ReliaHub Data Processing Addendum

Version 1.0 · August 15, 2026

This Data Processing Addendum ("Addendum") forms part of the ReliaHub Terms of Service between ReliaTax Group LLC ("ReliaHub", "we") and the customer accepting those terms ("Customer", "you"). It describes how ReliaHub handles information you and your clients put into the platform, and what each of us is responsible for.

This Addendum is a business document prepared for review by your own counsel. It is not legal advice, and it does not tell you whether your own practice is compliant with any law.

1. How This Fits With Your Other Agreements

Where this Addendum and the Terms of Service conflict on the handling of Client Data, this Addendum governs. Everything else in the Terms of Service continues to apply, including the limitations of liability, which apply to this Addendum as well.

The Privacy Policy describes information ReliaHub handles for its own purposes — your account, billing, security and support. This Addendum covers the separate category of information you put into ReliaHub about your own clients.

2. Definitions

Client Data means information relating to your clients that you or they submit to ReliaHub, including intake answers, identity and bank numbers, uploaded documents, case records, notes, due-diligence records, messages, and appointment information.

Tax Return Information has the meaning given in 26 CFR 301.7216-1, and Client Data will generally include it.

Applicable Privacy Law means US federal and state laws governing Client Data, including state consumer privacy statutes, the Gramm-Leach -Bliley Act and the FTC Safeguards Rule (16 CFR Part 314), and Internal Revenue Code sections 7216 and 6713.

Subprocessor means a third party engaged by ReliaHub that processes Client Data in order to provide the service.

3. Roles of the Parties

You decide what Client Data to collect, from whom, and why. You are the controller, business, or equivalent under Applicable Privacy Law, and you are the tax professional responsible for the client relationship.

ReliaHub processes Client Data only on your behalf and on your documented instructions. ReliaHub is a processor and a service provider, not a controller, business, or third party with respect to Client Data.

4. Instructions and Purpose Limitation

ReliaHub will process Client Data only for these specific business purposes, and for no others:

• collecting and storing client intake information you request;
• storing, organizing, and serving uploaded documents to you;
• scheduling and managing appointments;
• tracking case progress, document status, and payment status;
• sending the communications you configure or approve;
• maintaining due-diligence records you enter;
• producing your exports and completion records;
• securing, maintaining, monitoring, and supporting the service, and

detecting and preventing fraud and security incidents.

ReliaHub will also process Client Data where required by law, in which case we will tell you first unless the law forbids it.

ReliaHub will not:

consumer privacy law;

providing the service, including for our own commercial purposes;

needed to provide the service to you or as permitted by law;

• sell or share Client Data, as those terms are defined under state
• retain, use, or disclose Client Data for any purpose other than
• combine Client Data with information from any other source, except as
• use Client Data to train general-purpose machine-learning models.

ReliaHub certifies that it understands these restrictions and will comply with them.

If ReliaHub determines it can no longer meet its obligations under Applicable Privacy Law, we will notify you, and you may take reasonable steps to stop and remediate unauthorized processing.

5. Tax Return Information — Sections 7216 and 6713

This section exists because Client Data is tax return information, and the rules for it are stricter than general privacy law.

You are disclosing tax return information to ReliaHub as a contractor providing services in connection with your practice. This Addendum is the written notice contemplated by 26 CFR 301.7216-2(d)(2), which requires you to ensure that everyone receiving tax return information is told that sections 7216 and 6713 apply to them and is given a description of the requirements and the penalties.

5.1 Notice of Sections 7216 and 6713

ReliaHub acknowledges receiving this notice and confirms it understands the following.

ReliaHub accepts these restrictions. ReliaHub does not prepare, review, sign, or file tax returns, and is not a tax return preparer in the ordinary sense of that phrase or under Internal Revenue Code section 7701(a)(36). Section 7216 nonetheless uses its own, deliberately broader definition at 26 CFR 301.7216-1(b)(2), which reaches persons providing auxiliary services in connection with the preparation of returns.

Rather than argue about where a client workflow platform sits within that definition, ReliaHub simply accepts the obligations: ReliaHub, its personnel, and its subcontractors will handle tax return information subject to the same confidentiality restrictions that sections 7216 and 6713 impose, whether or not those sections reach ReliaHub of their own force. Your practice gets the protection either way.

What the sections require. Tax return information may not be disclosed to anyone, or used for any purpose other than preparing or assisting in preparing the taxpayer's return, unless the taxpayer consents or a specific exception in the regulations applies. This restriction attaches to the information itself and follows it.

The penalties. Section 7216 makes a knowing or reckless unauthorized disclosure or use a criminal misdemeanor, punishable by a fine, by imprisonment of up to one year, or both, together with the costs of prosecution. Section 6713 imposes a civil penalty for each unauthorized disclosure or use, subject to an annual maximum, with substantially higher amounts where the disclosure or use relates to identity theft. Section 6713 has no knowledge requirement — it can apply to a disclosure that was merely careless. The amounts are set by statute.

ReliaHub will give an equivalent written notice to each Subprocessor that receives tax return information, and will require each to be bound accordingly.

5.2 ReliaHub's Undertakings

ReliaHub will:

provide the services described in section 4;

clients for its own purposes;

liability reported on any return.** ReliaHub's drafting assistant produces text for you to review and send; it does not decide filing positions, compute liability, or advise on the treatment of any item. If ReliaHub ever proposes to add a feature that would do so, we will notify you in advance, because it would change what consent your practice needs; and

• use and disclose tax return information only to the extent necessary to
• never use tax return information to market to, solicit, or contact your
• **not make substantive determinations or give advice affecting the tax
• keep tax return information, and access to it, inside the United States

as described in section 13.

5.3 No Access From Outside the United States

This deserves its own commitment because the rule is unusually strict.

Under 26 CFR 301.7216-3(b)(4), a taxpayer filing a Form 1040 series return cannot consent to the disclosure of their Social Security number to a tax return preparer located outside the United States. It is not a matter of obtaining better consent language; the consent is unavailable. And viewing tax return information from outside the United States counts as a disclosure even where nothing is downloaded.

ReliaHub therefore commits that tax return information, including Social Security numbers, is stored in the United States and is not accessed from outside the United States by ReliaHub personnel, contractors, or Subprocessors. If that ever needs to change, we will tell you before it does.

5.4 What Remains Yours to Decide

Whether a particular disclosure to ReliaHub falls within 26 CFR 301.7216-2(d)(2), or instead requires taxpayer consent under 26 CFR 301.7216-3, depends on your practice and how you use the platform. The regulation's contractor exception is written as a closed list of service categories, and reasonable advisors may differ on how a client workflow platform maps onto it. That determination is yours to make with your own counsel. ReliaHub does not make it for you, and nothing here is legal advice.

6. Confidentiality

ReliaHub will treat Client Data as confidential. Personnel with access to Client Data are bound by confidentiality obligations and are granted access only where needed to do their work.

ReliaHub staff cannot open your clients' uploaded documents, cannot sign in as you, and cannot read the encrypted identity and bank number fields. Any support access to your client workflow information requires your approval, is limited in time, can be withdrawn by you at any moment, and is recorded where you can see it.

7. Security

ReliaHub will implement and maintain the technical and organizational measures described in Annex B, and will not materially reduce them during the term.

This commitment is made in satisfaction of 16 CFR 314.4(f)(2), which requires you to obtain a contractual undertaking from your service providers to implement and maintain appropriate safeguards.

8. Subprocessors

You authorize ReliaHub to engage the Subprocessors listed in Annex A, and to change them as the service evolves.

ReliaHub keeps Annex A current and will notify you when a Subprocessor that processes Client Data is added or replaced. There is no waiting period: ReliaHub retains the ability to change providers when a service is discontinued, becomes unreliable, or a better-secured option exists, and waiting out a notice period in those situations would serve nobody.

Every replacement remains subject to the same obligations below, so a change of provider does not change what may be done with your clients' information.

ReliaHub will engage each Subprocessor under a written contract that imposes obligations no less protective than those in this Addendum, including the restrictions in section 4 and the tax return information obligations in section 5. ReliaHub remains responsible to you for each Subprocessor's performance as if it were our own.

9. Your Clients' Requests and Your Assessments

Where one of your clients exercises a right under Applicable Privacy Law, you handle the request; ReliaHub assists.

The product lets you locate, correct, export, and delete an individual client's record and their documents directly. Where you cannot complete a request through the product, ReliaHub will provide reasonable assistance, at no charge for a reasonable volume of requests.

ReliaHub will provide information reasonably necessary for you to conduct a data protection assessment or risk assessment concerning your use of the platform.

10. Security Incidents

If ReliaHub becomes aware of a security incident affecting Client Data, we will notify you without undue delay after confirming it, by email to your account owner and, where appropriate, by text message.

The notice will describe what we know, what we are doing, and what we recommend you do — updated as we learn more. ReliaHub will assist you in meeting your own notification obligations.

Determining whether an incident requires you to notify your clients, the IRS, a state authority, or anyone else is your decision, made with your own advisor.

11. Demonstrating Compliance

You may take reasonable and appropriate steps to verify that ReliaHub is using Client Data consistently with your obligations, including by exercising the rights in this section at least once every twelve months.

On written request, no more than once a year unless an incident or law requires otherwise, ReliaHub will:

• provide the current Annex A and Annex B;
• complete a reasonable written security questionnaire; and
• provide such other documentation as we reasonably maintain concerning

the safeguards described in Annex B.

ReliaHub will also make available to you the information necessary to demonstrate its compliance with this Addendum, and will allow and cooperate with a reasonable assessment or audit of the processing carried out on your behalf — conducted by you or an auditor you appoint, on reasonable prior written notice, during business hours, no more than once a year unless an incident or law requires otherwise, subject to confidentiality, and without access to another customer's data. Where the documentation above answers the question, providing it satisfies this obligation.

This is intended to support the periodic assessment of service providers required by 16 CFR 314.4(f)(3), and the demonstrate-compliance and audit provisions of state processor law.

ReliaHub has not undergone an independent third-party security audit or penetration test, and this Addendum does not represent otherwise.

12. Retention, Return, and Deletion

While your account is active you can export your records and your uploaded documents at any time, and delete individual clients and documents yourself.

On termination, the export windows in the Terms of Service apply: export remains available for 14 days after suspension, and for a further 90 days after cancellation. Export before those windows close — ReliaHub is not obliged to keep your data afterwards.

On your written request, ReliaHub will delete Client Data within 30 days, except where retention is required by law or is needed to resolve a dispute. Copies may persist in routine platform backups for a period after deletion; those copies remain subject to this Addendum, are not used for any purpose, and are removed as the backups age out.

Two limits worth stating rather than leaving you to discover. Deletion of individual clients and documents is blocked while an account is suspended or cancelled, so that records cannot be destroyed during a billing dispute — write to us if you need a deletion carried out in that window. And ReliaHub does not currently delete a practice's data automatically at the end of the export windows; it is removed on request or on our own schedule thereafter.

Uploaded documents also follow the retention schedule described in the Terms of Service, under which documents are scheduled for deletion five years after the related case is completed, with advance warnings.

You are responsible for retaining anything you are independently required to keep, including your due-diligence records.

13. Where Data is Processed

ReliaHub is operated by a United States company and serves United States tax professionals only. The database and document storage holding Client Data are located in the United States.

Consistent with section 5.3, ReliaHub does not store Client Data outside the United States, and does not permit its personnel, contractors, or Subprocessors to access Client Data from outside the United States. This covers access by people, not only where data physically sits — under the section 7216 regulations, viewing tax return information from abroad is a disclosure even if nothing is copied.

We will give you advance notice before making any change to this.

14. Term

This Addendum takes effect when you accept the Terms of Service and continues while ReliaHub processes Client Data for you.

Nothing in this Addendum relieves either party of any obligation or liability imposed on it directly by law in respect of its own role. Each of us remains responsible for our own compliance.

---

Annex A — Subprocessors

Current as of the version date above.

Google Calendar is connected by you, at your option, and is governed by your own agreement with Google rather than by this Annex. When it is connected, appointments ReliaHub creates carry the appointment summary and description, and add your client's email address as an attendee.

Annex B — Technical and Organizational Measures

These describe ReliaHub as of the version date. Where a measure depends on a setting you control, that is stated.

Encryption. Social Security numbers and bank routing and account numbers are encrypted with AES-256-GCM before storage, and the key is held outside the database. Data is encrypted in transit. Uploaded documents are held in private storage with encryption at rest provided by the storage platform.

Separation. Each practice's records are separated at the database level, enforced by the database rather than by application code.

Access control. Access is role-based. Identity and bank numbers are masked by default, and each reveal is recorded with the user, the client, and the time.

Authentication. Two-factor authentication using an authenticator app is available to every user, and you can require it for everyone in your workspace. It is not enabled by default.

Support access. ReliaHub staff have no ability to open uploaded documents, impersonate users, or read encrypted identity fields. Access to client workflow information requires your approval, carries a maximum duration of seven days, is revocable by you, and is recorded.

Logging. ReliaHub records account activity including record changes, exports, document views and downloads, identity reveals, permission changes, and support-access decisions.

Guided security setup. ReliaHub provides a guided Security Setup that documents your configuration and produces a record for your files. It covers your use of ReliaHub and is not a Written Information Security Plan for your practice.

Annex C — Details of Processing

Subject matter. Provision of the ReliaHub client workflow platform.

Duration. The term of your subscription, plus the export and retention periods described in section 12.

Nature and purpose. Collecting client intake information, storing and organizing documents, scheduling appointments, tracking case and payment status, sending communications you configure, and maintaining due-diligence records.

Categories of data subjects. Your clients, their spouses and dependents, and other individuals whose information you enter.

Categories of Client Data. Identifiers; contact details; Social Security and taxpayer identification numbers; dates of birth; bank routing and account numbers; filing and household information; uploaded tax and identity documents; case, payment, and appointment records; notes; due-diligence answers; and communications.

Sensitive data. Client Data includes Social Security numbers, financial account numbers, and government identification documents.