Privacy Notice

HVB Consulting LLC is a business located in Santa Ana, California. We provide bookkeeping, tax preparation, payroll management and business consulting services to individuals, self-employed professionals and businesses in Santa Ana and Orange County.

HVB Consulting LLC is not a CPA firm and does not provide audit, attestation, review, third-party compilation or investment-advisory services.

This Privacy Notice explains how we collect, use, share, protect and retain personal information when you: • Visit our main website: hvbconsultingllc.com; • Visit our campaign landing page: hvb-consulting-llc.marblism.me; • Contact us by email, telephone, WhatsApp, forms or social media; • Request information about our services; • Hire our services; • Receive access to our client portal; • Are an employee whose information we receive from an employer for payroll services; or • Are a current or former client of HVB Consulting LLC.

2.1 Contact and identification information — We may collect: Name; Email address; Telephone number; WhatsApp number; Mailing address; Business or DBA name; Entity or business type; Name and position of the person representing a business.

2.2 Tax and identification documents — Depending on the service requested, we may receive: Social Security number, or SSN; ITIN; EIN; License or registration numbers; Government-issued identification; W-2, 1099 and other tax forms; Tax returns; Tax-supporting documents; Information about dependents, employees or owners.

2.3 Financial, bookkeeping and payroll information — We may collect: Bank statements; Credit-card statements; Bookkeeping records; Income and expense records; Payroll and employee information; Wage and withholding information; Contracts, loans and leases; Invoices, receipts and sales reports; Information from QuickBooks, ADP or other platforms; Information needed to process payments or ACH debits.

2.4 Browsing data and cookies — When you visit the website or our campaign landing page, we may collect: IP address; Device type; Operating system; Browser type; Pages visited; Time spent on the site; Referring website or source; Information about interactions with the site; Cookies, pixels and similar technologies. These technologies are described further in Section 8.

2.5 Information you send to us — We may collect information you send through: Website and landing-page forms; Email; WhatsApp; Facebook, Instagram or other social media; Telephone calls; Text messages; Documents delivered in person, through our client portal or through third-party platforms.

You decide what information to provide. However, if you do not provide information necessary for a service, we may not be able to provide or complete that service.

For security reasons, please do not send Social Security numbers, identification photographs, complete banking information or sensitive tax documents through text messages, social media or unsecured channels.

We may use personal information to: Provide bookkeeping, tax, payroll and business consulting services; Prepare tax returns, forms and filings when applicable; Process payroll, employee records and related reports; Comply with tax, legal, regulatory and professional obligations; Communicate with you and answer questions; Schedule consultations and follow up on requests; Bill, collect and process payments; Operate, maintain, protect and improve the website and the campaign landing page; Measure how our advertising performs and show ads to people with similar interests, as described in Section 8; Detect, prevent and investigate fraud, unauthorized access and security issues; Maintain business and professional records; Respond to privacy requests; Comply with court orders, legal demands and valid requests from authorities.

The basis for using information may include: Performing a contract or professional engagement; Complying with legal obligations; Consent where required by law; Operating and securing our business; Preventing fraud and protecting our rights and those of our clients.

If we seek to use personal information for a new and materially different purpose, we will request consent when required by law.

HVB Consulting LLC does not sell or rent personal information. We do not share personal information in exchange for money.

We do use advertising cookies and pixels, including the Meta pixel, which communicate technical and browsing data to Meta and other advertising platforms — such as your IP address, device type and the pages you visit — together with a cookie identifier. That communication is made to measure how our advertising performs and to show our ads to people with similar interests. It may constitute a "sharing" of information for behavioral advertising under California law, and you may opt out as explained in Sections 8 and 10.4.

We do not share taxpayer information with third parties for purposes unrelated to the service, or for those third parties' own marketing, unless there is valid authorization or a legal exception.

Beyond that, we may share limited and necessary information with the following categories:

4.1 Service providers and platforms — We may use providers that help us operate our business, including: Intuit and QuickBooks Online; QuickBooks Online Payroll; ADP; Labitax, our tax-preparation software; Jotform, for forms, questionnaires and e-signature; Our client portal, for the secure exchange of documents; WhatsApp Business and Meta, including Facebook and Instagram; Google, including Google Analytics and Google Business Profile; WordPress and the hosting provider for hvbconsultingllc.com; Marblism and the hosting provider for our campaign landing page (hvb-consulting-llc.marblism.me); Email providers; Cloud-storage providers; Payment processors; GTranslate, for the Spanish version of the website; Security, backup, technical-support and administrative providers.

These providers receive only the information reasonably necessary to perform their function. Each provider may have its own privacy policy and terms. Some may store or process information outside California or the United States.

4.2 Disclosures required by law — We may disclose information when required or permitted by law, including: A valid request from the IRS; A request from the California Franchise Tax Board, or FTB; A request from the California Employment Development Department, or EDD; A request from another tax or governmental authority; A valid subpoena, court order or legal process; A request from a regulatory agency; An investigation of fraud, security issues or unlawful activity; Protection of rights, property or safety.

4.3 Professionals who assist us — We may share limited information with CPAs, attorneys, insurers, compliance consultants and other professionals assisting us when necessary and subject to confidentiality duties.

4.4 Corporate transactions — If HVB Consulting LLC merges, sells assets, reorganizes or transfers part of its business, personal information may be transferred as part of that transaction, as permitted by applicable law.

As a tax preparer, HVB Consulting LLC must comply with special federal rules regarding the use and disclosure of tax information.

Internal Revenue Code §7216 and related regulations generally prohibit a tax return preparer from using or disclosing tax-return information for purposes other than those permitted by law, unless valid taxpayer consent or a legal exception applies.

When consent is required for a specific disclosure, we will request separate, informed, voluntary and written consent under the applicable requirements, including 26 C.F.R. §301.7216-3.

Employees and providers who receive tax information must also treat it confidentially. Limited exceptions may apply to certain auxiliary service providers, legal obligations, court proceedings, permitted internal functions and authorized disclosures.

Section 10.21 of Treasury Circular 230 primarily addresses the duty to advise a client when the practitioner knows of an error, noncompliance or omission in a tax matter or document. It does not replace the specific confidentiality and consent rules under Internal Revenue Code §7216 and its regulations.

HVB Consulting LLC maintains safeguards consistent with: IRS Publication 4557, Safeguards for Taxpayer Data; The FTC Safeguards Rule; The Gramm-Leach-Bliley Act, or GLBA; Other applicable data-protection laws and standards.

Those safeguards are described in Section 7 and are set out in writing in HVB's information security plan, which is reviewed at least once a year.

Nothing in this Notice limits rights granted under California law.

We retain information only as reasonably necessary to provide services, comply with legal and tax obligations, resolve disputes, maintain business records and protect our rights.

The periods we apply are: Bookkeeping records: 7 years; Tax returns and tax-supporting documents: 7 years, or the applicable legal period if longer; Payroll information and employee records: 4 years, subject to applicable California requirements; Prospective-client information that does not result in an engagement: 24 months; Browsing and cookie data: 14 months; Billing and payment records: 7 years.

When information is no longer needed, we will seek to delete, destroy or make it unreadable securely. Applicable law may require us to retain certain records longer.

HVB Consulting LLC maintains a written information security plan, reviewed annually, that applies to all personal and financial information of our clients, in any format. The measures we apply are as follows.

Two-step verification. The accounts for our tax, bookkeeping, payroll, forms, cloud and banking platforms have two-step verification enabled.

Encryption. Electronic information is transmitted encrypted and stored encrypted. The disks of our work computers and phones are encrypted and password protected, and backups are encrypted as well. We do not request or send Social Security numbers, identification photographs, tax returns or bank statements by text message, WhatsApp, social media or unencrypted email; for that we use the client portal, a secure link or delivery at our office.

Access limited to authorized personnel. Access to client information is limited to the people who need it to provide the service. Each team member has their own account and password; we do not share logins or passwords. Administrator accounts are held by no more than two people. We review access every three months, and when someone stops serving a client or leaves the team, their access is disabled the same day.

Backups. Information is backed up in the encrypted cloud storage HVB uses, with continuous copying, and the bookkeeping and payroll platforms maintain their own backups. We periodically verify that files can be recovered. As part of our security plan, we are extending this backup with a second copy held by a provider independent of the primary one.

Incident response plan. We have a written procedure that activates on any unauthorized access, use, disclosure or loss of information. It consists of stopping the access, documenting what happened from the first moment, assessing the scope, notifying affected individuals and authorities where the law requires it, fixing the cause, and leaving a written summary.

Training and assessment. On joining, each person reads and signs the plan before receiving access to client information. We hold an annual training session and a documented annual risk assessment, which is repeated when personnel, a tool or a provider changes.

No internet, email, telephone or messaging system is completely secure.

Email, text messages and WhatsApp can be intercepted, forwarded, misdirected or viewed by third parties. Therefore, HVB Consulting LLC cannot guarantee that a transmission will be delivered correctly or read only by the intended recipient.

Please do not send sensitive tax or financial information through unsecured channels. When available, use our client portal, secure email or delivery to our office.

If a security incident affects personal information, we will notify affected individuals and authorities when required by applicable law.

Cookies are small files stored in your browser. They help a website function and help us understand how the website is used. The website and the campaign landing page may use: Essential cookies: needed for basic functions; Performance and analytics cookies: including Google Analytics, to understand which pages are visited and improve the site; Functionality cookies: to remember preferences and support the Spanish version through GTranslate; Advertising cookies and pixels: the Meta pixel (Facebook and Instagram), which lets us measure how our ads perform and show them to people with similar interests, and Google advertising cookies, when active.

About the Meta pixel. When the page loads, the pixel may communicate technical and browsing data to Meta, such as your IP address, device type and the pages you visit, together with a cookie identifier. That communication is made for measurement and advertising purposes, and it may constitute "sharing" under California law. You can review Meta's privacy policy for more information on how that platform handles this data.

How to control or disable cookies: The preferences in the cookie notice that appears on our website and on the campaign landing page; Chrome, Safari, Edge or Firefox settings; The Google Analytics opt-out browser add-on; Google advertising and privacy settings; Meta advertising preferences; Your mobile device privacy controls, to limit tracking across apps.

"Do Not Track" signals. Some browsers offer a "Do Not Track" signal. Our website does not currently respond to that signal and does not change its collection practices when it receives one. To exercise your choices, use the controls listed above and Section 10.4.

Cookie notice. We publish this notice on the website and on the campaign landing page. By continuing to browse and accepting non-essential cookies, you acknowledge this notice. If you block essential cookies, some parts of the website may not work properly. Blocking cookies does not, by itself, affect professional services provided under a separate agreement.

The website, the campaign landing page and our communications may include links to third-party websites or platforms, including Intuit, QuickBooks, ADP, Labitax, Jotform, Google, Facebook, Instagram and other social-media platforms.

HVB Consulting LLC does not control those websites and is not responsible for their content, security, availability or privacy policies. We recommend reviewing third-party policies before using their services.

When you directly use QuickBooks, ADP, WhatsApp, Google or another third-party platform, your relationship with that platform is governed by its own terms and privacy policy.

The California Consumer Privacy Act, or CCPA/CPRA, may provide certain rights to California residents. Whether particular requirements apply depends on the size of the business, revenue, amount of information processed and other legal factors.

Even if HVB Consulting LLC determines that certain legal thresholds do not apply, we seek to respect these rights as a good practice.

10.1 Right to know and access — You may request information about: Categories of personal information we collect; Sources of that information; Purposes for using it; Categories of third parties with whom it is shared; Specific pieces of personal information we retain, where legally permitted.

10.2 Right to correct — You may request correction of inaccurate personal information.

10.3 Right to delete — You may request deletion of personal information, subject to legal exceptions. For example, we may be unable to delete information that must be retained for tax, legal, contractual or security purposes.

10.4 Right to opt out of sale or sharing, and to limit the use of sensitive information — HVB Consulting LLC does not sell personal information. We do use advertising cookies and pixels, including the Meta pixel, which may constitute "sharing" of personal information for cross-context behavioral advertising, as described in Section 8. You may opt out of that use in the following ways: Declining non-essential cookies in the cookie notice on the website or the landing page; Adjusting Meta advertising preferences and Google advertising and privacy settings; Writing to service@hvbconsultingllc.com and asking to opt out of sharing for advertising purposes. If your browser already shared data with Meta before we receive your request, we will explain how to exercise your choices directly with Meta. Where applicable, you may also request to limit the use or disclosure of sensitive personal information. The law allows certain necessary and proportionate uses, so this right may have limits.

10.5 Right to non-discrimination — You will not be discriminated against for exercising privacy rights. We will not deny services or charge a different price solely because you submit a lawful privacy request.

10.6 Authorized agent — You may designate an authorized agent to submit a request on your behalf. We may request proof of authorization and verify both individuals' identities.

10.7 How to submit a request — You may submit a request: By email: service@hvbconsultingllc.com; By telephone: (714) 651-3790; By WhatsApp: (714) 651-3790. Please identify the right you wish to exercise. To protect information, we may verify your identity by requesting contact information or other reasonably necessary information. We will generally respond within 45 calendar days. When permitted by law, we may extend the period by up to 45 additional days and will explain the reason. Requests are generally free. We may refuse or charge a reasonable fee for excessive, repetitive or clearly unfounded requests only when permitted by law. We cannot provide another person's information or delete information that we are legally required to retain.

10.8 California "Shine the Light" — California Civil Code §1798.83 allows certain California residents to request information about categories of personal information shared with third parties for those third parties' direct marketing. HVB Consulting LLC does not share personal information with third parties for their own direct marketing. If you wish to make a request under this law, contact service@hvbconsultingllc.com.

Our services, the website and the campaign landing page are primarily directed to adults and businesses.

We do not knowingly collect personal information from children under 16 for marketing purposes. If a parent or legal guardian believes a child provided us with personal information, the parent or guardian may contact us to request review and deletion where appropriate.

You may contact us through WhatsApp. When you do so, your telephone number and message content may be processed under this Notice and WhatsApp's and Meta's policies.

WhatsApp is a third-party service. We recommend that you do not send through WhatsApp: Social Security numbers; Identification photographs; Complete banking information; Tax returns; Sensitive tax documents.

Request access to our client portal, secure email or another method for transmitting documents.

We may update this Notice to reflect changes in law, our services, the website, the landing page or the tools we use.

We will publish the updated version on the website with a new last-updated date. If the change is material, we will seek to provide additional notice by email or a prominent website notice.

Your continued use of the website after an update means that you acknowledge the current version, to the extent permitted by law.

Contact: HVB Consulting LLC · 901 W Civic Center Dr, Suite 400, Santa Ana, CA 92703; General and privacy email: service@hvbconsultingllc.com; Telephone and WhatsApp: (714) 651-3790; Websites: hvbconsultingllc.com and hvb-consulting-llc.marblism.me.