← Back to home
Privacy Policy
JTH Tax & Accounting
1. About this policy
I am Joshua Hor, trading as JTH Tax & Accounting (ABN 14 844 190 091) (JTH, I, me), a registered tax agent in Sydney, NSW. I provide tax compliance, bookkeeping, accounting and advisory services to individuals and to small and medium businesses. This policy explains how I collect, hold, use, disclose and protect your personal information, including your financial information and tax file number (TFN).
It applies to my website and to every client I work with. It forms part of my engagement letter, and by engaging me or giving me your information you agree to it. I handle personal information in line with the Privacy Act 1988 (Cth), the Australian Privacy Principles, the Privacy (Tax File Number) Rule 2015, and my confidentiality duties as a registered tax agent under the Tax Agent Services Act 2009 (Cth) and the Code of Professional Conduct.
When I act for a company, trust or partnership, “personal information” includes information about its directors, trustees, partners, shareholders, employees and other connected people.
2. What I collect and how
I collect only what I need to do the work you engage me for. Depending on the services, this can include:
- Contact and identity details: name, address, email, phone, date of birth, ABN/ACN, and your role in a company, trust or partnership.
- TFN and tax records: tax returns, notices of assessment, ATO correspondence, income and deduction records, superannuation, payroll, PAYG, BAS and GST records.
- Financial documents: bank, loan and credit card statements, transaction ledgers, and accounting software data (such as Xero, MYOB and QuickBooks).
- Business documents: invoices, contracts, leases, loan agreements, trust deeds and company records, where they relate to the work I do.
- Working papers: my own calculations and notes showing how I prepared your tax and accounting work.
- Identity documents and account access: only in the limited cases described in sections 4 and 5.
- Website enquiries: the details you enter in my enquiry form, and basic technical information my website host may collect, such as your IP address and browser type.
I collect information directly from you (by form, email, phone, in person, or documents you send), from people you authorise (such as your previous accountant, bookkeeper or lender), from government agencies and your bank or accounting software with your authority, and from public sources, such as a business’s own website, when I contact it to introduce my services. If you give me information about other people, you confirm that you are entitled to do so and that you have told them I will handle it under this policy.
Some records contain sensitive information, such as health-related claims, union fees or donations. I collect it only when it is needed for your work and you consent or the law requires it, and I use it for nothing else.
You can choose not to give me information, but I need accurate and complete information to prepare and lodge your returns, so I may be unable to help without it. If you send me information I did not ask for and did not need, I will not save it to my storage systems. It may remain in my email, and I will delete those email records if you ask me to.
3. Why I use it
I use your information to:
- prepare and lodge tax returns, BAS, activity statements, payroll and super reports, and financial statements;
- keep bookkeeping and accounting records and bring them up to date for lodgment or advice;
- give tax planning, structuring and business advice;
- keep working papers that support my tax calculations;
- deal with the ATO and other agencies on your behalf;
- communicate with you, run our engagement and issue invoices; and
- meet my legal and professional obligations, and handle complaints, disputes and insurance claims.
I use your TFN only as tax law allows. I do not sell, rent or exchange your information, and I use it for other purposes only with your consent, where you would reasonably expect it, or where the law requires or permits it.
Marketing. I may send you tax and lodgment reminders and let you know about other services that may suit your situation, where you would reasonably expect it. I may also email businesses directly to introduce my services, using contact details they have published or provided. I do not use sensitive information for marketing without your consent, and I do not give your information to others for their marketing. You can opt out at any time by replying to one of my emails or otherwise contacting me, and I will act on your request free of charge within five working days. If I collected your details from a public source, you can ask me where I got them.
4. Bank and online account access
I can usually do my work from statements and ledgers that you send me or that flow in through your accounting software. Sometimes I need to view your bank or financial accounts myself to extract statements or transaction ledgers.
My preferred options, in order:
- You download and send me the statements or ledgers.
- You set up a bank feed, or give me view-only or third-party access through your bank or accounting software.
- Only if you choose, you give me your online login details so I can view and download the records.
If you give me login details:
- You must give them to me voluntarily, and you confirm in writing (email is fine) that you authorise me to use them.
- I prefer to receive passwords verbally, by phone or in person, so there is no written record of them. You may instead send them by email, but you accept the risks of doing so, because email is not secure.
- I will use them only to view and download statements and transaction ledgers for the work you engaged me for.
- I will not make payments or transfers, change account settings or contact details, or approve any transaction.
- I will not ask for your card PIN or card security codes.
- I may store them, as described in section 7, until our engagement ends, unless you ask me to delete them sooner.
- You may change your password or remove my access once I have finished.
Please check your bank’s terms before sharing login details. Some banks’ terms restrict sharing online banking credentials, and you remain responsible for deciding whether to share them. If you are unsure, ask your bank about view-only or authorised third-party access, or choose one of the first two options above.
5. Identity documents
I ask for a copy of identity documents, such as a driver licence or passport, only when the law requires me to verify who you are. For example, this can apply to anti-money laundering and counter-terrorism financing (AML/CTF) obligations for certain services, or to other legal or regulatory requirements.
Where I collect them:
- I keep a copy only where the law requires it, and otherwise I keep a record of the checks I made;
- I ask you to send them through a secure method I provide, rather than ordinary email, where practicable;
- I store them securely (see section 7); and
- I keep them for the period the law requires (see section 8), and destroy them securely only if you ask me to.
6. Who I share it with
I keep your information confidential and share it only where needed, with:
- Government agencies and regulators, such as the ATO, ASIC, the Tax Practitioners Board and AUSTRAC, when I lodge on your behalf, when you authorise me, or when the law requires.
- Service providers that help me run the practice, such as accounting and payroll software, cloud storage, email, e-signature and password management providers. They may access your information only to provide their service to me.
- Other professionals you authorise, such as your solicitor, financial adviser, lender, or a new accountant if you move.
- Insurers, professional bodies and reviewers, where needed to deal with a claim, complaint or quality review, subject to confidentiality.
- Courts and authorities, where required by law or a court order.
- A successor to my practice, if I sell or transfer the business. I will tell you first where practicable.
I will not disclose your information to anyone else without your consent.
7. Storage, security and overseas
I take reasonable steps to protect your information from misuse, loss and unauthorised access. These include:
- storing electronic records in secure, access-controlled cloud systems;
- using strong passwords and multi-factor authentication on my accounts and devices; and
- scanning paper documents, and preferring to return the originals to you unless you ask me to securely destroy them.
Login details you give me may be kept in a reputable, encrypted password manager protected by multi-factor authentication. I prefer to receive them verbally, so there is no written record. If you send them by email, they will also exist in your email and mine, and you accept the risks of that. I handle them as described in section 4.
I use cloud-based software and storage, so your information may be stored outside Australia. I take reasonable steps to choose providers with appropriate security.
I may use artificial intelligence (AI) tools in my work. I use only business-grade tools whose terms say they do not train their models on my inputs, and I do not enter your login details or identity documents into them. If you do not want me to use AI tools on your information, tell me and I will work without them where I reasonably can.
No method of storing or sending information is completely secure, and ordinary email in particular is not private. If a data breach occurs that the Notifiable Data Breaches scheme requires me to report, I will notify you and the Office of the Australian Information Commissioner (OAIC) as the scheme requires. I will also notify other agencies where the law requires.
8. How long I keep records
I keep client records, including working papers and engagement documents, for at least five years after I finish providing the service, as tax practitioner record-keeping rules require. Where AML/CTF laws apply to a service, I keep identity verification records for seven years, or as long as that law requires. I keep records longer if the law requires it, or if I need them for a dispute or investigation.
I do not destroy records when the retention period ends. I destroy them only if you ask me to, as long as the law does not require me to keep them.
You are still responsible for keeping your own records as tax law requires. I do not act as your record keeper.
9. Access, correction and complaints
You can ask me for access to the personal information I hold about you, or ask me to correct it, by contacting me using the details below. I will give you access in the way you ask for if that is reasonable and practicable, and I do not charge for making a request or for correcting information. In limited cases I may refuse access, for example where the law prevents it or it would affect another person’s privacy, and if I do I will explain why in writing. You can also ask me to delete your information, which I will do unless the law requires me to keep it. Please tell me about changes to your details, such as a new address, bank account or business structure, so my records stay accurate.
If you have a question or complaint about how I handle your information, contact me, Joshua Hor, as the privacy contact:
I will acknowledge your complaint within 7 days and aim to resolve it within 30 days. If you are not satisfied with my response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992. For concerns about my conduct as a tax agent, you can contact the Tax Practitioners Board at tpb.gov.au.
10. Changes to this policy
I may update this policy from time to time. The current version is always on my website, and it applies to your engagement with me unless your engagement letter says otherwise. This policy was last updated on 29 October 2026.