Privacy Policy

Updated for Amendment 13 to the Protection of Privacy Law

Date of update: September 2026 | Amendment 13 in force from: 14 August 2025

This is an English translation provided for convenience. The Hebrew version is the operative text and prevails in the event of any discrepancy.

Eran Shemesh, CPA (a licensed sole proprietor, osek murshe), trading as "Shemesh CPA" (שמש רואי חשבון) (hereinafter: "the Firm", "we") respects your privacy and is committed to safeguarding your personal information in accordance with the Protection of Privacy Law, 5741-1981, as amended by Amendment No. 13 (5784-2024), and with the Protection of Privacy Regulations (Data Security), 5777-2017. As certified public accountants we hold financial and particularly sensitive information, and we are therefore bound by strict standards of security and privacy beyond what the law requires.

1Principal Definitions

"Personal information"Any datum relating to an identified person or to an identifiable person, including financial, accounting, business and commercial information. "Sensitive information" (in the professional sense)Financial information, accounting documents, bank details, business standing — subject to a Medium security level in accordance with the Protection of Privacy Regulations (Data Security), 5777-2017. This definition is distinct from "sensitive information" as defined by statute under the Law (health, criminal record, sexual orientation and the like). "Database owner / operator"Eran Shemesh, CPA, trading as Shemesh CPA, as defined in the Protection of Privacy Law. "Processing of information"Any act or series of acts performed on personal information — collection, storage, use, transfer, deletion. "Outsourcing provider (Regulation 15)"An external party that processes personal information on behalf of the Firm. The engagement with it is subject to the requirements of Regulation 15.

2Databases and Bases of Processing

The Firm maintains the following databases (Amendment 13 abolished the registration requirement for private bodies that are not data brokers — registration is not required of a private CPA):

Professional client databaseFinancial, accounting and business information of clients, required for performance of the service contract. Marketing leads databaseEnquiry information from the website (name, telephone, email) — on the basis of express consent. Direct mail databaseFor the purpose of marketing and professional updates — on the basis of optional consent only. Legal compliance databaseReports to the tax authorities, the National Insurance Institute and the Registrar of Companies — a legal obligation.

The types of information we collect:

• Identifying information: full name, email, telephone, company name, company registration number (ח.פ.), position.
• Financial and sensitive information (clients): financial statements, accounting documents, bank account details, contracts, cheques.
• Professional information: filings to the authorities, tax orders, assessment decisions.
• Technical information: IP address, geolocation data, device identifiers, browser, browsing data, cookies — all of these are defined as "personal information" under Amendment 13.
• Minors: the website and services are intended for adults. We do not knowingly collect personal information about minors under 18; if such information reaches us without the consent of a parent or guardian, we will delete it.

3Purposes of the Processing of Information

We use your personal information for the following purposes only:

• Provision of professional services: tax advice, bookkeeping, audit, reports to the authorities.
• Making contact and responding to enquiries from the website.
• Improvement of the service and statistical analysis of website use (Google Analytics) — with consent only; and, for visitors who choose "Accept all" in the cookie banner, personalised advertising and remarketing through Google.
• Recording cookie consent choices, as evidence of consent or refusal.
• Compliance with legal and regulatory obligations (tax, National Insurance, Registrar of Companies).
• Direct mail and marketing — on the basis of express consent only, revocable at any time.

Purpose limitation:

In accordance with Amendment 13, we undertake not to use the information for purposes other than those defined, without your express consent.

4Transfer of Information to Third Parties

Fundamental principle: we undertake not to disclose, sell or transfer the personal information to third parties, except:

• With your express and prior consent.
• A legal obligation or a judicial order.
• To competent authorities: the Israel Tax Authority, the National Insurance Institute, the Registrar of Companies.
• To outsourcing providers (Regulation 15) — see the full details in section 5 below.

5Outsourcing Providers — Regulation 15 of the Protection of Privacy Regulations

In accordance with Regulation 15 of the Protection of Privacy Regulations (Data Security), 5777-2017:

The engagement with an external provider that processes personal information on behalf of the Firm is subject to the requirements of Regulation 15, including the provider's undertaking to keep the information secure and to use it only for the purposes of the engagement.

Cross-border transfer mechanisms (Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 2001):

• Providers in the EU (Make.com, Qonto): Israel is recognised by the European Union as a country with adequate protection, and reciprocal Israel–EU transfers are regulated automatically in both directions.
• Providers in the USA (Netlify, Google Analytics, Google Workspace, Zapier, Anthropic, OpenAI, Grok/xAI, Manus AI, Instantly.ai, NewOaks.ai, Meta Forms, Dynadot, Name.com): information is transferred under each provider's terms of service. Large providers (Google, Netlify, Anthropic, OpenAI, Meta) include a data processing agreement (DPA) and/or standard contractual clauses (SCCs) in their terms of service. For questions about a specific provider, contact us (section 11).
• DeepSeek (China): no identifying personal information of data subjects is transferred — use of this AI tool is limited to the processing of general content with no linkage to a specific data subject; the Israeli Protection of Privacy Law does not apply where no personal information is transferred.

Domain Registrars

Provider	Country	Purpose	Legal basis
Dynadot	USA	Registration and management of the domain name shecpa.co.il	Legitimate interest
Name.com	USA	Registration of additional domains	Legitimate interest

Hosting and Infrastructure

Provider	Country	Purpose	Legal basis
Netlify	USA	Hosting and publication of the website, receipt of enquiries from the forms and recording of cookie consent choices	Legitimate interest
Google Analytics (Google LLC)	USA	Statistical analysis of website use (including IP address and device identifiers) and aggregated age, gender and interest statistics (Google Signals); and, only for visitors who choose "Accept all", Google personalised advertising and remarketing	Consent (cookie banner)

Cloud & Productivity

Provider	Country	Purpose	Legal basis
Google Workspace	USA / EU	Email, documents, calendar, Drive — client communications	Performance of a contract / legitimate interest
Zapier	USA	Automation of work processes (transfer of leads)	Legitimate interest
Make.com	EU (Czech Republic)	Advanced automation of business processes	Legitimate interest

Artificial Intelligence (AI) Models

Provider	Country	Purpose	Legal basis
Claude (Anthropic)	USA	Streamlining writing, analysis, assistance with professional tasks	Legitimate interest
ChatGPT (OpenAI)	USA	Streamlining writing, analysis, assistance with professional tasks	Legitimate interest
Gemini (Google)	USA / EU	Streamlining writing, analysis, assistance with professional tasks	Legitimate interest
Manus AI	USA	Automation of administrative tasks	Legitimate interest
Grok (xAI)	USA	Content analysis and internal information processing	Legitimate interest
DeepSeek	China	Content analysis — without the transfer of identifying personal information	Not applicable — no transfer of personal information

AI governance and human oversight — Amendment 13 + guidelines of the Privacy Protection Authority:

• AI tools are used for streamlining internal processes only. No identifying information of clients is transferred to AI tools without express consent.
• The principle of data minimisation is mandatory in every use of AI.
• There is no automated decision-making affecting clients — every professional decision is subject to human judgement of the Firm alone.
• An AI tool will be used with sensitive information only after its impact on privacy has been considered, in accordance with the guidelines of the Privacy Protection Authority.

Marketing and Client Generation

Provider	Country	Purpose	Legal basis
Instantly.ai	USA	Sending marketing emails only to people who have given express consent to direct mail	Consent
WhatsApp (Meta)	USA / EU	Receiving and answering enquiries you send us on WhatsApp	Enquiry initiated by the data subject
WbizTool	Israel / EU	Sending marketing WhatsApp messages	Consent
NewOaks.ai	USA	AI chatbot for lead management	Consent / legitimate interest
Meta Forms (Facebook / Instagram)	USA / EU	Lead forms on social networks	Consent

Professional Software for Certified Public Accountants

Provider	Country	Purpose	Legal basis
Finbot	Israel	Management of client files and accounting documents	Performance of a contract
Yesh Heshbonit (Invoice Maven)	Israel	Issuing invoices and managing fiscal documents	Performance of a contract
Ardeni	Israel	Payroll management and payslips	Performance of a contract
Qonto	EU (France)	Business account and payment management	Performance of a contract
Morning	Israel	Business financial management, invoices, expenses	Performance of a contract
Hashavshevet	Israel	Bookkeeping software and tax reporting	Performance of a contract
Summit	Israel	Client management and work processes	Performance of a contract

The information transferred to the providers below includes financial and sensitive data. The engagement with them is subject to the requirements of Regulation 15, and the providers are required to apply security measures appropriate to the sensitivity of the information.

6Retention of Information — Retention Policy by Type (CPA)

In accordance with the requirements of the Auditors Law, the Income Tax Ordinance, the Value Added Tax Law and the Protection of Privacy Law:

Accounting documents and books (bookkeeping, reports, invoices)	7 years
Payslips and payroll files	7 years
Tax returns, assessments, objections	7 years from filing
Service contracts with clients	7 years from termination
Marketing leads (that did not become clients)	3 years / until consent is revoked
Website technical data (cookies, logs, Google Analytics)	Up to 14 months
Requests to exercise rights (access, deletion)	3 years (evidentiary)

Information required in order to comply with a legal obligation will be retained for as long as required, including after the end of the business relationship.

7Information Security

We implement the following security measures:

• Encrypted communication (HTTPS) between the browser and the website.
• Access to information limited to those who need it in order to provide the service.
• Accepted organisational and technological security measures, in accordance with the Protection of Privacy Regulations (Data Security) and the security level that applies to the databases.
• Engagement with providers that process information on the Firm's behalf subject to the requirements of Regulation 15.
• Employee training and awareness of information security and of the privacy policy — a basic-level requirement.
• Information Security Officer: Eran Shemesh — contact details in section 11.

Security level classification:

In accordance with the Protection of Privacy Regulations (Data Security), 5777-2017, the Firm's databases are classified at a Medium security level — determined by virtue of the holding of sensitive financial information and a marketing database numbering more than 10,000 records.

8Security Incidents and Reporting

In accordance with the Protection of Privacy Law and the Protection of Privacy (Data Security) Regulations, 2017, in the event of a severe security incident we undertake:

• To notify the Privacy Protection Authority without delay, and in any event no later than 72 hours after discovering the incident.
• To notify the affected data subjects without unreasonable delay, where there is a high risk of harm to their privacy.
• To document every security incident and to take corrective and preventive measures.
• To report to law enforcement authorities in accordance with the decision of the Privacy Protection Authority.

9Your Rights in the Personal Information (Amendment 13)

In accordance with the Law, you are entitled to exercise the following rights — a response within 30 days:

Right of access (Section 13)To receive a copy of the information held about you in our databases, in Hebrew, English or Arabic at your choice. A written request with identifying documentation must be submitted. Right of correction (Section 14)To request the correction of information that is incorrect, incomplete or not up to date. Right of deletionTo request the deletion of information — subject to statutory retention obligations (7 years for accounting documents). Objection to processing (offered by us)To object to marketing processing at any time, at no cost. Receiving the information in a structured format (offered by us)To receive a structured copy of your information in a machine-readable format. Withdrawal of consent (Section 8C — Amendment 13)To withdraw consent to any processing given on the basis of consent, at any time — withdrawing consent shall be as simple as giving it. Removal from direct mail (Section 17F)To demand removal from the direct mail database — the Firm is obliged to remove and to confirm. Click "Unsubscribe" in any message or contact us directly.

How to exercise your rights:

1. Send a written request to the email address shemesh@shecpa.co.il with the subject: "Request to exercise a privacy right".
2. Include your name, contact details and a detailed description of the request. We will contact you to verify your identity, asking only for what is proportionate to the type of request.
3. Alternatively, use the online form on the website.
4. We will handle your enquiry within 30 days as required by law.
5. If the request is refused, you are entitled to appeal to the Privacy Protection Authority.

10Cookies and Tracking

The website uses cookies for the purpose of:

• Essential cookies: functioning of the website — these do not require consent.
• Analytics cookies (Google Analytics): understanding how the website is used. The data (including IP address and device identifiers) is transferred to Google servers in the USA. The script is loaded only after consent You can choose between two levels of consent: "Analytics only" — analysis of website use and aggregated age, gender and interest statistics (Google Signals), with no advertising use; "Accept all" — in addition, Google may use the data for personalised advertising and remarketing (for example, showing the Firm's ads to people who visited the site). If you choose "Reject", no tool is loaded. You can change your choice at any time.
• Your choice is stored in your browser for 12 months, after which you will be asked again. As evidence of consent, a record of the choice is kept (the choice, time, page, banner version and a random identifier also stored in your browser — no name or contact details).

You can change or withdraw consent at any time via the "Cookie settings" button at the bottom of the website. Withdrawing consent stops the analytics and deletes the Google Analytics cookies from your browser.

11Privacy Protection Coordinator (DPO) and Contact

Privacy Protection Coordinator: Eran Shemesh

The Privacy Protection Coordinator is responsible for the Firm's compliance with the requirements of the Protection of Privacy Law and for handling enquiries from data subjects.

Eran Shemesh also serves as the Information Security Officer in accordance with the Protection of Privacy Regulations (Data Security), 5777-2017.

Telephone: 052-4485784

Email: shemesh@shecpa.co.il

Address: Dizengoff 148, Tel Aviv

Response hours: Sunday–Thursday, 07:00–20:30

For enquiries to the Privacy Protection Authority: gov.il/privacy

You may also contact us through the data rights request form

on the website.

Version 4.1 (Amendment 13 + Regulation 15) | Shemesh CPA | Updated September 2026

English homeExercise your data rightsEnglish-speaking accountantHebrew version