Data Processing Addendum

The player controls their underlying records and authorizes firm access. The firm determines the professional purpose and scope of its use. The platform processes information to provide the requested service, maintain security, and comply with law. Nothing here overrides duties imposed directly on a firm or preparer.

The firm will provide lawful instructions, limit access to authorized personnel, assign appropriate roles, remove access promptly, protect credentials and downloaded files, maintain required safeguards, and obtain any taxpayer consent or professional authorization required for its use.

The platform maintains role-based access, protected storage, append-only access histories, and available encryption and retention controls. The firm evaluates whether those controls meet its regulatory, contractual, insurance, and client requirements.

Tax return preparers and auxiliary service providers may have obligations under 26 U.S.C. §7216 and its regulations. The firm must determine when written taxpayer consent is required and must not use an ordinary platform invitation as a substitute for a consent form whose content and format are prescribed by law.

Each party will address incidents and legally valid requests within its control and provide reasonable cooperation. The firm remains responsible for notices, regulator contact, and client communications legally assigned to the firm, including duties arising from downloaded or independently stored copies.

At the end of authorized access, the firm must stop retrieving client information and handle its own copies under applicable retention rules. Platform deletion remains subject to security, immutable-history, backup, dispute, and legal-retention requirements.