Stout Risius Ross, LLC (and all affiliates and subsidiaries, collectively "Stout") values your privacy and is committed to complying with the applicable data privacy and security requirements in the countries in which it operates. Stout complies with internationally recognized standards of privacy protection and with various privacy laws globally including, but not limited to, the EU General Data Protection Regulation (GDPR).

What this Privacy Policy Covers

This Privacy Policy applies to our collection, use, and sharing of your personal data when you visit our websites, when you apply for employment with us, when you have or may have had an employment relationship with us, or when we provide valuation advisory, transaction opinions, investment banking, dispute consulting, management consulting, or other services (the “services”) to you. This Privacy Policy applies only to data collected by Stout and does not apply to any other data or websites not owned or operated by Stout. For more information about our privacy practices for employee information, please see our Employee Handbook.

Who is Collecting Data

Data will be collected by Stout Risius Ross, LLC (and all affiliates and subsidiaries, collectively "Stout").

Data We Collect

Stout collects the following categories of personal data:

Contact data and other identifiers: We may collect information about data subjects such as name and contact details (email, phone number, mailing address) in order to communicate and facilitate the provision of our services with our clients or potential clients and to respond to your requests. For example, contact details of individuals who work for or on behalf of the clients, in order to carry out the client’s engagement with Stout.

Services data: Personal data may be provided to us by clients to the extent required to perform the services. Stout may also acquire personal data from a third party at the direction of our client as required to perform services.

Employment Information: We collect the information you choose to disclose if you apply for potential employment with Stout, such as your educational history, professional experience, and certain sensitive information such as race, age, citizenship, and any disabilities you may have. If you are employed by Stout, the types of personal information that we process may vary based on the nature of the employee’s position and duties, and are described in more detail in the Privacy Notice located in the Stout Employee Handbook.

Sensitive Personal Information: We may collect certain categories of sensitive personal information, including government-issued identifiers, citizenship or work authorization information, protected classification information, financial information, and health-related information where necessary for one or more of the following purposes: (i) fulfilling employment or recruiting obligations; (ii) performing client engagements under a signed agreement; (iii) complying with applicable legal or regulatory requirements; or (iv) protecting the security of Stout’s systems and personnel. We do not sell sensitive personal information and use such information only as permitted by applicable law.

Website visitor information and statistical analysis: When you visit our website, we may collect information about your visit such as your IP address and the pages you visited and when you use our services we may collect information on how you use those services. We may use cookies to collect this information. Please see our Terms of Use and Cookies Policy for additional information.  We also use Google Analytics to help us gather statistical information about the visitors to our website and how they use the website on an anonymous, aggregate basis. We will not associate this data with your personally identifiable data unless required to do so to cooperate with law enforcement activity or other governmental request or to comply with law. Depending on the type of browser and device that you use, you may have the ability to control the type of information that Google Analytics use. To understand how Google Analytics collects and processes data, please visit www.google.com/policies/privacy/partners/.

Marketing information: We may collect information to respond to inquiries regarding our services or to provide you with information, reports, or updates. This information includes the contact data and website visitor information described above as well as information about your occupation or employer if you provide it to us.

Clients and other third parties who provide personal data to Stout must do so in compliance with applicable data privacy regulations.

Processing of Personal Data

“Personal data” is any information, either alone or in combination with other readily available data, that identifies, relates to, describes, or could reasonably be linked with a particular individual or household.

We collect personal data to offer and administer our services and products and to manage employment relationships. The data you provide to us will be processed in accordance with the purposes specified in this Privacy Policy, namely:

• To provide the products or perform the services requested by clients and individuals pursuant to a letter of engagement, statement of work, or similar (where the processing is necessary for our legitimate business interests in conducting and managing our business).
• To provide the products or perform the services requested by clients and individuals using our website or web applications (where the processing is necessary for our legitimate business interests in conducting and managing our business).
• For complying with obligations provided by laws, current regulations and legislation (e.g. tax regulations) (where processing is based on a legal obligation).
• For direct marketing to existing clients and contacts regarding services materially similar to those previously provided (where Stout has determined, after conducting a balancing test, that its legitimate interest in business development is not overridden by the data subject's interests or fundamental rights, and where applicable law permits such processing without prior consent). You have the right to object to this processing at any time by contacting legal@stout.com.
• For operating and improving Stout’s website and your customer experience. For example, we may collect and analyze data on your use of our website and process it for the purpose of improving our online experience. Please see our Terms of Use and Cookies Policy for additional information.
• For security purposes. For example, we may use your data to protect Stout and its third parties against security breaches and to prevent fraud and violation of Stout’s applicable agreements (where the processing is necessary for our legitimate business interests).
• For employment relationships. For example, evaluate applications for employment; manage all aspects of an employee›s employment relationship, including, but not limited to, payroll, benefits, business travel and other reimbursable expenses, development and training, absence monitoring, performance appraisal, disciplinary processes; perform general administrative, analytical and human resource-related processes; develop workforce and succession plans; maintain sickness records and occupational health programs; investigate and respond to claims against Stout, and its employees; conduct employee surveys; administer termination of employment and provide and maintain references; maintain emergency contact and beneficiary details (which involves Stout holding information on those you nominate in this respect); and comply with applicable laws (e.g., health and safety laws), including judicial or administrative orders regarding individual employees (e.g., garnishments or child support payments).

Whenever we process your personal data for our legitimate interests, we make sure to consider and balance any potential impact on you and your rights under data protection laws. Our legitimate business interests do not automatically override your interests - we will not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You have the right to object to this processing if you wish.

How Personal Data is Processed

Personal data is processed by Stout both manually and electronically in accordance with the above-mentioned purposes and in compliance with current regulations. Stout will not process personal data unless the processing of the personal data is legally permitted or required. Stout will limit the collection of personal data to information that is relevant for the purposes of processing and does not sell the personal data of any individual. Stout does not process such personal data in a way that is incompatible with the original purposes for which it has been collected unless additional authorization is obtained from the individual, and it will ensure its notices regarding its processing activities are not unfair or deceptive.

Stout will implement appropriate technical and organizational measures to ensure that such personal data is accurate, up-to-date for its intended use, complete, and current. Stout will retain personal data in identifiable form only for as long as it serves a purpose of processing, which includes Stout’s obligations to comply with professional standards, its business purposes, its data retention policy, and as required by law, unless a longer retention period is permitted by law and in such case Stout will adhere to this policy for as long as it retains such Personal data.

We permit only authorized Stout employees and third-party service providers to have access to your information. Stout limits access to personal data only to those employees and third-party service providers who have a need to know such information to either perform functions directly on the personal data, or who must access personal data on behalf of Stout for its provision of services. Such employees and third-party services providers are appropriately designated and trained to process data only according to the instructions we provide them.

Securing of Personal Data

Stout will implement appropriate technical and organizational measures to protect your Personal Data from loss, misuse, and unauthorized access, disclosure, alteration, and destruction, taking into due account the risks involved in the processing of the personal data, and the nature of the personal data. Stout will implement appropriate security and privacy safeguards at all stages of the personal data lifecycle, including collection, transfer, and storage of such personal data.

Storage of Personal Data

Stout will retain personal data for a reasonable period, taking into account legitimate business needs to capture and retain such information. Information will also be retained for a period necessary to comply with state, local, federal regulations, or country specific regulations and requirements, and in accordance with Stout’s Document Retention Schedule. Except as set forth in this policy, employees shall not alter, destroy, conceal or falsify any record or document, including those in hard copy, electronic form, or video or audio files. If there are any questions related to this policy, including cases in which an individual requests treatment of information that conflicts with Stout’s data retention policy, contact Stout’s Legal & Compliance team at legal@stout.com.

Disclosure/Sharing of Personal Data

We only share your personal data with your consent or in accordance with this Privacy Policy. We will not otherwise share, sell or distribute any of the information you provide to us except as described in this Privacy Policy.

• We share personal data among Stout affiliates and subsidiaries who act for Stout for the purposes set out in this Privacy Policy.
• Stout may share your information with external third parties, such as vendors, consultants and other service providers who are performing certain services on behalf of Stout, such as marketing services, website hosting, and new hire screening, benefits providers. Such third parties have access to personal data solely for the purposes of performing the services specified in the applicable service contract, and not for any other purpose. Stout requires these third parties to undertake security measures consistent with the protections specified in this Privacy Policy.
• Stout may be required to disclose personal data in response to lawful requests by public authorities, including meeting national security or law enforcement requirements.
• In the event of a merger, acquisition, joint venture, or sale of all or a portion of Stout’s assets, personal data may be transferred to the successor entity solely to the extent necessary to complete the transaction and operate the acquired business. Any such transfer will be subject to confidentiality obligations consistent with this Privacy Policy, and affected individuals will be notified via the website or email prior to their personal data becoming subject to a materially different privacy policy.

Cross – Border Transfers of Personal Data

Stout is a global firm. Personal data may be transferred, accessed and stored globally as necessary for the uses stated above in accordance with this Privacy Policy, and in compliance with local regulations.

Data concerning EU data subjects may be transferred to or processed in locations outside of the EU only where one of the following safeguards is in effect:

• Transfers to certain countries which the EU Commission has determined ensures an adequate level of protection;
• Transfers pursuant to standard contractual clauses or contract terms ensuring adequate data protection;
• Where required, Stout entities have entered into European Commission’s Standard Contractual Clauses of lawful transfer mechanisms recognized under applicable law which allow for the processing of your personal data and for transfers of your personal data.

Automated Decision Making

Automated decisions are defined as decisions about individuals that are based solely on the automated processing of data and that produce legal effects that significantly affect the individuals involved.

Stout does not make automated decisions using personal data. If automated decisions are to be made, affected persons will be given an opportunity to express their views on the automated decision in question and object to it.

Your Choices

Individual Rights: Under applicable privacy laws, individuals have the right to access their personal data and to correct, amend, or delete such personal data in certain circumstances. Requests for access, correction, amendment, or deletion should be sent to the Legal & Compliance Team at legal@stout.com. Stout may refuse to implement an individual’s request for the following reasons:

• The individual fails to provide sufficient proof for Stout to verify one’s identity, or a third party fails to present sufficient proof of authority to make the request on the individual’s behalf.
• Privacy laws provide a basis for denying the request, such as the bases set forth in Article 23 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) or Section 1798.100(d), 1798.105(d), or 1798.145 of the California Consumer Privacy Act (“CCPA”).
• Stout does not hold any personal data related to the individual’s request.
• The individual’s request is unfounded or excessive, in particular because of its repetitiveness.

Opt Out of Marketing Communications: If you are located in the EU or an EU resident, we will only send you marketing communications and updates about our products, services and events with your prior consent. You can withdraw your consent at any time. If you are not located in the EU, you may opt-out of receiving marketing communications and updates at any time. You can manage your receipt of marketing and non-transactional communications by clicking on the «unsubscribe» link located on the bottom of Stout’s marketing emails. Additionally, you may send a request to marketing@stout.com. We will use commercially reasonable efforts to process such requests in a timely manner.

Consequences of Not Providing Information: If you choose not to provide certain information, it may be an impediment to the exchange of information necessary for the execution of the contract or provision of services, and we may not be able to provide you with some services and you may not be able to participate in some of the activities on our website(s).

Children

We do not knowingly collect personal data from children under the age of 13 (or, for individuals in the European Economic Area, under the age of 16), except as may be provided to Stout by our clients in connection with services for such clients. Where applicable law requires parental or guardian consent for processing personal data of minors above the age of 13 but below the applicable age of digital consent, Stout will obtain such consent prior to processing. If you are under 13, please do not give us any personal data. We encourage parents and legal guardians to monitor their children’s Internet usage and to help enforce our Privacy Policy by instructing their children to never provide personal data through Stout’s website without their permission. If you have reason to believe that a child under the age of 13 has provided personal data to us, please contact us, and we will endeavor to delete that information from our databases.

Third Party Websites or Other Services

We are not responsible for the privacy practices of any non-Stout operated websites, mobile apps or other digital services, including those that may be linked through Stout websites or services, and we encourage you to review the privacy policies or notices published thereon.

Social Media Widgets

Our website includes social media features, such as the LinkedIn and Twitter buttons, and widgets, such as the “share this” button or interactive mini-programs that run on our website. These features may collect your Internet protocol address, which page you are visiting on our website, and may set a cookie to enable the feature to function properly. Social media features and widgets are either hosted by a third party or hosted directly on our website. Your interaction with these features are governed by the privacy policy of the company providing it.

Notice to European Users

Individuals residing in the European Economic Area have the following rights concerning your data processed by Stout:

• Access: You have the right to access personal information that Stout holds about you.
• Rectification: You have the right to ask us to rectify information Stout holds about you if it is inaccurate or not complete.
• Erasure: You can request that Stout erase your personal data. We may keep basic data to identify you and retain it solely for preventing further unwanted processing.
• Restrict Processing: You have the right to ask Stout to restrict how we process your data. This means we are permitted to store the data but not further process it. We keep just enough data to make sure we respect your request in the future.
• Object to processing: Where processing is based on legitimate interests, you have the right to object to Stout processing your data. Stout will discontinue processing your data, unless we can demonstrate compelling legitimate grounds for the processing. We may keep basic data to identify you and retain it solely for preventing further unwanted processing.
• Portability: Where processing is based on consent or performance of a contract, you have the right to data portability. Stout must allow you to obtain and reuse your personal data for your own purposes in a safe and secure way without this effecting the usability of your data. This right only applies to personal data processed by automated means on the basis of your consent or the performance of a contract, including both data that you have directly provided to Stout and data generated through your interaction with Stout’s services. It does not apply to personal data processed on the basis of a legal obligation or legitimate interest.
• Lodging Complaints: If we are not able to satisfactorily resolve your questions, concerns, or complaints, or if you believe that the processing of your personal data infringes on your rights under applicable data protection laws, you have the right, without prejudice to any other administrative or judicial remedies, to lodge a complaint with a supervisory authority, in particular, in the Member State of your habitual residence, place of work or place of the alleged infringement. Contact information for the supervisory authorities may be found here: EU Data Protection Authorities.

Please contact legal@stout.com to request access, rectification, or erasure, or to restrict processing, to object to processing, or to request data portability.

UK Residents: For the purposes of GDPR, the data controller is Stout Park Ltd (Company Number 8923987), 57 Grosvenor Street, London W1K 3JA, United Kingdom. We can be contacted at info@stout.uk or on +44 20 3405 3296.

Notice to Japanese Users

If we receive non-personally identifiable user information relating to individuals who reside in Japan from Google in connection with our use of Google Analytics, Stout will not merge that information with those user’s personally-identifiable information unless, prior to such processing, Stout has obtained all legally required consents from the user and have provided Google with accurate and complete information about the processing.

Please contact legal@stout.com if you have any questions, to restrict processing, or to object to processing.

Notice to California Residents

Shine the Light: Under California’s “Shine the Light” law, California residents have the right to ask us once a year if we have shared their personal information with third parties for their direct marketing purposes. To make a request or to opt out, please contact us at legal@stout.com and specify you are making a Shine the Light request. 

California Consumer Privacy Act (“CCPA”): The California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CPRA”) provides California residents with certain rights regarding their personal information and requires businesses to make disclosures regarding their privacy practices. Additional privacy notices may apply to current employees, former employees, job applicants, and independent contractors, as applicable. For more information about our privacy practices relating to employee information, please see our Employee Handbook.

Categories of Personal Information Collected: In the last twelve months, we have collected the following categories of personal information: identifiers; characteristics of protected classifications under California or U.S. law; occupation, professional, or employment-related information; and Internet or other electronic network activity information. For examples of the data points we collect, please see the “Data We Collect” section, above.

Sources of Personal Information: We have collected this information directly from you, passively when you visit our website or view our electronic communications, and from third parties such as our clients and business partners. For more information, please see the “Data We Collect” section, above.

Categories of Personal Information Disclosed and Third Parties With Whom We Share This Information: We do not sell your personal information, but we may disclose it to third parties for a business purpose consistent with this Privacy Policy. We may disclose personal information to service providers, contractors, affiliates, professional advisors, recruiting vendors, technology providers, or other third parties for business purposes consistent with this Privacy Policy. In the past twelve months, we have disclosed identifiers; professional, occupational and employment-related information, and Internet or other electronic network activity information to our third party marketing service providers. We have also disclosed identifiers; characteristics of protected classifications under California or U.S. law; occupation, professional, or employment-related information; and educational information to the third party provider of background checks in connection with potential employment. For more information about the personal information we share, please see the “Disclosure/Sharing of Personal Data” section, above.

Your Rights: In addition to the U.S. Rights outlined below, California residents also have the following rights:

• Right to Know: You may request no more than twice in a 12-month period that we provide you with copies of specific personal information we have collected, sold, or disclosed about you. However, under California law, we cannot provide you with certain sensitive information, despite your request (for example, we will not send you copies of your social security number even if it is something we collected).
• Right to Correct: You may request that we correct inaccurate personal information that we maintain about you.
• Right to Opt Out of Sale or Sharing: California residents have the right to opt out of the sale or sharing of personal information.
• Right to Limit Use of Sensitive Personal Information: Where required by law, California residents may have the right to limit certain uses and disclosures of sensitive personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising any right provided under the CCPA.

To exercise your rights above, please submit a request by: emailing us at legal@stout.com. Please describe your request with sufficient detail so we can properly respond to your request. As part of your request, please specify which right you are exercising and provide your name, contact information, and the type of request you wish to make. We may ask for additional information to verify your identity. The information you provide in your request and any follow up information we ask for from you will be used solely to verify your request.

Only you or an individual designated as your authorized agent to act on your behalf may make a request related to your personal information. You may also make a request on behalf of your minor child.

We may not discriminate against you if you choose to exercise your rights.

After receiving your request, we may need to contact you for further information and will notify you if your request has been granted or declined, or if an exception applies to your request. We will try to respond to your request within 45 days. If we need more time, we will contact you with the reason we need more time and the extension period. We will deliver our written response by mail or electronically, at your option. In response to your request to know, we will only disclose the information we have collected in the 12 months prior to our receipt of your request. Our response will also explain the reasons we cannot comply with any request, if applicable.

We do not charge a fee to process or respond to your request unless your request is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate prior to completing your request.

Additional U.S. State Privacy Rights

Residents of certain U.S. states (including but not limited to: California, Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and other states that have enacted comprehensive consumer privacy legislation) may have rights regarding their personal information under applicable privacy laws, subject to certain exceptions and limitations. The specific rights available to you depend on your state of residence; where state law provides rights broader than those described below, those broader rights apply.

Depending on your state of residence, these rights may include the right to:

• Access personal information we maintain about you;
• Correct inaccurate personal information;
• Delete personal information;
• Obtain a portable copy of certain personal information;
• Opt out of the sale of personal information, targeted advertising, or certain profiling activities; and
• Appeal our denial of a privacy rights request.

Stout does not sell personal information for monetary consideration.

To exercise your privacy rights, please contact us at legal@stout.com. We may take reasonable steps to verify your identity before responding to your request.

If we deny your request, you may appeal our decision by contacting legal@stout.com. We will review and respond to your appeal in accordance with applicable law.

Verifying, Changing, or Deleting Your Information

If the information you provided us is incorrect or if you have an issue with your information that we have collected, you can contact us as detailed at the end of this Privacy Policy and ask us to change, update or fix your information in certain cases. You can also request that we erase or delete all or some of your personal data or otherwise object to, limit, or restrict the use of such information (if we have no legal right or legitimate business interest in retaining such information).

Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time. If we make changes to this Privacy Policy we will post them on our website and indicate the effective date of the change. For purposes of this section, “material changes” include changes to the categories of personal data collected, the purposes for which personal data is used, the third parties with whom personal data is shared, or your rights as a data subject. If we make material changes to this Privacy Policy we will notify you by email (to the address associated with your account or most recent correspondence) or through a prominent notice on our website. Non-material updates (such as formatting corrections or updates to contact information) will be reflected by updating the effective date at the top of this policy and will take effect immediately upon posting.

Contact Us

Please contact us with questions, concerns, or complaints at:

Stout
150 West Second Street, Suite 400
Royal Oak, MI 48067
legal@stout.com

For current employees, please contact your Human Resources Business Partner.

This Privacy Policy was updated June 18, 2026.