How the Suite tools handle your data.

What this notice covers and which of our companies is responsible for what

This notice explains how personal data is handled in the TIF Suite tools. How personal data is handled on our website is set out separately, in our website privacy notice at https://www.tifsynergy.com/privacy.html. This notice also sets out which of our companies is responsible for what across both the website and the tools, because that is one map and it is easier to read in one place. Two companies are involved. Which of them is responsible depends on what you are doing. They are:

• Blauw Belastingen B.V., trading as TIF Synergy, a private limited company incorporated in the Netherlands, KvK number 58905375, VAT number NL853231886B01, registered office in Amsterdam, Netherlands. You can reach it at info@tifsynergy.com.
• TIF SYNERGY IRELAND LIMITED, a private company limited by shares incorporated in Ireland, registered number 821025, VAT number IE4760769WH, registered office 77 Camden Street Lower, Dublin, D02 XE80, Ireland. You can reach it at info@tifsynergy.com.

The tools are developed and provided by Blauw Belastingen B.V., trading as TIF Synergy, and are supplied to you under our terms of use either by Blauw Belastingen B.V. or by TIF Synergy Ireland Limited. From 28 August 2026 to 13 September 2026 that is TIF Synergy Ireland Limited for every organisation, wherever it is established. From 14 September 2026 it depends on where your organisation is established, as set out below. Where TIF Synergy Ireland Limited supplies them, Blauw Belastingen B.V. operates them for it and is its sub-processor.

Part 1, our website. When you use the contact form, register your interest on tifsynergy.com or subscribe to TIF Weekly, the controller for that data is Blauw Belastingen B.V. It decides how that data is used. Part 1 applies. This does not depend on which of our companies your organisation contracts with, and it applies even if your organisation contracts with neither of them.

Part 2, the TIF Suite tools. When you sign in to a tool, the tool is provided to your organisation under our terms of use. Two different kinds of data are held in the tools and they work differently.

• Your account data, meaning the information about you as a user. The controller for it is the company your organisation contracts with. From 28 August 2026 to 13 September 2026 that is TIF Synergy Ireland Limited for every organisation, wherever it is established, including in the Netherlands. From 14 September 2026 it is Blauw Belastingen B.V. where your organisation is established in the Netherlands and has accepted that company's terms, and TIF Synergy Ireland Limited in every other case.
• The content your organisation puts into the tool. For that content your organisation is the controller and we are a processor, acting on your organisation's instructions. Your organisation's own contracting entity is the processor, and where that is TIF Synergy Ireland Limited, Blauw Belastingen B.V. is its sub-processor. The data-processing schedule in our terms of use sets out the processor terms in full.

How we decide which of our companies your organisation contracts with. Between 28 August 2026 and 13 September 2026 there is nothing to decide: it is TIF Synergy Ireland Limited for every organisation. For the change that begins on 14 September 2026 we work out whether your organisation is established in the Netherlands from two things your organisation gives us: the VAT identification number, a number beginning NL meaning the Netherlands and anything else meaning somewhere else, and the registered office address. Where we hold both, we read both. Where we hold only one, that one decides. Where the two point in different directions, the Netherlands answer applies. Where we hold neither, your organisation's contracting entity does not change. That answer does not change unless we agree it in writing, so a later change in where your organisation is established does not by itself move it to the other company. If you are not sure which applies to you, ask whoever administers the tool for your organisation, or contact us at info@tifsynergy.com.

Who is responsible and who you can complain to.

You may in any case complain to the supervisory authority of the place where you live or work, whichever row above applies to you.

What "we" means in the rest of this notice. This notice is Part 2, so "we" means the company your organisation contracts with, as decided above. In our website privacy notice, which is Part 1, "we" means Blauw Belastingen B.V. Where something is done by the other of our two companies, or by one of the service providers in our sub-processor list, we say so. Nothing in this notice describes a thing as done by us in order to avoid naming who does it.

Where each part is published. Which part applies to you depends on what you are doing. If you filled in a form on our website, that is Part 1. If you are signed in to a tool, that is Part 2. If you have done both, both parts apply to you, each to its own data. The two parts are published as two separate documents. Part 1 is our website privacy notice, published at https://www.tifsynergy.com/privacy.html. It is one notice for everyone who uses our website whether or not they also use a tool. Part 2 is this notice in full. Nothing set out below belongs to Part 1.

The data we hold about you as a user

When you use a TIF Suite tool we hold your email address, your name where the tool has it, the organisation you belong to, your role or permissions in the tool, the identifier your sign-in gives you, and a record of the actions you took in the tool. The tools differ in how much of this they keep and the annex below says so tool by tool. TaxMap and TaxTrack hold only your email address and, in TaxMap's case, a display name. TaxLex additionally holds your saved preferences.

Why we hold it and on what basis. We hold it to give you access to the tool, to keep the tool secure, to keep an audit record of who did what and to support you when you ask us to. Our lawful basis is our legitimate interest in operating and securing the tool (Article 6(1)(f) GDPR) and, where your organisation has a contract with us, performance of that contract (Article 6(1)(b)).

How long we keep it. For as long as your account is open. We do not close accounts because they have gone quiet, so an account stays open until you or your organisation asks us to close it. Records of activity in the tool are kept longer than your account data, because they are the evidence trail your organisation relies on: seven years in TaxLex, twenty-four months in TaxTag and indefinitely in TaxMap and TaxTrack. The annex sets this out per tool. When your account closes, those activity records are not deleted. They are stripped of the details that identify you and kept in that form.

Your rights over the data we hold about you as a user. You can ask us for a copy of it (Article 15 GDPR), ask us to correct it (Article 16), ask us to erase it (Article 17), ask us to restrict what we do with it while a question about it is resolved (Article 18), ask us for it in a structured, machine-readable form (Article 20) and object to our holding it where we rely on our legitimate interest (Article 21). Whom you exercise these rights against, and how we handle a request, are set out below.

We do not use your account data for marketing unless you have separately asked us to, for example by subscribing to TIF Weekly on our website. Using a tool does not sign you up to anything.

The content your organisation puts into the tool

Your organisation decides what to put into the tool and why. For that content we act on your organisation's instructions and we are a processor, not a controller. In plain terms: it is your data, we hold it for you and we do not decide what to do with it.

We do not use your content to train, fine-tune or improve any artificial-intelligence model, ours or anyone else's. The service providers listed in our sub-processor list are bound by written terms under which they may process your content only on documented instructions that come from us and run down the chain to them, and neither of our companies instructs any of them to use it for training, fine-tuning or model improvement.

What our AI provider does do, so you are not surprised by it. Two of our tools, TaxLex and TaxTag, use Microsoft's Azure OpenAI Service, and TaxMap will use it too when the mapping-proposal feature described below is made available. Microsoft's licence terms commit it not to use what is sent to it to train any generative AI foundation model except on our own documented instructions, which we do not give. It does not pass it to OpenAI and it does not make it available to other customers. Microsoft does screen what is sent to it for abuse and misuse, and its own licence terms say that, as part of providing the service, it temporarily stores what is sent to it and what it sends back for that purpose. Where its automated systems flag something, authorised Microsoft employees may review that content to investigate and verify potential abuse. For a deployment inside Microsoft's EU data boundary, Microsoft's terms commit that those employees are located in the European Economic Area. We do not tell you that every deployment we use sits inside that boundary, because which of them do is not established. What we are able to say, tool by tool, is in the paragraph below that begins "Where a tool sends a request to an AI service", and it records that two of the models you can choose in TaxLex are published by Microsoft only as globally routed deployments. Microsoft's published documentation describes a narrower ordinary practice, under which content that is flagged and then reviewed by automated means is not additionally stored by the abuse-monitoring system and under which a review by a person is the exception introduced where automated review does not meet Microsoft's confidence thresholds or is unavailable. Where Microsoft's licence terms and its documentation differ we tell you what the licence terms say. Where content is stored for abuse monitoring, Microsoft's published position is that the store sits in the geography your resource is in and that this holds whether the deployment is a globally routed one or a data-zone one. Microsoft publishes no retention period for that store and we will not state one. This is a security measure and it is not training. We have not applied for the arrangement under which Microsoft switches that screening off and on Microsoft's published eligibility criteria we do not expect to qualify for it, so it applies to us as it applies to Microsoft's customers generally.

Our other two tools use AI differently. TaxMap does not send anything to an AI service today. A mapping-proposal feature that does is being built and will be made available. When it is, the names of your columns and the mapping structure you have configured are sent to our AI provider and the paragraph above applies to that. The figures, ledger lines and account balances in your file are not sent. TaxTrack has no chat or text-generating feature, but it does use an automated document-reading service to pull fields out of assessment notices you upload. That service uses a standard pre-trained model, your documents are not used to train it, and what it reads out is shown to a person for confirmation before it enters the record.

How we build and support the tools, which is a separate route and we would rather tell you about it. The tools are built, maintained and supported by Blauw Belastingen B.V., using AI-assisted engineering and support software. Where a problem is investigated, data is migrated or a request you have raised with us is worked on, content held in a tool can enter that software. This is not a feature of any tool and it does not happen as part of your ordinary use of one. It happens when we work on the service. The providers that may process your content on this route are the ones named in our sub-processor list, and no other. We restrict what may be put into such a session. Clause DP7.6 of our data-processing schedule is what makes that restriction binding on us. Synthetic or redacted data must be used first. Your content may be used only where the task genuinely requires it and an extract cannot answer the question. Whole documents, national identification numbers, special category data and bulk exports must not be put into such a session at all. A record is kept of the occasions when your content does enter one.

We do not sell your content and we do not share it with anyone else except the service providers named in our sub-processor list, who are bound by written terms, and where the law requires us to.

When we correspond with you about a tool. Correspondence with you about a tool, including support, a request you have raised with us and the notices we have to send you, sits in the email and productivity system our group uses. That system is Microsoft's, it is not one of the tools and it is named in our sub-processor list. Support correspondence about a problem in a tool routinely carries extracts of your organisation's content, so this is the route through which every human exchange about that content passes. Microsoft personnel and Microsoft companies outside the European Economic Area can reach data held in that system, under the same agreement with Microsoft that covers the services the tools run on. The four routes we describe below are written from Microsoft's material about those services and we do not restate them for this one. Our sub-processor list sets out what we are able to say about where that system holds data.

Where it is held. All four tools are hosted in the European Economic Area, in Microsoft Azure regions inside it and they are operated by Blauw Belastingen B.V. from the Netherlands. Our sub-processor list gives the region for each of the services the tools run on.

Where a tool sends a request to an AI service is a different question from where the tool is hosted, so we answer it separately rather than letting one answer stand for both. TaxMap does not send anything to an AI service today, and a mapping-proposal feature that does is being built. This notice will say what it sends and where those requests are processed before that feature is made available. TaxTrack sends uploaded documents only to Microsoft's document-reading service in West Europe. TaxTag's AI processing runs on a deployment confined to Microsoft's EU data zone. TaxLex composes its answers on a deployment inside Microsoft's EU data zone by default, and two of the models you can choose in TaxLex, gpt-5.4-nano and gpt-5.4-pro, are published by Microsoft only as globally routed deployments, so Microsoft may process a request sent to either in any region in which the model is deployed, including outside the European Economic Area.

What leaves the European Economic Area, and we would rather tell you than have you find it.

• Account email. The emails TaxLex sends you about your account go through SendGrid, a United States company, so your name and work email address reach it. No content you put into a tool is ever sent through this route.
• The text of a question you ask in TaxLex, where Microsoft processes it on a globally routed deployment. That is the case whenever a user selects gpt-5.4-nano or gpt-5.4-pro, which exist only as globally routed deployments. Content from documents in your library is not sent to either of those two models: where library content is in the material assembled to answer a question, TaxLex uses a deployment inside Microsoft's EU data zone instead. Where a TaxLex request is served from is not fixed in advance.
• Microsoft's own access to the services we run on. Microsoft personnel and Microsoft companies outside the European Economic Area can reach data held in our Azure services. Microsoft documents four routes and we would rather set them out than call them support: engineers may need remote access when a service is down or needs a repair automated tooling cannot make; data processed for security purposes, normally pseudonymised and in limited cases including your content, may be transferred to any Azure region worldwide; network traffic may occasionally be routed outside the EU Data Boundary to keep the service available; and limited sign-in directory data, including a username and an email address, may be replicated outside that boundary. This applies to all four tools and it is not something you or we trigger.
• Microsoft's own access to the system we correspond with you in. Correspondence with you about a tool sits in the email and productivity system described above. That system is also Microsoft's and Microsoft personnel and Microsoft companies outside the European Economic Area can reach data held in it. Support correspondence routinely carries extracts of your organisation's content, so we state this exit in its own right rather than leave it to be read out of the bullet above.

One step happens on every TaxLex question whichever model is chosen, so we state it on its own rather than inside a bullet about one of them. Before any model sees your question, TaxLex turns that question into a search vector using a Microsoft AI service. Everything said below about the safeguards applies to that step as well and our sub-processor list says where that step runs.

Content moving between our two companies does not leave the European Economic Area. Blauw Belastingen B.V. is established in the Netherlands and TIF Synergy Ireland Limited is established in Ireland, so content moving from one to the other stays inside the European Economic Area. It is not a transfer under Chapter V of the General Data Protection Regulation and it needs no transfer mechanism. We say so expressly rather than leaving you to work it out.

The safeguards, described as they actually are. Blauw Belastingen B.V. holds the accounts with the providers named below and is the party that makes these transfers, either as your organisation's processor where Blauw is its contracting entity, or as sub-processor to TIF Synergy Ireland Limited where that company is. Whichever it is, your organisation's contracting entity remains fully liable to it for them. For SendGrid two mechanisms stand behind the transfer rather than one, because that is how Twilio's data protection addendum arranges it. Ranked first is the EU-US Data Privacy Framework, the addendum recording that Twilio Inc. is self-certified under it, which brings the transfer within the European Commission's adequacy decision for that framework. Ranked behind it and designated by the addendum to apply automatically if that self-certification is withdrawn, terminated, revoked or otherwise invalidated are the European Commission's standard contractual clauses. Twilio must tell us in writing if that happens. Twilio Inc. is the organisation self-certified under the framework and the named data importer under the clauses, whichever Twilio company holds the account. We are describing how the addendum is arranged. We are not offering the certification to you as a safeguard of ours. A self-certification can be withdrawn and the adequacy decision standing behind it is under challenge before the Court of Justice, which is exactly why what stands behind it is worth telling you: if the first mechanism goes, this transfer moves to signed clauses by the operation of the addendum rather than by a new negotiation. Microsoft is different in structure. The contract is with Microsoft B.V., a company established in the Netherlands, so that transfer does not leave the European Economic Area at all. The transfers described in the last two bullets are made by Microsoft rather than by us and Microsoft's own data protection addendum annexes the standard contractual clauses for them and commits that every such transfer is subject to those clauses. Neither of our companies is a party to those clauses and neither describes itself as the exporter under them. What we hold is Microsoft's commitment to us: that it remains fully liable to us for the processors it engages, that it will challenge and narrow any government demand for your data and never give unfettered access and that we may suspend transfers or terminate if the law changes to your material disadvantage. Microsoft's EU Data Boundary commitments limit where processing is performed. They are not a transfer mechanism. We do not rely on an adequacy decision for the Microsoft routes. SendGrid is the one route where an adequacy decision operates. It is described above rather than denied here.

How long we keep it. It depends on the tool and the annex below sets it out. As a general position: for as long as your organisation's account is open, except where the tool deletes working files sooner, which TaxTag does after 24 hours. If the account closes you have 30 days to get your content out, after which we delete it. Keeping your own records remains your organisation's responsibility and the tool is not your system of record. See clause 6.3 of the terms of use.

Your rights. If you are an individual whose personal data appears inside content held in a tool, your rights are exercised against the organisation that put it there, because that organisation is the controller. Contact them, or contact us at info@tifsynergy.com and we will pass the request on.

Which of our companies you are exercising a right against. For the data we hold about you as a user of a tool, it is your organisation's contracting entity, which the table at the start of this notice identifies. You do not have to work that out to make a request: info@tifsynergy.com reaches both companies and we will route it and tell you which one is answering.

How we handle a request. We handle rights requests by hand, not through a button in the tool. Ask us and a person deals with it. We aim to respond within five working days and we will always respond within the month the law allows. Two things we do not delete when we act on an erasure request: records we are required by law to keep, and the audit trail of who did what in the tool, which we strip of the details that identify you rather than delete.