Privacy Statement

Last Updated: December 23, 2025

Rhode Island Privacy Addendum

This Rhode Island Privacy Addendum (“Addendum”) supplements the Grant Thornton Privacy Statement  and contains the disclosures required under the Rhode Island Data Transparency and Privacy Protection Act (“RIDTPPA”). For individuals who are Rhode Island residents, the RIDTPPA requires certain disclosures about the collection and use of Personal Data (Personal Information). Rhode Island residents have the right to exercise certain rights regarding their Personal Data as detailed in this Addendum.

What is Personal Data

For Indiana residents, the term “Personal Data” (Personal Information) is defined as information linked or reasonably linkable to an identified or identifiable individual, and does not include de-identified data, aggregate data, or publicly available information as defined in the ICDPA.  All other capitalized terms have the same meanings as given in the Privacy Statement.

Uses of Your Personal Data

This Addendum indicates the categories of Personal Data that Grant Thornton collects when acting as a Controller through the Site and our Services, the business purposes for which it was collected and the categories of third parties to whom it may have been disclosed.

Grant Thornton does not have actual knowledge that it sells or shares the Personal Data of individuals under 16 years of age. We do not make any decisions based solely on the automated processing of your Personal Data.

Personal Data collected about you will vary according to our interactions with you and the products and services we offer.

Targeted Advertising

Grant Thornton does not sell Personal Data to third parties; however, to the extent we process Personal Data for targeted advertising, you have the right to opt out by clicking on this link: Customize cookie settings.

You can also click on the “Do not sell/share my Personal Data” link at the bottom of the Site to learn more about exercising this right.

You may also opt out by broadcasting an Opt-Out Preference Signal, such as the Global Privacy Control (GPC). We honor Opt-Out Preference Signals, including GPC. If you choose to use an Opt-Out Preference Signal, you will need to turn it on for each supported browser or browser extension you use.

You can read more about our general cookies use here.

Sale of Personal Data

Grant Thornton does not sell your Personal Data. Should Grant Thornton engage in activities that the RIDTPPA defines as a sale, we will conform to the requirements of the RIDTPPA.

Rights

If you are a Rhode Island resident who has provided Personal Data to Grant Thornton, you have the right to request the following, subject to any statutory limitations or exceptions. RIDTPPA permits one request at no cost to you; however, additional requests may incur costs.

• confirmation of whether we are processing your Personal Data and enabling your access to it 
• ability to opt out targeted advertising, sale of personal data or profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning you
• deletion of your Personal Data
• correction of your Personal Data
• withdrawal of any prior granted consent to process Personal Data, where the basis of processing was consent

In some instances, Rhode Island law permits consumers to use an authorized agent to submit opt-out requests on their behalf. Grant Thornton will honor opt-out requests from authorized agents with appropriate verification.

How to Submit a Rights Request

To submit a rights request or to have an authorized agent make a request on your behalf as permitted by the RIDTPPA, please contact us at privacy.questions@us.gt.com, (877) 282-0109, or complete the web form located here. If you choose to have an authorized agent submit an opt-out request on your behalf, we will require proof that the agent is authorized by you and may also require you to verify your identity directly.

Verification

We will need to verify your identity to respond to a rights request, except for requests to opt-out of targeted advertising. If you have an account with us that is password-protected, we may verify your identity through our existing authentication practices for your account. If you do not have an account with us, we may request from you two data points or more of Personal Data to verify your identity depending on the nature of the request. Where you request specific pieces of Personal Data as permitted by RIDPAA, we may require additional confirmation or request a signed declaration under penalty of perjury to attest to/verify your identity. Opt-out requests for targeted advertising will be honored via an opt-out cookie or similar mechanism and do not require identity verification.

Responses to Requests

Grant Thornton will respond to requests as required by applicable law consistent with statutory requirements. In the case of a request to delete Personal Data, we may use a two-step process for online requests to delete where you must first, submit the request to delete and then second, separately confirm that you want your Personal Data deleted. We reserve the right to deny a request in the following circumstances and where otherwise permitted by Rhode Island law:

• your identity cannot be verified according to the level required
• the request can reasonably be considered fraudulent

No Discrimination

Grant Thornton will not discriminate against you for exercising your privacy rights under Rhode Island law. We will not deny you goods or services, charge you different prices or rates, or provide a different quality of services because you exercised your rights, however, we are not obligated to provide goods or services to you if you decline to provide the personal data necessary for the delivery of goods or services. RIDTPPA does permit different prices and levels for goods and services based on loyalty and other, similar programs.

Right to Appeal

If we refuse to take action on a request, you may have the right to appeal that decision. To appeal a decision, please contact us using the information in the How to Contact Us section below, with the subject line “Appeal of Privacy Request.” We will review your appeal and respond within sixty (60) days.

The Rhode Island Attorney General has exclusive authority to enforce the RIDTPPA. If your appeal is denied, you may file a complaint with the Rhode Island Attorney General’s Office.

Accessible Format

This Addendum is available to individuals with disabilities. To access this Addendum in an alternative downloadable format, please click here (PDF - 189 KB).

Enforcement and Dispute Resolution

We will investigate and attempt to resolve complaints and disputes regarding our use and disclosure of Personal Data in accordance with this Addendum. We will attempt to resolve any issues internally.

Merger, Change in Ownership and Other Business Transitions

In the event Grant Thornton goes through a business transition, such as a merger, or the acquisition or sale of all or a portion of its assets, your Personal Data may be among the assets transferred.

Addendum or Privacy Statement Changes

Grant Thornton reserves the right to amend or modify this Addendum or the Privacy Statement from time to time. We will post any revised Addendum or Privacy Statement on this Site, or a similar website that replaces this Site. By continuing to use any of our Sites, you agree that the terms of this Addendum and the Privacy Statement as of the effective date will apply to information, including Personal Data, previously collected, or collected in the future as permitted by law. 

How to Contact Us

If you have any questions, comments, or complaints regarding this Addendum the Privacy Statement, or our privacy practices, please contact us by email at privacy.questions@us.gt.com, or by mail at:

Grant Thornton LLP

Privacy Office - Risk, Regulatory & Legal Affairs

171 N. Clark Street, Suite 200

Chicago, IL 60601