Privacy Policy

Updated for Amendment 13 to the Protection of Privacy Law

Last updated: October 2026 | Amendment 13 effective: August 14, 2025

This is the English version of the Hebrew document. If there is any difference, the Hebrew version prevails.

Eran Shemesh, CPA (a licensed sole proprietor, osek murshe), trading as "Shemesh CPA" (שמש רואי חשבון) (the "Firm" or "we"), respects your privacy and is committed to safeguarding your personal information in accordance with the Protection of Privacy Law, 5741-1981, as amended by Amendment No. 13 (5784-2024), and the Protection of Privacy Regulations (Data Security), 5777-2017. As certified public accountants, we hold financial and highly sensitive information, and we are therefore bound by strict security and privacy standards that go beyond what the law requires.

1Definitions

"Personal information"Any data relating to an identified or identifiable person, including financial, accounting, business and commercial information. "Sensitive information" (in the professional sense)Financial information, accounting documents, bank details, business standing - subject to a Medium security level under the Protection of Privacy Regulations (Data Security), 5777-2017. This is separate from the statutory definition of "sensitive information" under the Law (health, criminal record, sexual orientation and the like). "Database owner / operator"Eran Shemesh, CPA, trading as Shemesh CPA, as defined in the Protection of Privacy Law. "Processing of information"Any operation or series of operations performed on personal information: collection, storage, use, transfer or deletion. "Outsourcing provider (Regulation 15)"An external party that processes personal information on the Firm's behalf. Engaging such a party is subject to the requirements of Regulation 15.

2Databases and Legal Basis for Processing

The Firm maintains the following databases (Amendment 13 abolished the registration requirement for private entities that are not data brokers, so a CPA in private practice is not required to register):

Professional client databaseClients' financial, accounting and business information, required to perform the service contract. Marketing leads databaseDetails from website inquiries (name, phone, email) - based on express consent. Direct mail databaseUsed for marketing and professional updates - based on optional consent only. Legal compliance databaseReports to the tax authorities, the National Insurance Institute and the Registrar of Companies - required by law.

Types of information we collect:

• Identifying information: full name, email, phone, company name, company registration number (ח.פ.), job title.
• Financial and sensitive information (clients): financial statements, accounting documents, bank account details, contracts, checks.
• Professional information: filings with the authorities, tax orders, assessment decisions.
• Answers to the short questionnaire on the website (/start, /en/start): business status, estimated turnover, the type of help you need, line of business, whether you also have salaried income, and how you found us - stored together with your inquiry.
• Information from social networks: when you comment on our content or message us on Instagram, Facebook, TikTok or YouTube, we receive your username and the content of your comment or message.
• Technical information: IP address, geolocation data, device identifiers, browser, browsing data, cookies - all of which are defined as "personal information" under Amendment 13.
• Minors: the website and services are intended for adults. We do not knowingly collect personal information about minors under 18; if we receive such information without the consent of a parent or guardian, we will delete it.

3Purposes of Processing

We use your personal information for the following purposes only:

• Providing professional services: tax advice, bookkeeping, auditing and reporting to the authorities.
• Contacting you, responding to website inquiries, and replying to comments and messages sent to us on social networks (sometimes automatically).
• Improving the service and analyzing website use statistically (Google Analytics, and heatmaps and session recordings with Microsoft Clarity) - with consent only; and, for visitors who choose "Accept all" in the cookie banner, personalized advertising and remarketing through Google.
• Recording cookie consent choices, as evidence of consent or refusal.
• Complying with legal and regulatory obligations (tax, National Insurance, Registrar of Companies).
• Direct mail and marketing - only with your express consent, which you may revoke at any time.

Purpose limitation:

In accordance with Amendment 13, we undertake not to use the information for any purpose other than those listed, without your express consent.

4Transfer of Information to Third Parties

As a fundamental principle, we undertake not to disclose, sell or transfer your personal information to third parties, except:

• With your prior, express consent.
• Where required by law or by court order.
• To competent authorities: the Israel Tax Authority, the National Insurance Institute, the Registrar of Companies.
• To outsourcing providers (Regulation 15) - see section 5 below for full details.

5Outsourcing Providers - Regulation 15 of the Protection of Privacy Regulations

In accordance with Regulation 15 of the Protection of Privacy Regulations (Data Security), 5777-2017:

Engaging an external provider that processes personal information on the Firm's behalf is subject to the requirements of Regulation 15, including the provider's undertaking to keep the information secure and to use it only for the purposes of the engagement.

Cross-border transfer mechanisms (Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 2001):

• Providers in the EU (Make.com, Qonto, bundle.social): Israel is recognized by the European Union as a country with an adequate level of protection, and transfers between Israel and the EU are regulated automatically in both directions.
• Providers in the USA (Netlify, Google Analytics, Microsoft Clarity, Google Workspace, Zapier, Anthropic, OpenAI, Grok/xAI, Manus AI, Instantly.ai, NewOaks.ai, Meta Forms, WhatsApp (Meta), Google Cloud / Google Sheets, GitHub, Meta (Instagram / Facebook), YouTube API Services, Gemini, Dynadot, Name.com): information is transferred under each provider's terms of service. The large providers (Google, Netlify, Anthropic, OpenAI, Meta) include a data processing agreement (DPA) and/or standard contractual clauses (SCCs) in their terms of service. If you have questions about a specific provider, contact us (see section 11).
• DeepSeek (China): no identifying personal information about data subjects is transferred. We use this AI tool only to process general content that is not linked to any specific data subject, and the Israeli Protection of Privacy Law does not apply where no personal information is transferred.

Domain Registrars

Provider	Country	Purpose	Legal basis
Dynadot	USA	Registration and management of the domain name shecpa.co.il	Legitimate interest
Name.com	USA	Registration of additional domains	Legitimate interest

Hosting and Infrastructure

Provider	Country	Purpose	Legal basis
Netlify	USA	Hosting and publishing the website, receiving inquiries submitted through the forms and recording cookie consent choices	Legitimate interest
Google Analytics (Google LLC)	USA	Statistical analysis of website use (including IP address and device identifiers) and aggregated age, gender and interest statistics (Google Signals); and, only for visitors who choose "Accept all", personalized advertising and remarketing by Google	Consent (cookie banner)
Microsoft Clarity (Microsoft Corporation)	USA	Heatmaps and session recordings to improve the website (mouse movement, scrolling and clicks, IP address and device identifiers). Anything typed into forms is masked and not stored	Consent (cookie banner)

Cloud & Productivity

Provider	Country	Purpose	Legal basis
Google Workspace	USA / EU	Email, documents, calendar, Drive - client communications	Performance of a contract / legitimate interest
Zapier	USA	Workflow automation (transferring leads)	Legitimate interest
Make.com	EU (Czech Republic)	Advanced business process automation	Legitimate interest
Google Cloud / Google Sheets (Google LLC)	USA	Inquiry log: every website inquiry is logged automatically (name, phone, answers to the short questionnaire) and its handling is tracked	Legitimate interest
GitHub (Microsoft)	USA	Running an automated weekly report on website activity and the number of inquiries	Legitimate interest

Artificial Intelligence (AI) Models

Provider	Country	Purpose	Legal basis
Claude (Anthropic)	USA	Streamlining writing and analysis and assisting with professional tasks, including analyzing website usage data (Google Analytics, Google Search Console and Microsoft Clarity) and handling incoming inquiries, including comments and messages on social networks	Legitimate interest
ChatGPT (OpenAI)	USA	Streamlining writing and analysis and assisting with professional tasks	Legitimate interest
Gemini (Google)	USA / EU	Streamlining writing and analysis and assisting with professional tasks	Legitimate interest
Manus AI	USA	Automating administrative tasks	Legitimate interest
Grok (xAI)	USA	Content analysis and internal information processing	Legitimate interest
DeepSeek	China	Content analysis - without the transfer of identifying personal information	Not applicable - no transfer of personal information

AI governance and human oversight - Amendment 13 and Privacy Protection Authority guidelines:

• AI tools are used only to streamline internal processes. No identifying client information is transferred to AI tools without express consent.
• Data minimization is mandatory whenever AI is used.
• There is no automated decision-making that affects clients - every professional decision is subject solely to the Firm's human judgment.
• An AI tool will be used with sensitive information only after its impact on privacy has been considered, in accordance with the guidelines of the Privacy Protection Authority.

Marketing

Provider	Country	Purpose	Legal basis
Instantly.ai	USA	Sending marketing emails only to people who have given express consent to direct mail	Consent
WhatsApp (Meta)	USA / EU	Receiving and answering inquiries you send us on WhatsApp, and sending an internal alert to the accountant for every new website inquiry	Inquiry initiated by the data subject
WbizTool	Israel / EU	Sending WhatsApp marketing messages	Consent
NewOaks.ai	USA	AI chatbot for lead management	Consent / legitimate interest
Meta Forms (Facebook / Instagram)	USA / EU	Lead forms on social networks	Consent
Meta (Instagram / Facebook)	USA / EU	Managing our accounts: publishing content and replying to comments and messages sent to us (username and message content), including automatic replies	Inquiry initiated by the data subject
YouTube API Services (Google LLC)	USA	Uploading and managing videos on our YouTube channel, and replying to comments on the channel	Legitimate interest
bundle.social (BUNDLE sp. z o.o.)	EU (Poland)	Scheduling and publishing our videos on TikTok and other networks	Legitimate interest

Social networks and YouTube:

• We have accounts on Instagram, Facebook, TikTok and YouTube. When you comment on our content or message us, we receive your username and the content of your comment or message, and use them only to reply - sometimes automatically, and sometimes with replies drafted using the AI tools listed above. Marketing messages are sent only to people who have given express consent. The networks themselves are responsible for the information they collect, under their own privacy policies.
• Our systems use YouTube API Services to upload and manage videos on our channel. This use is subject to the YouTube Terms of Service (https://www.youtube.com/t/terms) and the Google Privacy Policy (https://policies.google.com/privacy). You can revoke any application's access to your Google account at any time at https://security.google.com/settings/security/permissions.

Professional Software for Certified Public Accountants

Provider	Country	Purpose	Legal basis
Finbot	Israel	Management of client files and accounting documents	Performance of a contract
Yesh Heshbonit (Invoice Maven)	Israel	Issuing invoices and managing fiscal documents	Performance of a contract
Ardeni	Israel	Payroll management and payslips	Performance of a contract
Qonto	EU (France)	Business account and payment management	Performance of a contract
Morning	Israel	Business financial management, invoices, expenses	Performance of a contract
Hashavshevet	Israel	Bookkeeping software and tax reporting	Performance of a contract
Summit	Israel	Client management and work processes	Performance of a contract

The information transferred to the providers below includes financial and sensitive data. Our engagement with them is subject to the requirements of Regulation 15, and the providers are required to apply security measures appropriate to the sensitivity of the information.

6Data Retention - Retention Policy by Type (CPA)

In accordance with the requirements of the Certified Public Accountants Law, 5715-1955, the Income Tax Ordinance, the Value Added Tax Law and the Protection of Privacy Law:

Accounting documents and books (bookkeeping, reports, invoices)	7 years
Payslips and payroll files	7 years
Tax returns, assessments, objections	7 years from filing
Service contracts with clients	7 years from termination
Marketing leads (who did not become clients)	3 years / until consent is revoked
Website technical data (cookies, logs, Google Analytics, Microsoft Clarity)	Up to 14 months
Requests to exercise rights (access, deletion)	3 years (for evidentiary purposes)

Information needed to comply with a legal obligation will be retained for as long as required, including after the business relationship ends.

7Information Security

We implement the following security measures:

• Encrypted communication (HTTPS) between the browser and the website.
• Access to information restricted to those who need it to provide the service.
• Generally accepted organizational and technological security measures, in accordance with the Protection of Privacy Regulations (Data Security) and the security level that applies to the databases.
• Engaging providers that process information on the Firm's behalf subject to the requirements of Regulation 15.
• Employee training and awareness of information security and the privacy policy (a basic-level requirement).
• Information Security Officer: Eran Shemesh (contact details in section 11).

Security level classification:

In accordance with the Protection of Privacy Regulations (Data Security), 5777-2017, the Firm's databases are classified at a Medium security level, because the Firm holds sensitive financial information and a marketing database of more than 10,000 records.

8Security Incidents and Reporting

In accordance with the Protection of Privacy Law and the Protection of Privacy (Data Security) Regulations, 2017, if a severe security incident occurs, we undertake:

• To notify the Privacy Protection Authority without delay, and in any event no later than 72 hours after discovering the incident.
• To notify the affected data subjects without unreasonable delay where there is a high risk of harm to their privacy.
• To document every security incident and take corrective and preventive measures.
• To report to law enforcement authorities as decided by the Privacy Protection Authority.

9Your Rights Regarding Your Personal Information (Amendment 13)

Under the Law, you may exercise the following rights, and we will respond within 30 days:

Right of access (Section 13)To receive a copy of the information about you held in our databases, in Hebrew, English or Arabic, as you choose. Requests must be submitted in writing with proof of identity. Right of correction (Section 14)To request the correction of information that is incorrect, incomplete or not up to date. Right of deletionTo request the deletion of information, subject to statutory retention obligations (7 years for accounting documents). Objection to processing (offered by us)To object to processing for marketing purposes at any time, free of charge. Receiving the information in a structured format (offered by us)To receive a structured copy of your information in a machine-readable format. Withdrawal of consent (Section 8C - Amendment 13)To withdraw, at any time, consent you have given to any consent-based processing - withdrawing consent must be as simple as giving it. Removal from direct mail (Section 17F)To demand removal from the direct mail database - the Firm must remove you and confirm that it has done so. You can click "Unsubscribe" in any message or contact us directly.

How to exercise your rights:

1. Send a written request to shemesh@shecpa.co.il with the subject line "Request to exercise a privacy right".
2. Include your name, contact details and a detailed description of your request. We will contact you to verify your identity and will ask only for what is proportionate to the type of request.
3. Alternatively, use the online form at shecpa.co.il/en/data-rights.
4. We will handle your request within 30 days, as required by law.
5. If your request is refused, you have the right to appeal to the Privacy Protection Authority.

10Cookies and Tracking

The website uses cookies for the following purposes:

• Essential cookies: required for the website to function - these do not require consent.
• Analytics cookies (Google Analytics): understanding how the website is used. The data (including IP address and device identifiers) is transferred to Google servers in the USA. The script is loaded only after you consent. You can choose between two levels of consent: "Analytics only" - analysis of website use and aggregated age, gender and interest statistics (Google Signals), with no advertising use; "Accept all" - in addition, Google may use the data for personalized advertising and remarketing (for example, showing the Firm's ads to people who visited the site). If you choose "Reject", none of these tools are loaded. You can change your choice at any time.
• Heatmaps and session recordings (Microsoft Clarity): a Microsoft tool that shows how visitors use the pages - how far they scroll, what they click and where they get stuck - so the website can be improved. Mouse movement, scrolling and clicks, IP address and device identifiers are collected and transferred to Microsoft servers in the USA. Anything typed into forms is masked and not stored. The tool is loaded only after you consent, at either consent level ("Analytics only" or "Accept all"), and is not used for advertising.
• Your choice is stored in your browser for 12 months, after which you will be asked again. As evidence of consent, we keep a record of your choice (the choice, time, page, banner version and a random identifier that is also stored in your browser - no name or contact details).

You can change or withdraw your consent at any time using the "Cookie settings" button at the bottom of the website. Withdrawing consent stops the analytics and deletes the Google Analytics and Microsoft Clarity cookies from your browser.

11Privacy Protection Coordinator (DPO) and Contact Details

Privacy Protection Coordinator: Eran Shemesh

The Privacy Protection Coordinator is responsible for the Firm's compliance with the requirements of the Protection of Privacy Law and for handling inquiries from data subjects.

Eran Shemesh also serves as the Information Security Officer in accordance with the Protection of Privacy Regulations (Data Security), 5777-2017.

Phone: +972-52-448-5784

Email: shemesh@shecpa.co.il

Address: HaMaagal 25, Ramat Gan

Response hours: Sunday-Thursday 7:00 AM-9:30 PM, Friday 7:00 AM-3:30 PM (Israel time)

To contact the Privacy Protection Authority: gov.il/privacy

You may also contact us through the data rights request form

on the website.

Version 4.3 (Amendment 13 + Regulation 15) | Shemesh CPA | Updated October 2026

English homeExercise your data rightsEnglish-speaking accountantHebrew version