1. Information We Collect and How We Use It
Ahura Group collects various types of information from our clients to effectively deliver our comprehensive range of accounting, tax, and related services . As previously outlined, this information may encompass personal identification details, financial records, tax-related documents, communication logs, and other data essential for the specific services we are engaged to provide. Ahura Group is a full-service certified public accounting firm assisting individuals and business owners with a wide array of services, including individual and business tax preparation and planning, tax consulting, IRS tax resolution, bookkeeping services, payroll services, and specialized services for digital entrepreneurs and social influencers . The nature and extent of the information we collect will depend on the specific services you request from us.
We utilize the collected information to fulfill our contractual obligations to you, to provide the accounting, tax, and related services you have requested, to ensure our compliance with all applicable legal and regulatory requirements, to facilitate effective communication with you regarding your services, and to continually improve the quality and scope of the services we offer. The specific purposes for which we collect and use your information will be clearly communicated to you at the point of collection or as detailed within our comprehensive privacy policy.
Transparency regarding the types of information we collect and how we use it is not only a matter of ethical practice but also a fundamental requirement under prevailing data privacy laws, such as the New Jersey Data Privacy Act (NJDPA) and the Gramm-Leach-Bliley Act (GLBA) . These regulations emphasize the importance of businesses being upfront and clear with consumers about their data handling practices. For instance, the NJDPA mandates that businesses provide clear privacy notices detailing the categories of personal data collected and the purposes for which it is processed . Similarly, the GLBA requires financial institutions to explain their information-sharing practices to their customers . This consistent legal emphasis across both state and federal regulations underscores the critical importance of Ahura Group maintaining transparency in our data collection and usage practices, which is essential for both legal compliance and fostering a relationship of trust with our clients.
2. Security Measures Implemented by Ahura Group
Ahura Group has implemented and diligently maintains a comprehensive information security program meticulously designed to protect the confidentiality, integrity, and availability of your valuable information. This robust program incorporates a multi-layered approach, encompassing administrative, technical, and physical safeguards that are in strict alignment with the stringent requirements of the GLBA Safeguards Rule, the guidelines set forth by the Internal Revenue Service (IRS), and the prevailing cybersecurity best practices specifically tailored for CPA firms.
A. Technical Safeguards:
We employ industry-standard encryption protocols to ensure the protection of your sensitive data both when it is securely stored on our systems (at rest) and when it is being transmitted across networks (in transit) . The FTC Safeguards Rule explicitly mandates the encryption of customer information both while it is being transmitted and when it is stored on our systems, recognizing encryption as a fundamental technical safeguard for protecting sensitive data from unauthorized access . Furthermore, the use of robust encryption technologies is highlighted as a key feature of secure tax accounting software, which is directly relevant to the nature of the services provided by Ahura Group.
Access to client information is rigorously controlled through the implementation of multi-factor authentication (MFA), a security measure that requires individuals to provide at least two distinct forms of verification before they are granted access to sensitive data . This significantly enhances security by adding extra layers of protection beyond just a username and password, thereby minimizing the risks associated with unauthorized access . Cybersecurity best practices for CPA firms in 2025 strongly recommend the use of MFA to strengthen access controls and mitigate the potential for unauthorized access . Moreover, the FTC Safeguards Rule explicitly requires the implementation of MFA for any individual accessing customer information, underscoring its importance in protecting sensitive financial data.
Our network infrastructure is fortified with the use of robust firewalls and sophisticated intrusion detection and prevention systems. These critical components work in concert to continuously monitor our network traffic, identify and block any unauthorized access attempts, and prevent malicious activity from compromising our systems and your data . The implementation of strong firewalls and intrusion detection systems is recognized as an essential practice for safeguarding an accounting firm's network against a wide range of external cyber threats .
To maintain the security and operational stability of our technological environment, we adhere to a strict regimen of regular software updates and security patching. This proactive approach ensures that any known vulnerabilities within our software and operating systems are promptly addressed, thereby minimizing the potential for exploitation by malicious actors . Cybersecurity guidance for CPA firms emphasizes the critical importance of regularly patching and updating all devices and software to address any identified vulnerabilities and keep systems secure . Additionally, partnering with a managed IT services provider to ensure that antivirus and anti-malware software is consistently up to date is a recommended best practice . The AICPA cybersecurity checklist also suggests setting computers to automatically update the operating system and key applications as a fundamental security measure .
We employ reputable and regularly updated antivirus and anti-malware software across all our systems. This crucial layer of defense works to detect, quarantine, and remove any malicious software that may attempt to infiltrate our systems and compromise the integrity or confidentiality of your data . Utilizing effective virus-scanning software is considered a basic yet indispensable step in protecting sensitive client data . Furthermore, industry experts often recommend specific antivirus solutions, such as Sophos, Bitdefender, and McAfee, for their proven effectiveness in safeguarding business environments .
To proactively identify and address any potential security weaknesses within our infrastructure, we conduct regular vulnerability assessments and penetration testing of our systems and applications. These rigorous testing procedures help us to uncover and remediate any security flaws before they can be exploited by malicious actors, ensuring the ongoing security of your information . Scheduling regular penetration testing is a recommended cybersecurity practice for uncovering vulnerabilities in systems before they can be exploited . Moreover, periodic penetration testing and vulnerability assessments are specifically listed as methods to effectively monitor the overall effectiveness of our implemented security safeguards .
B. Administrative Safeguards:
Ahura Group has established and diligently maintains a comprehensive Written Information Security Plan (WISP) that serves as a foundational document outlining our detailed policies and procedures for the protection of your information. This WISP is a critical requirement under both the GLBA Safeguards Rule and the guidelines issued by the IRS, reflecting our commitment to adhering to the highest standards of data security . The GLBA Safeguards Rule explicitly mandates that all tax return preparation firms, regardless of their size, must develop, implement, and maintain a WISP . This plan describes in detail how our business is prepared to protect the nonpublic personal information of our consumers . Compliance with the FTC Safeguards Rule, often formalized through the creation and regular updating of a WISP, is a legal obligation for all accounting and bookkeeping firms that handle client financial data .
Access to client information within Ahura Group is strictly controlled and granted on a need-to-know basis. We adhere to the principle of least privilege, ensuring that only authorized personnel who require access to specific data to perform their assigned job responsibilities are granted that access . The FTC Safeguards Rule requires the implementation of access controls and the regular reevaluation of whether an individual's access aligns with their legitimate business needs . Operating on a strict need-to-know basis when assigning access rights is a fundamental practice for enhancing cybersecurity within accounting firms .
All employees at Ahura Group undergo regular and comprehensive security awareness training programs. These educational initiatives are designed to equip our team with the knowledge and skills necessary to identify potential security threats, such as phishing attacks and ransomware, and to ensure they fully understand their individual responsibilities in protecting the confidentiality and security of client information . Investing in ongoing employee training is recognized as a critical strategy for significantly strengthening a firm's overall cybersecurity posture . Recognizing that human error is a significant contributing factor to cyber breaches, we emphasize the importance of continuous education and awareness to mitigate these risks . Educating employees through refresher courses and comprehensive training programs ensures that our team remains up-to-date on the latest cybersecurity threats and effective preventative measures .
Ahura Group has established clear and comprehensive internal policies and procedures that govern the proper handling and security of all client data. These documented guidelines ensure consistent and secure practices across all aspects of our firm's operations . CPA firms are advised to begin by thoroughly evaluating their existing data privacy policies and procedures to ensure they are reasonable, effective, and aligned with current best practices and regulatory requirements . Maintaining a comprehensive WISP that accurately reflects our firm's implemented security measures is a cornerstone of our administrative safeguards .
To further enhance the security of client information, Ahura Group conducts thorough background checks on all employees who will have access to sensitive client data. This measure helps to mitigate potential internal risks and ensures that individuals entrusted with client information have a demonstrated history of trustworthiness and reliability . Running thorough background checks on potential employees is a recommended practice for protecting an accounting firm from internal threats, including theft, fraud, and security breaches .
In strict accordance with the FTC Safeguards Rule, Ahura Group has designated a qualified individual who is directly responsible for overseeing our comprehensive information security program. This designated individual is tasked with ensuring the effective implementation, ongoing maintenance, and continuous improvement of our security measures . The FTC Safeguards Rule explicitly mandates that financial institutions appoint a qualified individual to oversee and be accountable for their information security program . This ensures that there is clear leadership and accountability for all aspects of our data security efforts.
C. Physical Safeguards:
Ahura Group maintains stringent physical security measures to protect our premises, including our offices and data storage areas, from unauthorized access. These measures are designed to prevent any physical intrusion that could potentially lead to the compromise of client information . Prioritizing physical security is a critical component of cybersecurity for accounting firms, and recommended measures include implementing access controls, maintaining visitor logs, and utilizing security cameras to ensure that only authorized individuals can enter sensitive areas or access physical documents and devices . Additionally, securing hard copy documents in locations that are not accessible to visitors is a fundamental best practice .
All physical documents containing sensitive client information are securely disposed of through the use of professional-grade shredders. This ensures that the information is rendered completely unreadable and prevents any possibility of unauthorized retrieval or reconstruction . Shredding physical documents containing sensitive information is a widely recommended proper disposal method . For example, regulations specify that paper records containing sensitive information must be shredded, pulverized, burned, or pulped until the information is completely unreadable and cannot be reconstructed .
Backup media containing client data is stored securely in a separate, access-controlled location. This ensures that in the event of a disaster or security incident affecting our primary systems, we have the ability to recover your data and minimize any potential disruption to our services . Maintaining secure storage for backup media is a critical element of a comprehensive data security and disaster recovery plan .
Access to our server rooms and other critical infrastructure areas is strictly limited to authorized personnel only. This physical restriction helps to prevent unauthorized individuals from gaining access to the core systems that house and process client data . Best practices suggest that server rooms should be located in the interior of the building, without any windows, and with tightly controlled physical access to ensure the security of the critical equipment housed within .
Ahura Group has also implemented clean desk policies within our offices. These policies require employees to clear their desks of any sensitive client information at the end of each workday and whenever they step away from their workstations. This simple yet effective measure minimizes the risk of sensitive information being inadvertently exposed or accessed by unauthorized individuals who may be present in the office.
The FTC Safeguards Rule serves as the overarching framework guiding Ahura Group's comprehensive security program. This rule mandates specific administrative, technical, and physical safeguards that financial institutions, including CPA firms, must implement to protect customer information . Non-compliance with the Safeguards Rule carries significant risks, including the potential for substantial financial penalties and irreparable damage to our firm's reputation . The rule provides a detailed roadmap for establishing and maintaining a robust information security program, making it a central pillar of our security strategy. Complementing these broad federal requirements, the IRS provides specific guidelines, particularly within IRS Publication 4557, that focus on the protection of taxpayer data . These IRS guidelines offer tailored recommendations for tax professionals, ensuring that Ahura Group adheres to both general financial data protection standards and the specific requirements for safeguarding taxpayer information. This dual compliance demonstrates our commitment to the highest levels of data security within our capacity as tax professionals. Furthermore, Ahura Group recognizes that the cybersecurity landscape is constantly evolving. Therefore, we actively incorporate cybersecurity best practices specifically recommended for CPA firms in 2025 . These best practices emphasize the critical need for a proactive and adaptive security posture, including continuous threat monitoring, the development and regular testing of incident response plans, and the strategic adoption of advanced security technologies. This forward-thinking approach ensures that our security measures are not static but are continuously evaluated and enhanced to effectively address emerging cyber threats and maintain the highest level of protection for our clients' valuable information.
3. Data Retention and Disposal Practices
Ahura Group maintains data retention policies and procedures that are in strict compliance with all applicable legal and regulatory requirements, as well as established industry best practices for data management . We are committed to retaining client information only for the duration necessary to fulfill the specific purposes for which it was collected, to provide the requested accounting, tax, and related services, to meet our obligations under relevant laws and regulations (such as those stipulated by the IRS regarding the retention of tax records), and for other legitimate business purposes . For instance, the IRS generally requires that records supporting items on a tax return be retained until the period of limitation for that return expires . Financial institutions are also typically required to securely dispose of customer information after a certain period, often two years from the last date of use, unless a longer retention period is mandated by law or required for legitimate business needs . Establishing comprehensive data retention policies that include category-specific retention schedules and implementing automated data lifecycle management systems are crucial for ensuring that data is not retained longer than necessary while also respecting clients' privacy rights .
Once client information is no longer required to fulfill these necessary purposes, Ahura Group ensures its secure and responsible disposal through the utilization of methods specifically designed to prevent any unauthorized access or potential for data recovery . Secure data disposal methods include techniques such as data anonymization, the physical shredding of paper documents, and the secure deletion or modification of digital records to render them unrecoverable . For both paper and electronic records, we consult reputable sources like the National Institute of Standards and Technology (NIST) Special Publication 800-88 or ISO 27001 for guidance on best practices in destruction and sanitization . Regulations specify that sensitive paper records must be shredded, pulverized, burned, or pulped until the information is completely unreadable, and secure data destruction for electronic records involves overwriting sensitive information with random data to ensure it cannot be retrieved . The FTC Safeguards Rule also mandates that customer information must be securely disposed of when it is no longer needed for legitimate business or legal reasons .
For electronic data, our disposal practices include the use of specialized secure deletion software and advanced data overwriting techniques. These methods ensure that the data is not simply deleted but is effectively overwritten multiple times, making it virtually impossible to retrieve or reconstruct the information, even with sophisticated forensic tools . Specifically, electronic information should be deleted and overwritten to ensure it is unrecoverable . All physical documents that contain sensitive client information are securely shredded using professional-grade shredders. This process renders the paper into small, indistinguishable pieces, effectively destroying the information and preventing its unauthorized access or use .
Data retention policies at Ahura Group are carefully crafted to strike a crucial balance between meeting all applicable legal and regulatory obligations, such as the IRS's specific record retention requirements for tax-related documents, and adhering to the fundamental principle of data minimization. This principle advocates for limiting the amount of data stored to only what is strictly necessary, thereby reducing the overall potential risk exposure. Indefinite retention of data is generally discouraged, as it increases the attack surface and the potential impact of a security breach. Secure data disposal is a critical process that extends beyond simple deletion or discarding. It requires the implementation of specific and robust methods, including physical shredding for paper documents and secure data overwriting or anonymization for electronic data. These techniques are essential to ensure that data is truly unrecoverable, even with advanced forensic efforts, thus preventing potential data breaches long after the information is no longer actively used. The implementation of automated data lifecycle management systems offers a significant advantage in ensuring consistent and effective adherence to established data retention and disposal schedules. By automating these processes, Ahura Group can minimize the risk of human error, ensure that data is not retained for longer than necessary, and maintain a comprehensive audit trail of all data disposal activities, ultimately strengthening our compliance posture and reducing potential risks associated with outdated or unnecessary data.
4. Third-Party Vendors and Their Security
Ahura Group engages with carefully selected third-party vendors, which includes SuiteDash, to enhance the delivery of our services and provide specialized functionalities to our clients. We are deeply committed to ensuring that all such vendors maintain security practices that are commensurate with the sensitivity of any client information they may have access to or process on our behalf . Our vendor selection process incorporates a thorough and rigorous due diligence phase, during which we meticulously assess their existing security controls, their established security policies, and their overall compliance with relevant industry standards and applicable regulations . This comprehensive assessment helps us to make informed decisions about which vendors meet our stringent security requirements.
Our due diligence process aligns with established best practices for third-party security and compliance audits, which typically involve several key steps . These steps include a comprehensive identification of all active partnerships, followed by a careful tiering of vendors based on the level of risk they present to our organization. This risk assessment considers factors such as the sensitivity of the data shared with the vendor, the extent of their access to our networks, whether they host or build applications for us, their level of physical access to our facilities, and their potential to disrupt our key business processes. Based on this risk tiering, we develop tailored assessment plans that align with recognized security frameworks such as ISO 27000 series or NIST 800 series. We often utilize standardized information gathering questionnaires to efficiently collect security-related information from our vendors in a consistent format. Furthermore, we clearly communicate our assessment requirements to potential vendors as part of our onboarding process to ensure full transparency and willingness to comply. Our approach is also consistent with the key steps involved in developing and maintaining a robust third-party risk management program, which includes establishing a clear risk management framework, thoroughly identifying and evaluating our current third-party relationships, and implementing a detailed due diligence and vetting process that includes comprehensive risk assessments . This process often involves requesting relevant internal documentation from the vendor, such as their security policies and incident response plans, and conducting detailed security questionnaires to gain a deeper understanding of their security practices and risk management capabilities.
Ahura Group requires all of our third-party vendors to implement and consistently maintain reasonable administrative, technical, and physical safeguards that are specifically tailored to the level of sensitivity of the client information they are entrusted with . The security requirements we impose on our vendors are designed to vary based on the risk they present to our organization, considering factors such as the type of confidential information they process, the nature of their network connection to our systems, the specific services they provide, and any data availability requirements . This risk-based approach ensures that vendors handling more sensitive data are subject to more stringent security controls.
Our contracts with all third-party vendors include specific and legally binding clauses that clearly outline their confidentiality obligations, their security responsibilities, the procedures they must follow in the event of a data breach, and our explicit right to audit their security practices to ensure ongoing compliance . These contractual protections are essential for establishing clear expectations and accountability regarding the safeguarding of client information. We ensure that our vendor contracts mandate prompt notification in the event of any security incidents or changes to their security practices . Additionally, we include clauses that allow us to audit the vendor's management of any subcontractors they may engage and define the specific liabilities in the event of a security breach or data loss that can be attributed to the vendor or their subcontractors . The FTC Safeguards Rule also emphasizes the importance of selecting and diligently monitoring service providers to ensure they maintain appropriate safeguards to protect customer information, and it recommends executing detailed contracts that explicitly specify these security requirements .
Ahura Group is committed to the ongoing monitoring of our vendors' security practices to ensure their continued compliance with our established security requirements and all applicable regulations . This continuous monitoring helps us to identify and address any potential security weaknesses or deviations from our agreed-upon standards in a timely manner, further strengthening the security of our clients' information.
A critical aspect of Ahura Group's security strategy is the robust management of risks associated with third-party vendors. The level of due diligence we undertake and the stringency of the security requirements we impose are directly proportional to the risk each vendor presents to our clients' data and our operations. Vendors who handle more sensitive information or provide services that are critical to our core business functions are subjected to more rigorous scrutiny and must adhere to more demanding security controls. While we recognize the value of vendor self-assessments as an initial step in evaluating security posture, Ahura Group also understands the importance of obtaining independent verification for critical vendors. Therefore, we consider obtaining independent security assessments, such as SOC 2 reports, for vendors who handle highly sensitive data or provide essential services. These independent assessments offer a greater level of assurance regarding the effectiveness of a vendor's security controls and can help identify potential vulnerabilities that may not be apparent through self-reporting alone. Furthermore, we recognize that contractual agreements are the cornerstone of our relationships with third-party vendors. These legally binding documents serve to clearly define the security responsibilities of each party, establish explicit expectations for data protection, outline the specific procedures that must be followed in the event of a data breach, and grant Ahura Group the essential right to audit the vendor's security practices. These comprehensive contractual provisions are absolutely vital for ensuring accountability and effectively mitigating the potential risks that can arise from outsourcing services that involve the handling of our clients' valuable data.
5. Client Portal (SuiteDash) Usage Terms
Ahura Group utilizes SuiteDash as a secure and convenient client portal to streamline communication, facilitate the secure sharing of documents and information, and enhance the overall efficiency of our service delivery. By accessing and using the SuiteDash client portal, you, as our valued client, acknowledge and agree that your use of the portal is also subject to SuiteDash's own comprehensive Terms of Service and Privacy Policy, which are readily available for your review directly on SuiteDash's website.
It is important to understand that while Ahura Group has carefully selected SuiteDash as a reputable third-party provider to enhance our client service capabilities, SuiteDash operates independently, and their own Terms of Service and Privacy Policy govern their platform and its functionalities. Therefore, Ahura Group cannot be held directly responsible for SuiteDash's independent actions, their specific security protocols, or their individual privacy practices. While we have undertaken a due diligence process to evaluate SuiteDash's security measures prior to engaging their services, our responsibility is specifically limited to the security of our own internal systems and the protection of the data we transmit to and receive from the SuiteDash platform within our control. We strongly encourage you to take the time to carefully review SuiteDash's Terms of Service and Privacy Policy to gain a thorough understanding of their data handling practices and security measures, as these are distinct from Ahura Group's policies.
By clearly stating that clients' use of the SuiteDash portal is subject to SuiteDash's own terms and that Ahura Group's responsibility is limited to our own systems, we aim to establish clear boundaries of legal liability and set appropriate expectations for our clients. This approach acknowledges the shared responsibility model that is inherent in the use of third-party cloud-based services. While Ahura Group has chosen SuiteDash as a service provider to enhance our offerings, the direct interaction of our clients is with the SuiteDash platform itself, which operates under its own legal and security frameworks. This explicit disclaimer helps to protect Ahura Group from potential liability for issues or incidents that may arise solely from SuiteDash's operations or the implementation of their security protocols. Furthermore, by proactively encouraging our clients to independently review SuiteDash's Terms of Service and Privacy Policy, we are promoting transparency and empowering them to make informed decisions regarding their use of the portal. This also reinforces the understanding that SuiteDash is a separate and distinct entity with its own data handling practices, over which Ahura Group does not have direct control. This transparency aligns with the fundamental principles of data privacy, which emphasize the importance of individuals being well-informed about the processing of their personal information, regardless of whether it is handled directly by Ahura Group or by a third-party service provider we utilize.
6. Data Breach Notification Procedures for New Jersey Residents
In the unfortunate event of a security breach that involves the personal information of residents of New Jersey, Ahura Group is fully committed to adhering to all the requirements stipulated by the New Jersey Data Breach Notification Law (N.J.S.A. 56:8-161 et seq.) . In such a circumstance, we will provide notification to all affected New Jersey residents in the most expedient time possible and without any unreasonable delay, while also ensuring that our notification process is consistent with the legitimate needs and directives of law enforcement agencies, as specifically outlined in the applicable law . New Jersey law mandates that any organization conducting business within the state that maintains computerized records containing personal information must disclose any security breach of those records to any resident of New Jersey whose personal information may have been accessed by an unauthorized party, and this disclosure must be made in a timely manner . Notification must be made without unreasonable delay, unless the entity determines that the misuse of the personal information is not reasonably possible, and it is also required that the breach be reported to the Division of State Police prior to any disclosure to customers .
The notification provided to affected New Jersey residents will include all pertinent details about the security breach. This will encompass a clear explanation of the nature of the incident, a comprehensive description of the specific types of personal information that were potentially compromised as a result of the breach, the date on which the breach occurred or was discovered, and a detailed outline of the steps that Ahura Group has already taken and the specific actions that we recommend you, as the affected individual, should take to mitigate any potential harm or risk of identity theft . New Jersey law specifies that a data breach report must include comprehensive details about the breach, the precise types of data that were compromised (including Personally Identifiable Information, or PII), and specific information regarding the notification of affected consumers .
Prior to issuing any notification to affected individuals, Ahura Group is legally obligated to report the security breach and any relevant information pertaining to the incident to the New Jersey Division of State Police within the Department of Law and Public Safety for their potential investigation or handling. This reporting requirement is a critical component of the New Jersey Data Breach Notification Law . New Jersey law explicitly states the obligation to report the breach and all related information to the Division of State Police before any disclosure is made to the affected customers . Furthermore, submitted data breach reports are shared with the NJ State Police for potential criminal activity investigation .
In the event that a security breach affects more than 1,000 residents of New Jersey, Ahura Group is also required by law to provide notification of the breach to all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis . This additional notification requirement ensures broader awareness of the incident and allows consumer reporting agencies to take appropriate measures to protect affected individuals.
Within our data breach notification, we will provide clear and readily accessible contact information for affected New Jersey residents to direct any inquiries or concerns they may have regarding the incident. We are committed to providing prompt and informative responses to all such inquiries and will offer appropriate assistance as necessary, which may include providing information on how to access credit monitoring services or other relevant resources to help protect against potential identity theft or financial harm.
New Jersey law establishes specific and rigorous requirements for data breach notification. These include not only the obligation to notify affected residents without undue delay but also the necessity of including specific information within the notification itself. Furthermore, a critical aspect of the law is the requirement to report any data breach to the New Jersey Division of State Police before any notification is provided to the individuals affected. This pre-notification to law enforcement ensures proper coordination and potential investigation of the incident. This legal framework underscores the importance of Ahura Group having a meticulously developed and regularly tested incident response plan that is in complete alignment with these precise legal obligations to guarantee timely and compliant notification in the event of a data breach. Additionally, the New Jersey law includes a specific threshold: when a data breach affects more than 1,000 residents of the state, there is an additional requirement to notify nationwide consumer reporting agencies. This provision indicates a recognition within the law of the potential for more widespread impact and the consequent need for broader awareness and protective measures when data breaches of this scale occur. This threshold necessitates that Ahura Group has in place robust procedures for accurately assessing the scope of any data breach to ensure that all necessary notification obligations, including those to consumer reporting agencies, are met in accordance with the law.
7. Your Privacy Rights Under the New Jersey Data Privacy Law (NJDPA)
If you are a resident of the State of New Jersey, you are afforded certain rights concerning your personal data under the New Jersey Data Privacy Law (NJDPA), which went into effect on January 15, 2025 . This comprehensive law grants New Jersey consumers several important rights regarding the collection, use, and processing of their personal information.
These rights include:
• The Right to Confirm Processing and Access: You have the right to obtain confirmation from Ahura Group as to whether we are processing your personal data, and if so, to access that personal data .
• The Right to Correction: You have the right to request that Ahura Group correct any inaccuracies in the personal data we hold about you .
• The Right to Deletion: Under certain circumstances, you have the right to request that Ahura Group delete your personal data .
• The Right to Data Portability: You have the right to obtain a copy of your personal data in a portable and readily usable format, allowing you to transmit this data to another entity without hindrance, where technically feasible .
• The Right to Opt-Out of Targeted Advertising and Sales: You have the right to opt out of the processing of your personal data for the purposes of targeted advertising and the sale of your personal data .
• The Right to Opt-Out of Profiling: You have the right to opt out of the processing of your personal data for profiling in furtherance of decisions that produce legal or similarly significant effects concerning you .
To exercise any of these rights under the NJDPA, we kindly request that you submit a verifiable request to us using the contact information provided in the section below. We are committed to responding to your request within the timeframe mandated by the NJDPA, which is generally 45 days from receipt of your request. Please note that in certain complex cases, we may extend this response period by an additional 45 days, as permitted by law. Furthermore, in accordance with the NJDPA, Ahura Group is committed to honoring opt-out signals that are sent by consumers through universally recognized opt-out mechanisms (UOOMs), such as the Global Privacy Control (GPC). This requirement will become effective no later than July 15, 2025, allowing you to easily communicate your privacy preferences across different online platforms .
The NJDPA provides New Jersey residents with a significant set of rights regarding their personal data, including the ability to confirm processing, access their data, request corrections or deletions, obtain their data in a portable format, and opt out of certain processing activities like targeted advertising, data sales, and specific types of profiling. Ahura Group is obligated to establish clear and easily accessible procedures for our New Jersey clients to exercise these rights, ensuring that we can effectively receive, verify, and respond to their requests within the legally specified timeframes. The NJDPA defines "sensitive data" broadly, explicitly including financial information. This classification is particularly relevant for Ahura Group, as we routinely handle our clients' financial data. This broad definition means that we are required to obtain explicit, opt-in consent from New Jersey residents before processing their sensitive financial information. Additionally, we must conduct data protection assessments for any processing activities involving sensitive data to evaluate and mitigate potential risks to consumers. By July 15, 2025, Ahura Group's online platforms and data processing systems must be capable of recognizing and honoring universal opt-out mechanisms (UOOMs). This technical capability is essential for complying with the NJDPA's requirement to respect user consent preferences communicated through these standardized mechanisms, such as the Global Privacy Control (GPC), thereby empowering consumers to more easily manage their privacy choices across the internet.
8. Contact Us for Privacy and Security Concerns
If you have any questions, concerns, or wish to exercise your rights regarding the confidentiality and security of your information, please do not hesitate to contact us using the following details:
Phone: [Insert Phone Number]
Email: [Insert Email Address]
Mail: [Insert Mailing Address]
We are fully committed to addressing your inquiries in a prompt, transparent, and comprehensive manner, and we assure you that all concerns will be handled with the utmost diligence and attention.
9. Our Ongoing Commitment to Data Security
At Ahura Group, we firmly believe that protecting the confidentiality and security of your information is not a static goal but an ongoing and evolving responsibility. We are therefore committed to continuously reviewing and proactively enhancing our security practices to ensure they remain robust and effective in the face of evolving technological landscapes, emerging cyber threats, and any changes in applicable legal and regulatory requirements.
We deeply value the trust you place in us when you share your personal and financial information, and we are dedicated to upholding that trust by consistently maintaining the highest possible standards of data protection. Our commitment to the security and privacy of your data is a fundamental principle that underpins all of our client relationships, and we will continue to strive to ensure the ongoing safety and confidentiality of your valuable information.