Legal and privacy

Privacy Notice

Forvis Mazars Limited (“Forvis Mazars”, “we”, “us” or “our”) takes the protection and safeguarding of your personal data, and our legal responsibilities in relation to that personal data, seriously.

Forvis Mazars operates this website for the purpose of providing information concerning its business and services. We are committed to protecting the personal data that we receive in the course of our business in accordance with the Cayman Islands Data Protection Act (2021 Revision) (the “DPA”) and other applicable laws and regulations.

This Privacy Notice explains how Forvis Mazars collects, uses, stores, shares and protects personal data obtained through our website. It also explains the types of personal data we may collect, the purposes for which we process that data, how long we may retain it and the rights available to individuals under the DPA.

We may update this Privacy Notice periodically. We recommend that you review this page regularly to ensure that you remain informed about how we process your personal data and any changes to our privacy practices.

What is Personal Data?

The DPA defines “personal data” as data relating to a living individual who can be identified, directly or indirectly, from that data or from that data together with other information that is in, or is likely to come into, the possession of the data controller.

Personal data may include, but is not limited to, your name, residential or mailing address, telephone number, email address, Internet Protocol (“IP”) address, device information, age and date of birth.

The DPA also recognises certain categories of information as “sensitive personal data”. This may include information concerning an individual’s racial or ethnic origin, political opinions, religious beliefs, trade union membership, physical or mental health, medical condition, sex life, alleged or actual commission of an offence, or related legal proceedings or sentencing.

What Types of Personal Data Do We Collect?

The personal data we process when you visit our website will depend on how you interact with the website and the information you choose to provide.

If you access our website without actively submitting information, we may collect limited technical and usage information through cookies and similar technologies. This may include your IP address, browser type, device information, pages visited, date and time of access, and other information necessary to operate, protect and improve the website. Please refer to the “Cookies” section below for further information.

If you interact with our website by:

1. completing a “Contact us” or enquiry form;
2. subscribing to communications or requesting information;
3. registering for an event;
4. applying for employment or submitting a spontaneous application; or
5. otherwise communicating with us through the website,

we may collect and process the personal data you provide for the purposes stated on the relevant form or page.

Certain fields may be mandatory because we require that information to respond to your request, consider your application, provide requested information or take steps towards providing services to you.

You may also choose to provide additional personal data, including information that may constitute sensitive personal data. We will process sensitive personal data only where permitted by the DPA and where an appropriate legal condition for that processing applies.

Cookies

Our website uses cookies and similar technologies. Cookies are small text files placed on your computer or other device that help us operate the website, remember preferences, understand how the website is used and provide a more customised website experience.

Some cookies are necessary for the website to function properly. Other cookies, including analytical or marketing cookies, will be used only in accordance with applicable law and the choices made through the website’s cookie-management tool.

Further information about the cookies used by our website and how you can manage your cookie preferences is available in our Cookie Policy.

How Do We Use Your Personal Data?

We may process personal data collected through our website for the following purposes:

Entering Into and Performing a Contract

If you indicate an interest in becoming a client of Forvis Mazars, we may use the personal data you provide to respond to your enquiry, undertake preliminary discussions and take steps at your request before entering into a contract for services.

Where services are subsequently provided, we may continue to process relevant personal data to administer the client relationship and perform our obligations under the applicable engagement or contract.

Managing Our Business and Legitimate Interests

We may process personal data where necessary for the legitimate interests of Forvis Mazars or a third party, provided that those interests are not overridden by your rights and interests.

This may include:

• managing and administering our relationship with you;
• responding to enquiries and communications;
• managing our administrative, accounting and corporate affairs;
• maintaining and improving our information technology systems;
• developing and improving our business, website and services;
• maintaining business records;
• protecting our business, personnel, clients and systems against fraud, misuse and security threats;
• establishing, exercising or defending legal rights; and
• undertaking internal reporting, quality management and risk management activities.

Recruitment and Personnel Administration

If you apply for employment or otherwise express an interest in a career with Forvis Mazars, we may process the personal data contained in your application, resumé, supporting documentation and related correspondence.

This information may be used to:

• assess your qualifications, experience and suitability;
• communicate with you regarding your application;
• verify information you have provided;
• conduct appropriate background, reference, immigration or right-to-work checks;
• comply with employment and regulatory obligations; and
• administer the recruitment process.

Recruitment information may include sensitive personal data where relevant and permitted by law.

Security, Quality and Risk Management

We may process personal data in connection with maintaining the confidentiality, integrity and availability of our systems and information, preventing or investigating security incidents, and performing internal quality, independence, compliance and risk-management procedures.

Communications and Direct Marketing

Where permitted by law, we may process personal data to provide information about our services, publications, events and developments that we believe may be relevant or of interest to you.

Where consent is required, we will obtain that consent before sending the relevant communications. You may withdraw your consent or opt out of direct-marketing communications at any time by using the unsubscribe facility included in the communication or by contacting us using the details set out below.

Your decision to opt out of marketing communications will not affect communications that are necessary to provide services, administer an existing relationship or comply with legal or professional obligations.

Legal, Regulatory and Professional Obligations

As a professional services firm, Forvis Mazars is subject to legal, regulatory, professional, independence, quality-management, anti-money laundering, sanctions and other compliance obligations.

We may process and retain personal data where necessary to comply with such obligations, respond to lawful requests from competent authorities, demonstrate compliance, undertake client and engagement acceptance procedures or maintain professional records.

Consent

Where we rely on your consent to process personal data, you may withdraw that consent at any time by contacting our Privacy Officer.

Withdrawal of consent will not affect the lawfulness of processing undertaken before consent was withdrawn. We may also continue to process certain information where another lawful basis applies or where retention or processing is required or permitted by law.

Disclosure of Personal Data

We may disclose or transfer personal data to other Forvis Mazars member firms or to third parties where necessary for the purposes described in this Privacy Notice.

Recipients may include:

• other Forvis Mazars member firms;
• persons working with or on behalf of Forvis Mazars;
• professional advisers and consultants;
• website-hosting, information technology and cybersecurity providers;
• cloud-hosting and data-storage providers;
• customer relationship management and business administration providers;
• payment and financial service providers;
• recruitment and background-screening providers;
• insurers;
• auditors and quality reviewers;
• governmental, regulatory, law-enforcement and professional bodies; and
• other third parties where disclosure is required or permitted by law.

We may share personal data with other Forvis Mazars member firms where this is necessary for administrative purposes, quality management, risk management, independence procedures, business operations or the provision of professional services involving member firms in different countries.

Access to personal data is restricted to those persons who have a legitimate business need for the information and is subject to applicable confidentiality, professional, contractual and information-security requirements.

Where third-party service providers process personal data on our behalf, we require them to process that data only for authorised purposes, in accordance with our instructions and subject to appropriate confidentiality, privacy and security obligations.

We may also disclose personal data where required by law, court order or a competent governmental, regulatory, professional or law-enforcement authority, or where necessary to establish, exercise or defend legal rights.

International Transfers

The operation of our business and the international nature of the Forvis Mazars network may require personal data to be transferred to, accessed from or stored in countries outside the Cayman Islands.

Where personal data is transferred outside the Cayman Islands, we will take reasonable and appropriate steps to ensure that the transfer complies with the DPA. Depending on the circumstances, this may include:

• transferring personal data to a jurisdiction that provides an adequate level of protection;
• entering into appropriate contractual arrangements;
• implementing technical, organisational and security safeguards;
• obtaining the individual’s consent where appropriate; or
• relying on another exemption or condition permitted by the DPA.

Retention of Personal Data

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected or subsequently processed.

The applicable retention period will depend on the nature of the information and the purpose for which it is held. We may retain personal data for the longest of the following periods:

1. the period necessary to fulfil the purpose for which the personal data was collected;
2. the period required by applicable legal, regulatory, contractual or professional obligations;
3. the period required under our internal record-retention policies; and
4. the period during which litigation, regulatory proceedings, investigations, complaints or professional claims might arise in relation to our services or business activities.

After the applicable retention period has expired, the personal data will be securely deleted, destroyed or anonymised, subject to any legal or professional requirement to retain it.

How Do We Protect and Safeguard Your Personal Data?

Forvis Mazars maintains appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access, misuse or other unlawful processing.

Depending on the nature of the information and associated risks, these measures may include:

• anti-virus and anti-malware protection;
• firewalls and secure network controls;
• secure servers and cloud environments;
• encryption of devices and data;
• password and identity-access controls;
• multi-factor authentication;
• physical access controls;
• intrusion and anomaly detection;
• system monitoring and testing;
• data backup and recovery procedures;
• information-security policies;
• incident-response procedures; and
• privacy and cybersecurity training.

Access to personal data is limited, so far as reasonably practicable, to personnel and service providers who have a legitimate business need to access the information or whose responsibilities reasonably require such access.

Personnel with access to personal data are subject to confidentiality and professional obligations and are granted access only to the extent necessary for the proper performance of their responsibilities.

We require contractors, processors, subprocessors and suppliers with access to personal data to maintain appropriate confidentiality, privacy and security measures and to process personal data only for authorised purposes.

Personal data transmitted through our website is protected using appropriate encryption technologies. We also maintain procedures for the secure deletion, destruction or anonymisation of personal data.

However, no method of transmission over the internet or method of electronic storage can be guaranteed to be completely secure. While we take reasonable measures to protect personal data, absolute security against every possible threat cannot be guaranteed.

Personal Data Breaches

Forvis Mazars maintains procedures for identifying, assessing, investigating, documenting and responding to actual or suspected personal data breaches.

Where required under the DPA, we will notify the Cayman Islands Ombudsman and affected individuals of a personal data breach within the applicable statutory period and provide the information required by law.

Under the Cayman DPA, a reportable personal data breach must generally be notified to the Ombudsman and affected individuals no later than five calendar days after the data controller should, with the exercise of due diligence, have become aware of the breach. 

Your Rights

Subject to applicable limitations and exemptions under the DPA, you may have the following rights in relation to your personal data:

1. The right to be informed about the collection and use of your personal data.
2. The right of access to personal data held about you and certain information concerning how that personal data is processed.
3. The right to rectification of inaccurate or incomplete personal data.
4. The right to request that processing cease or be restricted where the statutory conditions are satisfied.
5. The right to object to direct marketing and request that your personal data no longer be processed for direct-marketing purposes.
6. Rights in relation to automated decision-making, including certain decisions based solely on automated processing.
7. The right to seek rectification, blocking, erasure or destruction of personal data in circumstances provided for under the DPA.
8. The right to seek compensation where you suffer damage as a result of a contravention of the DPA.
9. The right to complain to the Cayman Islands Ombudsman if you believe your personal data has not been processed in accordance with the DPA.

These rights are not absolute and may be subject to statutory conditions, limitations and exemptions. The Cayman Islands Ombudsman identifies the principal individual rights as the rights to be informed, access, rectification, stop or restrict processing, stop direct marketing, rights concerning automated decision-making, compensation and complaint. 

If you wish to exercise any of these rights, please contact our Privacy Officer using the contact details set out below. We may need to request information from you to verify your identity and assist us in responding to your request.

Children and Our Website

Forvis Mazars understands the importance of protecting children’s privacy, particularly in an online environment.

Our website is a general-audience website and is not intended for or directed towards children. We do not knowingly collect personal data from children through our website except where that information is lawfully provided with appropriate authorisation or consent.

If you are under 16 years of age, you should obtain the consent and assistance of a parent or guardian before submitting personal data through our website.

If we become aware that a child has submitted personal data without appropriate authorisation or consent, we will take reasonable steps to delete the information, unless we are legally required or otherwise permitted to retain it.

Questions, Concerns or Requests

If you have any questions or comments about this Privacy Notice, wish to exercise a right under the DPA, or have concerns regarding how we have handled your personal data, please contact:

Privacy Officer
Forvis Mazars Limited
Email: jeff.kelly@forvismazars.com

You may also make a complaint to the Cayman Islands Ombudsman if you believe that your personal data has not been processed in accordance with the DPA.

The Ombudsman’s contact details are:

Office of the Ombudsman
5th Floor, Anderson Square
64 Shedden Road
George Town, Grand Cayman
Cayman Islands

Mailing address:
PO Box 2252
Grand Cayman KY1-1107
Cayman Islands

Email: info@ombudsman.ky
Telephone: +1 345 946 6283

The Ombudsman is the supervisory authority responsible for investigating, mediating and deciding complaints concerning data-protection rights and the use of personal data in the Cayman Islands. 

EU Representative / Data Privacy Contact

For individuals located in the European Union or European Economic Area, enquiries concerning the processing of personal data or the exercise of applicable data protection rights may also be directed to:

For individuals located in the European Union or European Economic Area, data protection enquiries may also be directed to:

Representative name: Forvis Mazars & Compagnie

Address: Avenue du Boulevard 21, Box 8, 1210 Saint-Josse-ten-Noode, Belgium

Email: privacy@forvismazars.com

Changes to This Privacy Notice

We may amend this Privacy Notice periodically. Any updated version will be published on this page together with a revised “Last updated” date.

We recommend that you review this page regularly to remain informed about our privacy practices and how we process personal data.

Last updated: October 2026