (for example through Represent a Client), the Internal Revenue Service, your previous accountant, your financial institutions, your employer, or your legal advisers.

5. Why we collect it — identified purposes

PIPEDA Principle 2 requires that the purposes for collection be identified at or before the time of collection. We collect, use and disclose personal information only for the following purposes:

1. To prepare, review and file your Canadian and United States tax returns and information returns.
2. To provide bookkeeping, payroll, accounting, controllership and business advisory services.
3. To prepare and submit ITIN applications on Form W-7 and to certify supporting identification documents as an IRS Certifying Acceptance Agent.
4. To represent you before the Canada Revenue Agency and the Internal Revenue Service where you have authorized us to do so.
5. To verify your identity and satisfy our professional, regulatory and anti-money-laundering obligations.
6. To communicate with you about your engagement, deadlines, and requested documents.
7. To issue invoices and collect payment.
8. To maintain our records as required by professional standards, tax law and limitation periods.
9. To operate, secure and improve our websites.
10. To send you commercial electronic messages where you have consented to receive them.

We do not collect personal information for any purpose that a reasonable person would not consider appropriate in the circumstances.

6. Consent

We obtain your knowledge and consent before collecting, using or disclosing personal information, except where the law permits or requires otherwise.

Consent may be express (for example, signing an engagement letter, an authorization form, or a section 7216 consent) or implied (for example, providing us your receipts so we can prepare your return).

You may withdraw consent at any time, subject to legal and contractual restrictions and on reasonable notice. Withdrawing consent may mean we can no longer provide some or all of our services. Withdrawal of consent does not apply retroactively to filings already made or to records we are legally required to retain.

6.1 Special rule for U.S. tax return information — IRC section 7216

If we prepare a United States tax return for you, the information you give us for that purpose is "tax return information" under Internal Revenue Code section 7216. We may not use or disclose that information for any purpose other than preparing your return unless you first give us a separate, written, signed consent that meets the specific form and content requirements set out in Treasury Regulation 301.7216-3 and Revenue Procedure 2013-14 (IRS Section 7216 Information Center).

This means:

• We will not use your U.S. tax return information to market other services to you without your prior written section 7216 consent.
• We will not disclose your U.S. tax return information to any third party, including affiliates, without your prior written section 7216 consent, unless the disclosure is permitted without consent under the regulation.
• Any such consent will identify the intended purpose, the recipient, and the specific information to be disclosed, and will tell you that you are not required to sign it.
• Unauthorized use or disclosure may result in criminal penalties under section 7216 and civil penalties under section 6713.

If you decline to give a section 7216 consent, we will still prepare your return. Only the optional marketing or third-party disclosure will not occur.

7. Cookies, analytics and other website technologies

Our websites use the following technologies. This list is accurate as of the effective date above and will be updated if it changes.

Google reCAPTCHA collects hardware and software information, including device and application data, and sends it to Google for analysis. Your use of reCAPTCHA is subject to Google's own privacy policy and terms.

Your choices. You may accept or decline non-essential cookies through the consent banner on first visit and may change your choice at any time. You can also block or delete cookies in your browser settings. Strictly necessary cookies cannot be disabled without affecting site functionality.

Do Not Track. Our websites do not currently respond to browser Do Not Track signals.

8. Commercial email and your right to unsubscribe

We send newsletters, tax deadline reminders and firm updates only to people who have given express or implied consent under Canada's Anti-Spam Legislation.

Every commercial electronic message we send identifies A Garg CPA Professional Corporation, gives our mailing address and contact information, and includes an unsubscribe mechanism. If you unsubscribe, we will stop sending you commercial electronic messages within 10 business days (CRTC).

Where the message relates to United States tax return information, we will only send it if you have also given the separate written consent described in section 6.1 above.

Transactional and engagement-related messages — for example, a request for a missing document or notice that your return is ready to sign — are not commercial electronic messages and will continue regardless of your marketing preferences.

9. Who we disclose personal information to

We do not sell, rent or trade personal information. We disclose it only as follows.

Tax authorities. The Canada Revenue Agency, the Internal Revenue Service, provincial ministries of finance and U.S. state tax authorities, in the course of filing returns or representing you with your authorization.

Service providers. Our tax preparation software, client portal, secure file transfer, email, cloud storage, payment processing and IT support vendors. Some of these providers process or store data in the United States. We require service providers by contract to protect personal information to a standard comparable to this policy and to use it only for the purposes we specify.

Professional advisers. Your lawyer, financial adviser or other accountant, only with your authorization.

Where required by law. In response to a valid court order, subpoena, summons, search warrant, practice inspection or regulatory investigation, including a CPA Ontario practice inspection or an IRS review of our Certifying Acceptance Agent activity under Revenue Procedure 2006-10.

Business transaction. If our practice is sold or merged, personal information may be transferred, subject to the acquiring party agreeing to protect it under terms consistent with this policy and subject to any applicable professional and section 7216 restrictions.

9.1 Cross-border transfer

Because we provide cross-border tax services, your personal information will be transferred to and processed in the United States, and may be stored on servers located there. While it is in another country, it may be accessible to the courts, law enforcement and national security authorities of that country under that country's laws. By engaging us for U.S. tax services you acknowledge this transfer.

10. How we protect your information

We maintain a written information security plan as required of tax return preparers by the FTC Safeguards Rule and described in IRS Publication 5708. Our safeguards include:

• Encryption of data in transit and at rest for our client portal and file transfer.
• A secure client portal for exchanging tax documents rather than ordinary email attachments.
• Multi-factor authentication on systems holding client data.
• Access limited to personnel who need the information to do their work.
• Confidentiality obligations imposed on all staff and contractors.
• Locked physical storage for paper files and secure shredding on disposal.
• Regular patching, anti-malware protection and monitoring.
• A documented incident response procedure.

No method of transmission or storage is completely secure. We cannot and do not guarantee that our safeguards will prevent every unauthorized access, and we make no such guarantee. What we commit to is maintaining security appropriate to the sensitivity of the information, as PIPEDA Principle 7 requires.

11. Privacy breaches

If a breach of our security safeguards creates a real risk of significant harm to you, we will:

• Report the breach to the Privacy Commissioner of Canada;
• Notify you directly and as soon as feasible, describing the circumstances of the breach, when it occurred, the information involved, what we have done to reduce the harm, what you can do to protect yourself, and who to contact for more information; and
• Notify any other organization or government institution that may be able to reduce or mitigate the harm.

We keep a record of every breach of security safeguards involving personal information under our control, whether or not it creates a real risk of significant harm, for at least 24 months (Office of the Privacy Commissioner of Canada).

If the breach involves U.S. taxpayer data, we will also follow IRS and state reporting procedures for tax professional data theft.

12. How long we keep your information

We retain personal information only as long as necessary for the purposes identified in this policy or as required by law and professional standards.

Original identification documents you provide for an ITIN application are reviewed and returned to you. We retain copies as required by our Acceptance Agent Agreement.

When information is no longer needed, we destroy, erase or de-identify it securely.

13. Accuracy

We keep personal information as accurate, complete and up to date as necessary for the purposes for which it is used. Please tell us promptly if your name, address, marital status, residency status, dependants or banking information changes, as inaccurate information can directly affect your tax filings.

14. Your rights

Access. You may request access to the personal information we hold about you, and information about how it has been used and to whom it has been disclosed. We will respond within 30 days, or tell you if we need an extension. In limited circumstances the law allows or requires us to withhold information — for example, information that would reveal personal information about another person, or that is subject to solicitor-client privilege — and we will tell you why.

Correction. You may challenge the accuracy or completeness of your information and ask us to amend it.

Withdrawal of consent. As described in section 6.

Marketing opt-out. As described in section 8.

Complaint. As described in section 15.

There is no charge for a straightforward access request. If a request requires substantial effort, we will give you an estimate of any cost before proceeding.

To exercise any of these rights, contact our Privacy Officer at pr*****@*****rg.com. We may ask you to verify your identity before we act on a request.

15. Challenging our compliance

If you have a question, concern or complaint about how we handle personal information, contact our Privacy Officer first. We will acknowledge your complaint, investigate it, and give you a written response.

If you are not satisfied with our response, you may contact:

You may also contact CPA Ontario regarding the professional conduct of a registered member or firm.

16. Children

Our services are directed to adults. We collect information about minors only where a parent or guardian provides it in connection with a family tax filing, a dependant's ITIN application, or a similar purpose, and only with that parent or guardian's consent.

17. Third-party links

Our websites link to third-party sites, including our client portal, our payment provider, and government websites. We are not responsible for the privacy practices of those sites. Review their privacy policies separately.

18. Changes to this policy

We may update this Privacy Policy from time to time. The effective date at the top of this page shows when it was last revised. Material changes will be posted prominently on our websites. Where a change would affect how we use information we already hold, we will obtain any consent the law requires.

19. Contact us