Effective July 1, 2024
Oregon Privacy Addendum
This Oregon Privacy Addendum (“Addendum”) supplements the Grant Thornton1 Privacy Statement (“Privacy Statement”) and contains the disclosures required under the Oregon Consumer Privacy Act (“OCPA”). Individuals, whose information is not processed in a commercial or employment context but who are Oregon residents, are considered consumers under the OCPA and certain disclosures about the collection and use of Personal data should be made available to them. Oregon consumers have the right to exercise certain rights regarding their Personal data as detailed in this Addendum, subject to some exemptions.
What is Personal Data
For Oregon residents, the term “Personal data” means data, derived data or any unique identifier that is linked to or is reasonably linkable to a consumer or to a device that identifies, is linked to or is reasonably linkable to one or more consumers in a household, as defined in the OCPA. All other capitalized terms have the same meanings as given them in the Privacy Statement.
Uses of Your Personal data
This Addendum provides disclosures with respect to the categories of Personal data that Grant Thornton collects through the Site and our Services, the business or commercial purposes for which such Personal data was collected, the categories of sources of such Personal data, and the categories of third parties to whom such Personal data may have been disclosed in the past twelve (12) months as well as the period or criteria for retention of Personal data. Grant Thornton does not have actual knowledge that it sells Personal data, nor that it conducts targeted advertising or profiling of individuals under 15 years of age. Where Grant Thornton processes deidentified data, it will not attempt to reidentify such data.
Purpose of collection
Personal data collected about you will vary according to our interactions with you and the products and services we offer. We will obtain your consent where required for any uses of Personal data not disclosed to you either in this Addendum or at the time of collection, or where we collect Personal data defined as sensitive under the OCPA. Where you wish to withdraw such consent, please contact privacy.questions@us.gt.com.
Personal data collection and use
Specific types or examples of Personal data that could be collected by category are provided below.
Category of Personal data | Category of source from which data is collected | Purpose of collection | Category of third parties to whom data is potentially disclosed | Retention |
Personal identifiers: contact information (such as first and last name, e-mail address, mailing address or phone number), and current employer and job title | Directly from consumer; directly or indirectly from our clients or their agents | Respond to requests; send information about Grant Thornton’s services or events; send administrative information or notices; advertise our services on other websites; communicate in connection with an engagement | Service providers; service providers for marketing services; our affiliates in Bangalore and Kolkata, India; other member firms of GTIL | Life of client relationship, plus 3 years |
Education and professional information (employment context): name, address and other contact information, work history, educational experience, licenses, and certifications, other professional or employment-related information, disability status, immigration status, full or partial Social Security number, gender, race, ethnicity, citizenship, veteran, and disability status | From consumer | Create an account on Grant Thornton’s online job board; process applications for employment and communicate about employment opportunities; evaluate information for employment opportunities | Service providers; our affiliates in Bangalore and Kolkata, India; background check vendors | End of employment, termination of benefits or final benefit payment, plus 10 years |
Audio, visual: includes audio and video recordings and surveillance | From consumer | Employment and security for premises and technology | Service providers for providing audio/visual services; law enforcement authorities | 90 days |
Internet activity: automatically collected information from activity on our Sites such as browser information, IP address, and browser type | Cookies and other tracking technologies | Personalize content on our Sites; track activity on and technical performance of our Sites; evaluate our marketing efforts; improve our Sites | Service providers for providing internet services; service providers for marketing services | One year |
Personal identifiers: Personal data collected while providing services and in connection with pre-engagement activities | Directly from consumer; directly or indirectly from our clients or their agents | Fulfill a contract for services; perform pre-engagement activities; enforce our rights arising from any contract, including billing and collections | Service providers; our affiliates in Bangalore and Kolkata, India; other member firms of GTIL | Termination of relationship or life of solution, plus 7 years |
Automated Decision-making
We do not make any decisions based solely on the automated processing of your Personal data.
Targeted Advertising
We may use cookies to determine what Grant Thornton content or services may interest you. You can opt out of these cookies by broadcasting an Opt-Out Preference Signal, such as the Global Privacy Control (GPC). We honor Opt-Out Preference Signals, including GPC. If you choose to use an Opt-Out Preference Signal, you will need to turn it on for each supported browser or browser extension you use. You may also go here to opt out of non-essential cookies. You can read more about our general cookies use here.
Sales or Selling
To the extent our processing activities could be considered a sale of Personal data, you have the right to opt out and can do so here. You can also click on the “Do not sell/share my Personal data” link at the bottom of the Site to learn more about exercising this right.
You may also opt out by broadcasting an Opt-Out Preference Signal, such as the Global Privacy Control (GPC). We honor Opt-Out Preference Signals, including GPC. If you choose to use an Opt-Out Preference Signal, you will need to turn it on for each supported browser or browser extension you use.
You can read more about our general cookies use here.
Rights
If you are an Oregon consumer who has provided Personal data to Grant Thornton you may request, subject to any statutory limitations or exceptions:
- Confirmation that Grant Thornton is processing your Personal data
- Categories of your Personal data that have been processed
- Third parties, other than natural persons, to which Grant Thornton has disclosed your Personal data
- A copy of your Personal data that Grant Thornton has processed or is processing
- Correction of inaccuracies in your Personal data
- Deletion of your Personal data
- Opt-out of targeted advertising sale of Personal data; or profiling where used to make legal or other, significant decisions
How to Submit a Rights Request
To submit a rights request or to have an Authorized Agent make a permitted2 request on your behalf, please contact us at privacy.questions@us.gt.com, (877) 282-0109, or complete the web form located here.
Authentication
We will need to verify your identity to respond to a rights request. If you have an account with us that is password-protected, we may verify your identity through our existing authentication practices for your account. If you do not have an account with us, we may request from you two data points or more of Personal data to verify your identity depending on the nature of the request. Where you request specific pieces of Personal data, we may also request a signed declaration under penalty of perjury to attest to/verify your identity.
Authorized Agents
Where the OCPA permits you to designate an authorized agent to exercise any rights indicated above on your behalf, we will require proof that you have designated the authorized agent to act on your behalf. In addition, we will ask you to verify your identity directly and confirm that you have provided the agent permission to submit the request.
Where you designate an authorized agent by means of an internet link, browser setting, browser extension, global device setting or other technology that enables opt out of processing your Personal data, Grant Thornton will honor such request where it can verify, with commercially reasonable efforts, your identity and the authorized agent’s authority to act on your behalf. Please contact us at privacy.questions@us.gt.com for more information or assistance.
Responses to Requests
Grant Thornton will respond to requests as required by, and consistent with, the OCPA. In the case of a request to delete Personal data, we may use a two-step process that will require you to first, submit the request to delete and then second, to separately confirm that you want your Personal data deleted.
We reserve the right to deny a request in the following circumstances and where otherwise permitted by Oregon law:
- agent authorization is not verifiable
- your identity cannot be verified
Appeal Process
If your request is denied, please send us an email to privacy.questions@us.gt.com with the Subject Line “Appeal” and attach the communication from Grant Thornton explaining why we were unable to fulfill your request as well as your response to the reason we provided for not fulfilling your request. We will respond within forty-five (45) days of receipt of your appeal. You may contact the Oregon Attorney General through its website: https://www.doj.state.or.us/ regarding any complaints you may have with respect to the exercise of your rights.
No Discrimination
Grant Thornton will not discriminate against you in the event you exercise any of your rights under the OCPA. Specifically, we will not:
- deny services to you
- charge different fees or rates for services, including through the use of discounts or other benefits or imposing penalties
- provide a different level or quality of services to you
- suggest that you will receive different rates for services or services at a different level or quality.
Accessible Format
This Addendum is available to individuals with disabilities. To access this Addendum in an alternative downloadable format, please click here.
Do Not Track Signals
Some web browsers incorporate a “do-not-track” or similar feature that signals to websites with which the browser communicates that a visitor does not want to have their online activity tracked. If you have enabled a legally recognized browser-based opt out preference signal (e.g. Global Privacy Control) on your browser, Grant Thornton will recognize this preference according to and the extent required by applicable law.
Enforcement and Dispute Resolution
We will investigate and attempt to resolve complaints and disputes regarding our use and disclosure of Personal data in accordance with this Addendum. We encourage interested persons to raise any concerns with us by contacting privacy.questions@us.gt.com. Any employee who we determine is in violation of our privacy policies will be subject to our disciplinary process.
Merger, Change in Ownership and Other Business Transitions
In the event Grant Thornton goes through a business transition, such as a merger, or the acquisition or sale of all or a portion of its assets, your Personal data may be among the assets transferred.
Addendum or Privacy Statement Changes
Grant Thornton reserves the right to amend or modify this Addendum or the Privacy Statement from time to time. We will post any revised Addendum or Privacy Statement on this Site, or a similar website that replaces this Site. By continuing to use any of our Sites, you agree that the terms of this Addendum and the Privacy Statement as of the effective date will apply to information, including Personal data, previously collected, or collected in the future as permitted by law.
How to Contact Us
Questions, comments or complaints about this Addendum or the Privacy Statement, or data collection and processing practices can be e-mailed to privacy.questions@us.gt.com, or by writing to us using the contact details below:
Corporate Mailing Address:
Grant Thornton
Privacy Office - Risk, Regulatory & Legal Affairs
171 N. Clark Street, Suite 200
Chicago, IL 60601
1 “Grant Thornton” refers to the brand name under which the Grant Thornton member firms provide services to their clients and/or refers to one or more member firms, as the context requires. Grant Thornton LLP and Grant Thornton Advisors LLC (and their respective subsidiary entities) practice as an alternative practice structure in accordance with the AICPA Code of Professional Conduct and applicable law, regulations and professional standards. Grant Thornton LLP is a licensed independent CPA firm that provides attest services to its clients, and Grant Thornton Advisors LLC and its subsidiary entities provide tax and business consulting services to their clients. Grant Thornton Advisors LLC and its subsidiary entities are not licensed CPA firms.
Grant Thornton International Limited (GTIL) and the member firms, including Grant Thornton LLP and Grant Thornton Advisors LLC, are not a worldwide partnership. GTIL and each member firm are separate legal entities. Services are delivered by the member firms, GTIL does not provide services to clients. GTIL and its member firms are not agents of, and do not obligate, one another and are not liable for one another’s acts or omissions.
2 A parent or legal guardian may exercise rights on behalf of the parent’s child or on behalf of a child for whom the guardian has legal responsibility. A guardian or conservator may exercise the rights on behalf of a consumer that is subject to a guardianship, conservatorship or other protective arrangement.
Corporate Mailing Address:
Grant Thornton LLP
Privacy Office - Risk, Regulatory & Legal Affairs
171 N. Clark Street, Suite 200
Chicago, IL 60601