I. INTRODUCTION

Baker Tilly Virchow Krause, LLP, whose principal office is located in the State of in Illinois, United States of America (the “United States") controls and operates the following data processing systems (referred to herein as the “Systems") that are certified under the voluntary U.S.- EU Safe Harbor program (the “Safe Harbor Program").

Baker Tilly Virchow Krause, LLP will process employee data for the purposes of employee compensation planning and management.
Baker Tilly Virchow Krause, LLP will process data associated with providing accounting, auditing and consulting services to its clients.
Baker Tilly Virchow Krause, LLP may also process personal data that includes employee contact information such as telephone number, address, or line of business.
Baker Tilly Virchow Krause, LLP recognizes the privacy protections afforded to individuals in the European Union and the European Economic Area (collectively the “EEA") with regard to Personal Information (as defined below). Baker Tilly Virchow Krause, LLP will adhere to the voluntary U.S. – EU Safe Harbor program by adopting and implementing this set of Safe Harbor Privacy Principles which include a set of frequently asked questions (collectively, the “Principles").

II. PRINCIPLES

The Principles (Notice, Choice, Onward Transfer, Access, Security, Data Integrity, Enforcement) apply to all Personal Information that is (1) collected by Baker Tilly Virchow Krause, LLP about an individual located in the European Union or if data is received from an EU affiliate; (2) transferred from the EEA to Baker Tilly Virchow Krause, LLP in the United States after the effective date of these Principles and included in the Guideline information. The effective date of these Principles is June 30, 2010.

FREQUENTLY ASKED QUESTIONS

What is “Personal Information"?
Personal Information means any information (information defined in the Sensitive Information section of the Notice and Choice) relating to an individual that identifies that individual, or could reasonably be used to identify the individual and that is recorded in any form (e.g. paper, electronic, video, audio) and included in the Guideline Information.
Who is an Individual for Purposes of these Principles?
An individual is any natural person whose Personal Information is included in the Guideline Information.
What is the relationship between the Principles and the Safe Harbor Program?
The Principles implement and satisfy the requirements of the Safe Harbor Program and establish the legally required level of protection for the individual’s Personal Information.
A. NOTICE AND CHOICE

1.  Collection and Use of Personal Information
Baker Tilly Virchow Krause, LLP collects and uses Personal Information only in a lawful manner and in compliance with the Safe Harbor Program and these Principles.

FREQUENTLY ASKED QUESTIONS

a.  Why is personal Information transferred to Baker Tilly Virchow Krause, LLP in the Guideline Information?
The collection and use of Personal Information is for the purpose of maintaining compliance by Baker Tilly Virchow Krause, LLP and its Affiliate Entities with certain legal and accounting requirements.

2.  Informing the Individual and Obtaining Consent
Except where an applicable legal exceptions exists, Baker Tilly Virchow Krause, LLP and /or Affiliated Entity is legally required to inform individuals of the ways in which their Personal Information will be collected and used and the types of third parties to which such information will be disclosed and to obtain the individual’s consent. Accordingly, except where an applicable legal exception exists, Baker Tilly Virchow Krause, LLP shall notify individuals of the following:

The type(s) of personal Information Baker Tilly Virchow Krause, LLP plans to use.
The purpose for which Baker Tilly Virchow Krause, LLP will process Personal Information.
How to contact the Affiliated Entity or Baker Tilly Virchow Krause, LLP with any inquires or complaints about the use and processing of such Personal Information.
The types of parties to whom Baker Tilly Virchow Krause, LLP will disclose Personal Information and
The right of individuals to access and, if necessary, correct Personal Information about them.
This information will be provided before Baker Tilly Virchow Krause, LLP uses or discloses Personal Information or as soon thereafter as is practicable.
FREQUENTLY ASKED QUESTIONS

a. Are there any cases where Baker Tilly Virchow Krause, LLP may disclose Personal Information about an individual without obtaining the individual’s consent?
In certain cases, and in accordance with the Safe Harbor Program, Baker Tilly Virchow Krause, LLP may disclose Personal Information about an individual without the individual’s consent, such as, for example, when Baker Tilly Virchow Krause, LLP is required to disclose the information by law or legal process or in order to conduct an investigation of the facts alleged in a complaint received by Baker Tilly Virchow Krause, LLP. In such circumstances, and at such time as may be required by law or the Safe Harbor Program, Baker Tilly Virchow Krause, LLP and/or Affiliated Entities, as appropriate, shall inform the individual whom to contact if the individual has a legitimate reason to object to the disclosure of the individual’s Personal Information by Baker Tilly Virchow Krause, LLP.

b. Under what circumstances may Baker Tilly Virchow Krause, LLP disclose Personal Information to agents and contractor, and what steps does Baker Tilly Virchow Krause, LLP take to safeguard that Personal Information?
As a part of its normal business operation, Baker Tilly Virchow Krause, LLP may hire agents and contractors to carry out certain functions that require use of Personal Information. Baker Tilly Virchow Krause, LLP is not required by the Safe Harbor Program to provide notice or obtain the relevant individual’s consent in these circumstances and Baker Tilly Virchow Krause, LLP does not generally do so. Those agents or contractors have obligated themselves to observe the relevant Principles (or adopt another form of adequate protection for the Personal Information) and Baker Tilly Virchow Krause, LLP restricts the use and the retention of the Personal Information to the purposes and duration of the functions for which the agent or contractor was hired.

c. What happens if an individual objects to the collection, use or disclosure of his/her Personal Information by Baker Tilly Virchow Krause, LLP?
If an individual objects to Baker Tilly Virchow Krause, LLP’s collection, use or disclosure of certain Personal Information, Baker Tilly Virchow Krause, LLP and/or Affiliated Entities will make reasonable efforts to address the concerns of the individual.

d. Will Baker Tilly Virchow Krause, LLP take adverse action against the individual for refusing to permit his/her Personal Information to be collected, used or disclosed?
The Safe Harbor Program prohibits a company that subscribes to the Safe Harbor Program from taking unreasonable action in such circumstances. Baker Tilly Virchow Krause, LLP reserves the right, in circumstances permitted by applicable law and Safer Harbor Program to collect, use or discloses Personal Information without the consent of the relevant individual.

3. Sensitive Information
While recognizing that all Personal Information deserves to be protected in accordance with the Safe Harbor Program, Baker Tilly Virchow Krause, LLP exercises special precautions and safeguards for any sensitive information it may collect, as defined by the Safe Harbor Program.

FREQUENTLY ASKED QUESTIONS


a. What is “sensitive information"?
“Sensitive Information" includes Personal Information specifying racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and health or sexual orientation.
 

b. What safeguards are required for “sensitive information"?
Except as permitted by the Safe Harbor Program or applicable law, affirmative permission of the individual is required to process “sensitive information" and to disclose such information to a third party or use such information for purposes other than those for which it was originally collected or subsequently authorized by the individual.

B. ONWARD TRANSFER
To disclose information to a third party, Baker Tilly Virchow Krause, LLP applies the Notice and Choice Principles. Baker Tilly Virchow Krause, LLP ascertains that the third party subscribes to the Principles or is subject to the Directive or another adequacy finding or enters into a written agreement with such third party requiring that the third party provide at least the same level of privacy protection as is required by the relevant Principles.

C. ACCESS
Baker Tilly Virchow Krause, LLP provides individuals about whom it maintains Personal Information with a reasonable opportunity to examine their information to challenge its accuracy and to have it corrected, amended or deleted as appropriate, subject to certain exceptions.

FREQUENTLY ASKED QUESTIONS
 

a. How do individuals exercise their rights under the Access Principle?
Individuals may exercise a right to access Personal Information maintained about them by Baker Tilly Virchow Krause, LLP. Reasonable access applies to both the process of accessing Personal Information and the types of Personal Information to be accessed. In terms of process, reasonable access means, for example, that requests for access are made during normal business hours; following standard procedures and that the frequency of access requests is not excessive. In terms of types of Personal Information to be accessed, reasonable access recognizes certain exceptions discussed in the immediately following FAQ 2. If Baker Tilly Virchow Krause, LLP or Affiliated Entity denies an individual access, however, such individual will be provided with the reason(s) access was denied and a contact point for further inquiries.

If Baker Tilly Virchow Krause, LLP or an Affiliated Entity is notified that Personal Information it maintains is incorrect, is required to correct the Personal Information, and is provided with appropriate supporting documentation, Baker Tilly Virchow Krause, LLP or the Affiliated Entity will either correct the information or direct the individual to the source of the information for correction. If, upon review, Baker Tilly Virchow Krause, LLP or the Affiliated Entity believes that the existing information is correct, the individual will be informed accordingly.
 

b. Is there any Personal Information about an individual maintained by Baker Tilly Virchow Krause, LLP that such individual would not be permitted to access?
Yes, there are some exceptions to the obligation to provide access permitted by the Safe Harbor Program. These include access to confidential or proprietary information of either an Affiliated Entity or Baker Tilly Virchow Krause, LLP, and situations in which granting access might have to be balanced against the privacy interests of others. In addition, access may be denied when the Personal Information requested relates to an ongoing investigation concerning the individual, litigation or potential litigation or where the burden or expense of providing access would be disproportionate to any risk s to the individual’s privacy that would arise from not providing access.


D. DATA INTEGRITY
Baker Tilly Virchow Krause, LLP employs reasonable steps to keep Personal Information accurate, complete and up-to-date for the purposes of which Personal Information is used.
 

E. SECURITY
Baker Tilly Virchow Krause, LLP takes reasonable precautions, including administrative, technical, personnel and physical measures to safeguard Personal Information against loss, theft and misuse, as well as unauthorized access, disclosure, alteration and destruction.

FREQUENTLY ASKED QUESTIONS
 

a. How are decisions reached about who has access to Personal Information about individuals?
It is the policy of Baker Tilly Virchow Krause, LLP to give access to Personal Information about individuals only to those entities and persons that Baker Tilly Virchow Krause, LLP determines have a legitimate need to know the information to carry out their responsibilities.
 

b. What keeps those with access to some of an individual’s Personal Information from browsing through other parts of that Personal Information of other reasons?
It is the policy of Baker Tilly Virchow Krause, LLP to limit the access to Personal Information given to employees, agents and contractors to such information that Baker Tilly Virchow Krause, LLP determines is needed to carry out their responsibilities.


F.  ENFORCEMENT

1. COMPLIANCE
Baker Tilly Virchow Krause, LLP maintains an active program to ensure compliance with Principles, Safer Harbor Program and Baker Tilly Virchow Krause, LLP’s contractual agreements and other commitments regarding the handling of Personal Information.

Baker Tilly Virchow Krause, LLP’s Privacy Compliance Officer is responsible for implementing and overseeing the administration of the Principles. It is the responsibility of all Baker Tilly Virchow Krause, LLP’s employees to act in accordance with the Principles with respect to Personal Information. Failure to so, may result in disciplinary action up to and including discharge from employment.

FREQUENTLY ASKED QUESTIONS

a. What are the responsibilities of the Baker Tilly Virchow Krause, LLP privacy Compliance Officer?
Responsibilities of Baker Tilly Virchow Krause, LLP’s Privacy Compliance Officer include:

Ensuring that the privacy guidelines, programs, procedures, training and other measures necessary to implement the Principles are developed and put into practice.
Overseeing responses to inquires and resolution of complaints relating to Personal Information.
Working with legal advisors to ensure Baker Tilly Virchow Krause, LLP’s ongoing compliance with applicable privacy laws and agreements, as well as any obligations Baker Tilly Virchow Krause, LLP may enter into voluntarily, such as the Principles and the U.S. – EU Safe Harbor Program and
Overseeing periodic assessments of Baker Tilly Virchow Krause, LLP’s internal practices to ensure that they conform to the Principles and related company obligations.
b. What steps are taken to promote compliance with the Principles?
Compliance measures include:

Educating Baker Tilly Virchow Krause, LLP’s employees as to the purpose and application of the Principles.
Training Baker Tilly Virchow Krause, LLP’s employees with access to Personal Information on the purposes and application of the Principles.
Ensuring that Baker Tilly Virchow Krause, LLP’s employees, agents, and contractors with access to Personal Information are legally obligated to abide by the Principles.
Holding Baker Tilly Virchow Krause, LLP’s employees, agents, and contractors accountable for violations of the Principles, with sanctions up to and including termination of contracts and employment.
Having designated points of contact in Baker Tilly Virchow Krause, LLP, to answer questions regarding the Principles and Baker Tilly Virchow Krause, LLP’s privacy practices and to investigate complaints regarding conduct inconsistent with the Principles or related obligations.
2. Complaint Resolution
Baker Tilly Virchow Krause, LLP recognizes the importance of having mechanisms in place to address and resolve complaints by individuals about the processing of Personal Information. Therefore, if an individual makes a complaint about the processing of his/her Personal Information, and the complaint is not resolved to the individual’s satisfaction through internal Baker Tilly Virchow Krause, LLP procedures, then Baker Tilly Virchow Krause, LLP will refer such individual to the national data protection authority in the jurisdiction where the individual resides as required by the Safe Harbor Program. Jurisdiction for dispute resolution for Baker Tilly Virchow Tilly, LLP will be in the state of Illinois.

FREQUENTLY ASKED QUESTIONS

a. What are the procedures for filling an internal complaint about the handling for Personal Information by Baker Tilly Virchow Krause, LLP?
Individuals covered by the Principles should contact the Baker Tilly Virchow Krause, LLP Privacy Compliance Officer at the address given below. Baker Tilly Virchow Krause, LLP will investigate and attempt to resolve complaints and disputes regarding the use and disclosure of Personal Information in accordance with the Principles contained in this Policy.

b. What types of independent dispute resolution mechanisms are available?
For complaints that cannot be resolved between Baker Tilly Virchow Krause, LLP and the complainant Baker Tilly Virchow Krause, LLP has agreed to participate in the dispute resolution procedures of AICPA WebTrust pursuant to the Safe Harbor Principles. Baker Tilly Virchow Krause, LLP is domiciled in the state of Illinois. The state of Illinois will be the applicable jurisdiction for dispute resolution.

3. Changes to the Principles
Baker Tilly Virchow Krause, LLP reserves the right to modify these Principles at any time consistent with the requirements of Safe Harbor Principles. A notice will be posted on Baker Tilly Virchow Krause, LLP website (www.bakertilly.com) for 60 days whenever this Safe Harbor Policy is changed in a material way.

Contact Information

Inquires and comments regarding this policy are to be directed to Baker Tilly Virchow Krause, LLP’s Privacy Compliance Officer as follows:

Privacy Compliance Officer
Baker Tilly Virchow Krause, LLP
205 North Michigan Avenue
Chicago, IL 60601-5927
safeharbor@bakertilly.com