Policy

McKinsey & Company Recruitment Privacy Notice

Effective date January 20, 2021. Last reviewed October 3, 2023

McKinsey & Company Inc., and its subsidiaries and affiliates (“McKinsey”, “us,” or “we”) are committed to respecting your privacy and protecting your personal data. We define personal data broadly as information that directly identifies an individual or that makes an individual identifiable when combined with other information.

This Recruiting Privacy Notice (“Privacy Notice”) describes how we handle and protect your personal data in connection with McKinsey’s recruiting processes and programs. In case of a conflict between this Privacy Notice and applicable law, applicable law will govern.

This Privacy Notice only applies to the personal data of job applicants, potential candidates for employment or partnership, and those who participate in our recruiting programs and events.

By submitting your personal data to us, you acknowledge that:

• You have read and understood this Privacy Notice and agree to the use of your personal data as set out herein.
• Your personal data may be transferred and processed worldwide, including in countries that may not be deemed to provide the same level of data protection as your home country, for the purposes and in the manner specified in this Privacy Notice.
• You are not required to provide any requested information to us, but your failure to do so may result in our not being able to continue your candidacy for the job for which you have applied.
• All of your representations are true and correct to the best of your knowledge and belief, and you have not knowingly omitted any related information of an adverse nature. Providing any inaccurate information may make you ineligible for employment.
• This Privacy Notice does not form part of any contract of employment offered to candidates hired by McKinsey.

Personal data we collect

The types of personal data that we request from you and the ways that we process it are determined by a combination of the requirements of the country in which the role you apply for is located and the country in which you reside. Should you apply to more than one location or should the role to which you apply be available in more than one country, the types of personal data we request from you and the ways that we process it are determined by the requirements of all the countries in which the position is located in conjunction with the requirements of the country in which you reside.

We usually collect personal data directly from you when you apply for a role with us through our online application process, such as your name, address, contact information, work and educational history, achievements, identity documents, test results, any information that may be required due to legal requirements (e.g. residence or work permits) and other categories of data that you voluntarily decide to share with us. We also collect data about you which is created by our recruiting personnel in the course of their interactions with you during the recruiting process or through your participation in our interactive assessment tools. Where permitted by law, we may collect photographs or videos, including those obtained during our recruiting events or as part of the recruiting process itself. If you receive an offer from us, we may then conduct a background check and, to the extent permitted by applicable law, we may also collect data related to criminal offences and proceedings. We also collect similar personal data about you from third parties, such as professional recruiting firms, your references, prior employers, McKinsey employees with whom you have interviewed or who recommended your candidacy, and, to the extent permitted by applicable law, employment background check providers. We may also collect personal data about you online to the extent that you have chosen to make this information publicly available on professional social media websites. For example, we may find your profile on LinkedIn and contact you about suitable roles.

Sensitive personal data is a subset of personal data that includes ethnicity, health, trade union membership, philosophical beliefs, sexual orientation, and other categories as prescribed by law. We may collect sensitive personal data about a candidate to the extent permitted or required to do so by applicable laws (e.g., U.S. equal opportunity laws) and to support our efforts to create an inclusive and diverse work environment. Under limited circumstances and to the extent permitted by applicable law, we may also collect sensitive personal information relating to health and medical characteristics, , to address our public health and workplace safety obligations , to provide reasonable accommodations to facilitate the interview process (in case of disabilities) and to protect the Firm and its employees, clients, and third parties.

Use of your personal data

We collect and use your personal data for legitimate human resources and business management reasons, including:

• identifying and evaluating candidates for potential employment, as well as for future roles that may become available;
• maintaining records in relation to recruiting and hiring;
• ensuring compliance with legal requirements, including those relating to public health and workplace safety;
• fostering our diversity and inclusion programs and practices;
• if you receive an offer from us, conducting background checks, including, to the extent permitted by applicable law, criminal history checks;
• protecting our legal rights to the extent authorized or permitted by law; and
• protecting the workplace and communicating with medical professionals, law enforcement, or other public authorities in the event of an emergency or public health event, such as when the health or safety of you or one or more individuals may be endangered.

We may also use your personal data for McKinsey analytics purposes, including in aggregated/pseudonymized form, to improve our recruitment and hiring process and augment our ability to attract successful candidates.

Legal basis for processing your personal data

Our processing of your personal data for the purposes mentioned above is based in one or several of the following legal grounds:

• in part, on our legitimate business interests in evaluating your application to manage our relationship with you, to ensure that we recruit appropriate employees, and to evaluate and maintain the efficacy of our recruiting process more generally; and in operating our business and protecting the Firm and its employees, clients, and third parties. When we rely on this legal ground, McKinsey will only process your personal data after assessing the adequacy, proportionality, and legitimacy of the data processing activity
• in part, on our performing contractual and precontractual measures relating to our potential employment relationship with you;
• in part, on our complying with applicable law with regard to personal data necessary to satisfy our legal and regulatory obligations, including with regard to public health and workplace safety;
• in part, on your consent, if we offer you the opportunity to participate in our optional recruiting programs or if we collect sensitive personal data for legally permitted purposes other than compliance with our legal obligations regarding public health and workplace safety.

Background screening

If you receive an offer from us, we may conduct a background check on you or instruct a third party to do so on our behalf. Background screening will only be done where permitted by the law applicable to the location where the position is located and to the extent necessary and proportionate to the role that you are being offered. A background check will only involve criminal background data to the extent permitted by law. Our legal basis for background screening is our need to perform precontractual measures related to establishing our employment relationship. If a background screening is required, you may be contacted by a third-party background screening service provider to request authorization for the release of your information, and at that time you will be provided with further information about the process and what personal data it might involve.

Data recipients and international data transfers

Your personal data may be accessed by recruiters and interviewers working in the country(ies) where the position(s) for which you are applying is(are) based, as well as by recruiters and interviewers working in different countries within the McKinsey global organization. Individuals performing administrative functions and IT personnel within McKinsey may also have access on a need to know basis to your personal data to the extent necessary perform their jobs. In some countries, you may have fewer rights under local law than you do in your country of residence, but we have put in place legal mechanisms designed to ensure adequate data protection for your personal data when it is processed by McKinsey subsidiaries and affiliates within the McKinsey global organization and by McKinsey’s service providers, including the transfer of your personal data to countries other than the one in which you reside.

We use third-party service providers to provide a recruiting software system. We also share your personal data with other third-party service providers that may assist us in identifying and recruiting talent, administering and evaluating pre-employment screening and testing, and improving our recruiting practices.

Except to the extent necessary to accomplish the McKinsey uses and purposes described in this Privacy Notice, we do not disclose your personal data to third parties. We also prohibit our service providers from using your personal data for non-McKinsey purposes. We do not otherwise share or sell your personal data to third parties.

We maintain processes designed to help ensure that any processing of personal data by third-party service providers is consistent with this Privacy Notice and protects the confidentiality, availability, and integrity of your personal data in compliance with applicable law. Where required by law, we put in place additional legal mechanisms designed to help ensure adequate data protection for your personal data when transferred to another country.

In addition, we may disclose or transfer your personal data in the event of a re-organization, merger, sale, joint venture, assignment, or other transfer or disposition of all or any portion of our business.

Automated sorting of applications

In certain jurisdictions, we may use data analytics and algorithms to help us to review the large quantities of candidates and application data that we receive. These algorithms help us prioritize the application review process and sort candidates on the basis of professional characteristics that suggest strengths and capabilities necessary to perform the relevant role.

The automated results are considered in combination with other information about the candidate and each candidate's assessment is based on human judgment. We evaluate each individual candidate on their own merits.

Certain roles may require specific prerequisites or skills (for example, fluency in a certain language, particular professional qualifications or certifications, or number of years in a similar role). Applications that do not meet those requirements may be automatically rejected.

Data retention

If you accept an offer of employment with us, any relevant personal data collected during your pre-employment period will become part of your personnel records and will be retained in accordance with specific country requirements and with the privacy notice applicable to McKinsey employees, which will be provided during the on-boarding process.

If we do not employ you, and unless you object by following the process described in the Section “Your Rights” below, we may nevertheless continue to retain and use your personal data for a period of time (which may vary depending on the country) for system administration purposes, to consider you for potential future roles, and to perform research. Thereafter, we retain a minimal amount of your personal data to record your recruiting activity with us.

To the extent that we have collected personal data, including sensitive personal data, for the specific purpose of fulfilling our legal obligations regarding public health or workplace safety, we will retain that data for the duration of those legal obligations. Thereafter, we retain a minimal amount of your personal data to establish our compliance with those obligations.

We may want to remain in contact with you and consider you for future employment opportunities. In such an event, we will seek your consent to include you in one of our recruiting programs that provides you ways to further learn about and stay in touch McKinsey, either prior to or after you formally apply for a job opportunity. Participation in these recruiting programs is entirely optional.

If you join a recruiting retention program, we retain your personal data for a period of time specific to that program, but if you wish to withdraw at any time, please contact us at keep-in-touch@mckinsey.com. For candidates in Germany, please contact us at karriere@mckinsey.com.

Security

We use generally accepted standards of technical and operational security to secure your personal data. Only authorized personnel of McKinsey and of our third-party service providers are permitted to access personal data, and these employees and third-party service providers are required to treat this information as confidential. Despite these precautions, we cannot guarantee that unauthorized persons will not obtain access to your personal data.

Your rights

We take reasonable steps that are designed to keep your personal data accurate, complete, and up-to-date for the purposes for which it is collected and used. We also have implemented measures that are designed to help ensure that our processing of your personal data complies with this Privacy Notice and applicable law.

Subject to applicable law, including exceptions, you have the following rights with regard to the personal data that we collect about you:

• right to request information about the personal data that we hold about you, including information about how we use your personal data.
• right to request a copy of the personal data that we hold about you;
• right to request portability of your data to permit you to provide a copy of your personal data in a structured, commonly used, and machine-readable format and to transmit that personal data to another controller;
• right to request that we correct or otherwise amend your personal data if it is not correct or otherwise not complete, timely, and accurate for the purposes for which we are using it;
• right to request deletion of your personal data;
• right to request that we cease processing or restrict or limit the processing of your personal data;
• right to withdraw your consent to our processing of your personal data where the basis of our processing is your consent. This right may not apply if there are other legal justifications to continue processing or we need to retain certain personal data where required or permitted under applicable law
• right to not be discriminated against for exercising your individual rights regarding your personal data;
• right to request review by McKinsey’s Global Protection Officer and, if applicable, McKinsey’s data protection officer for your jurisdiction, of our response to your request to exercise your individual data protection rights;
• right to seek additional legal remedies regarding our response to your request to exercise your individual data-protection rights, depending upon your jurisdiction, by lodging a complaint with your data-protection authority or initiating a legal proceeding.

If you would like to exercise your data protection rights regarding your personal data, you can do so by:

• completing the data-subject request form
• emailing your request to us at: DataSubjectRights@mckinsey.com
• contacting us by postal mail at:

McKinsey & Company - Legal Department, Attn: Privacy
175 Greenwich Street New York, NY 10007 212-446-7000

Upon receipt of your request to exercise your data protection rights, we will acknowledge receipt within the time period required by applicable law and provide you with information about the next steps in the process and the timing. To help protect your privacy and security, we may take reasonable steps to verify your identity before acting on certain data protection rights, in accordance with applicable law. If you are using an authorized agent to exercise your data protection rights and that agent does not provide a power of attorney with the initial request, we may request further evidence of the agent’s right to act on your behalf, including valid written authorization or contacting you to verify the request.

Please note that applicable laws include exceptions to assertions of data protection rights that may prevent us from providing access to your personal data or otherwise fully complying with your request. If we believe exceptions apply, we will respond to your request to the extent we are able to do so, and we will provide an explanation of the basis for not complying wholly or partially with your request.

Social Media Tools

Our application process allows you to provide us with relevant personal data from information you have on third-party websites (such as LinkedIn, Google Drive and Dropbox). If you choose to incorporate your personal data from third-party websites, it will be used in accordance with this Privacy Notice.

Cookies and other tracking technologies

McKinsey may use first- and third-party cookies and other tracking technologies, including web beacons, to manage our Sites and services, to identify you and your interests and remember your preferences, and to collect analytics about how you use our Sites and services. McKinsey may collect information about whether you open or click any links in the knowledge, research, or event communications that we send you. You have options regarding our use of cookies and other tracking technologies.

In addition, we use tools and applications that reduce security threats and reduce the risk of access by bots and automated devices, but we do not use those tools and applications for non-security purposes.

Some of our online recruiting activities are hosted by third parties. When you access sites operated by these third parties, they may to the extent permitted by applicable law, including your consent to the extent required, and consistent with this Privacy Notice, place their own Cookies or other tracking technologies on your device.

Please refer to our Privacy Notice and our Cookie Notice for more information

Availability of the Recruiting Privacy Notice in Other Languages

This Privacy Notice is also available in other languages. In the event of any conflict between the English version and any translations of this Privacy Notice, the English version shall prevail.

CONTACTS

If you have any questions about this Privacy Notice or if you would like to communicate with any of our Data Protection Officers or the Data Privacy Team, please contact us at privacy@mckinsey.com or

McKinsey & Company - Legal Department, Attn: Privacy
175 Greenwich Street New York, NY 10007 212-446-7000

McKinsey reserves the right to modify this Privacy Notice as required by changes to our business processes or applicable law. We will post any changes to our Privacy Notice on this page. Please check this page regularly to keep up-to-date.

This is a comprehensive Recruitment Privacy Notice from McKinsey & Company. Here's an analysis of the key aspects of this policy:

Key Strengths and Observations:

• Transparency: The notice is detailed and clearly outlines what personal data is collected, how it's used, the legal basis for processing, who the data is shared with, and the data retention practices.
• User Rights: It explicitly states the rights of job applicants regarding their personal data, including the right to access, correct, delete, restrict processing, data portability, and withdraw consent. It also provides clear instructions on how to exercise these rights.
• Legitimate Purposes: The purposes for collecting and using personal data are clearly defined and appear to be legitimate for recruitment and business management.
• Legal Basis: The policy identifies the legal grounds for processing personal data, including legitimate interests, contractual necessity, legal compliance, and consent. This demonstrates an awareness of data protection regulations like GDPR.
• International Data Transfers: It acknowledges that data may be transferred internationally and mentions the implementation of legal mechanisms to ensure adequate data protection in such transfers.
• Security Measures: The notice states that generally accepted technical and operational security standards are used to protect personal data.
• Automated Sorting Explanation: It transparently explains the use of automated systems for initial application review while emphasizing that final decisions are based on human judgment and individual merit. It also clarifies the potential for automatic rejection based on mandatory prerequisites.
• Sensitive Data Handling: The policy addresses the collection and use of sensitive personal data, limiting it to legally permitted or required purposes, such as equal opportunity laws, diversity and inclusion efforts, public health and safety, and providing reasonable accommodations.
• Third-Party Service Providers: It discloses the use of third-party service providers for recruitment software, talent identification, and background checks, and states that these providers are prohibited from using the data for non-McKinsey purposes.
• Contact Information: Clear contact information is provided for privacy-related inquiries.
• Regular Updates: McKinsey reserves the right to modify the policy and commits to posting updates on the same page.

Potential Areas for Further Consideration (though not necessarily weaknesses):

• Specificity of "Legitimate Interests": While "legitimate business interests" is a valid legal basis, providing more specific examples within the policy could enhance transparency further.
• Retention Periods: While the policy mentions varying retention periods depending on the country and purpose, providing more specific timeframes for different categories of unsuccessful applicants' data could be beneficial for clarity.
• Cookie Notice Link: The policy refers to a separate "Cookie Notice," which users would need to consult for detailed information on cookie usage. Ensuring this notice is easily accessible and comprehensive is important.
• Background Check Details: While it outlines the conditions for background checks, providing more detail about the scope and types of checks conducted (where legally permissible) could be helpful for candidates.

Overall:

This McKinsey & Company Recruitment Privacy Notice appears to be a well-structured and comprehensive document that aims to inform job applicants about how their personal data is handled during the recruitment process. It reflects an understanding of key data protection principles and regulations. The transparency regarding data collection, usage, legal basis, and user rights is commendable. Keeping this policy updated and ensuring the linked "Cookie Notice" is equally clear and accessible will be important for maintaining user trust and complying with evolving data protection requirements.