Privacy Policy — Croonen Dienstverlening & Associates

Last updated: November 9, 2026

1. Introduction

Croonen Dienstverlening & Associates ("Summit," "we," "us," or "our") is committed to protecting your privacy and handling your personal information with transparency, integrity, and care. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website, engage our services, or otherwise interact with us.

This Policy applies to all individuals whose personal information we process, including clients, prospective clients, website visitors, and business contacts. It is designed to comply with applicable privacy laws, including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and other applicable U.S. state and federal privacy laws.

By using our website or engaging our services, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

We collect personal information in the following categories:

2.1 Information You Provide Directly

Identity Information: Full name, date of birth, Social Security Number or Tax Identification Number (for tax services), government-issued ID details.
Contact Information: Mailing address, email address, telephone number.
Financial Information: Income, assets, liabilities, bank account details, investment information, tax returns, financial statements, and other financial records necessary to provide our services.
Business Information: Business name, entity type, EIN, ownership structure, financial records, and payroll data.
Communications: Messages, emails, and other correspondence you send us.

2.2 Information Collected Automatically

Usage Data: IP address, browser type and version, operating system, referring URLs, pages visited, time spent on pages, and clickstream data.
Device Information: Device identifiers, hardware model, and network information.
Cookies and Tracking Technologies: We use cookies, web beacons, and similar technologies as described in our Cookie Policy.

2.3 Information from Third Parties

Government agencies and tax authorities (e.g., IRS, state revenue departments) in connection with providing tax services.
Financial institutions, payroll providers, and other service providers you authorize us to communicate with.
Credit reporting agencies, where permitted by law and necessary for our services.

3. How We Use Your Information

We use your personal information for the following purposes:

Service Delivery: To provide accounting, tax, bookkeeping, payroll, audit, advisory, and estate planning services.
Client Relationship Management: To communicate with you about your account, respond to inquiries, and manage our professional relationship.
Legal and Regulatory Compliance: To comply with applicable laws, regulations, professional standards, and court orders, including IRS regulations, AICPA standards, and state CPA licensing requirements.
Security and Fraud Prevention: To detect, investigate, and prevent fraudulent transactions and other illegal activities.
Business Operations: To improve our services, conduct internal analytics, manage our business, and train our staff.
Marketing: With your consent where required, to send newsletters, tax updates, and information about our services. You may opt out at any time.

4. Legal Bases for Processing (GDPR)

For individuals in the European Economic Area (EEA) or United Kingdom, we process your personal information on the following legal bases:

Contract Performance: Processing necessary to perform our engagement agreement with you.
Legal Obligation: Processing required to comply with applicable laws and professional regulations.
Legitimate Interests: Processing for our legitimate business interests, including fraud prevention, security, and service improvement, where these interests are not overridden by your rights.
Consent: Where we rely on your consent (e.g., for marketing communications), you may withdraw it at any time.

5. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

Service Providers: With trusted third-party vendors who assist us in delivering our services (e.g., cloud storage providers, software platforms, IT support), subject to confidentiality obligations.
Professional Advisors: With attorneys, co-accountants, or other professionals engaged in connection with your matter, with your authorization.
Government and Regulatory Authorities: As required by law, including tax filings submitted on your behalf to the IRS and state agencies.
Business Transfers: In connection with a merger, acquisition, or sale of all or a portion of our business, subject to confidentiality protections.
With Your Consent: For any other purpose with your explicit consent.

We require all third parties to maintain the confidentiality and security of your personal information and to use it only for the purposes for which it was disclosed.

6. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, regulatory, accounting, and professional obligations. For tax and accounting records, we generally retain client files for a minimum of seven (7) years following the end of the engagement, consistent with IRS guidance and professional standards. We may retain certain information longer where required by law or where we have a legitimate business need.

7. Data Security

We implement industry-standard technical and organizational security measures to protect your personal information against unauthorized access, disclosure, alteration, or destruction. These measures include:

256-bit AES encryption for data at rest and TLS 1.3 encryption for data in transit.
Multi-factor authentication for all systems containing client data.
Role-based access controls limiting data access to authorized personnel only.
Regular security assessments and penetration testing.
Employee training on data security and confidentiality obligations.
Incident response procedures for data breach notification.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

8. Your Privacy Rights

8.1 Rights Under GDPR (EEA/UK Residents)

If you are located in the EEA or UK, you have the following rights:

Right of Access: To request a copy of the personal information we hold about you.
Right to Rectification: To request correction of inaccurate or incomplete information.
Right to Erasure: To request deletion of your personal information, subject to legal retention obligations.
Right to Restriction: To request that we restrict processing of your information in certain circumstances.
Right to Data Portability: To receive your personal information in a structured, machine-readable format.
Right to Object: To object to processing based on legitimate interests or for direct marketing purposes.
Right to Withdraw Consent: Where processing is based on consent, to withdraw it at any time.

8.2 Rights Under CCPA/CPRA (California Residents)

If you are a California resident, you have the following rights:

Right to Know: To request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the business purposes, and the categories of third parties with whom we share it.
Right to Delete: To request deletion of personal information we have collected, subject to certain exceptions.
Right to Correct: To request correction of inaccurate personal information.
Right to Opt-Out of Sale or Sharing: We do not sell or share personal information for cross-context behavioral advertising.
Right to Limit Use of Sensitive Personal Information: To limit our use of sensitive personal information to purposes necessary to provide our services.
Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise your rights, please contact us using the information in Section 11. We will respond to verifiable requests within the timeframes required by applicable law (generally 30–45 days). We may need to verify your identity before processing your request.

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on our website. For detailed information about the cookies we use and your choices, please see our Cookie Policy.

10. Children's Privacy

Our website and services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately and we will take steps to delete it.

11. International Data Transfers

Our operations are primarily based in the United States. If you are located outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction. Where required, we implement appropriate safeguards for international transfers, including Standard Contractual Clauses approved by the European Commission.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the updated Policy on our website with a revised "Last Updated" date. For material changes, we will provide additional notice as required by applicable law. Your continued use of our services after the effective date of any changes constitutes your acceptance of the updated Policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Privacy Officer:

Croonen Dienstverlening & Associates
Attn: Privacy Officer
1200 Summit Plaza, Suite 800
New York, NY 10001
Email: privacy@croonenassociates.com
Phone: (212) 555-0100

If you are an EEA or UK resident and are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.