Privacy Policy

Rationale Services collects personal and financial information so we can do accounting, bookkeeping, payroll, tax and business-licensing work for business clients in the United States. We work remotely with clients wherever they are based. This policy explains what we collect, why we hold it, who we share it with, and what you can ask us to do with it. It applies to our website at https://rationaleservices.com and to the work we do for clients.

1. Who is responsible for your information

Rationale Services is the controller of the information described here. You can reach us at:

• 6825 Jimmy Carter Blvd, Suite 1520, Norcross, GA 30071, USA
• Phone: +1 (470) 359-5949
• Email: office@rationaleservices.com

Our Qualified Individual for information security under the FTC Safeguards Rule can be reached through the email address above, and your message will reach that person.

2. What we collect

What we hold depends on whether you are a website visitor or an engaged client.

Website visitors

We collect your name, email address, phone number and the message you type when you use a contact or appointment form. Our servers log your IP address, browser type, device type, pages viewed, referring page and timestamps. Cookies and similar tools may collect usage data, as described in our Cookie Policy.

Engaged clients

To prepare returns, run payroll and file licensing paperwork, we collect far more sensitive information. This usually includes:

1. Social Security numbers and other taxpayer identification numbers, for you, your spouse and your dependents.
2. Employer Identification Numbers, state tax account numbers and sales tax registration details.
3. Dates of birth, home addresses, marital status and immigration or work-authorization documents where the payroll work requires them.
4. Bank account and routing numbers for direct deposit, tax payments and refunds.
5. Payroll records: wages, hours, deductions, garnishments, benefit elections and retirement contributions.
6. Financial records: bank and credit card statements, invoices, receipts, loan documents, general ledgers and prior-year returns.
7. Business formation documents, licenses, permits and ownership records.

We ask for only what the engagement needs. If you send us something we do not need, we will tell you and dispose of it securely.

3. How we collect it

We collect information in these ways:

• Forms on our website, including contact and appointment requests.
• Cookies, pixels and server logs when you browse the site.
• Phone calls, voicemail, text messages and email.
• Paper documents you hand or mail to our office.
• Third-party applications you authorize us to connect to, such as bookkeeping, payroll and accounting platforms.
• Government and financial sources, such as IRS transcripts, state tax portals and bank feeds, when you give us authority to access them.

4. Why we use it

We use your information to:

1. Prepare and file tax returns, extensions and amended returns.
2. Keep books, reconcile accounts and produce financial statements.
3. Process payroll, remit payroll taxes and file payroll returns.
4. Apply for and renew business licenses and permits.
5. Respond to your questions and schedule appointments.
6. Send invoices and collect payment.
7. Meet our own legal, tax and professional record-keeping duties.
8. Protect our systems against fraud and unauthorized access.
9. Send service updates and, where permitted, marketing about our services. You can opt out of marketing at any time.

We do not sell your personal information.

5. Our legal and professional basis

We process your information to perform the contract set out in your signed engagement letter, to comply with federal and state tax and employment law, and to serve our legitimate interest in running and securing our practice. Where the law requires your consent — most importantly for the uses of tax return information described below — we ask for it in writing first.

6. Tax return information is protected further

Tax return information gets stronger protection than ordinary personal data. Internal Revenue Code section 7216 makes it a criminal offense for a tax return preparer to knowingly or recklessly use or disclose information furnished in connection with preparing a return, except as the statute and its regulations permit. Section 6713 adds a civil penalty for the same conduct.

In practice, this means:

• We will not disclose your return information to a third party, or use it for a purpose other than preparing your return, without your prior written consent in the form the regulations require.
• Consent is specific. A consent for one disclosure does not cover another.
• Some uses are allowed without consent, including disclosures to the IRS or a state tax authority, disclosures required by a court order, and limited use by our own staff and contractors who help prepare your return.
• If we want to refer you to another provider, offer you a non-tax service based on your return data, or share your return with a lender, we will ask you to sign a separate consent first.

7. Our information security program

We are a financial institution for the purposes of the Gramm-Leach-Bliley Act, and we follow the FTC Safeguards Rule. Under that rule we maintain a written information security program. Its parts include:

1. A designated Qualified Individual who is accountable for the program.
2. A written risk assessment, reviewed at least annually, that identifies threats to client information.
3. Encryption of client information in transit and at rest.
4. Multi-factor authentication for access to systems holding client information.
5. Access controls, so staff see only the client data their work requires.
6. Vendor due diligence and written contracts with service providers that handle client data.
7. Staff security awareness training.
8. A written incident response plan, tested periodically.
9. An annual written report to management on the program.
10. Secure disposal of client information we no longer need.

No system is perfectly secure. We do not promise that our safeguards will never fail, but we do commit to maintaining this program and to telling you promptly if client information is compromised.

8. Our annual privacy notice

GLBA requires us to give clients a privacy notice describing our information-sharing practices. We provide that notice when you first engage us and annually afterward. This policy and that notice are consistent; if they ever conflict, the GLBA notice controls for client financial information.

9. Who we share information with

We share information in four situations.

Service providers (subprocessors)

We use vendors for tax preparation software, payroll processing, document storage, secure file transfer, email, bookkeeping platforms, e-signature and practice management. Each one receives only what it needs, under a written contract that requires confidentiality and appropriate security. A current list of categories is available on request.

With your direction

We release information to your bank, lender, attorney, insurer, other accountant or anyone else when you tell us to in writing.

When the law compels it

We will disclose information in response to an IRS summons, a court order, a validly issued subpoena, a search warrant or another lawful demand. Where we are legally permitted to do so, we will tell you before we respond, so that you have the chance to object or to seek relief from a court. Some demands legally bar us from telling you; in that case we cannot.

Business transfer

If our practice is sold or merged, client records may transfer to the buyer, subject to the same confidentiality duties and to any consent the law requires.

We do not sell or rent personal information.

10. How long we keep it

We keep records for as long as the engagement, the law and our professional duties require. Our written retention schedule sets a period for each kind of record:

• Tax returns and supporting workpapers — kept so that the file and our workpapers stay available for as long as we may need to answer questions about the engagement.
• Payroll records and payroll tax filings — kept to meet federal and state record-keeping rules.
• Engagement letters and signed consents — kept as evidence of scope, authority and consent.
• Client-provided source documents — returned to you or securely destroyed after the engagement. We hold originals no longer than needed.
• Business licensing files — kept as renewal history and as our own record of the work.
• Website analytics — kept to measure and improve the site.
• Cookie consent records — kept to show that consent was given and what it covered.
• Email correspondence — kept as part of the engagement record.
• Marketing lists — kept until you opt out, and then as a suppression record only, so that we can honor your opt-out.

Ask us and we will tell you the current retention period for a particular kind of record. When a retention period ends, we destroy records securely: shredding on paper, and certified deletion for electronic copies.

11. Children

We do not offer services to children and we do not knowingly collect personal information online from anyone under 13, consistent with the Children's Online Privacy Protection Act. We do process children's information inside a parent's tax or payroll file — a dependent's name and Social Security number, for example — because the work the parent engaged us to do requires it. That information comes from the parent or guardian, not from the child, and not through our website. If you believe a child under 13 has given us information through the site, write to office@rationaleservices.com and we will delete it.

12. California residents

If you live in California, the California Consumer Privacy Act as amended by the CPRA gives you rights over your personal information.

One important limit applies first. Personal information we collect, process, sell or disclose under the Gramm-Leach-Bliley Act is exempt from most CCPA obligations. For a client of our accounting, payroll or tax practice, that exemption covers nearly everything in your file. Information that falls outside GLBA — website browsing data, marketing contacts, job applicant data and some business-licensing material — may still be covered.

For information that is covered, you may:

1. Know what personal information we have collected, the sources, the purposes and the categories of recipients.
2. Receive a copy of that information in a portable form.
3. Correct inaccurate personal information.
4. Delete personal information, subject to our legal retention duties.
5. Opt out of the sale or sharing of personal information. We do not sell or share personal information, so there is nothing to opt out of; we provide no "Do Not Sell or Share My Personal Information" link for that reason.
6. Limit the use of sensitive personal information. We use sensitive information only to deliver the services you asked for and for the purposes the CCPA permits without a limitation right.
7. Not be retaliated against for exercising any of these rights. We do not deny service, charge a different price or provide a lower level of service because you made a request.

You may use an authorized agent. We will ask the agent for written proof of authority and will verify your identity directly.

13. Other state privacy laws

A growing number of states give their residents rights to access, correct, delete and obtain a copy of personal data, and to opt out of targeted advertising, sale and certain profiling. Because we work remotely with clients across the country, and hold records about their employees as well, more than one of these laws can apply to us at the same time, and the set of them changes as new laws take effect. Those laws contain GLBA exemptions similar to California's, so much of a client file is outside their reach. We handle requests under any of them through the same process described in section 16. We will tell you if an exemption prevents us from acting. Where a state law gives you a right to appeal a refusal, we will explain how to appeal in our written response.

14. Breach notification

Georgia law at O.C.G.A. § 10-1-910 et seq. applies to us, and requires notice when unencrypted personal information is acquired by an unauthorized person and misuse has occurred or is reasonably likely. Because we hold records for clients, and for their employees, in many states, the breach-notification statute of each affected person's own state can apply as well, and those statutes differ on timing, on what the notice must say and on which regulators and agencies must also be told. If an incident happens, we will:

• Investigate promptly and take steps to contain the incident.
• Notify affected individuals in the most expedient time possible and without unreasonable delay, allowing for the needs of law enforcement and for restoring system integrity.
• Describe in the notice what happened, what information was involved, what we are doing, and what you can do to protect yourself.
• Give the notice in writing, electronically where the law permits, or by substitute notice if the statutory conditions for substitute notice are met.
• Notify consumer reporting agencies and other parties where the statute requires it.

We will also meet any separate IRS, FTC or state-board reporting duty that applies to a data incident at a tax practice.

15. Visitors from outside the United States

We operate in the United States and store information here. If you are in the European Economic Area or the United Kingdom and you contact us through the site, we process your details to answer you and to decide whether we can take on the work. That processing rests on your consent or on our steps toward a contract with you. You may ask for access, correction, deletion, restriction or portability, and you may object to processing. Transfers to the United States mean your information leaves the protection of EU or UK law; we will put appropriate safeguards in place where we are required to.

16. How to exercise your rights

Send your request to office@rationaleservices.com, call +1 (470) 359-5949, or write to our Norcross address. Tell us which right you want to use and give us enough detail to find your records.

We verify every request before acting, because releasing a tax file to the wrong person causes real harm. Verification usually means confirming two or three pieces of information already in your file, and for sensitive requests we may ask for a government-issued identification document or a call to a phone number we already hold. We will not use verification information for any other purpose.

We respond within 45 days. If we need more time, we will tell you within that period and may extend once by another 45 days. There is no charge for a reasonable request. If we cannot act, we will tell you why, including when a legal retention duty or a GLBA exemption is the reason.

17. Third-party links

Our site links to third-party sites and tools, such as government filing portals and software vendors. Those sites have their own privacy practices, which we do not control and are not responsible for. Read their policies before giving them information.

18. Do Not Track

Web browsers can send a "Do Not Track" signal, but there is no common standard for how a site should respond. Our site does not respond to Do Not Track signals. We do honor the Global Privacy Control signal where our consent tool detects it, as explained in the Cookie Policy.

19. Changes to this policy

We update this policy when our practices, our software or the law changes. The effective date at the top always shows the current version. For a change that materially affects how we use information we already hold, we will post a notice on the site and, for clients, send an email to the address in your file before the change takes effect.

20. Contact us

• Rationale Services
• 6825 Jimmy Carter Blvd, Suite 1520, Norcross, GA 30071, USA
• Phone: +1 (470) 359-5949
• Email: office@rationaleservices.com
• Website: https://rationaleservices.com

See also our Terms of Use, Cookie Policy and Disclaimer.