Privacy Policy

Effective Date October 31, 2025

ABOUT THIS POLICY

This policy provides notice of our information collection and use practices by RKL LLP, and its affiliates (together, “RKL,” “us,” or “we”). It applies to information that we collect from you when you interact with us. This applies to generally to online information collection during your use of any websites or subdomains operated by us, including www.rklcpa.com, and the various portals contained on the websites (collectively, the “Websites”). Your use of the Websites indicates you agree to our collection, use, sharing, and disclosure of your information as described in this policy (“Privacy Policy”).  Except as described below, this policy does not apply to information collected offline or through any other means and does not include the use of your information by any third party that does not link to this policy.

COULD RKL LLP HAVE YOUR INFORMATION?

RKL LLP connects with individuals for many different reasons. Those interactions may result in us directly or indirectly gaining access to information about you. By identifying the category or categories of your relationship with RKL LLP, set out below, you will be able to easily understand what categories of information we may collect about you, our purpose for collecting your information, and whether we share your information with others.

Employment

• As a contractor, intern, applicant, or prospective applicant for employment at RKL LLP, using our employment application portal, powered by third-party provider(s) (currently, including Workday). You are encouraged to review the privacy policies and other terms of use that may apply to these other third-party providers’ use and sharing of your information.

Our Clients

• As an individual client of RKL LLP, using our client portals, powered by a third-party provider(s) (currently, including NetClient, for document management; and FIS Global, for payment management). You are encouraged to review the privacy policies and other terms of use that may apply to these other third-party providers’ use and sharing of your information.

RKL LLP Alliance

• As a result of an interaction, you had with an RKL LLP Alliance using our Websites.

General Public Interactions

• As a visitor to the Websites.

CATEGORIES OF INFORMATION WE COLLECT

Depending on your relationship with RKL LLP we may collect specific categories of information about you. Below is a description of categories of information that we may collect, with each followed by a list of the relationship group(s) (i.e., the groups noted above) with respect to which we may collect that category of information.

Please check our site periodically for updates.

BUSINESS PURPOSES FOR INFORMATION USE

Keeping in mind your relationship with RKL LLP and the categories of information we collect based on that relationship.

We may use your categories of information for Business Development, Marketing and Event Management. This business purpose includes activities like and similar to:

• lead generation
• marketing campaigns by mail or email or through our website
• hosting internal conferences and training for clients and employees
• hosting and sponsoring external events for our employees, clients, and the general public

We may use your categories of information to Provide Our Clients with Services. This business purpose includes activities like and similar to:

• client services & invoicing
• user registration & access rights monitoring
• tax preparation & filings
• outsourced business services

We may use your categories of information so we can Manage our Client Relationship with You. This business purpose includes activities like and similar to:

• event management & registration
• client on-/off-boarding & communication outreach
• credit review and background screening
• contract engagement, engagement letters, and other contractual obligations

We may use your categories of information to Comply with RKL LLP’s Legal, Professional and Regulatory Obligations. This business purpose includes activities like and similar to:

• data subject access request processing
• background screenings
• data loss prevention and security monitoring
• professional certifications and ethical compliance
• payroll processing, reporting, and administration
• personnel and incident investigations & litigation matters
• regulatory & government compliance matters
• government requests and subpoena responses
• corporate insurance management

We may use your categories of information to ensure we are Fulfilling Our Obligations to Our Employees as their Employer. This business purpose includes activities like and similar to:

• credit review and background screening
• services for alumni partners and principals
• employee insurance, benefits, and leaves of absence
• personnel compensation, travel, and expense reporting & reimbursement
• employee management, lifecycle & records

We may use your categories of information ensure the Physical and Electronic Security of RKL. This business purpose includes activities like and similar to:

• mobile device management system
• network monitoring & online intrusion detection
• physical, technical, and administrative security reviews
• digital user registration & access monitoring

We may use your categories of information as part of our process for Manage our Service Providers and 3rd Party Vendors. This business purpose includes activities like and similar to:

• order processing
• vendor payment reconciliation
• accounts receivable & payable processing
• vendor assessments & security evaluations
• vendor agreement negotiations, executions, and implementations

We may use your categories of information to Perform our Internal Business Operations. This business purpose includes activities like and similar to:

• real estate management & development
• strategic enhancements & new service development
• building, office and day to day business operations
• systems implementation & support services
• insurance, tax, and payroll preparation & filing

Please note, we use all categories as otherwise permitted by law or as we may notify you. If your consent is required by law, we will obtain your consent prior to the use and/or collection of your information.

OUR SOURCES OF INFORMATION & HOW WE COLLECT INFORMATION

We collect categories of information in a few different ways.

You or Your Legal Representative / Authorized Agent is our main source when collecting your information in all of the categories above.  We collect your information through a variety of different methods:

• emails
• employment applications
• electronic files (e.g. pdfs, word docs, ppt.)
• scholarship applications
• charitable contributions
• event registration forms
• web forms, including data subject access requests

Our Clients are another source for collecting your information in all of the categories above. We collect your information through several different methods:

• emails
• workspace collaboration sites
• electronic files (e.g. pdfs, Word docs, ppt.)
• integrations, API’s, file transfer sites.
• database and data warehouse access
• event registration forms

Our Website Cookies and your interaction with our website is an additional source for collecting your information for four of the categories above: Personal Identifiers and Demographic Information, Internet or Network Activities, Location Data, and Inference Data. We automatically collect your information through a few different methods:

• pixels
• tags
• tracking cookies
• marketing cookies
• analytic cookies
• log information

We automatically collect this sort of usage information about you when you access or use the website. This sort of usage information may include IP address, device identifier, browser type, operating system, information about your use of the website, and data regarding network-connected hardware (e.g., computer or mobile device). The methods that may be used on the website to collect usage information include log information and information collected by cookies and other tracking technologies. Log information is data about your use of the website, such as IP address, browser type, internet service provider, referring/exit pages, operating system, date/time stamps, and related data, and may be stored in log files.

Our Cookie Policy will provide you with more information about cookies and how we use them to enhance your experience and better serve you.

Our Business Partnerships, Service Providers & 3rd Party Vendors are another source for collecting your information in all of the categories above. We collect your information through several different methods:

• email
• event sponsorship forms & rosters
• contracts, including service agreements and statements of work
• web forms
• user account portals
• electronic files (e.g. pdfs, word docs, ppt.)
• integrations, API’s, file transfer sites

Educational Institutes, Professional & Government Licensing Groups and your interaction with these groups is an additional source for collecting your information for six of the categories above: Personal Identifiers and Demographic Information, Biometric Bodily Information, Location Data, Employment Information, Educational Information, and Inference Data. We collect your information through a few different methods:

• email
• user account portals
• web forms
• electronic files (e.g. pdfs, Word docs, ppt.)

Publically Available Sources another source for collecting your information for six of the categories above: Personal Identifiers and Demographic Information, Client Relationship Information, Biometric Bodily Information, Location Data, Employment Information, Educational Information and Inference Data. We collect your information through a few different methods:

• social media
• websites (such as professional networking sites & online searches)
• online professional forums
• magazine, newspaper, blogs, and other reporting media
• white papers and other peer review publications

WE COMBINE INFORMATION

We combine information we collect from you on the website with information we receive from you in person, by email, or by other forms of communication. We also combine information you provide with information we obtain from third parties, service providers, and our affiliates.

WHEN WE SHARE INFORMATION WITH OTHERS

Except as otherwise stated in this policy, we do not sell, trade, rent, or otherwise share for marketing purposes the personal information that we collect through the website with third parties. On an as needed and case by case basis, we may share all categories of information above with third parties, service providers, and others as described here:

We share information with our affiliates.

This includes current and future affiliates and other related entities (including, but not limited to, RKL Virtual Management Solutions and RKL Wealth Management LLC). We will share this information for our business purposes, business and service development and enhancement strategies, and to otherwise engage in the activities described in this Privacy Policy.

We share information with vendors and service providers. We share personal information with vendors who provide services to us. Refer to the above section, Categories of Information We Collect, to see the types of information that may be relevant to you.

Our Service Providers are categorized in at least one of the following categories based on the services they provide RKL LLP:

• Business & Finance Operational Services (such as travel reimbursement, payroll processing, recruitment, AR/AP processing, or other similar services)
• Legal, Compliance and Advisory Services (such as attorneys, financial advisors, external consultants, or other similar services)
• Education & Professional Development Services (such as training, professional licensing, continuing professional education or other similar services)
• Telecommunication & Mobile Services (such as telephone systems and inter office messaging services)
• Network, Datacenters & Infrastructure Services (such as internet, intranet, email, software and system architecture)
• Marketing, Events & Communication Services (such as hosted events, hotel & catering services, sporting events, newsletters, email marketing and other similar services)

We share information with government and regulatory authorities. We share information with government and regulatory authorities in the course of providing services to you, such as preparation of tax returns.

We share information if we must in order to comply with law or to protect our legal interests. We may share information we collect about you to respond to a court order or subpoena. We may share information in response to a government agency or investigatory body request. This may include sharing information with the US or Canadian government. We may share information if necessary to prevent physical harm or financial loss. We may share information we collect when we are investigating potential fraud or other illegal activity or to protect the rights, property, life, health, security, or safety of our firm and its employees, our Website or its users, or any third party.

We share information with any successor to all or part of our business. If all or part of our business is sold, we will share information as a part of that transaction.  If there is a merger or acquisition, we will also share your information. We will also share information as part of a financing or bankruptcy.

We share information as permitted by law and for other reasons we may describe to you.

YOU HAVE CERTAIN CHOICES

We provide you with the following options about how we use information:

EVERYONE

You can opt out of receiving our emails. You can change your mind if you signed up to receive email newsletters, alerts or other marketing emails and communications. To unsubscribe, click the link located at the bottom of our marketing emails.  If you opt out of receiving marketing messages, you will still get non-marketing messages. If you object to our use of your information for direct marketing purposes, please email us at RKLDataPrivacy@rklcpa.com. Please note that even if you opt out of receiving marketing communications from us, we may continue to send you nonpromotional communications.

You can control cookies and tracking tools. Click here to learn more about how we use cookies and other tracking tools.

CALIFORNIA RESIDENTS

As of January 1, 2020, the California Consumer Privacy Act gives you or your Proxy the right to make certain requests of RKL LLP regarding information that we collect about you. We will not discriminate against you because you have exercised any of your rights under the California Consumer Privacy Act.

Your Rights under the California Consumer Privacy Act

• Request what categories of information we collect (which may also be referenced above in Categories of Information We Collect)
• Request that a copy of your information be provided to you
• Request that your information be deleted
• Request what categories of Service Providers and 3rd Parties we share your information with

RKL LLP’s Verification Process

Before we can begin to process your request, we must first verify your identity. We will use the following points of information for our verification process.

• A unique ID assigned to you by RKL LLP (e.g. Client ID, Vendor ID)
• RKL LLP Line of Business(es) you are associated with
• Email Address
• Full Name
• Phone Number
• Mailing Address
• Employer, Service Provider, 3rd Party Vendor or Organization’s Name you are associated with

Request made for categories of information about you require that we verify your identity using at least two of the points of information listed above.

Requests made for specific information require that we use at least three points of information listed above. Additionally, you will be required to provide a document signed under penalty of perjury affirming that you are the consumer who you are making the information request about.

For requests made for the deletion of information RKL LLP will require two or three of the points of information above, depending on the sensitivity of the information requested to be deleted.

Proxy Requests. Requests made by a proxy will follow the same Verification Process as above. Additionally, a proxy is required to provide to RKL LLP a notarized attestation that they are the California resident’s authorized legal representative.

How To Make A Request. You or your Proxy may make a request by submitting your request to us by phone at 1-800-274-3978. An RKL LLP customer service representative will collect the necessary information from you and provide you with details about how you can provide RKL LLP with any additional documentation that may be necessary.

Sales of Information of California Resident. We do not sell California residents’ personal information, including personal information of minors under the age of 16.

NEVADA RESIDENTS

Sale of information of Nevada Residents. Nevada provides its residents with a limited right to opt-out of certain personal information sales. However, we do not exchange Nevada residents’ personal information for money with anyone so they may license or sell the personal information to additional parties. We do not sell personal information of minors under the age of 16.

OTHER STATE RESIDENTS

In addition to California, as of the date of this Privacy Policy, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia provide (now or in the future) their state residents with certain other rights, including rights to:

• Confirm whether we process their personal information.
• Access and delete certain personal information.
• Correct inaccuracies in their personal information, taking into account the information’s nature processing purpose (excluding Iowa and Utah).
• Data portability.
• Opt-out of personal data processing for:
  • targeted advertising (excluding Iowa);
  • sales; or
  • profiling in furtherance of decisions that produce legal or similarly significant effects (excluding Iowa and Utah).
• Either limit (opt-out of) or require consent to process sensitive personal data.

The exact scope of these rights may vary by state. To exercise any of these rights please email us at RKLDataPrivacy@rklcpa.com or submit your request to us by phone at 1-800-274-3978.

EUROPEAN UNION RESIDENTS

If you reside in the European Union, you may have certain additional rights. EU residents may be able to ask us to restrict how we process information, such as if you believe it is inaccurate, or if you believe that the processing is unlawful, but you do not want us to delete the information. It may also apply if we no longer need your information for the purposes described to you, but you do not want us to delete it because you need to establish, exercise, or defend a legal claim. It also may apply if you object to profiling or direct marketing. You may also have the right to data portability. To exercise any of these rights please email us at RKLDataPrivacy@rklcpa.com or submit your request to us by phone at 1-800-274-3978.

Our basis for processing information subject to General Data Protection Regulation (GDPR) is typically to perform a contract. Performance of a contract includes responding to your requests. We also process information based on compliance with our legal obligations. From time to time our basis for processing is also consent or legitimate interest.

CANADA RESIDENTS

If you reside in Canada, you have certain additional rights. Canadian residents may be able to request access and correction of personal data. Requests may be submitted to RKLDataPrivacy@rklcpa.com.

WE USE REASONABLE SECURITY MEASURES

We use standard and reasonable security measures. The Internet is not 100% secure. We cannot promise that your use of our sites or apps will be completely safe. We encourage you to use caution when using the Internet. Unfortunately, the transmission of information via the Internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of your personal information transmitted to us on our websites. Any transmission of personal information is at your own risk. Where we have given you (or where you have chosen) a password for access to certain parts of our websites, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

We keep personal information as long as it is legally required, necessary or relevant for the practices described in this Privacy Policy, including the purpose for which we originally collected your information.

WHERE WE STORE INFORMATION

You understand and agree that we may transfer, process and store your information to the US, Canada, India, the United Kingdom, or other countries. Our affiliates or other third-party service providers may also transfer, process, or store your information in the US or other countries. Our sites and businesses are subject to US laws, which may not afford the same level of protection as those in your country.

THIRD PARTY LINKS AND TOOLS; SOCIAL FEATURES

We may link to other sites or apps or have third party services on our platforms that we do not control. If you click on a third-party link, you will be taken to a platform we do not control. While some of these third parties will share information with us, including the information that you provide using our portals, this policy does not apply to the privacy practices of that website or platform. Read other companies’ privacy policies carefully. We are not responsible for these third parties. Our site may also serve third party content that contains their own cookies or tracking technologies. We do not control the use of those technologies.

Furthermore, certain functionalities on the website permit interactions that you initiate between the Website and third-party services, such as social media networks. These social media features enable you to send content between the website and a third-party service. If you use our social media features, and potentially other third-party services, information you post or provide access to may be publicly displayed or used by the third-party service you use. Also, both us and the third party may have access to certain information about you and your use of the website and the third-party service.

INFORMATION COLLECTION FROM CHILDREN

Our sites and apps are meant for adults. We do not knowingly collect personally identifiable information from children under 13 without permission from a parent or guardian. If you are a parent or legal guardian and think your child has given us information, you can email or write to us. Use the address information in the contact us section below. Parents, you can learn more about how to protect children’s privacy on-line here.

YOU CAN CONTACT US

If you have any questions about this Policy or our data practices, you can write to us at:

Attn: Data Privacy Office

1800 Fruitville Pike
Lancaster, PA 17601

You can email us at RKLDataPrivacy@rklcpa.com.

WE MAY UPDATE THIS POLICY

From time to time, we may change our privacy policies. We will notify you of any material changes to our Policy as required by law. We will also post an updated copy on our website. Please check our site periodically for updates. The date the policy was last revised is identified at the top of the page. You are responsible for ensuring we have an up-to-date, active, and deliverable email address for you, and for periodically visiting our website and this policy to check for any changes.