Privacy Policy

Crowe LLP and its subsidiaries (i) Crowe Cayman Ltd., (ii) Crowe Horwath Global Risk Consulting Holdings Ltd., (iii) Crowe Horwath Global Risk Consulting ULC (Canada), and (iv) Crowe Horwath IT Services LLP (“we,” or “us”) provide professional services including, without limitation, assurance, tax, financial advisory, and consulting services to private and publicly traded businesses, and governmental entities, as well as to individuals (“Services”). This Privacy Policy sets forth our policy and practices protecting personal information we collect through our website at Crowe.com, and other websites (each, a “Site”), and through our Products that we operate and in connection with the Services.

This Privacy Policy describes how we collect, use, disclose, and process your Personal Information (“you” and “your”), as well as rights that you may have in connection with that information.  By accessing or otherwise using this Site or our Products, you consent to our use of such personal information in accordance with this Privacy Policy.  We reserve the right to change this Privacy Policy at any time.  If we change our Privacy Policy, we will post an updated version on this website.  Please check back periodically to see if our Privacy Policy has been updated.  Updates to the Privacy Policy will be referenced by the "Last Updated and Effective Date" date shown above.

The data we collect depends on the context of your interactions and the choices you make, including your privacy settings and the products and features you use. When providing services, our firm signs agreements with clients that outline how information, including personal data, will be used. Companies must obtain required consents from individuals whose personal information will be transferred to our firm for service fulfillment. Similarly, individuals must consent to our use of their personal information to deliver the requested services.

Other webpages of applicable Crowe Global member firms or related entities manage their websites independently and such websites are not our responsibility.  Such websites, as well as other websites that may be linked to this website, are not governed by this Privacy Policy.  We are not responsible or liable for any acts or omissions of Crowe Global or any other member firm of Crowe Global and specifically disclaim any and all responsibility or liability for acts or omissions of Crowe Global or any other Crowe Global member firm.  We encourage visitors to review each of those entities’ privacy policies before disclosing any Personal Information.

Personal Information We Collect, How It Is Collected, and What We Use It For

For purposes of this Privacy Policy, “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular person or household. “Personal Information” does not include: (a) publicly available information or lawfully obtained, truthful information that is a matter of public concern; or (b) information that is deidentified or aggregate information.

Set forth below are the categories of Personal Information we collect and that have collected in the preceding 12 months, the categories of sources from which the Personal Information was collected and the business or commercial purpose for such collection.  The Personal Information we collect depends on the context of your interactions with the Site and the choices you make, including your privacy settings and the products and features you use. We may not collect all of the information referenced below from you and we may not use your Information for all purposes set forth in this Privacy Policy.

• Personal identifiers, such as your name, postal address, telephone number, fax number, email address, unique personal identifier, IP address, online identifiers, account names, associated passwords, social media profiles and other similar identifiers. These personal identifiers are collected directly from you, and automatically, e.g., when you visit our Site through cookies and tracking technology as forth explained in Cookie and Tracking Technologies below, and other sources as further set forth below.
  • We collect personal identifiers to provide Services, to manage your requests, to improve our Site or services, send administrative information or notices, send information about our services, events, and other relevant information, registration for access to certain areas of the Site, subscribing to or ordering newsletters, media alerts and/or publications, submission of resumes or work history information for purposes of recruitment and/or employment, participation in bulletin boards, discussion or message forums, responding to quick surveys, quizzes, or benchmarking surveys, registration for events (e.g., webcasts or seminars) and conferences, or online services, contacting us for further information, to comply and laws or regulations, security and fraud detection, and any other purpose stated at the point of collection.

• Protected characteristics, provided with protections under applicable law, such as race, religion, gender, age, medical information, and disability information. These protected characteristics are collected directly from you.
  • We collect protected characteristics for the purposes of recruitment and/or employment.

• Commercial information, such as records of personal property, products or services purchased, obtained, or considered, and type of work performed. This commercial information is collected automatically, e.g., when you visit our Site through cookies and tracking technology as forth explained in Cookie and Tracking Technologies below.
  • We collect commercial information to manage your requests, sending information about our services, events, and other relevant information, subscribing to or ordering newsletters, media alerts and/or publications, participation in bulletin boards, discussion or message forums, responding to quick surveys, quizzes, or benchmarking surveys, registration for events (e.g., webcasts or seminars) and conferences, registration for online services, and contacting us for further information.

• Internet information, such as electronic network activity, browsing history, search history, preference expressed, information regarding interaction with website application, advertisement, or analytics, viewing or purchasing of goods, services, and content, and system application access data. Internet information is collected automatically, e.g., when you visit our Site through cookies and tracking technology as forth explained in Cookie and Tracking Technologies below.
  • We collect internet information to provide Services, to improve our Site and services, registration for access to certain areas of the Site, subscribing to or ordering newsletters, media alerts, and/or publication, participation in bulletin boards, discussion or message forums, responding to quick surveys, quizzes, or benchmarking surveys, registration for events (e.g., webcasts or seminars) and conferences, registration for online services, contacting us for further information, and security and fraud detection.

• Professional or employment information and education information, for example, description of current position, job title, employer, location, professional certifications, employment goals and objectives, and educational history. This professional or employment information and education information is collected directly from you and other sources as further set forth below.
  • We collect professional or employment information and education information for the purposes of recruitment and/or employment, process and evaluate your application for employment, communicate with you about employment opportunities, identify and communicate with you about future potential employment opportunities with us. This information may include your first and last name, email address, CV, resume, cover letter and any other information provided by or about you, including information from references and background check providers.

We may obtain Personal Information from various other sources, including: publicly available sources (public authorities, public websites, and social media), existing or prospective personnel or previous employers, educational institutions, contractors, vendors, suppliers, our member firms, subsidiaries, and newly acquired businesses.

Some of the Personal Information may be considered Sensitive Personal Information under privacy laws. Various jurisdictions may use terms differently. For example, some jurisdictions use the terms “personal data” or “sensitive personal data”.  Moreover, some jurisdictions do not consider some of the Personal Information listed in the Sensitive Personal Information definition above as Sensitive Personal Information.

We may maintain and share aggregated or deidentified, data and information derived from Personal Information with other entities for the purpose of performing activities that may help us provide and improve our products and services.  When we deidentify data, we will not attempt to re-identify the data unless required to do so pursuant to a legal obligation.

Personal Information Collected Automatically

Cookies

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. For more information on what cookies or other tracking technologies are being used, please reference the specific Cookie Notice or Cookie Banner for the sites, services, or products you are accessing.

Web Beacons or Tracking Pixels

Web Beacons, also interchangeable with tracking pixels, are single-pixel sized images placed on websites that are typically used to target ads to consumers and track consumer behavior like page views, clicks and ad interactions. We do not use web beacons and tracking pixels on our website or applications.

Generative Artificial Intelligence

You may not use nor attempt to use any data or content found on our Sites or Products as input into or for the training or development of generative artificial intelligence, machine learning, algorithms, software, or related technologies, to create any derivative works, compilations or collective works, or for any purpose that infringes, misappropriates, or otherwise violates any intellectual property right, or that allows any third parties to access, use or benefit from our proprietary intellectual property in any way without specific permission from Crowe to do so.

Accessing or using the Site via mechanical, programmatic, robotic, scripted or any other automated means is strictly prohibited. Unless otherwise agreed to by Crowe in writing, use of the Site is permitted only via individual users engaged in an active user session and may not be collected via automated or robotic methods. Regardless of the data delivery method, the Site Content may not be used in conjunction with a generative artificial intelligence (“AI”) solution. Portions of the Site or Site content and our Products may utilize – directly or indirectly – AI algorithms and technologies, including generative AI, to provide certain features. We may provide responsive or accelerated search results based on natural language queries or prompts that you provide. AI systems may not be accurate or error-free, which means you remain responsible for independently verifying any information provided on the Site.

Personal Information We Disclose, Share for Targeted Advertising or Sell and the Purpose for It

As set forth in more detail below, we may transfer or disclose your Personal Information to service providers, subcontractors, Crowe Global member firms, and/or other Crowe affiliated companies for the purpose of managing your request, administration and management of the websites, and/or internal business purposes.  Personal Information may also be disclosed to service providers of identity management, credit card payment processing, website hosting and management, data analysis, data backup, and/or security and storage service. Your Personal Information may be transferred to parties located in other countries.  Crowe will take reasonable steps to ensure that such parties will provide adequate privacy protection to your Personal Information.  By using our websites, you explicitly consent to the disclosure of such data in accordance with this Privacy Policy.

Disclosure of Personal Information to Service Providers

In the preceding 12 months, we may have disclosed the following categories of Personal Information to our service providers and contractors for the following business purposes.

• Auditing of Ad Impression: We disclose Personal Information for auditing purposes related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
• Services on Our Behalf: We disclose Personal Information in order to receive services performed on our behalf, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on our behalf.
• Advertising and Marketing Services: We disclose Personal Information to provide advertising or marketing services on our own behalf.
• Quality Control & Improvement of Products and Services: We disclose Personal Information to verify, maintain, and improve our products and services.

The following chart sets forth the categories of Personal Information we may have disclosed to our service providers for a business purpose over the past 12 months.

As Necessary: We may also disclose Personal Information, as necessary: (a) to comply with any legal process; (b) to respond to requests from public and government authorities; (c) to enforce our terms and conditions; (d) to protect our operations and protect our rights, privacy, safety or property, and/or that of you or others; and (e) to allow us to pursue available remedies or limit the damages that we may sustain. We may also use Personal Information in connection with or during negotiation of any reorganization, acquisition, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings). Finally, we may disclose Personal Information when explicitly requested by you, when required to deliver publications or reference materials requested by you, and when required to facilitate conferences or events hosted by other parties.

How Long We Keep Your Personal Information

We will retain each category of your Personal Information identified above for an amount of time that is reasonably necessary for us to use the information for the purposes disclosed herein and for any other permitted purposes, including retention of Personal Information pursuant to any applicable contract, law or regulation.  To determine the appropriate retention period for Personal Information, we consider the amount, nature, and sensitivity of the Personal Information, the potential risk of harm from unauthorized use or disclosure of your Personal Information, the purposes for which we process your Personal Information and whether we can achieve those purposes through other means, and the applicable legal requirements.

Data Security for the Personal Information We Collect

We implement technical, organizational, administrative and physical measures to help ensure a level of security appropriate to the risk to the Personal Information we collect, use, process and disclose. These measures are aimed at ensuring the on-going integrity and confidentiality of Personal Information.  We evaluate these measures on a regular basis to help ensure the security of the processing.  Please be aware that, despite our ongoing efforts, no security measures are perfect or impenetrable.  By using our website, you acknowledge that the transmission of data over the internet is inherently insecure and assume all risks associated with such transmission. Further, you acknowledge and agree that we have no control over the security of data being transmitted over the internet.

Email Communications from Us

If you no longer wish to receive promotional communications from us, you may at any time request that we discontinue sending you such materials by contacting us using the contact information listed below.

Children’s Privacy

We do not direct our websites or applications to children under the age of 13.  We do not knowingly collect information from persons under the age of 13 nor provide any Personal Information from such persons to any third party for any reason whatsoever.  No information should be submitted to our website or applications by persons under the age of 13.  When appropriate, we may ask you to indicate your date of birth to verify compliance with the age requirements set forth herein.

Video Content on the Site

Our Site may include content that is governed by the Video Privacy Protection Act (“VPPA”).  Some of the cookies and other tracking technologies that we have disclosed above may provide to others access to your personal information (or personally identifiable information as that term is used under the VPPA).  To the extent that the VPPA applies to our Site, or any content on our Site, by using our Site you explicitly consent to our practices, including those that relate to video contents or otherwise governed by the VPPA.

Third-Party Sites and Social Media Applications

Our websites may facilitate certain links to third-party websites that are not operated under our privacy practices. This Privacy Policy does not address, and we are not responsible for, the privacy, information, or other practices of any third parties, including any third party operating any web site or service to which our website links. The inclusion of a link on our websites does not imply endorsement of the linked site or service by us or by our affiliates. We encourage you to carefully review each site’s privacy policy before disclosing any Personal Information.

Our website may also host various blogs, forums, wikis and other social media applications or services that allow you to share content with other users (collectively “Social Media Applications”). Any Personal Information or other information that you contribute to any Social Media Applications can be read, collected, and used by other users of that Social Media Application over whom we have little or no control. We are not responsible for any third party’s use, misuse, or misappropriation of any Personal Information or other information that you contribute to any Social Media Application.

California Residents

Your Rights If You Are a Resident of California

California residents may exercise certain privacy rights pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and related regulations.  Your right to submit certain requests as a California resident are described below. Please note that these rights are subject to certain exceptions and certain of these rights are subject to verification mechanisms.

• Right to Know Personal Information Collected About You. You have the right to know: (1) the categories of Personal Information we have collected about you; (2) the categories of sources from which the Personal Information is collected; (3) the business or commercial purpose for collecting, selling, or sharing Personal Information; (4) the categories of parties to whom we disclose Personal Information; and (5) the specific pieces of Personal Information we have collected about you.  You also have the right to know the list of all third parties to whom we have disclosed Personal Information, as defined under California Civil Code Section 1798.83(e) (a/k/a the “Shine the Light Law”), during the preceding year for third-party direct marketing purposes.

• Right to Know Personal Information Disclosed, Sold or Shared and to Whom.  You have the right to request that we disclose to you: (1) the categories of Personal Information that we collected about you; (2) the categories of Personal Information that we sold or shared about you and the categories of third parties to whom the Personal Information was sold or shared, by category or categories of Personal Information for each category of third parties to whom the Personal Information was sold or shared; and (3) the categories of Personal Information that we disclosed about you for a business purpose and the categories of persons to whom it was disclosed for a business purpose.

• Right to Request Deletion of Your Personal Information.  You have the right to request that we delete your Personal Information, subject to a number of exceptions.  Following receipt of a request, we will let you know what, if any, Personal Information we can delete from our records.  If we cannot delete all of your Personal Information, we will let you know the reason.

• Right to Correct Inaccurate Information.  If you believe that any of the Personal Information we maintain about you is inaccurate, you have the right to submit a request for us to correct that information.  Upon receipt of a request, we will use commercially reasonable efforts to correct the information as you direct.  You may submit a request.

• Right to Opt Out of the Sale of Personal Information or The Sharing of Your Personal Information for Targeted Advertising. This right is applicable only to the extent that Crowe is engaged in the sale or sharing of your personal information. Crowe generally does not sell your personal information, however, there are circumstances where we share personal information with our third-party providers or others for which individuals may have the right to opt out. If you choose to exercise your right to opt out of the sale or sharing of your personal information, please opt-out.
  
  You can exercise any of the foregoing rights by calling us at 1-800-599-6046 or emailing us at [email protected].

• Right to Non-Discrimination for Exercising Your Rights. If you choose to exercise any of your rights, you have the right to not receive discriminatory treatment by us.
  
  For California residents, regarding your rights to opt-out of the sale and sharing of Personal Information and to limit the use of your Personal Information, in addition to the links above, you can also exercise your right to opt-out by using a browser that supports an opt-out preference signal (also known as a Global Privacy Control (GPC)).  If you choose to use this signal, you will need to turn it on for each browser you use.  

Data Subject Rights

Depending on your state of residency, you may have certain rights related to your Personal Information.  California residents should refer to the “Your Rights if You Are a Resident of California” section above and for a description of California specific rights and Nevada residents should refer to the “Nevada Privacy Notice” below.

Please note that these rights are subject to certain exceptions and certain of these rights are subject to verification mechanisms.

• The Right to Know:  You have the right to know whether we are processing your Personal Information, and, if you are a resident of Oregon, the categories of your Personal Information we have processed and the specific third parties to which we have disclosed it.

• The Right of Access: You have the right to access your Personal Information, and to obtain a copy of it in a readily usable format, if feasible.

• The Right to Correct Inaccuracies: You may request that inaccuracies in your Personal Information be corrected.  Utah law does not provide for this right.

• The Right to Delete:  You have the right to request that your Personal Information be deleted, except in cases where retention is required by law or contractual obligation.

• The Right to Data Portability: You have the right to obtain a copy of your data in a portable and, if feasible, readily usable format.

• The Right to Opt-Out: You may elect to prevent your Personal Information from being:
  1. Used in targeted advertising;
  2. Sold; 
  3. *Used for profiling purposes that may produce legal or similarly significant effects.
     * Utah law does not provide for this right.

• The Right to Non-Discrimination for Exercising Your Rights:  If you choose to exercise any of your rights, you have the right to not receive discriminatory treatment by us.

• Rights Regarding Sensitive Personal Information:  In connection with your Sensitive Personal Information: (a) if you are a resident of Utah or Oregon, we will not process that information without first presenting you with clear notice and an opportunity to opt out of the processing; and (b) if you are a resident of Colorado, Connecticut, Florida, Montana, Texas or Virginia, we will not process Sensitive Personal Information without obtaining your consent.  You have the right to withdraw your previous consent and opt out of further processing of your Sensitive Personal Information.

Furthermore, if we have actual knowledge that you are 13 years of age and not older than 16 years of age, we will not without your consent process your Personal Information for the purposes of targeted advertising, profiling in furtherance of decisions that produce legal effects or effects of similar significance or selling your Personal Information.

You may submit a request via email to [email protected] or by calling us at 1-800-599-6046.

Verification of Consumer Requests

When you make a request to know, delete and/or correct, to help protect your privacy and maintain security, we will take steps to verify your identity.  Our verification procedure may differ depending on whether you have an account with us or not and the request you are making.  The following generally describes the verification processes we use:

• Password Protected Accounts. If you have a password-protected account with us, we may use existing authentication practices to verify your identity but will require re-authentication before disclosing, correcting or deleting data.  If we suspect fraudulent or malicious activity relating to your account, we will require further verification (as described below) before complying with a request to know, correct or delete.

• Verification for Non-Accountholders.  If you do not have, or cannot access, a password-protected account with us, we will generally verify your identity as follows:
  • For valid requests to know categories of Personal Information, we will verify your identity to a reasonable degree of certainty by matching at least two data points provided by you with reliable data points maintained by us.
  • For valid requests to know specific pieces of Personal Information, right of access and right to data portability, we will verify your identity to a reasonably high degree of certainty by matching at least three data points provided by you with reliable data points maintained by us.  
  • For valid requests to correct or delete Personal Information, we will verify your identity to a reasonable degree or a reasonably high degree of certainty depending on the sensitivity of the Personal Information and the risk of harm posed by unauthorized deletion.  We will act in good faith when determining the appropriate standard to apply.

If there is no reasonable method by which we can verify your identity, we will state so in response, including an explanation of why we have no reasonable method to verify your identity.

We may also require a declaration, signed under penalty of perjury, that the person requesting the information is the person whose information is the subject of the request or that person’s authorized representative. We will maintain all signed declarations as part of our records.

If you use an authorized agent to submit a request to know, delete or correct, we may require the authorized agent to provide proof that you gave the agent signed permission to submit the request. We may also require you to do either of the following: (a) verify your own identity directly with us; or (b) directly confirm with us that you provided the authorized agent permission to submit the request.

There may be situations where we cannot grant your request.  For example, if you ask us to delete Personal Information that we are obligated to keep to comply with applicable law we may not be able to fulfill some or all of your request. We may also decline to grant your request where our use of your personal information serves a legitimate purpose such as for security purposes.  Your request may also be denied if it compromises the privacy of others, is overly repetitive or extremely burdensome to fulfill.

We will respond to valid requests to know, requests to correct and/or requests to delete no later than 45 calendar days.  If we cannot verify your request within 45 days, we may deny your request.  If necessary, we may take up to an additional 45 days to respond to your request but in such an event will provide you a notice and an explanation of the reason that we will take more than 45 days to respond to your request.

Valid under “Right of Access” and “Right to Data Portability” will be transmitted securely. If we cannot fulfill your request, we will notify you of that decision and the reasons why within 45 days. At that point if you believe our decision was in error, you may have the right to submit an appeal using the method(s) above.  If the result is the same, you can also seek assistance and/or redress from your state attorney general.

Nevada Residents

Nevada law provides that Nevada residents may opt-out of the “sale” of “covered information” to third parties, including but not limited to name, address, social security number, and online service activity. Our uses of your Personal Information are not sales under Nevada law, so no opt-out right applies.

Crowe Data Privacy Framework Notice

Crowe LLP complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.  Crowe LLP has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF.  Crowe LLP has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF.  If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern.  To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

Residents of India

If you are a resident of India, the following India-specific provisions apply to our collection, processing and use of your personal information in lieu of or in addition to the relevant sections of the above Privacy Policy.

1. If you are a resident of India, Crowe LLP or Crowe Horwath IT Services LLP, will determine the purpose and means of processing your personal information. References to “Crowe” or “us” or “our” in the Privacy Policy should be construed as references to Crowe LLP and Crowe Horwath IT Services LLP, as appropriate.
2. Where Crowe LLP determines the purpose and means of processing your personal data, Crowe Horwath IT Services LLP will process your personal data on their behalf. 
3. The categories of personal data and the purposes for which it may be processed by Crowe LLP or Crowe Horwath IT Services LLP, is as under:
   • Employment Information
   • Contact Information
   • Education Information
   • Data related to our mandatory reporting requirements
   • Other applicant information
4. Where consent is required to process your personal information, and if you withdraw your consent or if you do not consent to the processing of your personal data, we may not be able to deliver the expected service.
5. Where processing of your personal information is not based on consent, our processing is based on certain legitimate uses as permitted under law and in compliance with the applicable law.
6. Should you find our resolution to your grievance or concerns unsatisfactory, you may have a right to complain to the Data Protection Board of India.

How to Contact Us

If you have any questions or concerns about our privacy policies and practices, please feel free to contact us by emailing us at [email protected] or calling us at 1-800-599-6046.