Privacy Policy

Introduction

AccGuru respects your personal information, and this Privacy Policy outlines our obligations to protect and manage it. We are committed to ensuring the safekeeping and proper handling of personal information. In line with this commitment, we adhere to ISO/IEC 27001-aligned security measures, which govern the manner in which we collect, use, disclose, store, secure, and dispose of your personal information. Our practices ensure that your personal information is managed in accordance with applicable data protection laws, including the Australian Privacy Act 1988, the UK General Data Protection Regulation (UK GDPR), the EU GDPR, Canada’s PIPEDA, and applicable United States privacy laws.

In most cases, AccGuru acts as a Data Processor, processing personal information on behalf of our clients (who act as Data Controllers), and only processes such data based on documented instructions.

Collection of Personal Information

AccGuru does not contact your clients directly or indirectly. Any client information is collected through your firm.

The information we collect includes:

• Names, addresses, dates of birth, and places of birth

• Employment details

• Personal health and insurance information

• Financial information such as income, expenses, retirement accounts, and investment details

We collect personal information for the primary purpose of delivering our services to you. We may also use this information for secondary purposes closely related to the primary purpose, where you would reasonably expect such use or disclosure, or where required or authorised by law.

Where applicable under the UK GDPR and EU GDPR, personal data is processed based on one or more of the following legal bases: performance of a contract, compliance with legal obligations, legitimate interests, or consent.

In certain circumstances, personal information may be provided to us by third parties (such as your firm). In such cases, we take reasonable steps to ensure that individuals are informed about the collection and use of their data.

You may unsubscribe from our mailing lists at any time by contacting us in writing or clicking on the “Unsubscribe” link at the bottom of marketing emails sent by us.

When collecting personal information, we will, where appropriate and possible, explain why we are collecting it and how we plan to use it.

Use of Personal/Sensitive Information

AccGuru provides Business Process Outsourcing solutions in areas including accounting, compliance, and operational and administrative processes for businesses in:

• Accounting

• Financial planning

• Mortgage brokering

• Legal firms

• Operations

• Small to medium businesses

The personal information collected is used only to facilitate one or more of the above services for your firm, as requested by you. AccGuru uses personal information:

• For the primary purpose for which it was obtained

• For a secondary purpose that is directly related to the primary purpose

• With your consent; or where required or authorised by law.

Where applicable under GDPR/UK GDPR, personal data is processed based on legal grounds such as contractual necessity, legal obligations, legitimate interests, or consent.

Third Parties

Where reasonable and possible, we collect personal information only from you. However, in certain circumstances, we may receive information from third parties.In such cases, we take reasonable steps to ensure that individuals are made aware of the information provided to us.

While we do not subcontract work to external vendors, we may use trusted third-party service providers to support our services. These providers are subject to strict confidentiality and security obligations.

Disclosure of Personal Information

AccGuru provides access to personal information only to authorised staff who require it to perform tasks requested by your firm. The information is not sold or disclosed to external parties except:

• Where required or authorised by law.

Storage and Data Security

AccGuru stores data electronically on secure servers and has implemented appropriate technical and organisational measures to protect data integrity and confidentiality. Our secure delivery centre is equipped with modern technology, infrastructure, and dedicated technical staff to ensure a secure working environment for client data. Our offices and systems align with international best practices for information security management.

We retain data only for as long as necessary to fulfil service requirements and comply with legal and regulatory obligations.

In addition to the above, the following controls are in place:

• Access cards are required to enter our offices; only authorised personnel are permitted entry

• Physical documents, books, and personal devices are prohibited in the processing centre

• CCTV surveillance is implemented across the office

• Systems operate on secure desktop environments

• Access to physical/removable drives (USB, external drives) is disabled

• Printers and scanners are not available within the processing centre

• Employees must store personal belongings in secure lockers outside the processing area

• Internet access is restricted through whitelisting; personal email access is blocked, and work emails are monitored

• Internal systems and applications are restricted through IP-based access controls

• Systems are protected with strong password policies and regular password updates

• Regular monitoring and audits are conducted to ensure compliance with security policies

• Firewalls, antivirus, intrusion detection, and prevention systems are implemented

• Security systems are regularly updated

• Systems include auto-lock features to prevent unauthorised access

• Wireless connections are prohibited within secure processing environments.

Data Subject Rights

General Rights: As a data subject, you have specific rights concerning your personal data under applicable data protection laws. To exercise these rights, please contact us at dpo@AccGuru.net.

Geographical Variations

Australia:

• Anonymity and Pseudonymity: Where practicable, you have the option not to identify yourself or to use a pseudonym when interacting with us.

• Right to Correction: You can request correction of any inaccurate personal data.

• Direct Marketing Opt-out: You have the right to request that your personal data not be used for direct marketing purposes.

• Data Portability: You can request your data in a portable and usable format.

Canada:

• Access to Personal Information: You have the right to know how your personal data is used and to access it.

• Rectification: You can request correction of inaccurate personal data.

• Consent Withdrawal: You may withdraw consent for the use of your personal data, subject to legal or contractual restrictions.

• Complaints: You can file a complaint with the Privacy Commissioner if you believe your rights have been violated.

Europe and UK:

• Access and Information: You have the right to access your personal data and be informed about its use.

• Erasure: You can request the deletion of your data under certain conditions.

• Rectification: You have the right to correct inaccurate or incomplete data.

• Restriction of Processing: You may request restriction of the processing of your personal data.

• Objection: You have the right to object to processing, including for direct marketing purposes.

• Automated Decision-Making: You have rights related to automated decision-making, including profiling with legal or significant effects.

• Withdraw Consent: You can withdraw consent at any time, where applicable.

• Data Portability: You have the right to receive your data in a structured, commonly used, and machine-readable format.

United States:

• State-Specific Rights: Rights vary by state but generally include the right to access, correct, and, in some cases, delete your personal data.

• California (CCPA/CPRA): You have the right to:

• Know the categories and purposes of personal data collected

• Request deletion of personal data

• Opt out of the sale or sharing of personal data

• Not be discriminated against for exercising your rights

Additional Information for Compliance

• Response Time: In accordance with GDPR/UK GDPR, we aim to respond to requests within one month of receipt. This period may be extended by up to two additional months where necessary, considering the complexity and number of requests.

• Complaints: If you believe your data protection rights have been breached, you have the right to lodge a complaint with the relevant supervisory authority.

Making a Privacy Complaint

If you have concerns about how AccGuru collects, maintains, or uses your personal information, you may submit a complaint to our Data Privacy Officer(DPO) at dpo@AccGuru.net.

Upon receiving your complaint, our Data Privacy Officer will address your request confidentially within thirty (30) days.

If you are not satisfied with our response, you have the right to lodge a complaint with the relevant data protection authority in your jurisdiction.

For complaints within Australia, you may contact the Office of the Australian Information Commissioner (OAIC):

• Website: http://oaic.gov.au

• Email: enquiries@oaic.gov.au

• Phone: 1300 363 992

• Fax: +61 2 6123 5145

For complaints within the United Kingdom (UK):

You may contact the Information Commissioner’s Office (ICO):

• Website: https://ico.org.uk

• Phone: +44 303 123 1113

• Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom

For complaints within the United States:

As privacy laws in the United States are state-specific, you may contact your relevant State Attorney General’s Office.

For California residents, you may contact:

• California Attorney General

• Website: https://oag.ca.gov

• Phone: (800) 952-5225

Cookies and Tracking Technologies

Our website may use cookies and similar technologies to enhance user experience and analyse usage. You may control cookie preferences through your browser settings.

Reporting of Data Breach

If a data breach is likely to result in serious harm, we will take the following actions:

• Contain the breach and assess the actual impact caused

• Prepare a statement detailing the breach

• Notify affected individuals and relevant stakeholders as soon as practicable

• Where required, notify relevant regulatory authorities (for example, within 72 hours under GDPR/UK GDPR, where applicable)

• If direct notification is not possible:

• Publish a copy of the statement on our website, and

• Take reasonable steps to publicise the contents of the statement

• Review and update our systems and processes to prevent future incidents

Access to Personal Information

Your firm and authorised staff can access the personal information you provide. AccGuru will take reasonable steps to verify your identity before providing access.

Additionally, you may request access to the personal information we hold about you and request updates or corrections, subject to certain exceptions. To make a request, please contact us via email.

Ensuring Quality of Your Personal Information

We take reasonable steps to ensure that your personal information is accurate, complete, and up to date. If you believe that the information we hold is inaccurate or outdated, please inform us at the earliest so that we can update our records and continue to provide quality services.

Changes to This Privacy Policy

This Privacy Policy may be updated from time to time. Any changes will be published on our website: www.AccGuru.net.

AccGuru reserves the right to update or modify this policy at any time without prior notice. Any changes will apply only to personal information collected after the updated policy is published.

If you have any questions regarding this Privacy Policy, please feel free to contact us.