Policies

At TaxDome, we prioritize data privacy and comply with the EU General Data Protection Regulation (GDPR) and equivalent international frameworks, to keep your data – and your clients’ data – protected wherever it’s processed.

What GDPR is

The General Data Protection Regulation (GDPR) is an EU privacy law adopted by the European Parliament and the Council of the European Union in 2016, effective since 25 May 2018. It governs how organizations collect, use, store, and remove the personal data of individuals in the EU, and gives individuals rights over their own data.

Data Processing Addendum

We offer a Data Processing Addendum (DPA) to customers who collect personal data from individuals in the EU. Our DPA sets contractual terms that meet GDPR requirements. All TaxDome accounts are covered under our standard DPA, incorporated by reference into our Terms of Service; we do not sign customer-provided DPA versions.

How we transfer data internationally

TaxDome incorporates the European Commission’s Standard Contractual Clauses (SCCs) in our DPA, providing a secure, legally recognized basis for transferring personal data outside the EEA, UK, and Switzerland. The DPA is incorporated by reference into our Terms of Service and applies to all TaxDome accounts. See our Data Processing Addendum for the full text.

Our EU representative

In compliance with GDPR Article 27, TaxDome has appointed Rickert Rechtsanwaltsgesellschaft mbH as our representative in the EU for matters concerning data protection.

Data Protection Officer

You can contact TaxDome’s DPO at [email protected].

GDPR program ownership

TaxDome’s GDPR compliance program is owned by the Legal function.

Consent

Our cookie policy explains what cookies we set and how you can control them in your browser.

Sub-processors

A full, current list of our sub-processors – including what each one does and where they’re located – is available on our Sub-processors page.

AI features and international data

AI-related features are reviewed for cross-border data transfer before being enabled for any EU-based firm, consistent with the transfer basis described above.

Your rights as a data subject

If you are located in the EEA, UK, or Switzerland, you have the right to access, correct, delete, or restrict the use of your personal data, and to object to or request portability of that data, subject to applicable law. To exercise these rights, contact us at [email protected].

If you delete your TaxDome account, we delete your personal data in accordance with our Terms of Service and Privacy Policy. Some system and activity logs needed for security and operational purposes may be retained separately.

Account administrators can search for and delete an end user’s conversation data directly through the help desk UI.

Risk assessment

TaxDome performs a data protection impact assessment (DPIA) for changes that affect how personal data is handled, to identify and mitigate privacy and security risks before release.

Breach management

TaxDome has a breach management and communication plan covering the escalation process and data subject notification requirements under GDPR.

Independent security assurance

TaxDome holds a SOC 2 Type II report covering our security controls, and maintains PCI DSS compliance (SAQ A) for payment-related data handling.

Questions

If you have any questions about this page or how TaxDome handles personal data, contact us at [email protected].