FTI Consulting, Inc. Privacy Practices

Privacy Policy

Effective Date: January 7, 2021 -- Last Revised: October 23, 2023.

This policy applies to FTI Consulting, Inc. and its affiliated companies (collectively “FTI Consulting”).

FTI Consulting understands that your privacy is important to you and is committed to safeguarding the confidentiality and privacy of personal information entrusted to it.

This Privacy Policy describes how FTI Consulting handles and protects your personal information in connection with the hosting of this website, and the provision of its diverse business advisory services in the fields of corporate finance and restructuring, economic and financial consulting, forensic and litigation consulting, health solutions, strategic communications and technology ("Services"), as explained in more detail here: http://www.fticonsulting.com/services.

Assistance for the disabled

Alternative formats of this Privacy Policy are available to individuals with a disability. Please contact privacy@fticonsulting.com for assistance.

Notice at Collection

FTI Consulting collects the personal information described below for the purposes and for the period described below. We do not sell your personal information or disclose it for cross-context behavioral advertising (“sharing”). We also do not collect or process sensitive personal information for the purpose of inferring characteristics about you. To the extent you provide FTI Consulting with personal information about others, you are responsible for providing this notice to them.

These Privacy Practices covers the following topics:

• Scope of this policy
• Quick read
• Who is your controller?
• When do we collect personal information?
• What types of personal information are collected and what do we use them for?
• What is our legal basis for collecting personal information?
• Disclosure of personal information to third parties
• International hosting and transfer of information
• Information security
• Retention of your personal information
• Your rights in jurisdictions covered by the GDPR and similar laws
• Important additional information for California residents
• Marketing
• Children
• Links
• Changes to this policy
• Contact us

Scope of this policy

This policy applies to personal information which is collected and/or used by FTI Consulting in its capacity as a controller as that term (or another term with equivalent meaning) is defined in the EU General Data Protection Regulation (GDPR) and other similar laws (e.g., Brazil’s Lei Geral de Proteção de Dados, the DIFC Data Protection Law 2020, etc.). California residents should also review the section of this policy addressing their rights. The contexts in which this might occur are explored under "When do we collect personal information" below.

When we provide Services to clients, we sometimes handle personal information as a processor (for example, the hosting of client data on our e-discovery platforms). This means that we process the information solely on the instructions of our clients, who retain control of the information.

Therefore, if our use of your personal information is not covered by this policy, you may need to contact the client (and controller) on whose behalf the processing of your information is carried out.

For purposes of these Privacy Practices, “Personal information” means information that is related to an identified or identifiable individual or is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or with a household.

Your Acceptance

In respect of personal information collected over this and other FTI Consulting websites, your continued use of these websites constitutes your understanding of, and agreement to, the practices described in this Privacy Policy and elsewhere on the websites as well as any subsequent updates. Please see the additional information under the heading [Legal] for more information about our on-line terms of use and policies in general.

When do we collect personal information?

We collect information about you if:

• you use this (or any other FTI Consulting) website;
• you enquire about, or engage FTI Consulting to provide, its Services (either in a personal capacity, or as a representative for your employer or client);
• the use of your personal information is reasonably necessary to provide our Services (in these circumstances, your personal information may be disclosed to us by our client who may, for example, be your employer or service provider, or we may obtain your personal information from a range of public or subscription sources, directly from you, or from your associates or persons known to you);
• you apply for a position with FTI Consulting;
• you attend an FTI Consulting hosted or sponsored event or webinar;
• you visit a FTI Consulting exhibit booth at a conference or industry event;
• you invest in FTI Consulting stock (please see our investor site for more information); or
• you contact us with any other enquiry, complaint or notice.
• we acquire a company or employer, or assets of a company or employer that has your information

Performing Services for Our Clients

As discussed above, many of our Services involve the processing of personal information. In the majority of cases, personal information is provided to us in strict confidence, subject to restrictive undertakings on its use / disclosure.

Illustrative examples of the use of personal information in connection with our Services, and the legal bases we rely upon for using personal information, are set out in Annex 1 (Use of Personal Information for our Services).

Other Uses

If you apply for a position with FTI Consulting, we will need to collect personal information in order to consider your application, and during any interview and assessment phase.

If you enquire about, or decide to purchase stock in FTI Consulting, then we will collect (either from you or from your broker / investment manager) basic personal information required to register you as a stockholder.

If we hire you as a vendor, supplier or contractor, we will need to collect personal information in order to complete transactions and, where applicable, complete appropriate screening activities.

Finally, if you contact us for any other reason, we will collect basic contact details, as well as any other personal information relevant to the reason for your enquiry, in order to resolve that enquiry.

What is our legal basis for collecting personal information?

Certain laws, including the GDPR, require us to establish a ‘lawful basis’ for our processing of your personal information. In the majority of cases, processing will be justified on the basis that:

• the processing is necessary for the performance of a contract to which you are a party, or to take steps (at your request) to enter into a contract (e.g. where you request certain Services as an individual client, or where we help advise your employer or service provider on fulfilling an obligation to you under a contract);
• the processing is necessary for us to comply with a relevant legal obligation (e.g. where we are required to collect certain information about our clients for tax or accounting purposes, or where we are required to make disclosures to courts or regulators); or
• the processing is necessary for the performance of a task carried out in the public interest (e.g. background checks for anti-money laundering and terrorist financing purposes); or
• the processing is in our legitimate interests, subject to due consideration for your interests and fundamental rights (this is the basis we rely upon for the majority of the processing of personal information in connection with the provision of our Services, and also for the purposes of most client on-boarding, administration and relationship management activities).

In limited circumstances, we will use your consent as the basis for processing your personal information, for example, where we are required by applicable law to obtain your prior consent in order to send you marketing communications.

Before collecting and/or using any special categories of data (as that term is defined in the GDPR, or as an equivalent term is defined by other privacy laws), or criminal record data, we will establish a lawful exemption which will allow us to use that information. This exemption will typically be:

• your explicit consent;
• the establishment, exercise or defense by us or third parties of legal claims; or
• other uses allowed by applicable law including context specific exemptions provided for under local laws of EU Member States and other countries implementing the GDPR and similar privacy laws, such as in relation to the processing of special category data for the purposes of preventing or detecting fraud in relation to instructions from potential clients.

Disclosure of Personal Information to Third Parties

FTI Consulting will not disclose your personal information to third parties other than as described in this Privacy Policy unless FTI Consulting has your permission or is required or permitted by law. FTI Consulting may share such information with its affiliates as necessary to carry out the purposes for which the information was supplied or collected. Similarly, third party contractors, consultants and/or vendors engaged by FTI Consulting to provide services may have access to your personal information. These third parties will be subject to their own data protection requirements providing the same or greater level of security provided by FTI Consulting and in most instances will also have entered into a written agreement with FTI Consulting which addresses the protection of your personal information.

FTI Consulting may also disclose your personal information for the purposes of:

• responding to requests from law enforcement agencies, regulators or courts, or to subpoenas, search warrants, or other legal requests;
• the prevention and/or detection of crime;
• establishing legal rights or to investigate or pursue legal claims;
• a merger, acquisition or corporate restructuring to which FTI Consulting is subject;
• preventing risk of harm to an individual.

International Hosting and Transfer of Information

FTI Consulting is a global organization and may transfer certain personal information collected on its websites across geographical borders to FTI Consulting offices, personnel, or third parties located throughout the world. FTI Consulting may also store such information in a jurisdiction other than where you are based including outside of the European Economic Area (“EEA”).

FTI Consulting will take appropriate steps to ensure that transfers of personal information are in accordance with applicable law and carefully managed to protect your privacy rights and interests and transfers are limited to countries which are recognized as providing an adequate level of legal protection or where we can be satisfied that alternative arrangement are in place to protect your privacy rights. To this end:

• Transfers of personal information to FTI Consulting's global offices are protected through contractual commitments (such as the Standard Contractual Clauses). FTI Consulting also maintains certifications under the EU-US DPF, the UK Extension to the EU-US DPF, and the Swiss-US DPF schemes, which continue to provide additional privacy safeguards.
• Where we transfer your personal information outside FTI Consulting to third parties who help provide us with any of the activities described in this policy, we obtain contractual commitments (such as the Standard Contractual Clauses) from them in order to protect your personal information.
• Where we receive requests for information from law enforcement, courts or regulators (who may be based overseas), we carefully validate these requests before any personal information are disclosed.

You have a right to contact us for more information about the safeguards we have put in place (including a copy of relevant contractual commitments) to ensure the adequate protection of your personal information when this is transferred as mentioned above.

Information Security

FTI Consulting has reasonable technical safeguards, security policies and procedures in place to protect personal information from unauthorized loss, misuse, alteration, or destruction. Measures we take include placing confidentiality requirements on our staff members and service providers, limiting access to your personal information on a "need to know" basis, and providing training to appropriate FTI Consulting personnel. We also maintain comprehensive policies addressing data incident response protocols. Our IT Security Program is audited on a regular basis.

Despite FTI Consulting's best efforts, however, security cannot be absolutely guaranteed against all threats.

Retention of your personal information

FTI Consulting retains your personal information for the period of time required for the purposes for which it was collected, any compatible purposes which we subsequently establish, or any new purposes to which you subsequently consent, or to comply with legal, regulatory and FTI Consulting policy requirements. This period of time will usually be the period of your, or the relevant client's, relationship or contract with FTI Consulting plus a period reflecting the length of time for which legal claims may be made following the termination of such relationship or contract. Some information (such as call recordings, tax records and certain information required to demonstrate regulatory compliance) may need to be kept for longer. Personal information will be kept for a shorter or longer period of time if so required by law or an FTI Consulting policy, if the information becomes subject to a legal hold (for example, following a communication from our regulator) or if we have identified through a data protection impact assessment that a different retention period is appropriate.

Your Rights in Jurisdictions Covered by the GDPR and Similar Laws

If your personal information is processed by an FTI Consulting entity in the EEA, Brazil or another jurisdiction that has adopted the GDPR or similar rules, then, subject to certain exemptions, and dependent on how and why we use it, you have certain rights in relation to your personal information. The rights described below may vary depending on the specific laws that apply to you.

We may ask you for additional information to confirm your identity before disclosing any personal information to you. We reserve the right to charge a fee where permitted by law, for instance if your request is manifestly unfounded or excessive.

You can exercise your rights by contacting us. Subject to legal and other permissible considerations, we will make every reasonable effort to honor your request promptly or inform you if we require further information in order to fulfil your request.

We may not always be able to fully address your request, for example if it would impact the duty of confidentiality we owe to others, or if we are legally entitled to deal with the request in a different way.

Right to Access

You have the right to access personal information which FTI Consulting holds about you, together with certain information about how and why your personal information is processed.

Right to Rectification

You have a right to request us to correct your personal information where it is inaccurate or out of date.

Right to be Forgotten (Right to Erasure)

You have the right under certain circumstances to have your personal information erased. Your information can only be erased if it is no longer necessary for the purpose for which it was collected, and we have no other legal ground for processing the information.

Right to Restrict Processing

You have the right to restrict the processing of your personal information, but only where:

• its accuracy is contested, to allow us to verify its accuracy; or
• the processing is unlawful, but you do not want it erased; or
• it is no longer needed for the purposes for which it was collected, but we still need it to establish, exercise or defend legal claims; or
• you have exercised the right to object, and verification of overriding grounds is pending.

Right to Data Portability

You have the right to data portability, which requires us to provide personal information to you or another controller in a commonly used, machine readable format, but only where the processing of that information is based on (i) consent; or (ii) the performance of a contract to which you are a party. Please note that FTI Consulting rarely relies upon consent as a legal basis, and the performance of a contract basis will only be relevant to the extent that you, as an individual, are party to a contract with FTI Consulting or a client, and our use of your personal information is necessary for the performance of that contract.

Right to Object to Processing

You have the right to object to the processing of your personal information at any time, but only where that processing is based on our legitimate interests. If you raise an objection, we have an opportunity to demonstrate that we have compelling legitimate interests which override your rights and freedoms.

If you have any specific concerns about this privacy policy or your data (including, without limitation, if you would like to exercise your right to access, review, erase, correct or discuss how your personal information is processed), please contact us via:

Email (for residents residing in the European Economic Area (EEA), the UK, the UAE, or anywhere Else in Europe, the Middle East or Africa): dataenquiriesemea@fticonsulting.com

Email (for residents of any country): privacy@fticonsulting.com

Post: Data Protection Officer, c/o the Legal department, FTI Consulting, Inc., 200 Aldersgate St, Barbican, London EC1A 4HD, United Kingdom

FTI Consulting will make all reasonable and practical efforts to comply with your request, so long as it is consistent with applicable law and professional standards.

In addition, under applicable local law you may have the legal right to lodge a complaint with the relevant supervisory authority or local data protection authority.

Important Additional Information for California Residents

This section provides information for California residents, as required under California privacy laws, including the California Consumer Privacy Act and its implementing regulations (“CCPA”). The CCPA generally requires that businesses provide California consumers information about how we use their personal information, whether collected online or offline, and this document is intended to satisfy that requirement. However, the CCPA notice requirement does not apply where we are providing services to our clients, receive personal data and use it solely to provide service to a client and function as a “service provider” within the meaning of the CCPA.

Job applicants should review the Notice at Collection and Privacy Policy for California Job Applicants.

Under the CCPA, “personal information” is any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household.

Categories of Personal Information that We Collect, Disclose, and Sell or Share

Below please find the categories of personal information about California residents that we may collect and may disclose to third parties or service providers for a business purpose. We describe the purposes of using the personal information in the “What types of personal information are collected and what do we use it for?” section, above, and, in more detail in Annex I, below.

Disclosures for Business Purposes

FTI Consulting does not disclose personal information for commercial purposes. FTI Consulting has disclosed each of the categories of personal information that it collects for the following “business purposes”, as that term is defined under the CCPA, in the last 12 months:

• SERVICE PROVIDERS: For the business purpose of performing services on FTI Consulting’s behalf and, in particular, for the specific purposes described in “What types of personal information are collected and what do we use it for?” section, above, and, in more detail in Annex I, below.
• AUDITORS, LAWYERS, CONSULTANTS, and ACCOUNTANTS engaged by FTI Consulting: For the business purpose of auditing compliance with policies and applicable laws, in addition to performing services on FTI Consulting’s behalf.
• AFFILIATED COMPANIES: To other companies within the FTI family of companies for the business purposes of (1) auditing compliance with policies and applicable laws, (2) helping to ensure security and integrity, (3) debugging, (4) short-term transient use, (5) performing services on behalf of FTI Consulting, (6) internal research, and (7) activities to maintain or improve the quality or safety of a service or device.

No Sales or Sharing

We do not sell or share your personal information¸ where “share” means disclosing personal information to third parties for cross-context behavioral advertising. Without limiting the foregoing, we have not, and have no actual knowledge that we have, sold or “shared” the personal information of individuals of any age, including the personal information of children under 16, in the last 12 months.

Note on Sensitive Personal Information: FTI Consulting does not infer characteristics from sensitive personal information. FTI Consulting only uses sensitive personal information as necessary to perform its services, to ensure security and integrity, or for other purposes permitted by the CCPA without the right to opt out.

The Categories of Sources from Which We Collect Personal Information

• You, as described in the section above titled "When do we collect personal information".
• Service providers, for example, analytics providers, IT, and system administration services.
• Affiliated companies, for example, so that we can assist other companies in the FTI Consulting family of companies in providing you with products or services.
• Automated technologies, for example, browsing activity collected by automated technologies on the website.
• Third parties, for example, lawyers, bankers, auditors, and insurers who provide consultancy, banking, legal, insurance, and accounting services.
• Public sources, for example, public databases.
• Marketing/advertising companies, for example, from social media platforms, consumer research companies, and analytics or marketing/advertising companies.
• Surveillance/recording technologies installed by FTI Consulting, for example, video surveillance in common areas of FTI Consulting facilities, voicemail technologies, and audio recording technologies with consent to the extent required by law.
• Government or administrative agencies, for example, law enforcement, public health officials, and other government authorities.
• Acquired entity, if FTI Consulting acquired another entity, we might collect personal information from that entity.

Aggregated and Deidentified Information

We may aggregate and/or deidentify information, use it internally, and disclose to third parties. Neither Aggregated Information nor Deidentified Information (defined below) is personal information.

• “Aggregated Information” refers to information about a group of individuals from which the individually identifiable information has been removed. An example of Aggregated Information would be the statistic that 20 people used our website’s contact form on a given day.
• “Deidentified Information” means information subjected to reasonable measures to ensure that the deidentified information cannot be associated with the individual. An example of Deidentified Information would be the data point that an unidentified visitor first entered the website through our main web page. We maintain Deidentified Information in a deidentified form and do not attempt to reidentify it, except that we may attempt to reidentify the information just to determine whether our deidentification processes function correctly.

California Residents’ Rights

California law grants California residents certain rights and imposes restrictions on particular business practices as set forth below.

Notice at Collection. We are required to notify California residents, at or before the point of collection of their personal information, the categories of personal information collected and the purposes for which such information is used.

Right of Deletion: California residents have the right to submit a verifiable request for the deletion of their personal information that we have collected about them, subject to certain exemptions, and to have such personal information deleted, except where necessary for any of a list of exempt purposes.

Right to Correct: California residents have the right to submit a verifiable request for the correction of inaccurate personal information maintained by FTI Consulting, taking into account the nature of the personal information and the purposes of processing the personal information.

Right to Know – Right to Specific Pieces: Up to twice in a 12-month period, California residents have the right to submit a verifiable request for specific pieces of personal information and to have this delivered, free of charge, either (a) by mail or (b) electronically in a portable and, to the extent technically feasible, readily useable format that allows the individual to transmit this information to another entity without hindrance. Please note that the CCPA’s right to obtain “specific pieces” does not grant a right to the whole of any document that contains personal information, but only to discrete items of personal information.

Right to Know – Right to Information: California residents have the right to submit a verifiable request that we provide them certain information about how we have handled their personal information, including the:

• categories of personal information collected;
• categories of sources of personal information;
• business and/or commercial purposes for collecting and selling their personal information; and
• categories of personal information that we disclosed for a business purpose, and for each category identified, the categories of third parties to whom we disclosed that particular category of personal information.

Submitting Requests. Requests to exercise these California rights may be submitted to privacy@fticonsulting.com or by contacting us at 833-708-0303 (toll free). We will respond to verifiable requests received from California consumers as required by law.

How We Will Verify Your Request. To verify your request, we match personal information that you provide us against personal information we maintain in our files. The more risk entailed by the request (e.g., a request for specific pieces of personal information), the more items of personal information we may request to verify your identity. If we cannot verify your identity to a sufficient level of certainty to respond securely to your request, we will let you know promptly and explain why we cannot verify your identity.

Right to Non-Discrimination, and Incentives. The CCPA prohibits discrimination against California residents for exercising their rights under the CCPA and imposes requirements on any financial incentives offered to California residents related to their personal information.

Authorized Agents. You may designate an authorized agent to exercise your right to know, to correct, or to delete. If an authorized agent submits a request on your behalf, the authorized agent must submit with the request another document signed by you that authorizes the authorized agent to submit the request on your behalf. In addition, we may ask you or your authorized agent to follow the applicable process described above for verifying your identity. You can obtain the “Authorized Agent Designation” form by contacting us at privacy@fticonsulting.com.

In the alternative, you can provide a power of attorney compliant with the California Probate Code.

Marketing

FTI Consulting may send you information related to its services, products and events that we believe are of interest to you. This information may be sent by post or via email. If at any point you no longer prefer to receive marketing communications from FTI Consulting you can (i) unsubscribe from FTI Consulting communications sent by email using a link provided in marketing emails sent from FTI Consulting; or (ii) contact us to exercise your right to prevent all forms of marketing (both post and email).

Children

FTI Consulting’s websites are not intentionally designed for or directed at children under the age of 16. It is FTI Consulting’s policy never to knowingly collect or maintain information about anyone under the age of 16, except as part of an engagement to provide professional services.

Links

FTI Consulting websites may contain links to other sites, including websites maintained by FTI Consulting affiliates that are governed by other privacy policies that may differ somewhat from this one. Users should review the privacy policy of each website visited before disclosing any personal information. To the extent that FTI Consulting provides links to third party websites, such links do not constitute an endorsement, sponsorship, or recommendation by FTI Consulting of the third parties, the third party websites, or the information contained on those websites, and FTI Consulting is not responsible or liable for your use of such third party websites. Where appropriate you should review the privacy polices of any websites or applications before submitting personal information.

Changes to this Policy

By using FTI Consulting websites you consent to the collection, use and storage of personal information as described in this Privacy Policy and elsewhere on the websites. FTI Consulting reserves the right to make changes to this Website Privacy Policy from time to time. FTI Consulting will notify you by posting amendments to the Privacy Policy on this website.

Contact Us

If you have questions or concerns regarding this policy or FTI Consulting’s personal data processing policies, please contact FTI Consulting at:

Via email (for residents residing in the European Economic Area (EEA), the UK, the UAE, or anywhere Else in Europe, the Middle East or Africa): dataenquiriesemea@fticonsulting.com

Via email (for residents of any country): privacy@fticonsulting.com

Via post: Data Protection Officer, c/o the Legal department, FTI Consulting, Inc., 200 Aldersgate St, Barbican, London EC1A 4HD, United Kingdom

If you are an EEA data subject, FTI Consulting’s appointed EU Representative and contact point under EU GDPR is FTI Consulting Management Solutions Limited. If you are a UK data subject, FTI Consulting’s appointed UK Representative and contact point under UK GDPR is FTI Consulting LLP.

1 FTI Technology services are not included here as that business unit functions as a data processor for its clients.

*In all cases where legitimate interests is relied upon as a lawful basis for processing Personal Data, FTI Consulting takes steps to ensure that its legitimate interests are not outweighed by any prejudice to the rights and freedoms of the underlying data subjects. This is achieved in a number of ways, including through the application of principles of data minimization and security, and by taking steps to ensure that personal information is only collected or otherwise obtained where it is relevant to the provision of Services to a client, and where access to personal information for FTI Consulting is reasonably necessary for the provision of those Services.