Privacy policy
This is a translation for your convenience. The German version (Datenschutzerklärung) is legally binding.
I process personal data on the basis of the GDPR (DSGVO), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021).
Controller
Alexander Aufreiter
Am Stadlfeld 10, 4040 Linz, Austria
Email: aufreiter-caa@pm.me
Phone: 0699 11856676
Hosting and server log data
This website is hosted by Hostinger International Ltd. The servers are located in the EU. A data processing agreement under Art 28 GDPR is in place with the provider. When you visit the website, the host processes technically necessary access data, such as IP address, time, page visited and browser type. The legal basis is my legitimate interest in secure and stable operation (Art 6(1)(f) GDPR). The data is deleted as soon as it is no longer needed for secure operation.
Microsoft 365
I use Microsoft 365 (Microsoft Ireland Operations Ltd.) as my IT service provider, for example for email, file storage, video calls and appointment booking. Microsoft processes the data on my behalf (Art 28 GDPR) and stores it in principle in the EU (EU Data Boundary). In certain cases, for example security incidents or technical support, data may be transferred to the USA. This is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art 45 GDPR) and, in addition, on standard contractual clauses (Art 46(2)(c) GDPR).
Cookies
This website does not set cookies and does not use analytics or tracking services.
Contact by email or phone
I process your details to handle your inquiry (Art 6(1)(b) or (f) GDPR). Inquiries that do not lead to an engagement are deleted once they have been dealt with and no follow-up questions are to be expected. Emails to my address are received by Proton Mail (Proton AG, Switzerland) as my processor and forwarded to my Microsoft 365 account. An adequacy decision of the European Commission exists for Switzerland (Art 45 GDPR). If you engage me, the section "Engagement" applies.
Appointment booking
After your inquiry, I send you a link to book an appointment. Appointments are booked through my Microsoft 365 account (see above). I process the details from the booking form to arrange the appointment (Art 6(1)(b) GDPR). Microsoft's terms apply to cookies that Microsoft sets on the booking page.
Engagement (ITIN application as Certifying Acceptance Agent)
Data and purpose. If you engage me, I process identity and contact data, details of your nationality and residence status, copies of your identity documents, notes from the identity interview and the tax data needed for the application. I check your original documents, certify your identity and foreign status to the IRS (Certificate of Accuracy) and send the application with copies of the documents to the Internal Revenue Service (IRS), the US tax authority. I keep IRS notices about the application in the client file.
Legal bases. The processing is based on the performance of my contract with you (Art 6(1)(b) GDPR) and on my legitimate interest in meeting my obligations under my agreement with the IRS as a Certifying Acceptance Agent (Art 6(1)(f) GDPR).
Identity interview and originals. I hold the identity interview in person or by video call. For a video call, I must hold your original documents during the call so that I can check their security features. You send me the originals beforehand by post or courier, and I return them to you immediately after the check. In certain cases, especially for children, the IRS requires originals or copies certified by the issuing agency. These go to the IRS with the application, and the IRS returns them to you.
Recipients. Recipients are the IRS, my IT service providers Microsoft and Proton (see above) and postal and courier services.
Transfer to the IRS (USA). There is no adequacy decision for the IRS. The transfer is necessary for the performance of my contract with you (Art 49(1)(b) GDPR; for family members who are not parties to the contract: (c)). Where you have given your explicit consent in the engagement letter, after I informed you of the risks of a transfer without an adequacy decision and without appropriate safeguards, the transfer is additionally based on your consent ((a)); this also applies to providing the client file during reviews by the IRS, TIGTA or GAO (see below). Your rights as a data subject may be limited in the USA.
Access by the IRS and US oversight bodies. The IRS and the US oversight bodies Treasury Inspector General for Tax Administration (TIGTA) and Government Accountability Office (GAO) may inspect my client files during reviews of my Acceptance Agent Agreement. I am contractually obliged to provide the documents. The IRS may also contact you directly for verification.
Obligation to provide data. Providing your data is required by contract and by the IRS rules. Without it, I cannot submit the application.
Data of third parties. If you also apply for an ITIN for your spouse or children, I receive their data from you. Please inform these persons about this policy.
Storage and security
I store the client file electronically in my Microsoft 365 account (see above) and protect it with technical and organisational measures under Art 32 GDPR, in particular encryption and access restriction. I scan paper documents; you get the originals back. Please send copies of your identity documents only via the secure upload link you receive from me, not by email.
Retention period. I keep the client file until the end of the third calendar year after the year in which the application was submitted or, if later, the year of the last IRS notice on the application. This meets the retention requirement under the IRS rules. For example, if the application is submitted in 2026 and the last IRS notice also arrives in 2026, I keep the file until 31 December 2029. I then delete it. If the application is not submitted, I delete the file once the engagement has ended. Technically required copies (e.g. in the recycle bin) are permanently removed automatically under the deletion periods of my IT service provider. Invoices and accounting records are kept for 7 years (§ 132(1) BAO; § 11 UStG).
Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and to withdraw any consent given with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before it. When you ask me to delete the client file, I take my retention obligation towards the IRS into account (see "Retention period"). I do not make automated decisions, including profiling.
Right to object
Where I process data on the basis of legitimate interests (Art 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. To do so, write to aufreiter-caa@pm.me.
Complaints
You can complain to me (aufreiter-caa@pm.me) or to the data protection authority: Österreichische Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40-42, 1030 Vienna, dsb.gv.at.