→ Back to home

Legal

Data Processing Addendum

Effective Date: August 27, 2026

This Data Processing Addendum (“DPA”) is incorporated by reference into the TaxFigure Terms of Use (the “Terms”) between TaxFigure LLC (“TaxFigure”, “we”) and the customer agreeing to the Terms (“Customer”, “you”). It applies to the extent your use of the TaxFigure Platform involves our processing of Personal Data contained in Platform Data on your behalf. Capitalized terms not defined here have the meanings given in the Terms.

1. Roles and Scope

As between the parties, you are the controller of (or, where you act on behalf of your own clients, a processor for) Personal Data contained in Platform Data, and TaxFigure is your processor and, for purposes of the California Consumer Privacy Act (“CCPA”), your service provider. We process Personal Data only to provide, secure, and support the Services described in the Terms.

2. Definitions

  • “Personal Data” means information within Platform Data that identifies or can reasonably be linked to an identified or identifiable natural person under applicable Data Protection Laws.
  • “Data Protection Laws” means the data protection and privacy laws applicable to our processing of Personal Data under the Terms, which may include the CCPA and, where applicable, the EU General Data Protection Regulation (“GDPR”).
  • “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data processed by TaxFigure.
  • “Sub-processor” means a third party engaged by TaxFigure to process Personal Data on your behalf in connection with the Services.

3. Processing Instructions and Details

The Terms, this DPA, and your use and configuration of the Platform constitute your documented instructions to TaxFigure. We will not process Personal Data for any other purpose unless required by law, in which case we will inform you unless legally prohibited from doing so.

  • Nature and purpose: hosting, document processing and extraction, analysis, AI-assisted research and drafting, and related support functions of the TaxFigure Platform.
  • Categories of data: the Personal Data you choose to submit, which may include names, contact details, identifiers, and financial and tax information contained in documents and inputs.
  • Data subjects: your personnel and, where you use the Platform in service of your own clients, those clients and individuals appearing in their records.
  • Duration: the term of the Terms, plus the retention and deletion periods described in Section 9.

4. CCPA Service Provider Commitments

To the extent the CCPA applies to Personal Data we process for you, TaxFigure will not:

  • sell or share Personal Data (as those terms are defined by the CCPA);
  • retain, use, or disclose Personal Data for any purpose other than the business purposes specified in the Terms and this DPA, or outside the direct business relationship between you and TaxFigure;
  • combine Personal Data received from you with personal information from other sources, except as permitted by the CCPA for service providers.

We will notify you without undue delay if we determine we can no longer meet our obligations under the CCPA, and upon such notice you may take the steps the CCPA provides to stop or remediate unauthorized processing.

5. Confidentiality

We ensure that personnel authorized to process Personal Data are bound by confidentiality obligations, and we limit access to personnel who need it to provide the Services.

6. Security

TaxFigure maintains administrative, technical, and organizational safeguards designed to protect Personal Data, as described in our Information Security Program, which is incorporated into this DPA by reference. We may update those safeguards from time to time, provided the overall level of protection is not materially reduced during a subscription term.

7. Sub-processors

You provide general authorization for TaxFigure to engage the Sub-processors listed in our Information Security Program, consistent with Section 12 of the Terms. We will update that list before we add a Sub-processor that will have access to Platform Data. We impose data protection obligations on our Sub-processors consistent with this DPA and remain responsible for their performance. If you object in writing to a new Sub-processor on reasonable data protection grounds, we will work with you in good faith to address the objection.

8. Security Incidents

We will notify you of a Security Incident affecting your Platform Data without undue delay after becoming aware of it, consistent with Section 12 of the Terms, and will provide information reasonably available to us to support your own notification obligations, followed by updates as our investigation progresses.

9. Data Subject and Consumer Requests; Deletion

Taking into account the nature of the processing, we will provide reasonable assistance so you can respond to requests from individuals exercising rights under Data Protection Laws. If such a request comes to us directly, we will redirect the individual to you where appropriate. Upon termination of the Terms, or upon your written request, we will delete Personal Data processed on your behalf, except where retention is required by law, after which residual copies are removed as backups cycle out in the ordinary course.

10. Attestations and Information

Upon reasonable written request, no more than once per year, we will make available information reasonably necessary to demonstrate compliance with this DPA, which may include summaries of third-party security assessments or attestations, subject to confidentiality obligations.

11. Location of Processing and International Transfers

The TaxFigure Platform is operated primarily from the United States, and our Sub-processors’ processing locations are described in the Information Security Program. To the extent the GDPR applies to Personal Data we process for you, this DPA is intended to satisfy the requirements of Article 28, and the parties will execute the EU Standard Contractual Clauses or other lawful transfer mechanisms upon request where required.

12. General

This DPA is subject to the limitations of liability in the Terms. If there is a conflict between this DPA and the Terms with respect to the processing of Personal Data, this DPA controls. We may update this DPA from time to time as Data Protection Laws evolve; the then-current version is available at this page, consistent with Section 12 of the Terms. Questions and requests under this DPA: contact us or write to the address in the Terms.