Privacy Statement

Effective: October 1, 2025

Maryland Privacy Addendum

This Maryland Privacy Addendum (“Addendum”) supplements the Grant Thornton Advisors LLC (“Grant Thornton,” the “firm” or “we”)  Privacy Statement (“Privacy Statement”) and contains disclosures required under the Maryland Online Data Privacy Act (MODPA) for individuals who are Maryland residents (“consumers”).

What is Personal Data

For Maryland residents, the term “Personal Data” means any information that is linked or can be reasonably linked to an identified or identifiable consumer. The terms “Personal Data” and “Personal Information”, as they are used within Grant Thornton privacy notices, are synonymous. All other capitalized terms have the same meanings as given them in the applicable Grant Thornton Privacy Statement or MODPA.

 

Uses of Your Personal data

This Addendum provides information about uses of your Personal Data, specifically: the categories processed through the Site and our Services, the purposes for collection, the categories of sources for collection, and the categories of third parties to whom such Personal Data may have been disclosed as well as the period or criteria for retention. Grant Thornton does not have actual knowledge that it sells or shares the Personal Data of individuals under 16 years of age.

Personal Data Processing

Personal Data collected about you will vary according to our interactions with you and the products and services we offer, please see the descriptions below for more information.

Opt-Out

To the extent our activities could be construed as a sale or share of Personal Data, you have the right to opt out here. You can also click on the “Do not sell/share my personal information” link at the bottom of the Site to learn more about exercising this right.

You have the right to opt out of targeted advertising and can do so by clicking on this link Cookie Settings

You may also opt out by broadcasting an Opt-Out Preference Signal, such as the Global Privacy Control (GPC). We honor Opt-Out Preference Signals, including GPC. If you choose to use an Opt-Out Preference Signal, you will need to turn it on for each supported browser or browser extension you use. You can read about our general cookies use here. 

Pursuant to the MODPA, Consumers can also opt out of any form of automated processing performed on Personal Data to evaluate, analyze, or predict personal aspects related to you, as an identified or identifiable consumer, with respect to the Consumer’s economic situation, health, demographic characteristics, personal preferences, interests, reliability, behavior, location, or movements where such automated decisions produce legal or similarly significant effects concerning the Consumer. The firm does not conduct such processing.  

Rights

As a Maryland resident whose Personal Data may be processed by Grant Thornton, you have the right to request, subject to any statutory limitations or exceptions:

• Confirmation that the firm is processing your Personal Data
• deletion of your Personal Data
• correction of your Personal Data
• opt-out of Personal Data processed for the purposes of targeted advertising, sale, or profiling
• copies of your Personal Data
• disclosure of categories of Personal Data shared with third parties.  

How to Submit a Rights Request

To submit a rights request or to have an Authorized Agent make a request on your behalf, please contact us at privacy.questions@us.gt.com, (877) 282-0109, or complete the web form located here.

Verification

We will need to verify your identity to respond to a rights request, except for requests to opt-out. If you have an account with us that is password-protected, we may verify your identity through our existing authentication practices for your account. If you do not have an account with us, we can request from you two or more data points of Personal Data to verify your identity depending on the nature of the request. Where you request specific pieces of Personal Data, we may also request a signed declaration under penalty of perjury to attest to/verify your identity.

Responses to Requests

Grant Thornton will respond to requests as required by applicable law consistent with statutory requirements. In the case of a request to delete Personal Data, we may use a two-step process for online requests to delete where you must first, submit the request to delete and then second, separately confirm that you want your Personal Data deleted. Requests made no more than once per 12-month period are free of charge.

We reserve the right to deny a request in the following circumstances and where otherwise permitted by Maryland law. You will be notified where we decline to act on your request.

• agent authorization is not verifiable
• it is not reasonably possible to associate your request with Personal Data
• Personal Data is not used to recognize you or is not associated with you
• your identity cannot be verified according to the level required by law
• other statutory exceptions as provided in the MODPA.

Appeal Process

If your request is denied, please send us an email to privacy.questions@us.gt.com with the Subject Line “Appeal Maryland” and attach the communication from Us explaining why we were unable to fulfill your request as well as your response to the reason we provided for not fulfilling your request. We will respond within sixty (60) days of receipt of your appeal. You may contact the Maryland Attorney General through its website: Consumer Protection Division regarding any complaints you may have with respect to the exercise of your rights.

No Discrimination

Grant Thornton will not discriminate against you in the event you exercise any of the rights under Maryland privacy law. Specifically, we will not:

• deny services to you
• charge different fees or rates for services, including using discounts or other benefits or imposing penalties
• provide a different level or quality of services to you
• suggest that you will receive different rates for services or services at a different level or quality.

Accessible Format

This Addendum is available to individuals with disabilities. To access this Addendum in an alternative downloadable format, please click here.

Do Not Track Signals

Some web browsers incorporate a “do-not-track” or similar feature that signals to websites with which the browser communicates that a visitor does not want to have their online activity tracked. If you have enabled a legally recognized browser-based opt out preference signal (e.g. Global Privacy Control) on your browser, Grant Thornton will recognize this preference according to and the extent required by applicable law.

Enforcement and Dispute Resolution

We will investigate and attempt to resolve complaints and disputes regarding our use and disclosure of Personal Data in accordance with this Addendum. We encourage interested persons to raise any concerns with us using the contact information provided in “How to Contact Us” below. Any employee who we determine is in violation of our privacy policies will be subject to our disciplinary process. For more information about how Maryland residents may file a complaint with the Maryland Attorney General’s office, see  https://www.marylandattorneygeneral.gov/Pages/CPD/Complaint.aspx.

Merger, Change in Ownership and Other Business Transitions

In the event Grant Thornton goes through a business transition, such as a merger, or the acquisition or sale of all or a portion of its assets, your Personal data may be among the assets transferred.

Addendum or Privacy Statement Changes

Grant Thornton reserves the right to amend or modify this Addendum or the Privacy Statement from time to time. We will post any revised Addendum or Privacy Statement on this Site, or a similar website that replaces this Site. By continuing to use any of our Sites, you agree that the terms of this Addendum and the Privacy Statement as of the effective date will apply to information, including Personal data, previously collected, or collected in the future as permitted by law.

How to Contact Us

Questions, comments or complaints about this Addendum or the Privacy Statement, Privacy Shield certification, or data collection and processing practices can be e-mailed to privacy.questions@us.gt.com, or by writing to us using the contact details below:

Corporate Mailing Address:

Grant Thornton LLP

Privacy Office - Risk, Regulatory & Legal Affairs

171 N. Clark Street, Suite 200

Chicago, IL 60601

The list below details the types of cookies used on our Sites:

1 “Grant Thornton” refers to the brand name under which the Grant Thornton member firms provide services to their clients and/or refers to one or more member firms, as the context requires. Grant Thornton LLP and Grant Thornton Advisors LLC (and their respective subsidiary entities) practice as an alternative practice structure in accordance with the AICPA Code of Professional Conduct and applicable law, regulations and professional standards. Grant Thornton LLP is a licensed independent CPA firm that provides attest services to its clients, and Grant Thornton Advisors LLC and its subsidiary entities provide tax and business consulting services to their clients. Grant Thornton Advisors LLC and its subsidiary entities are not licensed CPA firms.

Grant Thornton International Limited (GTIL) and the member firms, including Grant Thornton LLP and Grant Thornton Advisors LLC, are not a worldwide partnership. GTIL and each member firm are separate legal entities. Services are delivered by the member firms, GTIL does not provide services to clients. GTIL and its member firms are not agents of, and do not obligate, one another and are not liable for one another’s acts or omissions. 

2 A parent or legal guardian may exercise rights on behalf of the parent’s child or on behalf of a child for whom the guardian has legal responsibility. A guardian or conservator may exercise the rights on behalf of a consumer that is subject to a guardianship, conservatorship or other protective arrangement.