PRIVACY POLICY

This Privacy Policy governs the collection, use, disclosure, and protection of personal information by Fortuity Inc., a Delaware corporation operating at 4312 Woodman Avenue, Suite 301, Sherman Oaks, California 91423 ("Fortuity," "we," "us," or "our"). It applies to personal information collected through the website at fortuityco.com and through the prospect intake channels that precede formal engagement with Fortuity (collectively, the "Services").

Fortuity treats prospect communications and engagement communications differently. Initial contact through the website or through general inquiry channels is governed by this Policy. Once a prospect elects to communicate formally with Fortuity, a Mutual Non-Disclosure Agreement is executed before any sensitive information is exchanged. Information furnished after MNDA execution, and information furnished pursuant to an executed Services Agreement, Statement of Work, or engagement letter, is governed by those instruments, by the federal tax confidentiality framework discussed below, and by applicable professional confidentiality standards, not by the general terms of this Policy.

Categories of Personal Information Collected

Through the website and during pre-engagement intake, Fortuity collects only what is necessary to evaluate fit and to communicate with the prospect. This includes name, mailing address, email address, telephone number, employer, job title, the general nature of the inquiry, and any account credentials a prospect voluntarily creates. Limited internet activity information is also collected through the website, including IP address, browser and device metadata, referring URLs, and aggregate analytics signals. Precise geolocation is not collected from website visitors.

More sensitive categories of information, including taxpayer identification numbers, financial account information, beneficial ownership detail, source-of-funds documentation, identity verification documents, and the broader set of records required to deliver tax, estate, structuring, asset protection, and compliance services, are collected only after MNDA execution and are governed by the MNDA, the engagement instruments, the federal tax confidentiality framework, and applicable professional standards.

Sources of Personal Information

Personal information is collected from the prospect or client directly, from referral sources who introduce prospective clients with the subject's authorization, from public records and licensed background data providers used for conflict checks and identity verification, and from cookies and server logs operated on fortuityco.com.

Purposes of Processing

Pre-engagement, Fortuity uses personal information to respond to inquiries, evaluate prospective engagements, conduct conflict checks, execute the MNDA, and scope a potential engagement. Post-engagement, processing extends to performance of the contracted scope and to satisfaction of Fortuity's legal, regulatory, and professional obligations, including those imposed by the Internal Revenue Code, Treasury Regulations, Circular 230, state taxing authority retention rules, and applicable anti-money-laundering and beneficial ownership reporting frameworks.

Fortuity also processes personal information to detect unauthorized access, defend against fraud and threats, protect personal safety and property, and respond to lawful subpoenas, summonses, court orders, and regulatory inquiries.

Fortuity does not process personal information for any purpose materially different from the purposes identified at the point of collection without obtaining additional consent.

Disclosures to Third Parties

Fortuity uses contracted service providers to operate the firm and to deliver the Services. These providers operate under written agreements that restrict their use of personal information to the services contracted. They include Microsoft Corporation (Microsoft 365 tenant, SharePoint, Teams, Dynamics 365, Copilot), Intuit Inc. (QuickBooks Online), ActivTrak Inc. (workforce monitoring), payment processors, document storage and electronic signature providers, and similar vendors.

Fortuity discloses personal information to professional collaborators engaged on a matter, including licensed attorneys, certified public accountants, enrolled agents, appraisers, custodians, trustees, registered agents, and other professionals whose engagement is authorized by the client or required by the scope of the work.

Fortuity discloses personal information to regulatory and governmental authorities, including the Internal Revenue Service, state taxing authorities, secretaries of state, and other authorities, where disclosure is compelled by law, where Form 2848 authority has been granted to a Fortuity representative, or where disclosure occurs as part of a duly authorized representation.

In the context of a merger, acquisition, restructuring, sale of substantially all assets, or similar corporate transaction involving Fortuity, personal information may be disclosed to a successor in interest subject to that successor's agreement to honor this Policy or provide equivalent protections.

Fortuity may also disclose personal information where it has a good-faith belief that disclosure is required by law, court order, or necessary to protect against fraud, harm to persons, or harm to property.

Fortuity does not sell personal information. Fortuity does not share personal information for cross-context behavioral advertising or for targeted advertising. Fortuity does not engage in profiling that produces legal or similarly significant effects on a data subject.

Tax Return Information and IRC §7216

To the extent Fortuity, through its enrolled agents, certified public accountants, or other authorized personnel, prepares or assists in preparing federal tax returns, all tax return information within the meaning of IRC §6103(b)(2)(A) and 26 C.F.R. §301.7216-1(b)(3) is subject to the disclosure and use restrictions of IRC §7216 and Treas. Reg. §§301.7216-2 and 301.7216-3. Tax return information will not be disclosed to or used by any third party for any purpose other than preparation of the return absent the specific written consent of the taxpayer, executed in compliance with Rev. Proc. 2013-14 (or its successor) and 26 C.F.R. §301.7216-3. This section operates independently of, and is not waived by, any general authorization contained in this Policy.

Client Confidentiality and Privilege

Information furnished by a client in the course of an engagement is held in confidence consistent with applicable professional standards and with the confidentiality provisions of the MNDA, the Services Agreement, and any Statement of Work. Communications between a federally authorized tax practitioner acting in that capacity and a client may be protected under IRC §7525 in non-criminal tax matters before the Internal Revenue Service and in non-criminal federal tax proceedings. Communications made through or at the direction of retained counsel may be protected by attorney-client privilege or attorney work-product doctrine. Fortuity will not voluntarily waive any such privilege without informed client consent.

Security Measures

Fortuity maintains administrative, technical, and physical safeguards designed to protect personal information in a manner reasonably appropriate to its sensitivity. Controls include access management, multi-factor authentication, encryption of data in transit and at rest within the Microsoft 365 tenant, role-based permissioning across SharePoint and Dynamics 365, endpoint monitoring, written information security policies, and periodic personnel training. No system is impervious to compromise, and Fortuity does not represent that its safeguards are immune from all threats.

Data Retention

Personal information is retained only for the period necessary to fulfill the purpose for which it was collected or as required by law. Tax return preparation records are retained for not less than three years from the close of the return period, consistent with IRC §6107(b). Engagement files are retained in accordance with the applicable Services Agreement and in any event for the longer of the statute of limitations applicable to the underlying matter or seven years from engagement closure. Prospect information that does not mature into an engagement is purged or de-identified within twenty-four months of last contact, unless retention is required for conflict-check integrity.

Your Privacy Rights Under U.S. State Law

Depending on the state in which you reside, you may have rights with respect to your personal information under one or more state comprehensive privacy statutes, including those of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, Nebraska, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and any subsequently enacted comprehensive state privacy statute applicable to the data subject's jurisdiction.

Subject to verification and to the exceptions provided by the controlling statute, residents of these states generally have the right to confirm whether Fortuity is processing their personal information, the right to access the personal information Fortuity holds, the right to correct inaccurate personal information, the right to delete personal information, the right to obtain a portable copy of personal information, the right to opt out of the sale of personal information, the right to opt out of processing for purposes of targeted advertising, and the right to opt out of profiling in furtherance of decisions producing legal or similarly significant effects. As stated above, Fortuity does not sell personal information, does not engage in targeted advertising, and does not engage in profiling of that character. The opt-out rights remain preserved in principle.

Residents of California additionally have the right to limit the use and disclosure of sensitive personal information and the right under Cal. Civ. Code §1798.83 to request information regarding disclosures to third parties for direct marketing purposes. Residents of states recognizing an appeal right may appeal a denial of a privacy rights request by submitting written notice to the contact below within a reasonable period following the denial. Fortuity will respond to the appeal within sixty days, or such shorter or longer period as the controlling statute requires.

Residents of Nevada may exercise the rights provided under Nev. Rev. Stat. §§603A.300 et seq. with respect to the sale of covered information. Fortuity does not sell covered information.

Verifiable consumer requests, appeals, and authorized agent communications may be submitted to admin@fortuityco.com or by telephone at (844) 634-2711. Requests are verified using information sufficient to reasonably authenticate the requester, with the verification standard scaling to the sensitivity of the information requested. Substantive responses are provided within the period required by the controlling state statute, generally forty-five days, extendable as the statute permits with notice to the requester.

An authorized agent may submit a request on behalf of a data subject upon furnishing written authorization signed by the data subject, proof of the agent's identity, and where required, a Power of Attorney executed under the law of the data subject's domicile.

Fortuity will not discriminate against a data subject for exercising any right under any applicable privacy statute.

International Data Subjects and Cross-Border Transfers

The Services are operated from the United States. By using the Services from outside the United States, a user consents to the transfer of personal information to the United States and to processing under United States law. The data protection regime in the United States may differ from the regime in the user's country of residence.

Engagements involving international structuring, foreign trusts, foreign entities, or foreign financial accounts may require the transfer of personal information to professional collaborators, registered agents, trustees, financial institutions, and regulatory authorities located outside the United States. Such transfers are made only as necessary to deliver the scope of the engagement, are governed by the engagement instruments and the MNDA, and are subject to applicable disclosure requirements including those imposed by the Common Reporting Standard, the Foreign Account Tax Compliance Act, and the Bank Secrecy Act.

Fortuity does not market the Services to residents of the European Economic Area or the United Kingdom and does not, in the ordinary course, process personal information of EEA or UK data subjects on a scale that triggers the obligations of controllers under the EU General Data Protection Regulation or the UK GDPR. To the extent an engagement involves an EEA or UK data subject, Fortuity processes the relevant personal data on the lawful basis of contractual necessity, legal obligation, or the data subject's explicit consent, as applicable.

Cookies and Online Analytics

Fortuity uses cookies and similar technologies on fortuityco.com for site functionality, session management, and aggregated analytics. Fortuity does not knowingly use third-party cookies for cross-context behavioral advertising or for targeted advertising. Browser-based opt-out preference signals, including the Global Privacy Control, are recognized as valid opt-out requests where applicable state law treats them as such. Most browsers permit cookie blocking, and disabling cookies may impair site functionality.

SMS Communications

Where a person provides a mobile telephone number to Fortuity and consents to receive SMS messages, that consent constitutes prior express written consent under the Telephone Consumer Protection Act and 47 C.F.R. §64.1200, for transactional, account-related, and, if separately authorized, informational messages from Fortuity. Message frequency varies. Message and data rates may apply. A user may opt out of further messages by replying STOP to any message and may request assistance by replying HELP or by contacting admin@fortuityco.com. Mobile telephone numbers are not shared with third parties for those parties' independent marketing purposes. Carrier delivery is not guaranteed.

Email Communications

Email communications sent by Fortuity comply with the CAN-SPAM Act. Where Fortuity sends informational or commercial email, that email contains a functional unsubscribe mechanism. Opt-out requests are honored within ten business days as required by 16 C.F.R. §316.5.

Security Incident Notification

In the event of a breach of unencrypted personal information triggering notification obligations under applicable state breach notification statutes, Fortuity will provide notice in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and the requirements of the controlling statute.

Children

The Services are not directed to children, and Fortuity does not knowingly collect personal information from minors through the website or pre-engagement intake. Where engagement scope requires processing of information regarding minor dependents, beneficiaries, or other minor data subjects, that processing occurs only under the authority of the parent, guardian, or fiduciary, is governed by the engagement instruments, and is undertaken solely to deliver the contracted scope.

Changes to This Policy

Fortuity may revise this Policy from time to time. Material changes are communicated by a conspicuous notice on fortuityco.com and, where appropriate, by direct notice to affected parties. The Last Revised date reflects the date of any change. Continued use of the Services after a revision constitutes acceptance.

Governing Law and Venue

This Policy is governed by the laws of the State of Delaware, the state of Fortuity's incorporation, without reference to its conflict-of-laws principles, except that the substantive privacy rights of a data subject are governed by the law of the data subject's state or country of residence to the extent that law confers rights beyond those provided by Delaware law. Exclusive jurisdiction and venue for any dispute arising out of or relating to this Policy lie in the state and federal courts located in Los Angeles County, California, except where a data subject's home jurisdiction confers a non-waivable right to litigate locally.

Contact

Privacy inquiries, rights requests, appeals, and authorized agent communications may be directed to Fortuity Inc., Attn: Management, 4312 Woodman Avenue, Suite 301, Sherman Oaks, California 91423, by telephone at (844) 634-2711, or by email at admin@fortuityco.com.