Privacy Policy

Effective Date: December 1, 2025

This Privacy Notice (the “Notice”) describes how Offit Kurman (“Firm,” “we,” “our,” or “us”) processes the personal information of our website visitors, users of our social media accounts, clients, and others who share personal information with us.  The Notice sets forth the Firm’s practices regarding the collection, use, and disclosure of personal information collected on our website (the “Site”), through our social media accounts, and in connection with your communications and interactions with us.  It also explains the rights and choices you may have regarding the information that you share with us that we process.

Note that if we have entered into other agreements with you, the agreement will control. This Notice also does not apply to information that we collect and process under a client engagement that is protected by attorney-client privilege. 

This Notice does not create an attorney-client relationship between the Firm and any user of the Site.

I. Definitions

“Personal Information” means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household. Personal Information does not include:

• Publicly available information from federal, state, or local government records, or information that we have a reasonable basis to believe is lawfully made available to the general public by you, or from widely distributed media, or made available by someone you disclosed the information to without restricting that information to a specific audience.
• Information that is truthful and lawfully obtained that is a matter of public concern.
• Medical or Protected Health Information covered by the California Confidentiality of Medical Information Act (“CMIA”), medical records as defined by the Confidentiality of Maryland Records Act, health records for purposes of Virginia’s Title 32.1 (Health), the Health Insurance and Portability and Accountability Act of 1966 (“HIPAA”) or the Health Information Technology for Economic and Clinical Health Act (“HITECH”).
• Information subject to certain specific privacy laws, including the Fair Credit Reporting Act (“FCRA”), the Gramm-Leach-Bliley Act (“GLBA”), the California Financial Information Privacy Act (“FIPA”) and the Driver’s Privacy Protection Act of 1994.
• De-identified or aggregated information that no longer identifies an individual.

 “Sensitive Personal Information,” is a subset of Personal Information and includes information that reveals an individual’s social security number, driver’s license or state identification card number, passport number, financial account, debit card, or credit card number or other account number in combination with any required security or access code, password, or credentials; log in credentials, precise geolocation information; racial or ethnic origin, religious beliefs, union membership; contents of email or text messages; genetic data; biometric information that is processed for the purpose of uniquely identifying an individual and Personal Information collected and/or processed or analyzed concerning an individual’s health, sex life, or sexual orientation.  Sensitive Personal Information does not include information that is publicly available.

Other capitalized terms not defined here have the meaning given to them in the California Consumer Privacy Act.

---

II. What Personal Information do we collect?

We may collect Personal Information from you automatically when you visit and navigate through the Site.  We will collect Personal Information that you voluntarily provide to us when you fill out forms on the Site such as the Contact Us form.

If you register for or attend one of our events, we will collect Personal Information from you or about you. We may also receive your Personal Information from other sources, such as third parties (e.g., service providers or events) or other publicly available information sources.

We may collect Personal Information that you voluntarily provide to us when you interact with our official social media accounts, such as when you comment on or message our pages. We process such information in accordance with this Notice and the applicable privacy policies of the relevant social media platforms.

We may collect, and have collected in the preceding twelve (12) months, the following categories of Personal Information:

• Identifiers including first name, last name, username or other similar identifier, unique identification numbers, postal address, email address, telephone numbers, and Internet Protocol (IP) address;
• Account Information including credit card numbers, expiration dates, and CVV codes; bank account information, wire transfer information;
• Geolocation data (approximate location such as city or region), derived from IP address;
• Communications including the contents and metadata of our communications with you through the website, by email, text message (SMS or MMS), telephone call and our communications with you by mail;
• Internet or other similar network activity including browsing history, search history, information on a user’s interaction with a website, application or advertisement;
• Other personal information from which to draw inferences, including information for creating a profile reflecting one’s preferences, characteristics, behavior, attitudes, intelligence, abilities and aptitudes.
• Professional or Employment Related Information, including resumes, licensures information, or references.
• Cal. Civ. Code § 1798.80 personal information to the extent not already included in the other categories listed here.

Sensitive Personal Information. Unless we specifically request it, we ask that you refrain from disclosing to us or sending us any Sensitive Personal Information on or through the Site.

Where we have requested and you have provided Sensitive Personal Information, please note that our use of Sensitive Personal Information is only limited to what is necessary to perform the services an average person would reasonably expect when obtaining such services or for legal compliance purposes. We do not infer characteristics from the Sensitive Personal Information that we collect.

---

III. Collection of Usage Data

When you interact with us digitally, we may automatically collect certain information through the use of cookies or other similar tracking technologies.  This information generally does not reveal your specific identity (like your name or contact information) but may include device, internet traffic and usage information, such as your browser and device characteristics, operating system, language preferences, referring URLs, device name, general location, and information about how and when you use our Site and services. This information is primarily needed to maintain the security and operation of our website and Services, to monitor performance and availability, and for our internal analytics and reporting purposes.

Types of Usage Data We Collect

The usage data we collect may include the following categories:

• Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our services and which we record in log files.
  Our Site is hosted and managed by a third-party hosting provider.  According to our provider, their server logs associated with our Site do not include personally identifiable information or machine-specific identifiers toed to individual users. Instead, log data is limited to general, aggregated technical information used to support website functionality, performance, uptime, and security, such as overall traffic volume and system health metrics.  This information is not used to identify, profile, or track individual visitors.
• Device Data. We collect device data such as information about your computer, phone, tablet, or other device you use to access our Site. Depending on the device used, this device data may include information such as your device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information. Any location information collected is typically approximate and derived from IP‑based data, rather than precise location tracking.

Website Analytics

We use Google Analytics (GA4), a third‑party website analytics service provided by Google, to help us understand how visitors interact with our website. Google Analytics collects information such as pages visited, time spent on pages, referring websites, and general usage patterns.

The information collected through Google Analytics is used only in an aggregated and non‑identifying manner to monitor performance and improve website content. We do not use Google Analytics to intentionally identify individual visitors or to create user profiles. Google processes this information in accordance with its own privacy policies.

SOURCES FROM WHICH WE COLLECT YOUR PERSONAL INFORMATION

• Direct interactions with you. You may provide us with your Personal Information by filling in forms, interacting with us through our social media accounts, or corresponding with us, including by mail, telephone, email correspondence or otherwise.
• Service Providers.  We may collect personal information about you from our service providers, including IT service providers, website hosting services providers, social media service providers, and other vendors that support our business operations.
• Automated technologies or interactions. We may collect certain information about your device, browsing actions, and usage patterns to support the security, operation, and performance of our services.

---

IV. THE PURPOSES FOR WHICH WE USE YOUR PERSONAL INFORMATION

We may use your Personal Information for the business and commercial purposes set forth below.  We process your Personal Information for a variety of reasons, depending on how you interact with our Services.  The table below shows the purposes for which we use your information and the legal basis upon which we rely for such processing, including:

Where the legal basis for processing your Personal Information is our legitimate interests, those interests are to use Personal Information to conduct and develop our business activities with users and with others in order to support our reputation and growth, while limiting the use of Personal Information to those purposes that strictly support the conduct and development of our business within the reasonable expectations of the individuals concerned.

Offit Kurman will not Sell your Personal Information.  We will not Share your Personal Information with third parties for cross-context behavioral advertising purposes. 

We reserve the right to use any de-identified or aggregated information – information that does not directly or indirectly identify you – at our sole discretion.

---

V. DISCLOSURE OF YOUR PERSONAL INFORMATION

We may share your Personal Information with the categories of parties mentioned below for the purposes set out above.

• We may disclose your Personal Information to our Service Providers and Contractors.  These may be vendors who provide IT and telecommunications services in connection with website services, and accounting, insurance or other professional services such as consulting services.  We do not allow our third-party service providers to use your personal data for their own purposes and only allow them to process your personal data for specific purposes and in accordance with our instructions. We require all third parties to implement and maintain commercially reasonable technical, organizational, and administrative measures to protect the security of your personal information and to treat it in accordance with the law.
• In connection with the Firm’s marketing and business development efforts, we may disclose your information to existing or potential clients.
• In the event of a merger or sale of business or assets, we may disclose your personal information to third parties to whom we may choose to sell, transfer or merge all or a portion of our business or assets. We may also seek to acquire or merge with other businesses. If there is a change in our business, the new owners will be able to use your personal information in the same way as set out in this privacy notice.
• We may disclose your personal information if we are required to do so by law enforcement, or if we are otherwise under a legal obligation to make the disclosure.
• We may disclose your Personal Information to those parties involved in resolving a dispute, including court reporters, notaries, videographers, trial consultants, and other attorneys.
• We may disclose Personal Information if it is necessary to comply with the law, including to relevant government authorities, or regulators. 
• We may disclose Personal Information to courts of law, law enforcement, arbitration panels or tribunals or other third parties when it is reasonably necessary to establish or defend a claim, and to protect the rights, property, and safety of the Firm, our personnel, and others.

In the preceding twelve months, we have disclosed Personal Information to our service providers, parties involved in a dispute; law enforcement; and courts of law, in accordance with the above-referenced scenarios.

---

VI. International Transfers of Personal Information

Offit Kurman is based in the United States, but our services are global.  The Personal Information that we process may be stored at or transferred to countries where we engage service providers. By visiting the Site or using our services, you understand that your Personal Information may be transferred to countries outside of your residence jurisdiction which may have data protection laws that are different from those of your country or region. In certain circumstances, law enforcement agencies, regulatory agencies, or judicial agencies may be entitled to access your Personal Information.

We take reasonable steps to safeguard your Personal Information and will ensure that our service providers to whom we provide your Personal Information are bound by contractual obligations to protect your Personal Information, including transferring your Personal Information in accordance with applicable data protection laws.

---

VII. HOW LONG DO WE RETAIN YOUR PERSONAL INFORMATION?

We follow the Firm’s Data Retention Policy.  The period of time we retain your Personal Information depends on the nature of the information and the context in which it was received.  We will retain Personal Information for as long as reasonably necessary to fulfil the purposes for which we collected it, including to meet any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal information for a longer period in the event of a complaint or if we reasonably believe that there is a prospect of litigation concerning our relationship.

---

VIII. INFORMATION ABOUT MINORS

We do not knowingly collect Personal Information from minors. Any information about your children or dependents who are under the age of 18 is provided by you voluntarily and with your consent.  Offit Kurman does not Sell or Share Personal Information, and we do not have actual knowledge that we Sell or Share the Personal Information of those under the age of 16.

---

IX. SAFEGUARDING YOUR PERSONAL INFORMATION

We have implemented appropriate and reasonable physical, technical, and organizational security measures designed to protect the security and integrity of any Personal Information we process. In addition, we limit access to your Personal Information to employees, agents, contractors and other third parties who have a business need to know. They will only process your Personal Information on our instructions and are subject to a duty of confidentiality.

However, please note that despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Site and use the services within a secure environment.

---

X. YOUR PRIVACY RIGHTS

You may always opt out of receiving communications from us even after you have signed up for or subscribed to our alerts, blogs, or other content.  You may do so by clicking on the “Unsubscribe” link to our email communications or contacting us via the information at the end of this Notice and indicating your wish to opt-out.

Further, depending on where you live, you may have rights under certain applicable US state data protection laws. However, please note that these rights are not absolute, and in certain cases, we may decline your request as permitted by law.

These state‑specific rights apply only where Offit Kurman is subject to the applicable state privacy law. Certain exemptions or limitations may apply based on the nature of our activities and your relationship with the Firm.

Rights and Choices for California Consumers

The California Consumer Privacy Act provides certain rights to you to control the processing of your Personal Information, subject to certain exemptions.  These include:

Rights and choices for Maryland residents.

The Maryland Online Data Privacy Act may provide certain consumer rights to you, subject to certain exemptions.  These include:

Rights and choices for Texas residents

The Texas’ Data Privacy and Security Act provides you with the following consumer rights, subject to certain exemptions.  These include:

HOW TO EXERCISE YOUR RIGHTS:

You may exercise any of your rights by (1) submitting a request by email to privacy@offitkurman.com; (2) calling us at 1-888-409-1276, our toll-free telephone number.

Please be aware that we may need to ask you to provide a few pieces of Personal Information that we can use to match our records to verify your identity. We may also require you to submit a signed declaration under penalty of perjury stating you are the individual whose Personal Data is subject to the request.  We may not be able to respond to your request if you decline to provide the verifying details or if any of the details are incorrect. 

You may be able to exercise your rights through the assistance of an Authorized Agent, as defined by the California Consumer Privacy Act. We must verify the Authorized Agent’s authority to act on your behalf prior to addressing your request. Where the Authorized Agent is submitting a request to know, to correct, or to delete personal information, the request must be accompanied by: (1) a power of attorney that is valid under California law authorizing the agent to act on your behalf; and (2) verification of your own identity with us. Where the Authorized Agent is submitting a request to opt-out of Sales or Sharing, the request must be supported by a signed permission demonstrating that the agent is authorized by you to act on your behalf.

In general and unless otherwise stated in the above sections describing your rights, we will respond to your request within forty-five (45) days.  If necessary, we may extend the time to respond by a further forty-five (45) days.  If for any reason we decide to decline to respond to your request, we will notify you and provide our explanation and any appeal process that may be available to you.

Rights and Choices for European Users

If you are a resident of the European Union or the European Economic Area, please see the section titled “Supplemental Information for European Users.”

---

XI. UPDATING YOUR PERSONAL INFORMATION

We encourage you to keep your Personal Information accurate and up to date. You are responsible for notifying us of any changes to your Personal Information that you provide to us.

---

XII. Contact Us

Offit Kurman, with offices at 1954 Greenspring Dr Suite 605, Timonium, MD 21093, is the data controller for the Site.  If you have any questions or concerns about our privacy practices, please contact us at:

Email: privacy@offitkurman.com

Telephone: 1-888-409-1276

Supplemental Information for European Users

Data controller

Offit Kurman, with offices at 1954 Greenspring Drive, Suite 605, Timonium, MD 21093, is the controller of any Personal Data collected from you.

If you have any questions about this Privacy Notice, including any request to exercise your rights, please contact us via the following methods set out below.

Contact details:

IT Security Administrator

Email: privacy@offitkurman.com

Telephone No.: +1-888-409-1276 or 1-410-209-6400

International Transfers of Your Personal Data

We are headquartered in the United States, a country that the European Commission has deemed to not provide an adequate level of data protection.  Further, our affiliates and our third-party service providers having access to Personal Data may be located outside of the European Economic Area (“EEA”), and not always in a country that is recognized as having an adequate level of protection for Personal Data.  Personal Data may therefore be transferred outside of the EEA.  These transfers are necessary to perform our agreement with you or implement pre-contractual measures at your request. In some cases, the transfer is necessary to conclude or perform a contract in your interest, such as to provide services.

We ensure that a similar level of protection as that you enjoy in the EEA is given to your Personal Data by requiring that transfers to a service provider located outside of the EEA are covered by an appropriate transfer mechanism, including [the EU-U.S. Data Privacy Framework or] the EU Standard Contractual Clauses approved by the European Commission.  Please contact us if you would like further information about the specific mechanism we use when transferring your Personal Data out of the EEA.  You have the right to obtain a copy of the contract under which your Personal Data is transferred outside of the EEA.  To do so, please contact us through the means listed above.

Data Subject Rights

The General Data Protection Regulation (“GDPR”) provides you, the data subject, with certain rights.  These include:

• The Right to Access to your Personal Data. This allows you to receive a copy of the Personal Data we hold about you and to verify that we are lawfully processing it.
• The Right to Rectification of your Personal Data. This allows you to have incomplete or inaccurate data we hold about you amended or corrected.  Please note that we must verify the accuracy of the new data you provide to us.
• The Right to Object to the Processing of your Personal Data where we are relying on a legitimate interest (or those of a third party) and there is an element of your particular situation that causes you to object to processing on that ground, as you believe it has an impact on your fundamental rights and freedoms. You also have the right to object where we process your Personal Data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information that override your rights and freedoms.
• The Right to Erasure of your Personal Data (commonly referred to as the “right to be forgotten”). You can ask us to erase or delete Personal Data when we have no valid reason to continue processing it. You also have the right to ask us to erase or delete your Personal Data where you have successfully exercised your right to object to processing (above), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Please note, however, that we may not always be able to comply with your request for erasure for specific legal reasons.  If that is the case, we will notify you of those legal reasons at the time of your request. 
• The Right to Request the Restriction of the Processing of your Personal Data. You may ask us to suspend the processing of your personal data in the following scenarios:
  • If you want us to establish the accuracy of the data.      
  • When our use of the data is unlawful, but you do not want us to erase it.           
  • When you need us to keep the data even if we no longer need it because you need it to establish, exercise or defend legal claims.          
  • You have objected to our use of your data, but we need to check whether we have overriding legitimate grounds for using it.
• The Right to Request the Transfer of your Personal Data to you or a third party (commonly referred to as the right to data portability).  We will provide you, or a third party you choose, with your Personal Data in a structured, commonly used and machine-readable format. Note that this right only applies to automated information that you initially consented to us using or where we used that information to perform a contract with you. 
• The Right to Object to Direct Marketing (including profiling). You may object to our use of your Personal Data (including profiling) for direct marketing purposes, such as when we use your Personal Data to invite you to our promotional events.
• The Right to Withdraw your consent at any time where we rely on it to process your Personal Data. However, please note that withdrawing your consent will not affect the lawfulness of any processing that was carried out before you withdrew your consent. If you withdraw your consent, we may not be able to provide you with certain products or services. We will inform you if this is the case at the time you withdraw your consent.

Please note that some of these rights may be limited, such as where we have an overriding interest or legal obligation to continue to process the data.

Exercising Your Rights

If you wish to exercise any of the rights set out above, please contact us by email and use the subject line “GDPR DSAR.” We will generally respond to your request within thirty (30) days.  Where the request is more complex or if you have made multiple requests, we may extend our response time by another thirty (30) days for a total of sixty (60) days.  If this is the case, we will inform you before the expiration of the first thirty (30) days.

No fees are generally charged

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is manifestly unfounded, repetitive or excessive. We may also refuse to comply with your request in these circumstances.

What we may need from you

We may ask you for specific information to help us confirm your identity prior to processing your request to access your personal data (or exercise any of your other rights). This is a security measure to ensure that personal data is not communicated to a person who does not have the right to receive it. We may also contact you to request additional information in connection with your request in order to expedite our response.

Right to Lodge Complaint

Finally, you have the right to lodge a complaint with the data protection supervisory authority if you believe that your Personal Data is being processed in violation of the GDPR.  You may lodge a complaint with the supervisory authority in the Member State of your residence, your place of work, or where the alleged infringement occurred.  However, we would appreciate it if you could contact us first and give us the opportunity to process your requests and attempt to resolve any issues in advance.