Privacy Policy & APP 8 Governance

1. Introduction & B2B Operational Scope

MCR Associates ("we", "us", "our") operates strictly as a B2B remote operational and back-office capacity partner to Australian registered Tax Agents, BAS Agents, accounting and taxation firms, AFSL wealth advisory licensees, authorised insurance brokerages, and financial services businesses.

We are committed to safeguarding all personal, financial, corporate, and taxation information entrusted to us in strict accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This Privacy Policy details our operational data handling, security architecture, and regulatory commitments.

2. Australian Privacy Principle 8 (Cross-Border Data Disclosure)

Under Australian Privacy Principle 8 (APP 8), Australian registered firms, licensees, and businesses disclosing personal information to cross-border service providers must take reasonable steps to ensure the overseas recipient does not breach the APPs. MCR Associates legally warrants and covenants that:

• Purpose Limitation: We process client records, financial statements, advice strategy files, insurance schedules, and technical workflows strictly for the contracted purpose of delivery execution agreed with the Australian client firm.
• No Third-Party Transfer: We never sell, lease, disclose, or transfer any client or firm data to any third party under any circumstance.
• Equivalent Protection: Our technical, organizational, and physical data protection standards meet or exceed the requirements set out under the Australian Privacy Act 1988.

3. Zero Local Storage Technical Architecture

To eliminate cross-border data leakage risks, MCR Associates enforces a strict Zero Local Storage security model across all delivery squads:

• Direct Sovereign Cloud / SaaS Execution: Delivery professionals log directly into your firm's cloud software ecosystem (e.g. Iress Xplan, Plutosoft, Midwinter, Xero, LodgeiT, Access HandiSoft, Class Super, BGL Simple Fund 360, WinBEAT, Steadfast, HubSpot) hosted within Australian sovereign data centers. Zero client records or databases are downloaded locally.
• Encrypted Remote Desktop (RDP / VDI): For server-based tools (e.g. Access HandiSoft, Reckon Elite), staff work exclusively inside encrypted remote desktop sessions hosted on your infrastructure. Local drive mapping, local clipboard exports, and local file saving are completely disabled.
• Workstation Hardening: All delivery workstations are monitored with endpoint security, disk encryption, centralized activity logging, and enforced Multi-Factor Authentication (MFA).

4. Access Control & Credential Hygiene

Access to client software systems is governed by the principle of least privilege:

• Individual user accounts are provisioned and managed directly by the Australian client principal or system administrator.
• Multi-Factor Authentication (MFA / 2FA) is mandatory for every login endpoint.
• Upon task completion, pod reallocation, or contract conclusion, software credentials can be instantly revoked by the Australian firm administrator.

5. Security Incident Notification & Support

While statutory notification to the OAIC under the Australian Notifiable Data Breaches (NDB) scheme remains the legal responsibility of the Australian client entity (the APP entity), MCR Associates enforces immediate internal incident escalation protocols. In the unlikely event of any suspected unauthorized access or anomalous activity on an assigned operator workstation, MCR Associates will notify the client principal without delay and provide full audit logs to assist your firm's compliance team.

6. Artificial Intelligence & Data Privacy Covenant

MCR Associates does not train proprietary, public, or third-party artificial intelligence or machine learning models on client data or proprietary firm workpapers. Any enterprise productivity or automation tools utilized operate under commercial data processing agreements that prohibit customer data retention for model training.

7. Privacy Officer & Inquiries

If you have any questions regarding our privacy architecture, require a formal Data Processing Addendum (DPA), or wish to review our APP 8 compliance pack, please reach out to our team: