Privacy Policy

Aran Accounting Solutions (CRO Reg. No. 782024) is the data controller for personal data collected through this website and our services.

Location: Limerick, Ireland

Contact: info@aran-accounting.ie

• Identity data: Full name, date of birth, PPSN, nationality.
• Contact data: Email address, phone number, postal address.
• Financial data: Employment details, income information, bank details (IBAN, BIC), tax records.
• Dependant data: Names, PPSNs, dates of birth, relationships, incapacity/education status.
• Documents: Proof of identity, proof of address, PPS proof, medical certificates, payslips.
• Technical data: IP address, browser type, cookies (see our Cookie Policy).

We process your personal data on the following legal bases (Article 6 GDPR):

• Contract: To perform our engagement and provide tax services.
• Legal obligation: To comply with tax legislation (Taxes Consolidation Act 1997), anti-money laundering regulations (Criminal Justice Act 2010), and data retention requirements.
• Consent: For marketing communications (you may withdraw consent at any time).
• Legitimate interest: To improve our services, prevent fraud, and manage our business.

• Prepare and submit your Income Tax Return to the Irish Revenue Commissioners.
• Review and apply tax credits, reliefs and allowances on your behalf.
• Comply with AML/CFT obligations under the Criminal Justice Act 2010.
• Communicate with you about your tax affairs and our services.
• Improve our website and services.

We share your data with the following processors, all bound by Article 28 GDPR data processing agreements:

• Irish Revenue Commissioners — tax return filing and acting as your agent (Agent e-Link via ROS). Location: Ireland.
• Microsoft (SharePoint / Microsoft Graph) — secure client document storage. Location: EU (Ireland tenant).
• Resend — transactional email delivery (form confirmations, upload links). Location: USA.
• Sentry — error and performance monitoring. PII is scrubbed before sending. Location: EU (Frankfurt).
• Google reCAPTCHA — anti-bot protection on forms. Location: USA.
• Google Analytics — website usage analytics (only if you accept analytics cookies). Location: USA.
• Anthropic Claude — blog content drafting and review (does not process client data). Location: USA.
• OpenAI — automated classification of uploaded tax documents (internal operation; output reviewed by an accountant before use). Location: USA.
• Vercel / Hetzner — website hosting and edge functions. Locations: USA (Vercel) and EU-Helsinki (Hetzner).
• 360dialog (WhatsApp Business) — WhatsApp message routing. Location: EU.

We do not sell your personal data to third parties.

We retain your personal data for six years from the end of the relevant tax year, in accordance with Section 886 of the Taxes Consolidation Act 1997 and AML record-keeping requirements under the Criminal Justice Act 2010.

After this period, your data will be securely deleted or anonymised.

Leads and business contacts who do not become clients are retained for at most 12 months and then removed from our CRM.

You have the right to:

• Access — request a copy of your personal data.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion (subject to legal retention obligations).
• Restriction — limit how we process your data.
• Portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interest.
• Withdraw consent — at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at info@aran-accounting.ie. We will respond within 30 days.

We do not knowingly collect data from children under 16 directly. Dependant data (including children) is provided by the parent or legal guardian who is our client, as part of preparing their tax return.

We implement appropriate technical and organisational measures to protect your personal data, including encrypted storage, secure transmission (TLS), access controls, and regular security reviews.

Some of our processors (Resend, Google reCAPTCHA, Google Analytics, OpenAI, Anthropic, Vercel) process data in the United States. For these transfers, we rely on the European Commission Standard Contractual Clauses (SCCs) version 2021/914 as the adequate safeguard under Article 46 GDPR.

Other processors (Microsoft, Sentry, Hetzner, 360dialog, Revenue Ireland) keep data within the European Economic Area (EEA) or in jurisdictions covered by an adequacy decision.

If you believe your data protection rights have been infringed, you have the right to lodge a complaint with the Data Protection Commission (DPC):

Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28 • www.dataprotection.ie