Privacy Policy: CLA (CliftonLarsonAllen)

Last modified: August 22, 2025

This is the website of CliftonLarsonAllen LLP (“CliftonLarsonAllen” or “CLA”).

This privacy policy and the other documents referenced in this privacy policy outline how we use the data we collect when we interact with you via this website, via CLA applications, and other sites we operate, and in connection with the services we provide. Certain CLA services or subsidiaries may require additional agreements or consent regarding how your data is collected, used, or disclosed. If you are a client of CLA, please refer to your engagement letter, master service agreement or statement of work for additional information about the data we collect and how it is used.

General terms

By accessing this website, you willingly accept and consent to this privacy policy. In addition, by submitting information to us, you consent to our use of such information in accordance with this privacy policy.

If any dispute arises over the privacy of your information, the dispute is subject to this privacy policy and our Terms of Use, including limitation of liability, user disputes and release, and application of Minnesota law.

CLA reserves the right to make changes or update this privacy policy when necessary to reflect changes to our service offerings or in response to legal or regulatory changes. Changes we make to this privacy policy will be made by updating the effective date at the top of this privacy policy. By continuing to use this website after the effective date on this page, you accept and agree to the revisions.

Personal information collection, processing, and sharing

Personal information is information that relates to you or allows us to identify you. We collect and process personal information based on the type of relationship with us, with lawful basis, and as outlined below.

Accessing our website

Personal information collected by CLA on our website using cookies or other web technologies includes, but is not limited to, IP address, device identifiers, browser name, browser type, subscription preferences, page interactions and clicks, operating system, websites visited just before or just after visiting our site, and survey response data. Personal information collected by cookies is used for the following purposes:

Aggregate information on pages users access to improve and/or personalize the content and design of our website.
Display advertisements.

Personal information collected while navigating our website may be shared or disclosed to third parties who are classified as Service Providers. These parties are identified within the “Cookies and other tracking technologies” section of this policy.

Submission of forms and marketing interactions

Personal information submitted using one of our contact or registration forms, or through interactions with our marketing communications or advertisements may include, but is not limited to, your name, phone number, email address, home or business address, job title, the services in which you are interested, specific event registration elements such as dietary restrictions, and information about your engagement with marketing communications and advertisements. Personal information collected through form submission or interactions with marketing communications and advertisements may be used for the following purposes:

Inform you about products, services, events, and promotional offers that you might find interesting.
Invite you to webinars, conferences, and other industry events.
Send you educational information such as newsletters.
Build a relationship with you and provide you with seamless opportunities.
Combine it with other information obtained through website cookies or our third parties to get to know you.
Provide you with personalized content and communications.

Personal information collected through the submission of forms or during marketing interactions will be shared with our third-party marketing and advertising service providers in an effort to get to know you better, provide you with personalized marketing and target advertising services, and to help us provide aggregated market data to those providers that may be used by us to personalize our marketing campaigns and communications. Please contact your Client Relationship Leader or email Privacy@CLAConnect.com for a list of any such engaged third-party marketing and advertising service providers.

Information collected during your client relationship

Personal information collected when you become a client, and throughout our relationship, or while accessing one of our applications and ClientHQ, may include username, password, access and log in activity, phone number, personal financial information, health information, social security number, email address, IP address, device identifiers, MAC address, browser name, page interactions and clicks, survey response data, tax information, bank account numbers, retirement plan information, estate plans, investment information, family relationships, marital status, financial account numbers, credit card or debit card number, payment and purchase history, records of personal property, audit and visual information. Personal information collected as part of client relationship or while accessing CLA applications and ClientHQ may be used for the following purposes:

Onboarding you as a client includes, but is not limited to, the completion of conflict of interest and background checks.
Provide the services agreed upon within our Terms of Use, Master Service Agreement or Statement of Work.
Provide technical and administrative support.
Secure the applications that you are given access to.
Verify your identity.
Prevent fraud.
Send you administrative communications and surveys.

Personal information collected throughout our client relationship is always minimized to what is required to meet our obligations to you. Personal information may be shared with third party service providers, contractors, or other sub processors. Please contact your Client Relationship Leader or by sending an email to Privacy@CLAConnect.com for a list of any third parties that assist us with meeting our obligations to you.

Recruitment or hiring activities

Personal information we may collect as part of our recruitment or hiring activities includes, but is not limited to, your name, birth date, marital status, gender, social security number, email address, street address, phone number, career experience, educational experience, licenses and certifications, data related to race or ethnic origin, criminal record, protected Veteran and/or disability status and other personal information. Personal information collected during recruitment or hiring activities is used for the following purposes:

Process and evaluate employment applications and communicate with you about current or future employment opportunities.
Contribute to your employment file upon formal acceptance of employment.
Provide human resources and payroll services.
Secure us and you.
Communicate benefit and personal service opportunities to you.
Comply with our record keeping, and other federal and state reporting obligations.

By providing such information, you explicitly consent to CLA’s use of that information in accordance with this privacy policy or as otherwise agreed upon. You may choose not to provide information to us but doing so may limit our ability to communicate with you or fulfill your requests.

Information we collect from third parties

We may also obtain personal information from other websites, ads on other websites or applications, social media, CLA personnel, joint marketing organizations, event sponsors, referral or commercial lead sources, other data providers educational institutions, contractors, vendors, suppliers, and subsidiaries.

Information we receive from these sources may include your name, telephone number, email address, title, company, country, state, department or job role, information concerning your company or business, and the nature of your request.

We may combine this information with information we receive about you from other means, use it, or share it as described in this privacy policy.

Cookies and other tracking technologies

To make this Site work properly, we must sometimes place small data files called cookies, pixels, and other tracking technologies on your device or browser.

What are cookies?

A cookie is a small text file that a website saves on your computer or mobile device when you visit the Site.

There are two basic categories of cookies. First-party cookies are enabled by CLA and are used to remember your actions and preferences (such as login, language, font size, and other display preferences) over a period of time, so you don’t have to keep re-entering them whenever you come back to the Site or browse from one page to another. We also use third-party cookies that are placed by CLA but come from a different domain than the website you are visiting, and are used for advertising, and marketing efforts.

What types of cookies do we use?

We use five types of cookies.

Essential or strictly necessary cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the Site will not then work.

Performance cookies allow us to count visits and traffic sources so we can measure and improve the performance of our Site. They help us to know which pages are the most and least popular and see how visitors move around the Site. If you do not allow these cookies we will not know when you have visited our Site and will not be able to monitor its performance.

Functional cookies enable the website to provide enhanced functionality and personalization. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly.

Social Media cookies are set by a range of social media services that we have added to the Site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies, you may not be able to use or see these sharing tools.

Targeting/Advertising cookies are set through our Site by our advertising partners. Those companies may use them to build a profile of your interests and show you relevant advertisements on other sites. If you do not allow these cookies, you will experience less CLA specific targeted advertising.

What cookies do we use?

Specific information about the cookies CLA or our advertising partners add to your browser is located within the Cookie Preference Center. Details include the name of cookie, host name, duration, category/type, and description.

Who do we share personal data with?

With your consent; your IP address, device identifiers, user id (created by the cookie), session information, browser name, subscription preferences, page interactions and clicks, websites visited just before or just after visiting our Site, survey response data, and internet activity may be shared with our third parties. More specifically:

Company Name	Role in processing	Their policy	Opt out link
Google Analytics	To analyze interactions, improve the website, and improve your browsing experience.	Google Privacy Policy	Google Analytics Opt Out
Google Ads/Double Click	Used to track user interactions and behaviors to deliver personalized ads and improve effectiveness of ad campaigns.	Google Privacy Policy	Google Ad Settings
LinkedIn	To track and measure user interactions and behaviors to deliver personalized ads and improve effectiveness of ad campaigns.	LinkedIn Privacy Policy	LinkedIn Ads settings
Meta (Facebook)	To track and measure user interactions and behaviors to deliver personalized ads and improve effectiveness of ad campaigns.	Meta Privacy Policy	Access within your Facebook application, go to Ad Preferences
Hubspot	To identify, track, and analyze visitor interactions, improve the website, and personalize your experience.	Hubspot Privacy Policy	NAI Consumer Opt Out WebChoices Opt Out
YouTube Analytics	To track user interactions and preferences and personalize ads and improve effectiveness of ad campaigns.	YouTube Privacy Policy	YouTube Opt Out
TheTradeDesk	To track user interactions and behaviors to deliver personalized ads, improve effectiveness of ad campaigns and measure performance.	The Trade Desk Privacy Policy	The Trade Desk Opt Out
ShareThis	To track visitor's website navigation, activity and preferences when sharing with social media platforms.	ShareThis Privacy Notice	ShareThis Opt Out
SiteCore	To enhance user experience, enable personalized content, and track site usage to improve performance.	Sitecore Privacy Policy	Sitecore Opt Out
Casale Media	To track user interactions and behaviors to deliver personalized ads.	Casale Media Privacy Policy	Casale Media Opt Out
BidSwitch	To track user interactions and behaviors to deliver personalized ads.	BidSwitch Privacy Policy	BidSwitch Opt Out
HotJar	To identify and track user behavior to improve the website.	Hotjar Privacy Policy	Do Not Sell or Share: CLA (CliftonLarsonAllen)
OneTrust	Used for cookie choice management and consent tracking.	OneTrust Privacy Notice	Strictly Necessary Cookie
ServiceNow	To track user preferences and sessions.	ServiceNow Privacy Statement	Strictly Necessary Cookie
Cloudflare	To enhance website performance, security, bot mitigation, and functionality.	Cloudflare's Privacy Policy	Strictly Necessary Cookie

Control and update marketing communications

If you believe your information is outdated, you can make a request to update or remove your information by sending us an email at the below address, calling us at the below telephone number, writing to us at the below address, or contacting us here.

If you do not want to receive email or phone calls from us in the future, please let us know by sending us an email at the address below, writing to us at the address below, or contacting us here. To stop receiving emails from CLA, click "Unsubscribe" in one of our emails, or visit our subscription center to update your preference.

Sale or sharing of personal information

We may share your information as follows:

With CLA subsidiaries, to provide services to you or inform you about our services;
With third-party service providers;
To comply with court orders, subpoenas, government investigations, or law enforcement requirements;
In the course of any reorganization process including, but not limited to, mergers, acquisitions, and sales of all or substantially all of our assets.

We do not sell personal information collected through this Site, through CLA applications or as part of the services being provided. We have not done so for the past 12 months.

Legal basis of processing

We rely on the following legal basis for processing your personal information.

Contract: To conclude or perform a contract with you; for example:
- To provide our Services;
- To manage our accounts and records;
- To handle your inquiries and requests.
Legitimate Interests: We process your Personal Information for our legitimate interests. You have the right to object to processing that is based on our legitimate interests, as described in the “Your rights and choices” section of this policy. Examples of legitimate interests include:
- To respond to your customer service inquiries and requests for information;
- To maintain, improve, and analyze our website and Services we offer;
- To conduct marketing activities;
- To detect, prevent, or investigate security breaches or fraud; and
- To facilitate the functionality of our Site.
Legal Compliance: To comply with our legal obligations; for example:
- To maintain appropriate records for internal administrative purposes and as required by applicable law.
Consent: We process your Personal Information where you have given us permission to do so.
- For example, we will only send you information on sales and promotions where you have opted in to receiving those communications. Whenever processing is based on consent, you may withdraw your consent at any time.

Data security

At CLA, we place a priority on maintaining the confidentiality and privacy of your information, and we adhere to all applicable professional standards to protect confidentiality, including maintaining internal policies, procedures, and safeguards. However, data submitted via the internet is never completely secure. By accessing this website, you willingly accept and acknowledge all risks associated with such use.

If we learn of a breach of personal information, we may attempt to notify you electronically so that you can take appropriate steps. By using the Services or providing personal information to us, you agree that we can communicate with you electronically regarding security, privacy, and administrative issues related to your use of the Services. We may post a breach notice on our website or send an email to you at the email address you have provided. Depending on your location, you may have the legal right to receive written notice of a security breach.

Data retention

We will retain your personal information only for as long as is necessary for the purposes it was collected as explained in this policy or as legally obligated.

We utilize the following criteria to determine the length of time for which we retain personal information:

The nature and length of our relationship with you;
The business purposes for which the information was collected;
Legal or contractual obligations;
As necessary to defend against potential legal claims;
As necessary to detect or prevent potential illegal activity, secure our systems and online environment, or protect health and safety;
As necessary to comply with internal records retention policies.

Automated decision making

We do not engage in automated decision-making that produces legal effects or similarly significant impacts on individuals. All decisions involving personal data are reviewed and made by qualified personnel.

Cross border transfer for your personal information

CLA operates in multiple jurisdictions and your personal information may be transferred across national boundaries.

Where we transfer your personal information across national boundaries, we will protect your personal information by ensuring that those transfers are made in compliance with all relevant data protection laws. Generally, this means where we transfer your personal information either to a CLA international affiliates or to a third party that is located in a country which does not have adequate privacy protection, we will put in place a contract with the recipient of the personal information that includes the standard international data transfer contractual terms approved by the UK Information Commissioner’s Office and/or the European Commission, as applicable.

If you would like further details of how your personal information is protected when transferred from one country to another, then please email us at privacy@CLAConnect.com.

Children privacy protection

Our website is not intended for children under 16 years of age. No one under age 16 may provide any information to or on the website. We do not knowingly collect personal information from children under 16. If you are under 16, do not use or provide any information on this website or provide any information about yourself to us, including your name, address, telephone number, email address, or any screen name or username you may use. If we learn we have collected or received personal information from a child under 16 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 16, please contact us at privacy@CLAconnect.com.

Residents of certain states under 13, 16, or 18 years of age may have additional rights regarding the collection and sale of their personal information. Please see your state’s privacy rights for more information.

Your rights and choices

Applicable laws and regulations provide consumers with specific rights regarding their personal information. This section summarizes your rights and explains how to exercise those rights.

Right to opt-out of sharing or target advertising

You have the right to request that your personal information is not shared with third parties for targeted advertising. You can initiate your right by following the instructions located here.

Right to revoke your consent

You have the right to withdraw your consent previously provided especially where sensitive personal information has been collected.

Right to object to any processing based on legitimate interests

You have the right to object to the processing of personal information where legitimate interests has been identified for lawful basis.

Right to know

You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months.

Right to access and portability

You have the right to request access to and to obtain a copy of your personal information.

Right to correct or delete

You have the right to request that we correct or delete any of your personal information that we collected from you and retained, subject to certain exceptions.

Denial of or limitation of rights

We may deny or limit your rights based on the limitations identified within United States or international privacy laws and where it is necessary for us or our service providers to:

Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
Debug products to identify and repair errors that impair existing intended functionality.
Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement, if you previously provided informed consent.
Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
Comply with legal and regulatory obligations.
Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

Exercising your rights

To exercise your rights described above, please submit a verifiable consumer request to us by either:

Calling us at 888-529-2648.
Or complete our Consumer Rights Request form.

Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information.

You may also make a verifiable consumer request on behalf of your minor child. You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:

Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.
Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use personal information provided in a verifiable consumer request to verify the requestor's identity or authority to make the request.

Response timing and format

We endeavor to respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request's receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Right to file a complaint or appeal

If you are not satisfied with our use of your personal information or our response to any request by you to exercise your rights, or if you think that we have breached any relevant data protection laws, then you have the right to file a complaint with the data protection authority that supervises our processing. Please refer to your state’s privacy law to file a complaint or submit an appeal.

In the UK, this is the UK Information Commissioner’s Office. Details of the ICO can be found at https://ico.org.uk.

Your general data protection regulation rights

Individuals in the European Union may have additional rights, including to be informed how their personal data is being processed, to be sent a copy of their personal data, to correct inaccurate personal data, and to request that their data be deleted.

You may exercise your rights by submitting a request through our GDPR Rights Request Form, by emailing privacy@CLAconnect.com, or by writing to us at the address at the bottom of this page.

Non-discrimination

We will not discriminate against you for exercising any of your rights. Unless permitted by law, we will not:

Deny you goods or services.
Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
Provide you a different level or quality of goods or services.
Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

How we respond to “do not track” signals

The Site does not respond to "do not track" requests or similar features.

Opt-out preference signals

Some browsers and browser extensions support opt-out preference signals like the Global Privacy Control (GPC), which can indicate your choice to opt-out of certain types of data processing, including data sales and sharing. GPC is a browser-level setting managed by either a browser or a browser extension that a user or privacy-focused technology can set. We will make efforts to detect such signals and respect your choices as required by applicable law.

Links to third-party sites

Links to information on sites other than those operated by, or on behalf of, CliftonLarsonAllen LLP are for your convenience only and are not an endorsement or recommendation of those sites.

How to contact us

If you have any questions about our privacy policy or our data practices, please do not hesitate to contact us.

Email us at privacy@CLAconnect.com.

Our postal address is:

CliftonLarsonAllen LLP
Attn:Privacy
220 South Sixth Street, Suite 300
Minneapolis, MN 55402

Call us at 888-529-2648.