GDPR Compliance Statement

1. Our Commitment to GDPR Compliance

TAS Consulting (“Company”, “We”, “Us”, or “Our”) is fully committed to operational governance, data security, and safeguarding the privacy of all personal data processed across our consultancy, tax advisory, and website operations (https://tasconsulting.ie/).

We comply strictly with the General Data Protection Regulation (Regulation (EU) 2016/679 - GDPR), the Irish Data Protection Acts 1988–2018, and all supplementary European Union data protection standards. This statement details how we embed privacy by design and privacy by default across all aspects of our business.

2. Data Protection Principles

In accordance with Article 5 of the GDPR, TAS Consulting ensures that all personal data is handling adhering strictly to the following fundamental principles:

• Lawfulness, Fairness, and Transparency: Personal data is processed lawfully, fairly, and in a transparent manner in relation to the data subject.
• Purpose Limitation: Collected for specified, explicit, and legitimate corporate purposes and not further processed in a manner incompatible with those purposes.
• Data Minimisation: Adequate, relevant, and limited strictly to what is necessary in relation to the operational purpose.
• Accuracy: Maintained accurately and kept up to date; reasonable steps are taken to ensure inaccurate personal data is erased or rectified promptly.
• Storage Limitation: Kept in a form permitting identification for no longer than necessary for the original processing purposes or statutory audit retention periods.
• Integrity and Confidentiality: Processed using technical and organizational measures ensuring appropriate security, including protection against unauthorized processing, loss, or damage.

3. Lawful Bases for Processing

Under Article 6 of the GDPR, TAS Consulting processes personal data only when an explicit legal basis applies:

• Contractual Performance: Where processing is necessary to execute corporate consultancy services or perform contractual engagements with clients.
• Legal Obligation: To comply with statutory requirements under Irish tax, corporate governance, anti-money laundering (AML), and financial accounting legislation.
• Legitimate Interests: To manage, protect, and optimize our corporate operations, site security, and business growth, balanced against client rights.
• Consent: Where explicit opt-in consent has been provided by the individual (e.g., direct marketing or non-essential website cookies).

4. Your Individual Rights Under GDPR

As a data subject under EU law, you possess enforceable statutory rights regarding your personal data processed by TAS Consulting:

• Right of Access (Article 15): Obtain confirmation as to whether your data is processed and receive a copy of your personal data.
• Right to Rectification (Article 16): Request correction of inaccurate or incomplete personal information held by us.
• Right to Erasure / "Right to be Forgotten" (Article 17): Request deletion of your personal data where statutory retention exceptions do not apply.
• Right to Restrict Processing (Article 18): Request temporary suspension of data processing under specific legal conditions.
• Right to Data Portability (Article 20): Receive your data in a structured, commonly used, and machine-readable format.
• Right to Object (Article 21): Object at any time to processing based on legitimate interests or direct marketing operations.
• Rights Related to Automated Decision-Making (Article 22): Right not to be subject to decisions based solely on automated processing or profiling.

5. Submitting a Data Subject Access Request (DSAR)

To exercise any of your statutory data rights, you may submit a formal Data Subject Access Request (DSAR) to our designated privacy controller at moh@tasconsulting.ie.

To ensure data security, we may request proof of identity prior to fulfilling your request. In accordance with GDPR Article 12, all requests are addressed free of charge within one calendar month of receipt. In complex cases, this period may be extended by an additional two months with prior notice.

6. Technical & Organisational Security Measures

TAS Consulting enforces robust physical, technical, and administrative security controls to safeguard personal data against unauthorized access, destruction, loss, or disclosure:

• HTTPS / SSL TLS encryption protocols across all web endpoints.
• Restricted access control based on role-based authorization principles.
• Secure cloud infrastructure protected by multi-factor authentication (MFA) and enterprise firewalls.
• Routine data protection impact assessments (DPIAs) for high-risk operations.
• Confidentiality and non-disclosure obligations for all internal personnel and external sub-processors.

7. International Data Transfers

Where personal data is transferred outside the European Economic Area (EEA), TAS Consulting ensures adequate safeguards are enforced in accordance with GDPR Chapter V. This includes utilizing European Commission Standard Contractual Clauses (SCCs) or confirming that the receiving jurisdiction maintains an official adequacy determination.

8. Data Breach Incident Protocol

TAS Consulting maintains an active Incident Response Protocol to detect, investigate, and remediate potential security incidents involving personal data. In the event of a confirmed personal data breach likely to present a risk to individual rights and freedoms, we will notify the Irish Data Protection Commission (DPC) within 72 hours of becoming aware, as mandated by GDPR Article 33.

9. Supervisory Authority & Right to Lodge a Complaint

If you believe that TAS Consulting has processed your personal data in breach of EU GDPR standards, you hold the right to lodge a formal complaint with the lead supervisory authority in Ireland: