Effective date: 28 May 2026
Last updated: 28 May 2026
Fogel CFO and Management Services LTD, an Israeli private company, company number 515189637, registered office at Derech Hebron 93, Jerusalem 9345006 ("Fogel CFO", "we", "us", "our"), is the owner and the manager (as those terms are used in the Israeli Protection of Privacy Law, 5741-1981 ("PPL")) of the database(s) underlying the Platform and our Services.
This Privacy Policy describes how we collect, use, share and protect personal data in connection with (a) the Fogel CFO online platform (the "Platform"); (b) our fractional CFO, accounting and bookkeeping services (the "Services"); and (c) our marketing website and business communications. It supplements (and is incorporated into) our Terms of Service.
We have prepared this Privacy Policy to comply with the PPL, as amended by the Protection of Privacy Law (Amendment No. 13), 5774-2024, the principal provisions of which entered into force on 14 August 2025, and the Privacy Protection (Data Security) Regulations, 5777-2017 (the "Data Security Regulations"). To the extent the GDPR or US state privacy laws (such as the CCPA/CPRA) apply, the additional disclosures in Sections 11 to 12 also apply.
Our Services and Platform primarily involve business financial data of our Clients (companies and other legal entities). However, business records inevitably contain personal data of individuals, including employees, directors, signatories, contractors, vendors, customers and other business contacts of our Clients, as well as our own users. This Privacy Policy applies to those personal data.
For most personal data about employees or customers of our Clients, our Client is the data controller / database owner, and Fogel CFO acts as a data processor / database holder on the Client's behalf, on the basis of the Terms of Service / Engagement Letter. The Client is responsible for the lawful basis, notice and consent vis-a-vis those individuals.
For personal data of our Authorised Users, prospective clients, marketing contacts and website visitors, Fogel CFO is the data controller / database owner.
IP address, device identifiers, browser, OS, language, time zone, cookies and similar identifiers, pages visited, features used, error logs.
We do not seek to process information of "special sensitivity" (as redefined under Amendment 13). However, certain financial details, ID numbers and passport numbers of individuals may appear in client documents we process. We treat these with heightened care under the Data Security Regulations.
In accordance with section 11 of the PPL, as expanded by Amendment 13, we process personal data for the following purposes and legal bases:
Consequences of refusal. Providing personal data is generally voluntary, except where required by law (e.g. tax reporting). However, refusal to provide certain data, for example bank-account access via Plaid, Authorised User credentials, or core accounting data, will prevent us from providing the Services or specific features.
No general AI training on Client Data. We do not use Client Data to train general-purpose AI models. See Section 7.
We share personal data with the following categories of recipients, only as necessary and under appropriate confidentiality and data-protection terms:
We use AI Tools (third-party large-language-model APIs and proprietary tooling) to assist with extracting data from invoices, receipts, bank statements and contracts; classifying and reconciling transactions; drafting commentary; generating reports; and detecting anomalies.
We are an Israeli entity, but several of our subprocessors (notably Intuit, Plaid, AI providers and major cloud hosts) are based in the United States or operate globally. As a result, personal data may be transferred from Israel to recipients outside Israel.
We transfer personal data abroad pursuant to the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001, including, as applicable: transfers to countries that receive personal data from EEA member states under the same terms; transfers under written agreements with recipients that contractually commit to a level of protection materially equivalent to Israeli law; and transfers based on the informed consent of the data subject. Where the GDPR applies, transfers outside the EEA are made under appropriate safeguards such as Standard Contractual Clauses. Israel benefits from an EU adequacy decision (Commission Decision 2011/61/EU).
In line with the Data Security Regulations and Amendment 13, we maintain a written information security policy and apply administrative, technical and physical safeguards appropriate to the type, sensitivity and volume of personal data we process. Our measures include:
No security measure is perfect. We cannot guarantee absolute security but will respond to incidents in accordance with Section 10.
In the event of a "Severe Security Incident" within the meaning of the Data Security Regulations, we will: (a) promptly notify the Israeli Privacy Protection Authority as required; (b) notify affected Clients without undue delay so that they may inform data subjects as appropriate; and (c) report on the measures taken. Where the GDPR applies, we will assist the data controller in meeting its 72-hour notification obligations.
Subject to the conditions set out in the PPL, individuals have the right to: inspect the personal data held about them (section 13 PPL); request correction or deletion of data that is incorrect, incomplete, unclear or outdated (section 14 PPL); object to direct mailing and request removal from direct-mailing databases (section 17F PPL); withdraw consent, where processing is based on consent, with effect for future processing; and receive information about the controller's identity and contact details, the categories of data processed, the purposes and recipients, the consequences of refusing to provide data, and the existence of data-subject rights.
Where the GDPR applies, data subjects also have the rights of access, rectification, erasure, restriction of processing, data portability, objection, and the right not to be subject to solely automated decisions with legal effect. Data subjects may complain to a supervisory authority.
California residents whose personal data we process may have the rights to know, delete, correct, opt out of "sale" or "sharing" (we do not sell or share personal data for cross-context behavioural advertising), limit use of sensitive personal information, and non-discrimination.
We are an Israeli entity with no US or EU establishment. However, the GDPR may apply to the extent we offer services to data subjects in the EEA/UK or monitor their behaviour; where our Clients have EU/UK employees, vendors or customers whose data we process, we will, on request, enter into an Article 28 Data Processing Addendum and assist the Client as controller with GDPR compliance. The CCPA/CPRA employee and B2B exemptions expired on 1 January 2023, so personal data of California residents acting in business capacities is in principle within scope; most US Clients will not themselves meet the CCPA thresholds, and we do not "sell" or "share" personal data in the CCPA/CPRA sense. We will act as a "service provider" and enter into a CCPA-compliant addendum on request.
The Platform uses cookies and similar technologies that are strictly necessary to operate the service (session, login, security), as well as analytics cookies where consented to. For our marketing website, see our separate Cookie Notice / consent banner.
The Platform and the Services are intended for businesses and are not directed at individuals under 18. We do not knowingly collect personal data from children.
We retain personal data as long as necessary for the purposes for which it was collected, including: active Client Data for the duration of the engagement; after termination, for up to seven (7) years (or longer if required by Israeli tax/VAT law, the Companies Law or professional standards, or in response to actual or anticipated legal claims); marketing data until consent is withdrawn; and logs and security data typically for 12 to 24 months.
We may update this Privacy Policy from time to time. Material changes will be notified through the Platform and, where appropriate, by email. The "Last updated" date at the top of this Policy indicates the latest version.
If you believe your privacy rights have been violated, please first contact us at info@fogelcfo.com. You may also lodge a complaint with the Israeli Privacy Protection Authority, or with the relevant data-protection authority in your jurisdiction (e.g. an EU Member State data protection authority, or the California Privacy Protection Agency).
Full-time, English-speaking support from seasoned professionals with deep expertise in Israeli & U.S. bureaucracy: Taxes, social security, and beyond. We craft a flexible package tailored to your business, from everyday logistics to executive strategy, with add-on services on demand.