Data protection
Client financial records need an agreed purpose, limited access, and a clear end to their use. This page outlines the prerequisites for an engagement that involves nonpublic records.
Agree the scope before sharing
Before any client records are shared, Michael and the client must agree on the operating question, required fields, approved tools, permitted uses, and retention dates. The engagement agreement and data protection addendum set the exact responsibilities. Michael supplies those documents during scope review.
The public website provides an inquiry form. It provides no client login, file upload, or records portal. Use it for a short introduction and keep financial records, bank or card details, passwords, and employee or guest information out of the message.
Use only what the work needs
The standard service scopes use aggregate operating summaries and redacted records. The client must remove unrelated fields before transfer. A persistent ID can still identify a person, so replacing a name with an ID is not enough to establish anonymity.
Personal payroll, guest profiles, consumer financial accounts, and other restricted records require a separate assessment, agreed scope, and safeguards before intake. The client-records guide lists the information to leave out.
Approve access and tools
Before intake can begin, Michael must verify the agreed transfer and storage controls, including encryption, account protection, named access, and a tested return or deletion process. The client must approve services or people that will receive its records. These prerequisites must be completed for the chosen tools; this page does not establish that a tool or account has passed those checks.
Optional direct system access is limited to approved aggregate report views, read-only permissions, and an agreed duration. The engagement documents must name the system, views, access limits, and revocation process. The client does not have to provide live access or master credentials.
Keep use within the agreement
The proposed engagement terms limit client records and derived nonpublic information to the scheduled services. Client approval is required before a new vendor or AI service receives records. Records are not approved for model training, prospect lists, unrelated client work, or publicity by signing the standard engagement documents.
A case study or testimonial requires approval of the exact final public content, any necessary individual or third-party releases, and a separately signed amendment that authorizes that specific publicity purpose. The underlying records remain confidential.
Return, deletion, and concerns
The engagement documents must set the return or deletion event and identify any records that must be retained. Provider backups can have a separate deletion cycle. Michael must explain the verified limits rather than promise removal from systems outside his control.
For a privacy request or suspected exposure, email inquiries@thepassconsulting.com with a brief description. Leave out confidential attachments and credentials. Michael will assess the concern under the applicable engagement terms and law.
Read the privacy notice for website and outreach information, privacy requests for request instructions, and sharing client records before preparing engagement inputs.