US Privacy Notice

1. Introduction

1. This notice describes how Ostberg Sinclair & Co. Inc collects, uses, discloses, stores and otherwise processes personal information in connection with our professional services, business operations, recruitment activities, website and related communications. It is intended to address applicable US federal and state privacy and data security requirements, including, where applicable, the Gramm-Leach-Bliley Act (“GLBA”), the Federal Trade Commission Safeguards Rule (“FTC Safeguards Rule”), Internal Revenue Code Section 7216 (“IRC §7216”), and applicable US state consumer privacy laws. This notice is a general privacy notice and does not replace any more specific notice, engagement terms, consent, notice at collection or sector-specific disclosure that may apply to a particular service, product, state law requirement or regulated activity.
2. Ostberg Sinclair & Co. Inc is responsible for safeguarding personal information and for determining how and why personal information is processed in connection with the services and activities described in this notice, except where we process information on behalf of another organisation. The firm’s contact details are as follows: Ostberg Sinclair & Co. Inc, 575 Lexington Avenue, New York, NY 10022. Email address privacy@osandco.com
3. This privacy notice applies generally to personal information processed by Ostberg Sinclair & Co. Inc in connection with our professional services, business operations, recruitment activities, website and related communications. It is intended to apply to clients, prospective clients, business contacts, suppliers, job applicants, website users and other individuals whose personal information we process in the course of our business, whether they are located in the United States or, where relevant to our services, outside the United States.
4. Because privacy rights and obligations may vary depending on the individual’s place of residence, the nature of the relationship with us and the applicable law, certain additional rights or protections may apply only to the extent required by applicable US federal or state law. Where we act on behalf of another organisation as a service provider, processor, contractor or similar role, contractual provisions may also govern our processing of personal information and should be read in conjunction with this notice.

2. Personal information we process

1. The personal information we process about you depends on the purpose for which you have engaged us, but includes the following data:
   1. Full name, address, e-mail address, telephone number
   2. Date of birth
   3. Job title and company name
   4. Banking details if relevant to the service
   5. Tax filing details, including Social Security Number (SSN), Individual Taxpayer Identification Number (ITIN) and other tax identifiers
   6. Other personal information that you choose to provide
   7. Employment status
   8. Financial information where relevant to the services
   9. Your Curriculum Vitae (CV) where relevant
   10. Information from website enquiries, including IP address, geographical location, operating system and browser type
   11. Information collected via cookies and similar tracking technologies (see our Cookie Policy)

2A. Sources of personal information and whether you must provide it

1. We generally collect personal information directly from you, but we may also collect it from your employer or business, family members or representatives acting on your behalf, professional advisers, counterparties, public records, tax authorities, regulators, identity verification and sanctions screening providers, software providers you ask us to use, recruitment contacts, referees, and other third parties where relevant to the services or activities concerned.
2. Where personal information is needed so that we can provide services, establish or maintain a client relationship, comply with legal, tax, regulatory, professional, anti-fraud or anti-money laundering obligations, or process an application, failure to provide that information may mean that we cannot provide or continue providing services, complete the relevant filing, process your request, or otherwise carry out the activity concerned.

3. The purposes for which we intend to process personal information

1. We intend to process personal information for the following purposes:
   1. To enable us to supply professional accounting, tax and advisory services to you
   2. To prepare, file and support tax returns and related filings
   3. To comply with legal and regulatory obligations, including obligations under US tax law
   4. To comply with professional obligations applicable to CPAs and tax preparers
   5. To use in the investigation and/or defence of complaints, regulatory enquiries or legal proceedings
   6. To invoice you and address any fee-related matters
   7. To contact you about other services we provide where permitted by law or with your consent
   8. For recruitment and employment-related purposes
   9. Procurement of services from suppliers

4. How we are permitted to collect and use personal information

1. Under US law, we are permitted to collect and process personal information in connection with providing financial and professional services.
2. We process personal information:
   1. As necessary to provide services requested by you
   2. To comply with legal and regulatory obligations
   3. As reasonably required to operate and maintain our business
   4. With your consent where required (including for certain disclosures under IRC §7216)

5. Tax return information (IRC §7216)

1. Where we receive or process tax return information, we are subject to the requirements of Internal Revenue Code §7216 and related regulations.

2. We will not disclose or use your tax return information for any purpose other than tax preparation and related services unless:

   1. you provide prior written consent; or
   2. disclosure is otherwise permitted or required by law

   Criminal penalties may apply for unauthorised disclosure or use of tax return information.

6. Sensitive personal information

1. We may collect sensitive personal information such as Social Security Numbers, financial account information and tax identification numbers where necessary to provide our services.
2. We will take appropriate technical and organisational measures to protect such information.

7. Data sharing: Persons/organisations to whom we may give personal information

1. We will only share personal information where necessary and permitted by law. We do not sell your personal information to third parties.
2. We may share your personal information with:
   1. The Internal Revenue Service (IRS) and state tax authorities
   2. Cloud hosting providers, software providers, IT support providers, cybersecurity providers and other technology service providers
   3. Third parties with whom you authorise us to correspond
   4. Subcontractors, affiliated firms and specialist providers engaged by us to assist in the delivery of our services
   5. Tax insurance providers
   6. Professional indemnity insurers
   7. Professional bodies or regulators
   8. Law enforcement and regulatory authorities
   9. Employers, global mobility providers and payroll providers where this is necessary to provide employer-sponsored tax, payroll or mobility services
   10. Affiliated group companies
   11. Courts and tribunals
   12. Law enforcement agencies
3. We may need to share your personal data with the third parties identified above in order to comply with our legal obligations, including our legal obligations to you. If you ask us not to share your personal information where sharing is necessary to provide services or comply with law, we may be unable to continue acting for you.
4. We may engage affiliated firms, contractors or specialist third-party providers to perform services on our behalf. In some cases, these services may be provided as part of our overall service offering to clients. Such providers will only receive access to personal information to the extent necessary for the performance of the services and will be subject to appropriate contractual obligations relating to confidentiality, security and data protection.

8. Cross-border data transfers

1. As part of our service delivery model, personal information may be accessed, processed and stored in the United States, the United Kingdom and other jurisdictions in which we or our service providers operate. In particular, personal information may be shared with and processed by our affiliated firm in the United Kingdom where this is necessary to provide services, support our operations, maintain records, or administer our business.
2. Where cross-border transfers of personal information occur, we take reasonable steps to ensure that appropriate safeguards are in place to protect the confidentiality, integrity and security of the information. These measures may include contractual protections, access controls, confidentiality obligations, data minimisation, and other technical and organisational measures appropriate to the nature of the information and the transfer.

9. Data sharing in the event of a sale of all or part of the business

1. If we are involved in a merger, acquisition, reorganisation, financing, sale of assets or similar business transaction, personal information may be disclosed to prospective purchasers, investors, advisers and other transaction participants for due diligence and transaction-related purposes. We require appropriate confidentiality and security protections for personal information disclosed in this context.
2. If a transaction is completed, personal information may be transferred to the successor organisation or relevant purchaser as part of the transaction, subject to applicable law and any notice requirements that apply.

10. Retention of personal information

1. We retain personal information only for as long as reasonably necessary for the purposes described in this notice, including to provide services, comply with legal, tax, accounting, regulatory, professional, security and recordkeeping obligations, resolve disputes, enforce our agreements, and establish, exercise or defend legal claims. Retention periods vary depending on the nature of the information and the services provided. By way of example, client engagement records, tax return information, working papers, correspondence, billing records and related service files are typically retained for up to seven years after the end of the relevant engagement unless a longer period is required or justified; information maintained for identity verification, compliance or security purposes may be retained for the period required by law or reasonably necessary to meet those obligations; recruitment records are typically retained for up to twelve months after the end of the relevant hiring process unless a longer period is required or permitted; and records of privacy requests, consents, objections and suppression preferences may be retained for as long as necessary to document compliance and honour those choices. We may retain information for longer where required by law, where litigation, an audit, an investigation or a regulatory enquiry is anticipated or ongoing, or where necessary to protect our legal or regulatory position.

11. Access to personal information

1. You may request access to the personal information we hold about you by contacting us using the details above.
2. We may require verification of identity before providing access.
3. We will respond within a reasonable timeframe and in accordance with applicable laws.

12. Correction of personal information

1. You may request correction of inaccurate or incomplete personal information.
2. Please notify us promptly if any information we hold about you is incorrect.

13. Deletion of personal information

1. You may request that we delete your personal information where permitted by law.
2. We may be unable to delete certain information where retention is required for legal or regulatory purposes.

14. Restricting processing

1. In certain circumstances, you may request that we limit the processing of your personal information.
2. We will consider such requests in accordance with applicable laws.

15. Withdrawal of consent

1. Where we rely on consent, you may withdraw that consent at any time.
2. Please note:
   1. This will not affect prior lawful processing.
   2. We may not be able to continue providing services.
   3. We may continue processing where required by law.

16. Automated decision-making

1. We do not intend to use automated decision-making in relation to your personal information.

17. Additional rights and disclosures under applicable US state privacy laws

In addition to any rights described elsewhere in this notice, residents of certain US states may have the following additional rights:

1. Residents of certain US states may have additional rights under applicable privacy laws, subject to exemptions and limitations. Depending on the law that applies and the context in which we process information, those rights may include the right to know or confirm whether we process personal information about you, access that information, correct inaccuracies, delete personal information, obtain a portable copy of certain personal information, and opt out of certain processing activities.
2. For purposes of applicable state privacy laws, the categories of personal information we may collect are described in Section 2 of this notice, the categories of sources from which we collect personal information are described in Section 2A, the purposes for which we use personal information are described in Section 3, and the categories of third parties to whom we may disclose personal information are described in Section 7.
3. We do not sell personal information for monetary consideration. We also do not sell or share personal information for cross-context behavioural advertising and we do not engage in targeted advertising or profiling in furtherance of decisions that produce legal or similarly significant effects, except to the extent expressly stated in a more specific notice or required for a particular service offering. If our practices change, we will update this notice as required by law.
4. Where we collect sensitive personal information, we use it only as reasonably necessary and proportionate to provide requested services, comply with legal, regulatory and security obligations, detect and prevent fraud or other unlawful activity, maintain our systems, or otherwise as permitted by applicable law. We do not use or disclose sensitive personal information for purposes that would require a separate right to limit use unless we provide any additional notice required by law.
5. To exercise any rights available to you under applicable law, please contact us using the details in this notice. We may need to verify your identity before acting on your request and may request additional information for that purpose. You may also use an authorised agent where permitted by law, subject to appropriate verification and authority requirements.
6. Where applicable law grants you the right to appeal a decision relating to a privacy rights request, you may submit an appeal by contacting us and stating that you wish to appeal the decision. We will review the matter and respond within the period required by applicable law.
7. These rights are not absolute and may not apply in every case. In particular, rights may be limited where an exemption applies or where we are permitted or required by law to retain or continue processing the information.

18. Complaints

1. If you have concerns about how we handle your personal information, please contact us at privacy@osandco.com.
2. You may also have the right to complain to applicable US regulators depending on your jurisdiction.

19. Cookies

1. Navigation on our website will result in cookies being placed on your computer. Cookies are small text files that are placed on your computer by the websites that you visit.
2. We use cookies and similar technologies on our website. Nonessential cookies are used only with your consent, and you can change or withdraw your consent at any time using the cookie settings on our website. For further information, please see our Cookie Policy.