Privacy policy

1. Our Commitment to Your Privacy

At YAMA Consulting Services, Inc. (hereinafter “YAMA“, “we” or “our firm“), the protection of your privacy and the confidentiality of your personal information constitute fundamental pillars of our professional practice. With over 18 years of experience serving municipal entities, government agencies and organizations in Puerto Rico, we understand the sensitive and critical nature of the financial information and administrative data entrusted to us by our clients.

This Privacy Policy establishes our unwavering commitment to the responsible handling, rigorous protection and ethical use of all personal information and confidential data that we collect and process in the course of our professional relationships.

2. Scope of Application

This Privacy Policy applies to all information collected by YAMA Consulting Services, Inc. through:

• YAMA CSI Services: Compilation of financial statements, accounting advisory, regulatory compliance, federal funds administration, municipal budget preparation, compliance audits, legislative projects and progressive monitoring systems.
• YAMA DSP Services: Strategic planning, recovery project management, federal funds administration (FEMA, HUD, DOT), sustainable development, regulatory requirements compliance, real-time monitoring and regulatory training.
• Bubalis Administrative Solutions Services: Property appraisal, cadastral assessment, collections management, delinquent debt analysis, development research and tax database updates.
• Our website and client portals.
• Electronic communications, in-person meetings and professional correspondence.

3. Information We Collect

In the performance of our professional services, we collect the following categories of information:

3.1 Information from Municipal and Government Entities

• Institutional identification: Name of the entity, municipality, government agency, nonprofit organization or special district.
• Contact information: Physical addresses, institutional email addresses, departmental phone numbers and administrative contacts.
• Organizational structure: Organizational chart, key personnel, elected officials, department directors and designated liaisons.

3.2 Financial and Accounting Information

• Accounting records: General ledger, accounting journals, subsidiary records, accounts payable, accounts receivable, payroll and financial transactions.
• Financial statements: Statements of position, statements of activities, cash flow statements, bank reconciliations and supporting documentation.
• Budgetary information: Operating budgets, capital budgets, fiscal projections, departmental allocations and funding sources.
• GASB compliance: Information required for application of GASB pronouncements, governmental accounting policies, notes to financial statements and required disclosures.

3.3 Federal Funds and Grant Information

• Funding proposals: Grant applications, competitive proposals, eligibility documentation and budget justifications.
• Funds administration: FEMA programs, HUD funds, DOT projects, recovery funds, federal allocations and progress reports.
• Federal compliance: Single Audits, quarterly reports, OMB compliance, required certifications and supporting documentation.
• Project monitoring: Performance indicators, milestone progress, budget execution and transaction validation.

3.4 Property and Tax Information

• Cadastral data: Parcels, property maps, boundaries, land area, structures and improvements.
• Appraisals: Market values, special assessments, comparative analyses, field inspections and professional valuations.
• Tax information: Property taxes, accumulated debts, payment history, late charges and payment plans.
• Property owners: Names, mailing addresses, taxpayer identification and contact information for collection and notification purposes.

3.5 Legislative Project Information

• Legislative drafting: Ordinance drafts, municipal resolutions, public policy proposals and legal amendments.
• Research and analysis: Impact studies, comparative analyses with other jurisdictions, statistical data and legal foundations.

3.6 Technical and Usage Information

• Portal access: IP addresses, session logs, access date and time, browser type and operating system.
• Electronic communications: Email addresses, message metadata and professional correspondence records.

4. Use of Information

We use the information collected exclusively for the following legitimate purposes:

4.1 Provision of Professional Services

• Compile financial statements in accordance with GASB principles and GAAP.
• Provide accounting advisory and technical assistance in governmental administrative processes.
• Prepare budget projects and municipal fiscal projections.
• Develop compliance reports and regulatory certifications.
• Manage federal funds and post-disaster recovery programs.
• Perform appraisal services and collections management through Bubalis Administrative Solutions.
• Draft legislative projects and public policy proposals.
• Design monitoring strategies and corrective action plans.

4.2 Legal and Regulatory Compliance

• Comply with Law 39-2012 (Puerto Rico Privacy Policy Notification Law).
• Meet requirements of Law 111-2005 (Puerto Rico Law on Citizen Information Regarding Security of Information Banks).
• Adhere to Gramm-Leach-Bliley Act (GLBA) regulations applicable to financial institutions and financial advisory services.
• Comply with GASB pronouncements and governmental accounting standards.
• Respond to audit requirements of the Office of the Comptroller of Puerto Rico.
• Satisfy federal regulations applicable to FEMA, HUD, DOT funds and other agencies.
• Comply with Financial Oversight Board regulations when applicable.
• Maintain required records in accordance with tax laws and municipal regulations of Puerto Rico.

4.3 Internal Administration

• Maintain client records and project management.
• Manage billing, collections and contractual relationships.
• Perform quality control internally of our professional services.
• Provide customer service and administrative communications.

4.4 Service Improvement

• Develop methodologies and best practices in governmental accounting.
• Train our professional staff in updated regulations.
• Evaluate the efficiency of our processes and systems.

5. Information Protection and Security

YAMA implements rigorous and multilevel security measures to protect the confidentiality, integrity and availability of information under our custody:

5.1 Administrative Controls

• Limited access: Only authorized personnel with legitimate need have access to client information.
• Continuous training: Regular training for our team on confidentiality, data security and best practices.
• Confidentiality agreements: All our staff and collaborators sign strict confidentiality agreements.
• Internal policies: Documented procedures for handling, storage and transmission of sensitive information.
• Professional supervision: Review and supervision by licensed CPAs and experienced professionals.

5.2 Technical Controls

• Data encryption: Encryption of sensitive information in transit and at rest.
• Firewalls and antivirus: Perimeter protection and monitoring of cybersecurity threats.
• Secure backups: Encrypted backup copies with redundant storage.
• Robust authentication: Strong passwords, multi-factor authentication for critical systems.
• System updates: Security patches and updates applied regularly.
• Secure networks: VPN connections for remote access and protected file transmission.

5.3 Physical Controls

• Secure facilities: Controlled access to our offices and work areas.
• Protected physical storage: Files and documents stored in locked cabinets.
• Secure destruction: Shredding of physical documents and certified erasure of electronic media.
• Surveillance: Security systems at our corporate facilities.

5.4 Contractual Controls with Third Parties

• Due diligence: Rigorous evaluation of vendors and subcontractors.
• Data processing agreements: Formal contracts that establish security and confidentiality obligations.
• Compliance audits: Periodic verification that third parties comply with our security standards.

6. Disclosure and Sharing of Information

YAMA does NOT sell, rent or commercialize your personal information under any circumstances. We may share information in the following limited situations:

6.1 With Government and Regulatory Agencies

• Office of the Comptroller of Puerto Rico: For official audits, investigations and oversight requirements.
• Federal agencies: FEMA, HUD, DOT, OMB and other federal agencies in compliance with reporting requirements and federal funds audits.
• Financial Oversight Board: When required for fiscal reports or order compliance.
• Puerto Rico Department of Treasury: For tax compliance and fiscal validations.
• Municipal offices: Exchange of information necessary for project management and interagency coordination.

6.2 With Professional Collaborators

• CPA firms: Independent auditors contracted by our clients or required by regulations.
• Engineering professionals: Engineers, planners and architects in collaborative projects.
• Legal advisors: Attorneys and legal consultants when necessary for legal matters or legislative drafting.
• Technical experts: Specialists in specific areas (environmental, cadastral, technological) through collaborative agreements.

6.3 With Service Providers

• Accounting software providers: Financial information systems, management platforms and analysis tools.
• Technology services: Hosting, cloud storage, technical support and backup services.
• Communication providers: Email services, videoconferencing and secure portals.

All providers operate under strict contractual agreements that limit the use of information exclusively to authorized purposes.

6.4 With Your Express Consent

We will share your information with third parties when you provide us explicit written authorization.

6.5 By Legal Requirement

We will disclose information when required by law, court order, subpoena or valid legal process.

7. Your Privacy Rights

In accordance with applicable Puerto Rico laws and federal regulations, you have the following rights:

7.1 Right of Access

Request access to the personal information we maintain about your entity or organization.

7.2 Right of Rectification

Request the correction of inaccurate or incomplete information.

7.3 Right to Restriction of Processing

Request the limitation of the processing of your information under specific circumstances.

7.4 Right to Opt-Out

• Marketing communications: You may opt to not receive our promotional communications (newsletters, event invitations, publications).
• Certain sharing with third parties: You may restrict the sharing of certain information with third parties for purposes not essential to the contracted service.

7.5 Right to File Complaints

If you believe we have inadequately handled your information, you may file a complaint with:

• Puerto Rico Department of Consumer Affairs (DACO)
• Federal Trade Commission (FTC) (for matters under GLBA)

7.6 Exercise of Rights

To exercise any of these rights, contact us using the information provided in the “How to Contact Us” section of this Policy.

8. Information Retention

YAMA retains information for the time necessary to comply with the purposes established in this Policy and in accordance with legal requirements:

8.1 Financial and Accounting Records

• Compiled financial statements: Minimum 6 years in accordance with GASB standards and Puerto Rico regulations.
• Backup documentation: Period required by auditing regulations of the Office of the Comptroller.
• Payroll records: In accordance with labor laws and tax requirements.

8.2 Federal Funds

• Federal projects: Minimum 3 to 5 years after project closure in accordance with OMB regulations and specific federal agencies.
• Single Audit: Retention period established by federal requirements.

8.3 Tax and Cadastral Information

• Assessment records: In accordance with municipal laws and applicable tax regulations.
• Collection information: As required by local law and contracts with municipalities.

8.4 Secure Disposal

At the end of the retention period, information is securely destroyed by:

• Certified shredding of physical documents.
• Secure erasure of electronic media using specialized software.
• Physical destruction of storage devices when appropriate.

9. Cookies and Tracking Technologies

Our website may use cookies and similar technologies to:

• Facilitate navigation and functionality of the site.
• Remember your preferences and settings.
• Analyze traffic of the site and usage patterns to improve our online services.
• Provide secure access to client portals.

You may configure your browser to reject cookies, although this may affect the functionality of the site.

10. Links to Third-Party Sites

Our website may contain links to external sites. YAMA is not responsible for the privacy practices of these third-party sites. We recommend reviewing the privacy policies of any external site you visit.

11. Privacy of Minors

Our services are directed to government entities, municipalities and organizations. We do not intentionally collect information from minors under 18 years of age.

12. International Transfers

YAMA operates primarily in Puerto Rico. Any transfer of information outside of Puerto Rico is carried out in accordance with applicable laws and through appropriate safeguards (such as standard contractual clauses or data processing agreements).

13. Changes to This Policy

YAMA reserves the right to modify this Privacy Policy to reflect changes in our practices, services or legal requirements. The date of last update appears at the beginning of this document. Material changes will be notified through:

• Publication on our website.
• Direct notification to active clients when appropriate.

We recommend periodically reviewing this Policy to stay informed about how we protect your information.

14. Legal Basis and Regulatory Compliance

This Privacy Policy is based on and complies with:

• Law 39-2012 of Puerto Rico (Privacy Policy Notification Law)
• Law 111-2005 of Puerto Rico (Citizen Information Law on Information Bank Security)
• Regulation 8568 of 2015 of Puerto Rico
• Gramm-Leach-Bliley Act (GLBA) – Federal law applicable to financial institutions
• Fair Credit Reporting Act (FCRA)
• Privacy Act of 1974 – For government information
• Governmental Accounting Standards Board (GASB) Pronouncements
• Puerto Rico Office of the Comptroller Regulations
• Federal regulations applicable to federal funds administration (OMB, FEMA, HUD, DOT)

YAMA Consulting Services, Inc. is committed to maintaining the highest standards of confidentiality, professional integrity and data protection in all the services we provide to the communities we serve.