Last Updated: July 1, 2023
California Privacy Addendum
This California Privacy Addendum (“Addendum”) supplements the Grant Thornton LLP Privacy Statement (“Privacy Statement”) and contains the disclosures required under the California Consumer Privacy Act (“CCPA”) as amended by the Consumer Privacy Protection Act (“CPRA”). For individuals who are California residents (“consumers”), the CCPA requires certain disclosures about the collection and use of Personal Information. California residents have the right to exercise certain rights regarding their Personal Information as detailed in this Addendum.
What is Personal Information
For California residents, the term “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with or could reasonably be linked, directly or indirectly, with a particular individual or household as defined in the CCPA. All other capitalized terms have the same meanings as given them in the Privacy Statement.
Uses of Your Personal Information
This Addendum provides disclosures with respect to the categories of Personal Information that Grant Thornton collects through the Site and our Services, the business or commercial purposes for which such Personal Information was collected, the categories of sources of such Personal Information, and the categories of third parties to whom such Personal Information may have been disclosed in the past twelve (12) months as well as the period or criteria for retention of Personal Information. Grant Thornton does not have actual knowledge that it sells or shares the Personal Information of individuals under 16 years of age.
Categories of Personal Information Collected
Personal Information collected about you will vary according to our interactions with you and the products and services we offer. Specific types or examples of Personal Information that could be collected by category are provided below.
Category of Personal Information | Category of source from which data is collected | Purpose of collection | Category of third parties to whom data is potentially disclosed | Retention |
Personal identifiers: contact information (such as first and last name, e-mail address, mailing address or phone number), and current employer and job title | Directly from consumer; directly or indirectly from our clients or their agents | To respond to requests; to send information about Grant Thornton’s services or events; to send administrative information or notices; to advertise our services on other websites; to communicate in connection with an engagement | Service providers; service providers for marketing services; our affiliates in Bengaluru, India; other member firms of GTIL | Life of client relationship, plus 3 years |
Education and professional information: name, address and other contact information, work history, educational experience, licenses, and certifications, other professional or employment-related information, full or partial Social Security number, gender, race, ethnicity, citizenship, veteran, and disability status | From consumer | To create an account on Grant Thornton’s online job board; to process applications for employment and communicate about employment opportunities; to evaluate information for employment opportunities | Service providers; our affiliates in Bengaluru, India; background check vendors | End of employment, termination of benefits or final benefit payment, plus 10 years |
Audio, visual: This category would include audio and video recordings and surveillance | From consumer | Employment and security | Service providers for providing audio/visual services; law enforcement authorities | 90 days |
Internet activity: automatically collected information from activity on our Sites such as browser information, IP address, and browser type | Cookies and other tracking technologies | To personalize content on our Sites; to track activity on and technical performance of our Sites; to evaluate our marketing efforts; to improve our Sites | Service providers for providing internet services; service providers for marketing services | One year |
Personal identifiers: personal information collected while providing services and in connection with pre-engagement activities | Directly from consumer; directly or indirectly from our clients or their agents | To fulfill a contract for services; to perform pre-engagement activities; to enforce our rights arising from any contract, including billing and collections | Service providers; our affiliates in Bengaluru, India; other member firms of GTIL | Termination of relationship or life of solution, plus 7 years |
Automated Decision-making
We do not use profiling or make any decisions based solely on the automated processing of your Personal Information.
Your Personal Information may be Shared
To the extent we share Personal Information, you have the right to opt out of the sharing of Personal Information; you can do so here. You can also click on the “Do not sell/share my personal information” link at the bottom of the Site to learn more about exercising this right.
You may also opt out by broadcasting an Opt-Out Preference Signal, such as the Global Privacy Control (GPC). We honor Opt-Out Preference Signals, including GPC. If you choose to use an Opt-Out Preference Signal, you will need to turn it on for each supported browser or browser extension you use.
You can read more about our general cookies use here.
Sale of Personal Information
Grant Thornton has not sold the Personal Information of any “individual” in the twelve (12) months preceding the effective date of this Addendum.
Rights
If you are a California resident who has provided Personal Information to Grant Thornton you have the right to request twice in a twelve-month period the following, subject to any statutory limitations or exceptions:
- categories and specific pieces of Personal Information collected about you
- categories of sources from which your Personal Information is collected
- business or commercial purpose of collecting, sharing, or selling your Personal Information
- categories of third parties to whom your Personal Information was provided
- categories of Personal Information that were sold or shared and the categories of recipients
- deletion of your Personal Information
- correction of your Personal Information
- opt-out of having your Personal Information shared, disclosed, or sold to third partie
How to Submit a Rights Request
To submit a rights request or to have an Authorized Agent make a request on your behalf, please contact us at privacy.questions@us.gt.com, (877) 282-0109, or complete the web form located here.
Verification
We will need to verify your identity to respond to a rights request, except for requests to opt-out of sharing. If you have an account with us that is password-protected, we may verify your identity through our existing authentication practices for your account. If you do not have an account with us, we can request from you two data points or more of Personal Information to verify your identity depending on the nature of the request. Where you request specific pieces of Personal Information, we may also request a signed declaration under penalty of perjury to attest to/verify your identity.
Authorized Agents
As a California resident, you have the right to designate an authorized agent to exercise the Rights indicated above on your behalf. We will require proof that you have designated the authorized agent to act on your behalf. Specifically, we will require a signed permission demonstrating that the agent has been authorized by you to act on your behalf. In addition, we will ask you to verify your identity directly and confirm that you have provided the agent permission to submit the request. Please contact us at privacy.questions@us.gt.com for more information if you wish to submit a request through an agent.
Responses to Requests
Grant Thornton will respond to requests as required by applicable law consistent with statutory requirements.
In the case of a request to delete Personal Information, we may use a two-step process for online requests to delete where you must first, submit the request to delete and then second, separately confirm that you want your Personal Information deleted.
We reserve the right to deny a request in the following circumstances and where otherwise permitted by California law:
- agent authorization is not verifiable
- your identity cannot be verified according to the level required
- you exceed the permitted number of requests in a twelve-month period
No Discrimination
Grant Thornton will not discriminate against you in the event you exercise any of the rights under California privacy law. Specifically, we will not:
- deny services to you
- charge different fees or rates for services, including through the use of discounts or other benefits or imposing penalties
- provide a different level or quality of services to you
- suggest that you will receive different rates for services or services at a different level or quality.
Accessible Format
This Addendum is available to individuals with disabilities. To access this Addendum in an alternative downloadable format, please click here.
Do Not Track Signals
Some web browsers incorporate a “do-not-track” or similar feature that signals to websites with which the browser communicates that a visitor does not want to have their online activity tracked. If you have enabled a legally recognized browser-based opt out preference signal (e.g. Global Privacy Control) on your browser, Grant Thornton will recognize this preference according to and the extent required by applicable law.
Enforcement and Dispute Resolution
We will investigate and attempt to resolve complaints and disputes regarding our use and disclosure of Personal Information in accordance with this Addendum. We encourage interested persons to raise any concerns with us using the contact information below. Any employee who we determine is in violation of our privacy policies will be subject to our disciplinary process. For more information about how California residents may file a complaint with the California Privacy Protection Agency (“CPPA”) pursuant to the CCPA, see the CPPA’s website.
Merger, Change in Ownership and Other Business Transitions
In the event Grant Thornton goes through a business transition, such as a merger, or the acquisition or sale of all or a portion of its assets, your Personal Information may be among the assets transferred.
Addendum or Privacy Statement Changes
Grant Thornton reserves the right to amend or modify this Addendum or the Privacy Statement from time to time. We will post any revised Addendum or Privacy Statement on this Site, or a similar website that replaces this Site. By continuing to use any of our Sites, you agree that the terms of this Addendum and the Privacy Statement as of the effective date will apply to information, including Personal Information, previously collected, or collected in the future as permitted by law.
How to Contact Us
Questions, comments or complaints about this Addendum or the Privacy Statement, Privacy Shield certification, or data collection and processing practices can be e-mailed to privacy.questions@us.gt.com, or by writing to us using the contact details below:
Corporate Mailing Address: Grant Thornton LLP
Privacy Office - Risk, Regulatory & Legal Affairs
171 N. Clark Street, Suite 200
Chicago, IL 60601
Corporate Mailing Address:
Grant Thornton LLP
Privacy Office - Risk, Regulatory & Legal Affairs
171 N. Clark Street, Suite 200
Chicago, IL 60601