Privacy Policy

Effective July 20, 2026

“hfco” is the trade name under which Haefele, Flanagan & Co., P.C. provides services. We practice in accordance with the AICPA Code of Professional Conduct and other applicable laws, regulations and standards. hfco is a licensed CPA firm that provides tax and business consulting services to its clients. We value the trust our clients and visitors place in us. This Privacy Policy notice is made on behalf of hfco and explains what information we collect through hfco.com, how we use it, and the choices available to you. It applies to this website and to the forms, portals, and tools linked from it.

If you have questions about this policy, please reach out to us using the contact information at the end of this page.

Information We Collect

We collect nonpublic personal information (“Personal Data”) about you, only to the extent necessary to perform the services, from the following sources:

Information you provide directly. When you contact us through our website, request a consultation, or submit a form, we collect the details you choose to share, such as your name, email address, phone number, and the contents of your message.

Information collected for tax and advisory engagements. When hfco prepares a tax return or provides accounting or advisory services, we collect the information necessary to do that work well, which may include Social Security numbers (“SSNs”), financial account details, income and asset information, and other data relevant to the engagement. This information is provided directly by you or otherwise gathered in the course of the engagement.

Information collected through client portals and tools. hfco offers secure, third-party tools to support our client relationships, including our client portal, TaxCaddy, Smartsheet, SafeSend Returns, and our online bill pay processor. These platforms are operated by their respective providers under their own privacy and security practices, and they may collect financial, tax, or other personal information you submit in connection with the services we provide. We encourage you to review each provider’s privacy policy for details on how they handle your information. hfco maintains confidentiality agreements with each of its third-party service providers.

Information collected automatically. Like most websites, hfco.com uses cookies and similar technologies to understand how visitors use our site, improve functionality, and support our marketing efforts. This may include your IP address, browser type, device information, and browsing activity on our site.

Our site uses Google Analytics to help us understand how visitors use hfco.com. Google Analytics may place cookies on your browser and collect information about your activity on our site over time. You can learn more about how Google handles this information, and how to opt out, at https://tools.google.com/dlpage/gaoptout. Most browsers also let you manage or block cookies directly through your browser settings, though some site features may not work as well if cookies are disabled. Our website does not currently respond to browser ‘Do Not Track’ (“DNT”) signals, as there is no universally accepted standard for how to respond to such signals. However, in compliance with the New Jersey Data Protection Act (“NJDPA”), we do recognize and honor Global Privacy Control (“GPC”) signals, If your browser or extension transmits a GPC signal, we will treat it as a valid opt-out request for targeted advertising and sale or sharing of your Personal Data (to the extent applicable). When we detect a GPC signal, we automatically apply your opt-out preferences to your session on our website without the need for you to make individual or manual opt-out requests.

Information from social media. Links to hfco’s LinkedIn, Facebook, Twitter/X, Instagram, and Google profiles are available on our site. Interactions with these platforms are governed by each platform’s own privacy policy.

hfco may combine personal information provided to it with personal information obtained from third-party sources identified above or from our website.

Why And How We Use Your Information

Access to your Personal Data is restricted to our employees and contractors involved in providing professional services to you.

We use the information we collect to:

· Respond to inquiries and schedule consultations

· Deliver the accounting, tax, and advisory services for which we are engaged by clients

· Maintain and improve our website and the security of our systems

· Share relevant insights, resources, and updates with clients and prospective clients

· Meet recordkeeping, regulatory, and professional obligations tied to our work as a CPA and advisory firm

How We Share Your Information

hfco shares information only as needed to deliver our services and operate our business, primarily with the trusted service providers and through the portals referenced above. For details on how we handle information collected through client engagements specifically, see the Parties to Whom We May Disclose Personal Data and Professional Confidentiality section below. We do not post or display our clients’ SSNs.

Parties to Whom We May Disclose Personal Data and Professional Confidentiality

As a firm providing tax, accounting, and financial advisory services, hfco is entrusted with information that falls under federal privacy protections for financial institutions, including the Gramm-Leach-Bliley Act. We take this responsibility seriously and hold ourselves accountable for it. hfco maintains a Written Information Security Program (WISP) as required by the amended Safeguards Rule that is updated annually.

In the course of an engagement, hfco may collect Personal Data about clients, such as financial statements, tax records, account numbers, and other information necessary to provide our services. This information comes directly from clients, from the engagements we perform, and at times from other sources in connection with the services a client has requested.

hfco obtains written client consent in compliance with IRC §7216 (“Section 7216”) before sharing tax return information with third-party platforms, offering non-tax services to our clients or sharing information with mortgage lenders, banks, divorce attorneys or in response to a subpoena. You have the right to withhold or limit your consent to any such sharing of information by hfco.

hfco does not disclose Personal Data about current or former clients to non-affiliated third parties, except in the following circumstances:

· To legal and regulatory officials pursuant to court orders, subpoenas and mandatory government inquiries.

· To State Board of Accountancy authorized peer reviewers.

· To officials investigating ethical inquiries from AICPA, NJSCPA, or related bodies.

· To third-party providers aiding in the provision of our services under confidentiality provisions.

· To potential corporate transaction partners under confidentiality provisions.

· To third-party technology platforms and service providers that we use to deliver professional services to you including, without limitation, our client portal, TaxCaddy, Smartsheet, SafeSend Returns, and our online bill pay processor. These providers receive your information only to the extent necessary to perform the specific services for which we engage them, and each is bound by contractual confidentiality obligations required to maintain appropriate security safeguards.

Within hfco, access to client information is limited to team members who need it to deliver the services. Our team is guided by the AICPA Code of Professional Conduct and the standards of the state boards of accountancy where we practice, both of which place confidentiality at the center of the client relationship. We maintain administrative, technical, and physical safeguards designed to protect this information, consistent with our professional and regulatory obligations.

Tax Return Information – Section 7216

As a licensed tax preparation firm, hfco is subject to Section 7216, which protects the confidentiality of your tax return information. Under this law, we cannot disclose your tax return information to any third-party or use it for any purpose other than preparing your return, without first obtaining your written consent in a format prescribed by the IRS.

In practice, this means:

· Before we share your tax return information with any third-party service provider (such as a document-exchange portal or electronic signature platform), we will obtain your written authorization as required by the applicable Treasury regulation.

· Before we use your tax return information to offer you additional services beyond return preparation (such as advisory or planning services), we will obtain your separate written consent.

· You have the right to decline any such consent, and your decision will not affect our obligation to prepare your tax returns.

· Consents are obtained through a separate, signed authorization form provided as part of our engagement process-not through this website privacy policy.

If you have any questions about how your tax return information is used or shared, or if you wish to revoke a previously granted consent, please contact us at the email or phone number set forth below.

Your Choices

You have options when it comes to your information:

· You can decline to submit a form on our site; this may limit our ability to respond to your inquiry

· Most browsers allow you to manage or disable cookies through your browser settings

· Clients can reach out directly to discuss updating or correcting information held in their client file.

· Residents of certain states, including New Jersey, Pennsylvania, New York, Delaware, Maryland, and North Carolina, may have additional rights under applicable state privacy laws; contact us to make a request.

From time to time, we may send you emails containing firm news, tax-planning insights, regulatory updates, event invitations, or information about our services. Every marketing or promotional email we send includes a clear unsubscribe link at the bottom of the message. If you click that link or otherwise ask us to stop, we will remove you from our marketing list within ten (10) business days. You may also opt out by emailing us at the address below.

Opting out of marketing emails will not affect transactional or service-related communications (such as engagement letters, tax-return delivery notifications, invoice reminders, or portal access instructions), which we will continue to send as needed to service your account.

Your Right Under the NJDPA

If applicable, NJDPA grants consumers rights to access, correct, and delete personal data, as well as opt out of data selling. hfco does not sell Personal Data to third-parties.

Data Security

We maintain a comprehensive Written Information Security Program (“WISP”) as required by Gramm-Leach-Bliley Act Safeguards Rule. Our WISP includes administrative, technical, and physical safeguards appropriate to the size of our firm, the nature of our services, and the sensitivity of the financial and tax information we handle. Key elements include:

· Designated information-security personnel responsible for our program;

· Access controls limiting employee and contractor access to Personal Data on a need-to-know basis;

· Encryption of Personal Data in transit and at rest;

· Multi-factor authentication for access to systems containing sensitive client data;

· Regular risk assessments and employee security-awareness training; and

· Oversight procedures for our third-party service providers’ security practices.

SSNs and Taxpayer Identification Numbers (“TINs”): We collect SSNs and TINs only when required to perform tax preparation and related professional services. We do not publicly post, display or print SSNs on any materials mailed to clients (except as required by law, such as on filed tax returns). SSNs are not used as account numbers or login credentials for any hfco system. We require secure destruction of records containing SSNs when they are no longer needed for their intended purpose, in accordance with the New Jersey Identity Theft Protection Act (“NJITPA”). Third-party portals and technology providers used in connection with our services are selected, in part, based on their security standards, encryption practices, and suitability for handling confidential financial and tax information.

We also maintain security monitoring procedures designed to detect unauthorized access to personal information in our systems. In the unlikely event that a security breach compromises your Personal Data, we will notify you affected individuals in accordance with the NJITPA and any other applicable breach-notification laws. Notification will be provided without unreasonable delay, consistent with any law-enforcement investigation needs and measures necessary to determine the scope of the breach. Where required by law, we will also report the incident to the New Jersey State Police and other relevant authorities. We will include in our notification a description of the incident, the types of information involved, steps we are taking in response, and recommended steps you can take to protect yourself.

How Long We Keep Information

hfco retains client records and personal information for as long as needed to provide our services, and beyond that as required by professional standards, regulatory recordkeeping rules, and IRS recordkeeping guidance for tax preparers. When information is no longer needed for these purposes, we take reasonable steps to dispose of it securely so that such records cannot be read or reconstructed. Personal Data is encrypted in transit and at rest.

Links to Other Websites

hfco.com may include links to outside websites and resources for your convenience. We do not control these sites and are not responsible for their content or privacy practices. We encourage you to review the privacy policy of any third-party site before sharing information there.

Children’s Privacy

Our website and services are intended for business and professional audiences. We do not knowingly collect information from children under the age of 13. If hfco discovers that it has inadvertently collected information from a child under 13, we will take prompt steps to delete that information from our systems. If a parent has a concern that information has been inadvertently collected from a child under the age of 13, the parent should reach out to hfco at the phone number or email address set forth below so that we can investigate and remove the information.

Changes to This Policy

hfco may update this policy from time to time to reflect changes in our practices, services, or legal requirements. The effective date at the top of this page will reflect the most recent revision.

Contact Us

Questions about this policy or how hfco handles your information can be directed to:

hfco Tall Oaks Corporate Center 1000 S. Lenola Rd., Building 2, Suite 200 Maple Shade, NJ 08052 Phone: 856-722-5300 Email: info@hfco.com Contact: Brian Weldin, Director, A&A and Quality Control