Privacy Policy

Last updated: September 29, 2026

1. Who We Are and What This Policy Covers

Tukel, Inc. (“Tukel,”,”Tukel Accounting”, “we,” “us,” or “our”) provides bookkeeping, tax preparation, payroll and HR support, financial reporting, and CFO advisory services (together, the “Services”), together with our website at tukelinc.com and its subdomains under tukelinc.com domain (the “Website”) and forms (the “Site”).

Our Services are mainly sold to U.S. businesses. We market and provide the Services to companies and other organizations, not to individuals for personal, family, or household purposes, except where we prepare an individual income tax return for a person in connection with services provided to their business. The Site is intended for business use.

This policy explains how we handle personal information when we market the Services, deliver the Services, and operate our business.

If you are an individual whose information appears in a client’s records, for example, an employee on a payroll we process, a contractor who received a Form 1099, or a customer named in a client’s transaction data, we handle that information on behalf of our client, at their direction. Please contact that business directly with any request about your information. We will support them in responding.

Other documents sit alongside this one:

• Our GLBA Privacy Notice describes how we handle nonpublic personal information for individual clients under the Gramm-Leach-Bliley Act.
• Our Cookie Policy describes the tracking technologies on the Site.

We can provide our current subprocessor list of the vendors that process client data on request.

Where this policy and the GLBA Privacy Notice differ as to an individual client’s nonpublic personal information, the GLBA Privacy Notice controls.

2. The Three Kinds of Information We Hold

We separate the information we hold into three categories, because we use and keep them differently.

2.1 Client Data

Financial, tax, payroll, and business records that a client gives us, or authorizes us to obtain, so that we can deliver the Services, plus the reports, returns, filings, and statements we produce from them.

We receive Client Data directly from clients, and through connections a client authorizes us to make to their systems (for example accounting platforms, payment processors, payroll providers, banks, and document capture tools).

Client Data may include personal information such as:

• Names, business and personal contact details, and addresses
• Social Security Numbers, ITINs, and EINs where required to prepare returns or information returns
• Passport or other identification details for non-U.S. owners, where required for filings such as Form 5472 or Form W-8
• Dates of birth
• Bank account and payment details
• Compensation, payroll, and benefits information for a client’s workers
• Ownership, equity, and cap table information
• Transaction-level financial records, invoices, receipts, and expense documentation
• Anything else reported on a tax return we prepare

Some of this is sensitive personal information under state privacy laws, and nonpublic personal information under the Gramm-Leach-Bliley Act.

2.2 Engagement Records

The record of the work we performed: work papers, computations, our correspondence with a client, the instructions and approvals we relied on, drafts, engagement letters, signed consents, and scheduling and follow-up records. These typically contain names, business contact details, job titles, and the content of what was discussed.

2.3 Site and Account Data

Information generated when someone uses the Site or when a client uses the third-party client portal we provide, or when we market the Services:

• Name, business email, business phone, company name, job title
• Client portal credentials and authentication records (the portal is operated by a third-party provider; we do not issue accounts on the Site itself)
• Billing and subscription records
• IP address, device and browser information, and cookie or similar identifiers
• Pages viewed, links clicked, forms submitted, and email opens and clicks
• Content of enquiries submitted through our forms, booking tools, or email

3. Where We Get Information

• Directly from you — forms, email, calls, uploads, the client portal
• From systems you connect — accounting, banking, payroll, e-commerce, and payment platforms you authorize us to access
• From people at your organization — a colleague who adds you as a contact
• From our vendors — analytics and marketing tools, and data enrichment providers
• From public sources — company registries, government filings, and public websites
• From referral partners — where someone refers your business to us

4. Why We Use It

To deliver the Services. Bookkeeping, reconciliation, financial reporting, preparing and filing returns and information returns, payroll processing and filings, state registrations, and advisory work.

To run the engagement. Onboarding, identity and eligibility checks, answering questions, scheduling, invoicing and collecting fees, and keeping records of instructions and approvals.

To meet legal and professional obligations. Tax law, information reporting, anti-money-laundering and sanctions screening where applicable, records retention, responding to lawful requests, and maintaining professional standards.

To secure and improve the Services. Fraud prevention, access control, monitoring, troubleshooting, and improving our processes and tooling.

To market the Services. Email and, where you have opted in, SMS; measuring campaign effectiveness; and understanding how people use the Site. We use only Site and Account Data for marketing, never Client Data.

For aggregated insight. We may produce aggregated or de-identified statistics. We do not re-identify this data, and we do not publish anything from which a client or individual can be identified.

Artificial intelligence

We do not enter Client Data into general-purpose artificial intelligence tools.

We use AI-assisted tools from our vendors to help perform the Services for example, transaction categorization and document extraction. A member of our team reviews the output before it is relied on. We consider vendors’ data-use practices when selecting and configuring AI-assisted tools and, where configurable options are available, select settings designed to prevent Client Data from being used to train general-purpose AI models.

5. What We Never Do

• We do not sell personal information, as that term is defined under state privacy laws.
• We do not share Client Data with nonaffiliated third parties for their own marketing purposes.
• We do not disclose a client’s tax return information to anyone except as permitted by IRC §7216 and its regulations, or with the client’s prior signed consent.
• We do not share mobile telephone numbers or SMS opt-in data with third parties for marketing or promotional purposes. Every category of data described in this policy as shared for marketing excludes text-message originator opt-in data and consent.

6. Who We Disclose Information to

Service providers. Vendors who process information on our instructions to help us deliver the Services or run our business, accounting and tax software, document management, secure file transfer, the client portal, payroll platforms, e-file transmission, cloud hosting and backup, email and communications, payment processing, and analytics.

We select providers with regard to their security practices. For established platforms that contract on standard terms, we review the provider’s published security documentation and certifications. Where a provider will contract on negotiated terms, we impose written confidentiality and data security obligations.

Third-party tax preparers. Where an outside firm prepares or assists in preparing a return, we disclose the information necessary for that work. We obtain your signed written consent before any such disclosure, in the form required by IRC §7216 and the Treasury regulations. See Section 8.

Government authorities. The IRS, state and local tax authorities, and other agencies, in connection with filings we make for you or as required by law.

Professional advisers. Our lawyers, insurers, and accountants, who are bound by confidentiality obligations.

At your direction. Your bank, your lawyer, your investors, another accountant, whenever you instruct us to.

Legal process and protection. Where required or permitted by law: court orders, subpoenas, regulatory requests, and to protect our rights, our clients, or others against fraud or harm.

Business transfer. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. We will notify affected clients where required.

7. International Transfers

We are a US company and information is primarily stored and processed in the United States.

Some of our personnel and service providers are located outside the United States. Where they access client information, that information is transferred outside the United States. We apply the safeguards described in Section 9 wherever information is processed, and we obtain the consents required by IRC §7216 if and when possible, before any tax return information is disclosed to a preparer outside the United States.

8. Tax Return Information — IRC §7216

Under IRC §7216 and Treasury Regulations §§301.7216-1 through 301.7216-3, we may not disclose or use your tax return information except as the regulations permit, or with your prior written consent on a separate signed document.

What this means for you:

• We will not disclose your return information to any outside preparer, lender, investor, or other third party without your signed consent.
• We will not use your return information to market unrelated services to you.
• Each consent identifies the specific information, the specific recipient, and the specific purpose. A consent is not open-ended.
• You will receive a copy of every consent you sign.
• You may decline. If declining means we cannot perform a service, or changes its cost, we will tell you before you decide.
• This privacy policy is not a consent, and signing our engagement letter is not a consent. The regulations require a separate document.

9. How We Protect Information

We maintain a written information security program as required by the FTC Safeguards Rule (16 CFR Part 314), which applies to us as a financial institution under the Gramm-Leach-Bliley Act. It includes:

• A designated individual responsible for the program
• Periodic risk assessment
• Multi-factor authentication for access to systems holding client information
• Encryption of client information in transit and at rest
• Access controls limiting information to personnel who need it
• Vendor due diligence and contractual security obligations
• Secure disposal of information no longer required
• Staff training
• A documented process for responding to security incidents
• Annual review of the program

Please do not send tax documents, Social Security Numbers, or bank details by ordinary email. Email is not a secure channel. Use the client portal or the secure upload link we provide. If you send sensitive information by email anyway, you do so at your own risk.

If a security incident affects your information, we will notify you as required by applicable state and federal law. Where an incident involves the unencrypted information of 500 or more consumers, we will notify the Federal Trade Commission within 30 days of discovery, as required by 16 CFR §314.4(j).

No method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee its absolute security.

10. How Long We Keep Information

Two principles govern how long we hold your information.

First, we dispose of client information no later than two years after we last used it to serve you unless we need to keep it for a legitimate business purpose (such as an ongoing engagement, audit readiness, or a contractual obligation), a legal or regulatory requirement applies, or targeted disposal is not feasible because of the way the information is stored.

Second, where a tax or regulatory retention period applies, that period takes precedence over the two-year default.

For an active client, the two-year clock does not begin while we are still working with you.

We keep information longer where the law requires it, or where it is needed for an ongoing dispute, audit, or investigation.

11. Your Choices and Rights

Everyone

Marketing email. Unsubscribe from any marketing email, or write to info@tukelinc.com. We will still send messages about your engagement, your filings, and security matters, those are not marketing.

SMS. If you opted in, reply STOP to stop and HELP for help. Message frequency varies; message and data rates may apply. Consent to marketing texts is not a condition of purchasing anything.

Cookies. Manage your preferences through Cookie Banner or your browser. See our Cookie Policy. We honor Global Privacy Control signals.

Access and correction. Ask us for a copy of the information we hold about you, or ask us to correct it.

Individual clients — GLBA

If we provide services to you as an individual, the Gramm-Leach-Bliley Act gives you specific rights over our sharing of your nonpublic personal information. See our GLBA Privacy Notice, which we also send you when we begin working together.

US state privacy laws

Some states have comprehensive privacy laws in effect. Information governed by the Gramm-Leach-Bliley Act is exempt from these laws, so the rights below generally apply to Site and Account Data rather than to Client Data.

Where a state law applies to you, you may have the right to:

• Confirm whether we process your personal information and obtain a copy
• Correct inaccuracies
• Request deletion
• Obtain your data in a portable format
• Opt out of targeted advertising, sale, and certain profiling
• Appeal a refused request
• Not be discriminated against for exercising these rights

To make a request, email info@tukelinc.com. We will verify your identity before responding, and respond within the time the applicable law allows (generally 45 days, extendable once). Authorized agents may submit requests with proof of authorization.

EEA and UK

If the processing of your personal information is subject to the European Union General Data Protection Regulation (“GDPR”) or UK GDPR, you have rights to access, rectify, erase, restrict, object to processing, and receive certain personal information in a portable format, subject to applicable limitations.

Where we rely on consent, you may withdraw that consent at any time without affecting the lawfulness of processing that occurred before withdrawal.

You may also have the right to lodge a complaint with the data protection supervisory authority in the country where you live, work, or where you believe a violation of applicable data-protection law occurred.

Where we rely on legitimate interests, you may request additional information regarding the interests relied upon and may object to processing in circumstances provided by applicable law.

Legal Bases for Processing Personal Information

Where the European Economic Area (“EEA”), United Kingdom, or another jurisdiction requires us to identify a legal basis for processing personal information, our legal bases may include:

Performance of a contract. We process information where necessary to provide Services you or your organization have requested or to take steps before entering into a contract.

Legal obligations. We process information where necessary to comply with applicable tax, accounting, regulatory, legal, and professional obligations.

Legitimate interests. We may process information where necessary for our legitimate business interests, including operating and improving our business, communicating with clients and prospective clients, maintaining security, preventing fraud, and managing our professional relationships, provided those interests are not overridden by your rights and interests.

Consent. Where required, we process information based on your consent. You may withdraw your consent at any time, subject to applicable law.

Other legal bases may apply depending on the circumstances and applicable law.

You have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent at any time without affecting prior processing.

12. Children

The Services are mainly for businesses and are not directed to children. We do not knowingly collect personal information from anyone under 18 through the Site.

Client Data may contain information about minors where a client’s records include them for example a dependent on a tax return, or a beneficiary. We process that information solely to perform the Services.

If you believe we hold information about a child collected through the Site, contact info@tukelinc.com and we will delete it.

13. Cookies and Tracking

Full detail is in our Cookie Policy. In summary, we use:

• Strictly necessary cookies for security, authentication, and site function
• Analytics cookies to understand how the Site is used
• Marketing cookies to measure campaigns and, where you consent, to show relevant advertising

Session replay. Microsoft Clarity records session replays and heatmaps of Site activity. We do not run session replay on the client portal, on any page where financial data or identification numbers are entered, or on any page behind authentication.

We use strictly necessary cookies for security and site function, analytics cookies to understand how the Site is used, and marketing cookies to measure campaigns.

Third parties that serve content or advertising on the Site may set their own cookies. We do not control them.

14. Changes

We will post any change here and update the date at the top. If we make a material change to how we handle personal information, we will notify clients by email or through the client portal before it takes effect.

We keep prior versions available at below so you can see what changed.

Changing our GLBA sharing practices requires a revised GLBA notice, which we will deliver separately.

15. Contact

Privacy enquiries and requests:
info@tukelinc.com

Tukel, Inc.
2093 Philadelphia Pike #2108
Claymont, DE 19703
United States

We aim to respond within 10 business days, and within the period required by law where a legal deadline applies.