← Back to site

1. Introduction and database-controller declaration

Cohen Partners & Co., Certified Public Accountants (business no. 201447778) ("the Firm", "we") respects your privacy and is committed to protecting your personal information under Israel's Privacy Protection Law and Data Security Regulations. This policy covers all our websites, including cohen-partners.co.il, landing pages, the client portal, the tax-refund system, and any other digital channel we operate.

Database controller: Ido Cohen, CPA. Address: 10 Moshe Dayan St., Metropark, Petah Tikva. Privacy email: office@cohen-partners.co.il. Phone: +972-50-938-3080.

Providing personal information on this site is entirely voluntary. However, withholding certain details may prevent us from providing the requested services. By submitting a form you confirm you have read this policy and consent to the collection and use of information as described.

2. Information we collect

2.1 Provided voluntarily by you

Identity (full name, ID number), contact details (phone, email, address), business information, financial data (bank details, tax data, deductions), uploaded documents (payslips, certificates), and correspondence (WhatsApp, email), via contact forms, onboarding, the client portal, the tax-refund system, and direct communication.

2.2 Collected automatically

• Aggregate, cookieless measurement (no consent): through Cloudflare Web Analytics we collect aggregate usage data only (visitor counts, pages viewed, visitor country, device and browser type, referrer). The tool sets no cookies, does not store the IP address, and does not create a visitor identifier (full wording in section 5.5). Because no identifier of an individual is stored, this measurement is always active and is not conditioned on consent.
• Cookie-based measurement and marketing (only after separate per-category consent): IP address, browser, device and language, and browsing patterns (pages viewed, time on site, referrer), via Google Analytics (GA4) in the "Measurement" category and Meta Pixel in the "Marketing" category. Also general geo (city or region from IP), and local preferences (theme, language, consent choice) in local storage.

3. Purposes

Providing professional services; responding to inquiries; managing the client relationship, issuing payment requests and invoices; improving the site (aggregate measurement always; cookie-based measurement only after consent); legal compliance and record-keeping; marketing and direct mail (only with separate explicit consent); security and fraud prevention. We will not use your information for any other purpose without prior consent.

4. Legal basis

Consent (forms, cookies, mail); performance of a contract (services to existing clients); legal obligation (tax-authority reporting, statutory record retention).

5. Cookies and measurement technologies

5.1 What are cookies?

Small text files stored on your device that help the site function and improve browsing. Some of our measurement tools use no cookies at all (see 5.5).

5.2 Categories (three, as in the banner)

Category	Purpose	Examples	Consent
Necessary	Basic function, security, language preferences	Session id, theme, consent record	No. This category never includes Google Analytics or Meta Pixel
Measurement	Understanding and improving site use	Google Analytics (GA4): _ga, _gid, _ga_<id>	Yes
Marketing	Ad measurement, and showing you relevant content and services and personalized ads (remarketing)	Meta Pixel: _fbp, _fbc	Yes

5.3 Google Analytics

This site uses Google Analytics 4 to measure traffic and improve the site, via cookies. It loads only after you click "Got it" in the cookie notice, or after you enable the "Measurement" category via "Cookie settings". Before that it is inactive. Google policy: policies.google.com/privacy.

5.4 Meta Pixel

This site uses Meta Pixel to measure Facebook and Instagram campaigns and to show relevant content and services and personalized ads (remarketing). The pixel is active on certain pages of the site (mainly landing and campaign pages), and loads only after you click "Got it" in the cookie notice, or after you enable the "Marketing" category via "Cookie settings". Before that it is inactive. Meta policy: facebook.com/privacy/policy.

5.5 Aggregate, cookieless measurement (Cloudflare Web Analytics)

The measurement tool (Cloudflare Web Analytics) sees the visitor's IP address momentarily at the time of the request, only to produce aggregate figures (for example, visitor country). It does not store the IP address, does not derive an identifier from it, does not perform fingerprinting, and does not store any cookie or identifier on the visitor's device. The data retained is aggregate and does not identify an individual. For this reason the tool is always active, is not conditioned on consent, and does not appear in the banner.

5.6 Managing your choice

On your first visit a short cookie notice appears with a "Got it" button and a link to this policy. The notice does not block browsing. Clicking "Got it" enables the Measurement and Marketing categories. Before you click, only the aggregate, cookieless measurement (Cloudflare) runs; no measurement or marketing cookie loads. You can enable or disable the Measurement and Marketing categories at any time via the "Cookie settings" button at the bottom of every page, or through your browser settings. If you have already made a choice, it is remembered and the notice is not shown again.

6. Sharing with third parties

We do not sell, rent, or trade your information. We share only as needed with:

• Cloudflare, Inc. Provider of our cookieless measurement tool; processes only aggregate browsing data on the Firm's behalf, does not store the IP address, and does not build a user profile. Policy: cloudflare.com/privacypolicy.
• Google (Analytics) Anonymized or pseudonymized browsing data, with consent.
• Meta Browsing data, with consent.
• Supabase Client and lead data hosting.
• Netlify Hosting and form processing.
• WhatsApp Business / Twilio Messaging.
• SUMIT Payment processing and issuing invoices and receipts; receives name, email and amount to collect a payment from a client.
• Competent authorities As required by law.

All providers are bound to confidentiality.

7. International transfer

Some providers (Cloudflare, Google, Meta, Supabase, Netlify, Twilio) store or process data on servers outside Israel. Transfers are made under Israeli law governing transfer of data outside the country, ensuring an adequate level of protection through providers' contractual undertakings and/or your consent.

8. Data retention

We retain information for as long as needed for the purpose it was collected, or for the period required by law. Deletion is performed on request or as required by law.

Data type	Retention and deletion
Accounting documents	Retained up to 7 years, per the statutory retention duty
Client personal documents	Can be deleted at the end of the engagement or on request
Inquiries and leads	Retained as long as needed; deleted on request
WhatsApp messages	Retained as part of the communication record; deleted on request
Cookie data	Up to 24 months
Cloudflare aggregate data	Contains no personal identifier
Backups	System data backup: retained for about a week and replaced daily. Files and documents backup: retained for one year and deleted automatically at the end of the year.

9. Data security

We apply measures under the Data Security Regulations:

• Encryption: encrypted transport (SSL/TLS) on all pages; data is stored with infrastructure providers that encrypt it at rest.
• Access control: access to personal data limited to authorized staff by role permissions (RLS), on a need-to-know basis.
• Backup: the system is backed up automatically once a day. System data (client details and records) is backed up with the database provider. Files and documents are backed up separately to an external storage service, and each backup checks that all files were saved and that the copy is complete.

10. Your rights

11. Minors

The site and services are not intended for minors under 18. We do not knowingly collect information from minors; if we learn we have, we delete it.

12. Direct marketing

We send marketing only with separate, explicit consent. The Marketing category (Meta Pixel) is used to show relevant content and services and to personalize advertising (remarketing). You can opt out anytime via an "unsubscribe" link, by email, or by replying "STOP" on WhatsApp. Opting out does not affect service-related communication.

13. Use of AI systems

The Firm may use AI tools for internal efficiency, a virtual assistant, and data analysis, while maintaining confidentiality. Personally identifying information is not sent to external AI systems without appropriate anonymization or your consent.

14. Security-incident reporting

In a data-security incident we will take immediate steps to contain it and prevent recurrence, and will report to the Privacy Protection Authority promptly as required. Notification of data subjects will follow the law and the Authority's guidance.

15. Changes to this policy

We may update this policy from time to time. Material changes will be posted here with a new update date. Continued use after an update constitutes acceptance.

16. Contact

© 2026 Cohen Partners & Co. All rights reserved.