Privacy Policy
Last Revised: 9/25/2026
EU–U.S. Data Privacy Framework Certified | UK Extension Certified | Swiss–U.S. DPF Certified This policy incorporates SC&H’s Data Privacy Framework certification. Verify at dataprivacyframework.gov.
>>>
SC&H Group, Inc. and its affiliates (collectively, “SC&H,” “we,” “our,” or “us”) are committed to protecting your privacy and handling your personal information with transparency and care. This Privacy Policy describes how we collect, use, share, and protect information obtained through our website at www.schgroup.com and any associated subdomains or microsites (collectively, the “Site”). This Policy also incorporates SC&H’s EU–U.S., UK, and Swiss Data Privacy Framework commitments, previously published separately.
By using the Site, you agree to the terms of this Privacy Policy. If you do not agree, please discontinue use of the Site. SC&H reserves the right to update this Policy at any time. Changes will be posted to this page with an updated effective date. Continued use of the Site following any revision constitutes your acceptance of the revised Policy.
This Policy does not govern information collected through third-party websites linked from our Site. We strongly recommend that you review the privacy policies of any third-party sites you visit. SC&H has no responsibility or liability in connection with any third-party websites.
1. Information We Collect
We limit our collection of personal data to information that is reasonably necessary and proportionate to provide or maintain the products and services you request. Subject to this limitation, we collect information in the following ways:
A. Information You Provide Directly
When you interact with the Site, you may voluntarily provide personal information, including:
- Contact form submissions — name, email address, phone number, company name, and message content
- Event and webinar registrations — name, email address, organization, and job title for in-person and virtual/online events
- Newsletter and Insights subscriptions — name and email address
- Careers and internship applications — resume/CV, work history, contact information, and other application materials
- Client portal access — credentials submitted via our Citrix ShareFile portal or other client login systems
- Survey and assessment responses — information submitted through any survey, assessment, or marketing communication on the Site
SC&H may also collect personal information regarding current, former, and prospective clients and their personnel in connection with rendering services, managing client relationships, and business development activities, as further described in Section 8 (Client Services).
B. Information Collected Automatically
When you visit the Site, we and our service providers automatically collect technical and usage data, including:
- IP address and approximate geographic location
- Browser type, version, and operating system
- Pages viewed, links clicked, and time spent on pages
- Referring URLs and exit pages
- Device identifiers and session data
This data is collected through cookies, web beacons, pixels, and similar tracking technologies. See Section 5 for details.
C. Information from Third Parties
We may receive information about you from third-party sources such as marketing partners, analytics providers, and professional networking platforms, which we may combine with information we have already collected.
2. How We Use Your Information
We use the information we collect for the following purposes:
- To respond to inquiries, contact form submissions, and service requests
- To process event and webinar registrations and deliver related communications
- To send newsletters, thought leadership content, and marketing communications you have opted into
- To evaluate employment and internship applications
- To provide access to our client portal (Citrix ShareFile) and related secure services
- To render professional services to clients and manage client relationships
- To improve the Site’s content, functionality, and user experience
- To conduct analytics and understand how visitors engage with the Site
- To serve interest-based advertising through third-party vendors based on prior Site visits
- To prevent fraud, abuse, and security threats
- To comply with applicable legal and regulatory obligations
- To communicate updates to our services, policies, or the Site
We may use your personal data to understand how you interact with our websites and services, including through analytics tools that help us measure usage, improve functionality, and evaluate the effectiveness of our content and advertising. We may also process personal data for targeted advertising, including by sharing certain personal data with third parties that use the information to provide advertisements based on your activity over time and across unaffiliated websites or applications. SC&H currently conducts targeted advertising through Meta (Facebook and Instagram), LinkedIn, and Google Ads, with Pioneer Web Marketing as our advertising vendor. You may opt out of the processing of personal data for targeted advertising by contacting us using the information in Section 16.
3. How We Share Your Information
SC&H does not sell your personal information to third parties. We may share your information in the following limited circumstances:
- Service Providers: We engage trusted vendors who assist us in operating the Site, delivering communications, processing registrations, and providing analytics (e.g., web analytics providers, email platforms, event management tools, advertising partners, IT hosting services). Depending on the services provided, the categories of personal information shared with these vendors may include identifiers and contact information, internet or other electronic network activity, event registration information, communications preferences, and other information necessary to perform services on our behalf. These vendors are contractually obligated to use your information only as directed by SC&H and to provide at least the same level of data protection required under applicable law, including the DPF Principles described in Section 9. SC&H remains responsible for personal information transferred to third-party service providers and may be liable if a provider fails to meet these obligations, unless SC&H was not responsible for the event giving rise to the damage.
- Professional Services: Information shared in connection with SC&H engagements (accounting, tax, advisory, audit, technology, risk, investment banking, or wealth services) is subject to separate engagement terms and applicable professional standards. The categories of personal information shared in connection with these engagements may include identifiers and contact information, professional or employment-related information, financial information, transaction information, and other information relevant to the applicable engagement.
- Legal and Regulatory: We may disclose information when required by law, subpoena, regulatory inquiry, or to protect the rights, property, or safety of SC&H, our employees, clients, or the public. Depending on the circumstances, the categories of personal information disclosed may include identifiers and contact information, financial or transaction information, professional information, communications, and other information relevant to the applicable legal or regulatory matter.
- Business Transfers: In the event of a merger, acquisition, reorganization, or sale of all or substantially all of SC&H’s assets, your personal information may be transferred to the successor entity. The categories of personal information transferred may include identifiers and contact information, commercial or professional information, account or engagement-related information, and other information maintained by SC&H in connection with its business operations.
- With Your Consent: We may share your information for other purposes with your explicit consent.
4. Data Retention
We retain personal information for as long as necessary to fulfill the purposes described in this Policy, comply with legal and regulatory obligations, resolve disputes, and enforce our agreements. When information is no longer needed, we take reasonable steps to securely delete or de-identify it.
5. Cookies and Tracking Technologies
The Site uses cookies and similar tracking technologies to enhance your experience and gather analytics and advertising data. A cookie consent banner is displayed when you first visit the Site.
- Strictly Necessary Cookies: Required for the Site to function, including storing your cookie preferences. These cannot be disabled without affecting Site functionality.
- Analytics Cookies: Help us understand how visitors use the Site (pages visited, traffic sources, time on site). Third-party web analytics providers may store this data on servers in the United States.
- Advertising / Remarketing Cookies: SC&H works with third-party vendors to serve interest-based ads based on your prior visits to our Site, tracked across devices. To opt out of interest-based advertising, visit optout.networkadvertising.org.
You may refuse cookies through your browser settings or the Site’s cookie consent tool; however, doing so may limit certain Site functionality.
6. Data Security and Information Security Management
SC&H implements appropriate technical and organizational safeguards to protect your personal information from unauthorized access, disclosure, alteration, or destruction, including encryption, access controls, secure hosting environments, and regular security assessments.
No transmission over the internet is completely secure. While we use reasonable efforts to protect your data, we cannot guarantee absolute security and shall not be liable for any disclosure, unauthorized use, or damage resulting from circumstances beyond our reasonable control.
SC&H’s Information Security Management System (ISMS) Policy is publicly available at schgroup.com.
7. Third-Party Websites and Services
The Site may contain links to third-party websites, including our client portal (Citrix ShareFile), event platforms, and social media pages. This Policy does not apply to those third-party sites. SC&H has no responsibility or liability for the privacy practices of any linked third-party sites.
8. Client Services
Our Site provides access to a secure client file-sharing portal (Citrix ShareFile) via the Client Login page. Access to and use of the portal is governed by your engagement agreement with SC&H and applicable professional standards.
Financial, tax, investment, and other engagement-specific information is generally not collected through the public-facing portions of the Site. Instead, such information may be collected separately in connection with the professional services SC&H provides to you or your organization, including through secure client portals, engagement-specific communications, or other systems used in connection with those services.
Personal information you provide to SC&H in connection with a professional services engagement — including information about third parties such as colleagues or family members — may be collected, stored, used, and transferred as necessary for SC&H to carry out or seek business with you or your organization. Providing such third-party information constitutes confirmation that you have authority to do so.
Pursuant to IRS regulations under Internal Revenue Code Section 7216, except where permitted by law, SC&H is prohibited from using information obtained in connection with the preparation of your tax returns for any purpose other than preparing those returns without your consent.
9. EU–U.S., UK & Swiss Data Privacy Framework
Data Privacy Framework Policy | Last Revised: January 13, 2026
SC&H Group, Inc. complies with the EU–U.S. Data Privacy Framework (DPF), the UK Extension to the EU–U.S. DPF, and the Swiss–U.S. Data Privacy Framework as set forth by the U.S. Department of Commerce. SC&H has certified to the U.S. Department of Commerce that it adheres to the DPF Principles with regard to the processing of personal data received from the European Union and its Member States, the European Economic Area, the United Kingdom (and Gibraltar), and Switzerland. If there is any conflict between the terms of this Privacy Policy and the DPF Principles, the DPF Principles shall govern. To learn more about the DPF program and view our certification, please visit dataprivacyframework.gov.
Covered entities: The following SC&H affiliated entities are covered under SC&H’s DPF certification:
- Stout, Causey Consulting, Chartered
- SC&H Capital Corporation
- SC&H Financial Advisors, Inc.
- SC&H Attest Services, P.C.
FTC Enforcement: SC&H is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC).
Scope: This DPF Policy applies to personal information regarding current, former, and prospective clients and their personnel for the purposes of rendering SC&H’s services, managing the client relationship, and business development activities, as well as personal information collected to address inquiries or provide requested information.
Choice / Opt-Out: You have the right to choose (opt out) whether your personal data is (i) disclosed to a third party or (ii) used for a purpose materially different from the purpose for which it was originally collected or subsequently authorized. To opt out, please contact SC&H at dataprivacy@schgroup.com.
DPF Dispute Resolution: SC&H commits to resolve DPF-related complaints from EU, UK, and Swiss individuals within 45 days of receipt. Please direct inquiries and complaints to dataprivacy@schgroup.com. If we are unable to satisfactorily resolve your concern, you may escalate to:
- EU DPAs: Contact information
- UK ICO: Contact information
- Swiss FDPIC: Contact information
Binding Arbitration: In certain situations, you may invoke binding arbitration for complaints regarding DPF compliance not resolved through other DPF mechanisms. Refer to Annex I of the DPF for applicable conditions.
10. Careers and Internship Applications
If you apply for a position or internship through the Site or a linked applicant tracking system, the personal information you submit (including your resume, contact details, and work history) will be used solely for recruiting and hiring purposes. Information from unsuccessful applications may be retained for a reasonable period in case future opportunities arise, unless you request its deletion.
11. Sensitive Personal Information
SC&H does not collect, process, or transfer sensitive personal data through the Site unless you expressly consent. “Sensitive personal data” includes data revealing racial or ethnic origin, religious beliefs, health information or health diagnoses, sex life, sexual orientation, national origin, citizenship or immigration status, genetic or biometric data, precise geolocation data, and personal data of a child. Where required by applicable law, we will obtain your consent before collecting or processing sensitive personal data.
12. Children’s Privacy
The Site is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a minor, please contact us using the information in Section 16 and we will promptly delete it.
13. U.S. State Privacy Rights
Depending on your state of residence, and subject to applicable law, you may have certain rights with respect to your personal data, including:
- The right to know what personal information we collect, use, disclose, or sell
- The right to request deletion of your personal information (subject to certain exceptions)
- The right to correct inaccurate personal information
- The right to obtain a copy of certain personal information in a portable and, where technically feasible, readily usable format
- The right to opt out of the sale or sharing of personal information, targeted advertising, or certain profiling, where applicable, and to exercise applicable opt-out rights through a legally recognized universal opt-out mechanism, such as Global Privacy Control (“GPC”), where required by applicable law
- The right to non-discrimination for exercising your privacy rights
To submit a request, contact us using the information in Section 16. We will respond within the timeframe required by applicable law and may ask you to verify your identity.
If we decline to take action on your request, you may have the right to appeal our decision. To submit an appeal, please contact us using the information provided in Section 16 and indicate that you are appealing a decision regarding a privacy rights request. We will review and respond to your appeal within the time required by applicable law. If we deny your appeal, we will provide information regarding any additional rights or remedies available to you, including, where required by applicable law, how to submit a complaint to the appropriate state attorney general or other regulatory authority.
If you are a California resident, please see our California Privacy Notice [link to be added upon publication] for additional information about your rights under California law and how to exercise those rights.
14. European Privacy Rights (GDPR)
If you are located in the EEA or United Kingdom, you may have rights under the GDPR or applicable UK equivalent, including the rights of access, rectification, erasure, restriction, data portability, and to withdraw consent. Our lawful bases for processing include consent, performance of a contract, legal obligation, and legitimate interests. To exercise any of these rights, contact us at Section 16.
15. International Data Transfers
SC&H is headquartered in the United States. Information you submit may be transferred to, stored, and processed in the United States and other countries where our service providers operate. Data protection laws in these countries may differ from those in your home country. For cross-border transfers involving individuals in the EEA or United Kingdom, SC&H applies appropriate safeguards consistent with applicable data protection law, including Standard Contractual Clauses where required, and participates in the EU–U.S., UK, and Swiss Data Privacy Frameworks as described in Section 9.
16. Your Rights and Contact Information
You may request access to, correction, update, or deletion of your personal information at any time. To unsubscribe from marketing communications, contact:
SC&H Group, Inc. Attn: Privacy Inquiries 226 Schilling Circle, Suite 300 Hunt Valley, MD 21031
- Privacy & DPF inquiries: dataprivacy@schgroup.com
- Marketing unsubscribe: marketing@schgroup.com
- Web: www.schgroup.com/contact
17. Legal Notices and Disclaimers
Each legal entity owned by SC&H Group, Inc. is a separate and independent legal entity. SC&H Group, Inc. is not responsible or liable for any acts or omissions of other members of its group of affiliated companies.
This website and its contents — including all text, HTML code, scripts, graphics, images, site design, and “look and feel” — are the property of SC&H and are protected under U.S. and foreign copyright and trademark laws. This website and its materials may not be modified, copied, distributed, republished, downloaded, uploaded, or commercially exploited without the prior written consent of SC&H.
SC&H DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, WITH RESPECT TO THIS WEBSITE. TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, SC&H SHALL NOT BE LIABLE FOR ANY DAMAGES OF ANY KIND ARISING OUT OF OR IN CONNECTION WITH YOUR USE OF THIS WEBSITE.
SC&H maintains this Site in Maryland. You agree that these terms and any legal action relating to this Site shall be governed by the laws of the State of Maryland, and that all disputes shall be litigated before the United States District Court for Maryland or, where federal jurisdiction is lacking, before a court in Maryland.
18. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be posted to this page with a revised effective date. Your continued use of the Site after any changes constitutes your acceptance of the updated Policy.
Information Security
SC&H is committed to safeguarding sensitive data through strong security practices. For more details, view our Information Security Management System (ISMS) policy below.
