EU Region Policy Last Updated: March 30, 2022

A.T. Kearney Holdings Limited ("Kearney"), 1-11 John Adam Street, London, WC2N 6HT, United Kingdom wishes to inform you below of how your personal information is processed. This Website Privacy Policy applies to personal information we collect on Kearney websites (collectively, the “Sites”), how we use the information, with whom we share it, and the choices available to users of our Sites regarding our use of the information. We also describe the measures we take to protect the security of the information and how users can contact us about our privacy practices. Kearney and its respective local affiliates will separately act as controllers for the data processed via the respective country website.

Click on one of the links below to jump to the listed section:

Information We Collect
Information We Share
Your Rights and Choices
Data Transfers
How We Protect Personal Information
Links to Other Websites and Apps
Updates to Our Website Privacy Notice
How to Contact Us

Information We Collect

Why we process your data (purpose of the processing) and on what legal basis

Kearney might collect the categories of personal information and will use your personal information for the purposes set out below in compliance with the EU General Data Protection Regulation (GDPR), where applicable, and other relevant laws:

1. To manage your business relationship with us

To manage your business relationship with us, fulfill your request, provide you with the information you requested, provide our products and services, operate, evaluate, and improve our business (including developing new products and services; enhancing and improving our products, services, websites and mobile apps; managing our communications; analyzing our products and services; and performing accounting, auditing and other internal functions); perform data analyses (including anonymization and aggregation of personal information), protect against, identify, and prevent fraud and other unlawful activity, claims and other liabilities and enforce relevant industry standards, and our policies, or meet our legal obligations, such as to comply with and enforce applicable legal requirements.

Personal information we collect for these purposes might include your name, e-mail address, title, occupation, company, industry, region/country, relationship to Kearney, reason for contacting Kearney, topics you are interested in.

For the purposes above, we process your personal information for the fulfillment of contractual obligations (Article 6 (1b) GDPR), on the basis of legal requirements (Article 6 (1c) GDPR) and for the purposes of legitimate interests of Kearney (Article 6 (1f) GDPR).

We will delete your personal information as soon as it is no longer needed for the specific purpose. We are required to retain business and commercial documentation and other tax-relevant documents in order to fulfill our commercial and tax law archiving obligations. Retention periods are determined by the applicable laws.

2. For marketing activities

To send you marketing communications including promotional materials or other communications; communicate with you about, and administer your participation in, special events, programs, offers, surveys, and market research.

Personal information we collect for these purposes might include your name, e-mail address, title, occupation, company, industry, region/country, relationship to Kearney, reason for contacting Kearney, topics you are interested in.

For the purposes above, we process your personal information on the basis of your consent (Article 6 (1a) and for the purposes of legitimate interests of Kearney (Article 6 (1f) GDPR).

We will delete your personal information as soon as it is no longer needed for the specific purpose. We may retain your personal information for the period of time to which you consented. We may also be required to retain your personal information in accordance with retention periods applicable under the relevant laws.

Kearney may collect personal information and may disclose such information to third party service providers in aggregate for marketing and promotional purposes.

3. Job Applications

To process your job application, including by assessing qualifications, verifying information, conducting reference or other employment-related checks, and notifying you of future opportunities that might be of interest to you; we may also use your information to analyze and improve our recruiting and onboarding processes as well as to communicate with you about Kearney events and to send you publications that we think may be of interest to you.

If you have applied for a job at Kearney, personal information we collect might include, personal information contained in a résumé, C.V., application and/or our recruitment template, employment history, education history, references, transcripts, such as your name, e-mail address, title, occupation, company or university affiliation, industry, region/country, and, where legally permissible and depending on the country in which you apply, ethnicity, race, gender, disability status, and veteran status. Kearney will not consider information regarding an applicant’s ethnicity, race or gender, or an applicant’s choice to decline to provide it, in evaluating the applicant’s qualifications for employment with us. This information will be used only for Equal Employment Opportunity reporting and other legal compliance purposes.

For the purposes above, we process your personal information for the fulfillment of (pre-)contractual obligations (Article 6 (1b) GDPR), on the basis of legal requirements (Article 6 (1c) GDPR) as well as on the basis of your consent (Article 6 (1a) GDPR).

If your application is successful, your personal information will be used in your personnel file and for the execution and termination of the employment relationship and deleted in accordance with the regulations applicable to personnel files. If we are currently unable to offer you employment, we will continue to process your personal information for up to six months after the notification of rejection in order to defend ourselves against possible legal claims, in particular due to alleged discrimination in the application process. If you receive cost reimbursements or other tax-relevant transactions (e.g. invitation to a meal), the corresponding accounting documents will be kept until March 31 of the eleventh calendar year after payment at the latest in order to fulfill the commercial and tax retention obligations. Your personal information can initially be accessed by our recruiting and HR departments in charge of the recruiting process, but if required also by our firm’s consultants involved in the recruiting process and the accounting department.

We may disclose personal information to third party service providers such as recruiting agencies in connection with the recruiting process.

4. To manage your alumnus relationship with us

If you register as a Kearney Alumnus, your personal information will be processed for purposes including conducting alumni mailings and surveys as well as maintaining and sharing marketing and career development contacts.

Personal information we might collect includes your name, e-mail address, current employment information (such as title, division, and employer) region/country and information regarding previous employment with Kearney.

For the purposes above, we process your personal information on the basis of your consent (Article 6 (1a) and for the purposes of legitimate interests of Kearney (Article 6 (1f) GDPR).

We will delete your personal information as soon as it is no longer needed for the specific purpose. We may retain your personal information for the period of time to which you consented. We may also be required to retain your personal information in accordance with retention periods applicable under the relevant laws.

We may disclose your personal information to third party service providers in aggregate for marketing and promotional purposes. Your personal information might also be visible to other Alumni members.

5. Website Visits / Information We Collect by Automated Means

When you visit our Sites, we will collect certain information by automated means, (i) customize our users’ visits to our Sites, (ii) deliver content tailored to our users’ interests and the manner in which our users browse our Sites, and (iii) manage our Sites and other aspects of our business, using technologies such as cookies, web server logs, web beacons, and JavaScript. For residents of the European Union or Switzerland: Information about our cookie practices in the European Union is available here.

Our Sites are not designed to respond to “do not track” signals from browsers.

Cookies are files that websites send to your computer or other Internet-connected device to uniquely identify your browser or to store information or settings on your device. Subject to your consent, which you can withdraw at any time, our Sites may use cookies (such as HTTP and HTML5 cookies), as well as other types of local storage (such as browser-based or plugin-based local storage). Your browser may tell you how to be notified when you receive certain types of cookies and how to restrict or disable certain cookies. You also may be able to delete your Flash cookies or adjust your Flash cookie settings by visiting the Adobe Flash Website Storage Settings Panel and Global Storage Settings Panel. Please note, however, that without cookies you may not be able to use all of the features of our Sites.

In conjunction with gathering information through cookies, our web servers may log information such as your device type, operating system type, browser type, domain, and other system settings, as well as the language your system uses, and the country and time zone where your device is located. The web server logs also may record information such as the address of the web page that referred you to our Sites and the IP address of the device you use to connect to the Internet. They also may log information about your interaction with the Sites, such as which pages you visit. To control which web servers collect information by automated means, we may place tags on our web pages called “web beacons,” which are small files that link web pages to particular web servers and their cookies. We also may send instructions to your device using JavaScript or other computer languages to gather the sorts of information described above and other details about your interactions with the Sites.

Subject to your consent, which you can withdraw at any time, we may use third-party web analytics services on our Sites, such as those of Google Analytics. These service providers help us analyze how users use the Sites. The information collected for this purpose (including your IP address and other information collected by automated means) will be disclosed to or collected directly by these service providers. To learn more about opting out of these activities, click here.

The providers of other third-party plug-ins on our Sites, such as social sharing tools, use automated means to collect information regarding your use of the Sites and your interactions with the plug-ins. This information is subject to the privacy policies or notices of the plug-in providers and is not subject to this Website Privacy Policy. For more information, please see our Cookie Notice.

Personal information we collect for these purposes might include your name, e-mail address, title, occupation, company, industry, region/country, relationship to Kearney, reason for contacting Kearney, topics you are interested in, login credential for our Sites.

For the purposes above, we process your personal information on the basis of your consent (Article 6 (1a) and for the purposes of legitimate interests of Kearney (Article 6 (1f) GDPR).

We will delete your personal information as soon as it is no longer needed for the specific purpose. We may retain your personal information for the period of time to which you consented. We may also be required to retain your personal information in accordance with retention periods applicable under the relevant laws.

We may disclose your personal information to third party service providers for marketing and promotional purposes and to enhance and improve our websites and mobile apps.

Information We Share

We do not sell personal information we collect about you. We may disclose information about you (i) if we are required to do so by law or legal process, (ii) to law enforcement authorities or other government entities, and (iii) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss, or in connection with an investigation of suspected or actual fraudulent or illegal activity. We also reserve the right to transfer personal information we have about you in the event we sell or transfer all or a portion of our business or assets (including in the event of a reorganization, dissolution, or liquidation).

Your Rights and Choices

We offer you certain choices in connection with the personal information we collect from you. To update your preferences, ask us to remove your information from our mailing lists or submit a request, please contact us as indicated in the “How to Contact Us” section of this Website Privacy Policy. To the extent provided by the law of your jurisdiction, you may request access to the personal information we maintain about you or request that we correct, amend, delete, block, or move the information by contacting us as indicated below. Where provided by law, you may withdraw any consent you previously provided to us or object at any time on legitimate grounds to the processing of your personal information, and we will apply your preferences going forward.

To the extent, the EU General Data Protection Regulation, which came into force on 25 May 2018, applies to the processing of your personal information you have the following rights and choices:

What are your data protection rights?

Kearney is committed to ensuring fair and transparent processing. That is why it is important to us that data subjects can not only exercise their right to object but also the following rights where the respective legal requirements are satisfied:

Right to information, Art. 15 of the GDPR
Right to correction, Art. 16 of the GDPR
Right to deletion (“Right to be forgotten”), Art. 17 of the GDPR
Right to limit processing, Art. 18 of the GDPR
Right to data transmissibility, Art. 20 of the GDPR
Right to object, Art. 21 of the GDPR

To exercise your right, please contact us as indicated in the “How to Contact Us” section below.

In order to be able to process your request, as well as for identification purposes, please note that we will use your personal information in accordance with Art. 6 para. 1 (c) of the GDPR.

You also have the right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR in combination with Section 19 GDPR.

How can you withdraw your consent?

If you consent to us processing your personal information, please note that you may withdraw this consent at any time.

If you have consented to receive our marketing mailings, such as newsletters, you may withdraw this consent yourself using the Unsubscribe link in the marketing mailings.

If you have consented to the use of our cookies you can withdraw your consent as explained in our cookie policy. Please see our Cookie Notice.

In all other cases or if you have problems withdrawing your consent on this website, you can contact us as indicated in the “How to Contact Us” section below.

Please note that your consent can only be withdrawn with future effect and such a withdrawal does not have any influence on the lawfulness of past processing. In some cases, we may be entitled in spite of your withdrawal to continue to process your personal information on a different legal basis—to perform a contract, for example.

Information about your right to object pursuant to Art. 21 GDPR

You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal information based on Article 6 (1) (e) or (f) of the GDPR.

The controller shall no longer process the personal information that relates to you unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or processing is necessary for the establishment, exercise or defense of legal claims.

Where personal information that relates to you is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal information for such marketing purposes, which includes profiling to the extent that it is related to such direct marketing.

Where you object to processing for direct marketing purposes, the personal information that relates to you shall no longer be processed for such purposes.

You have the option of exercising your right of objection in connection with the use of the services of the information company using an automated procedure - notwithstanding Directive 2002/58/EC—in which technical specifications are used.

Data Transfers

We may transfer the personal information we collect about you to recipients in countries other than the country in which the information originally was collected. Those countries may not have the same data protection laws as the country in which you initially provided the information. When we transfer your information to recipients in other countries (such as the U.S.), we will protect that information as described in this policy.

If you are located in the European Economic Area (“EEA”), we will comply with applicable legal requirements providing adequate protection for the transfer of personal information to recipients in countries outside of the EEA.

Kearney recognizes that the EU-U.S. Privacy Shield and Swiss-U.S. Privacy Shield are no longer valid transfer mechanisms for personal information from the European Union and its Member States, the European Economic Area, or Switzerland. The U.S. Department of Commerce, which oversees compliance with Privacy Shield, has stated that it will nonetheless continue to administer the Privacy Shield program and that participants are not relieved of their obligations under Privacy Shield. Accordingly, Kearney, as a participant in the Privacy Shield program, will continue to comply with its commitments under the Privacy Shield and its robust internal data protection policies. For data transfers to non-EU countries we will rely, inter alia, on the European Commission approved standard contractual clauses.

How We Protect Personal Information

We maintain administrative, technical and physical safeguards designed to protect the personal information you provide on the Sites against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure, or use.

Your information is erased as soon as it is no longer required for the purposes stated. Your information is deleted as soon as it is no longer needed for the specified purposes. However, we must sometimes continue to store your personal information until the retention periods and deadlines set by statute, regulation, or supervisory authorities, which may arise, for instance, from the applicable commercial code, tax code or money laundering acts and regulations, expire. These generally amount to six to ten years. We may also retain your personal information until the statutory limitation periods have expired (usually three years, but up to 30 years in some cases), provided that this is necessary for the establishment, exercise or defense of legal claims. After that, the relevant personal information is routinely erased.

If you have any questions or comments about this Website Privacy Policy, you can contact us as indicated below. You also have a right to lodge a complaint with the supervisory authority for data protection in your country.

Links to Other Websites and Apps

Our Sites may provide links to other websites or apps for your convenience and information. These websites may operate independently from us. Linked sites and apps may have their own privacy notices or policies, which we strongly suggest you review. To the extent any linked websites are not owned or controlled by us, we are not responsible for the websites’ or apps’ content, any use of the websites or apps, or the privacy practices of the websites or apps.

Updates to Our Website Privacy Notice

This Website Privacy Policy may be updated periodically and without prior notice to you to reflect changes in our personal information practices. We will post a prominent notice on our Sites to notify you of any significant changes to our Website Privacy Policy and indicate at the top of the notice when it was most recently updated.

How to Contact Us

If you would like us to update information we have about you or your preferences, please contact us by email at dataprivacy@kearney.com. You also may write to:

A.T. Kearney, Inc.
Attn: Legal Department
227 West Monroe Street
Chicago, IL 60606, USA

If you are a resident of the EEA or Switzerland, please see below for contact information for the Kearney entity in your country.

EEA/Swiss Kearney entities contact information

For purposes of our Website Privacy Policy, below are country-specific contact details for Kearney entities in the EEA and Switzerland. These entities will act as controllers for the data processed via the respective country website.

Country	Responsible Kearney Entity	Websites
Austria	Kearney Ges.m.b.H Seitzergasse 2-4/3rd floor 1010 Vienna Austria	https://www.kearney.at
Belgium	Kearney S.A. N.V. Boulevard du Régent 43-44 Regentlaan 1000 Brussels Belgium	https://www.kearney.com/locations/belgium/
Croatia	Kearney Consulting S.R.L. Trg J. F. Kennedy 6b 10000 Zagreb Croatia	https://www.kearney.com/locations/southeast-europe
Czech Republic	Kearney GmbH Slovansky dum, Na Prikope 859/22 110 00 Prague 1 Czech Republic	https://www.kearney.com/locations/czech-republic
Denmark	Kearney A/S Sankt Annæ Plads 13, 4. Sal 1250 Copenhagen K Denmark	https://www.kearney.com/locations/denmark/
Finland	Kearney Oy Mannerheimintie 12 B 5th Floor 00100 Helsinki Finland	https://www.kearney.com/locations/finland/
France	Kearney S.A.S. 23 rue de l’Université 75007 Paris France	http://www.fr.kearney.com
Germany	Kearney GmbH Sendlinger Straße 8, 80331 Munich Germany	https://www.de.kearney.com
Hungary	Kearney GmbH Magyarországi Fióktelepe Kőér utca 2/a 1103 Budapest Hungary	https://www.kearney.com/locations/southeast-europe
Italy	Kearney Italia, Inc. Via Borghetto, 6 20122 Milano Italy	https://www.it.kearney.com
Netherlands	Kearney B.V. IJdok 21, 1013 mm Amsterdam, P.O. Box 22926, 1100 DK Amsterdam The Netherlands	https://www.nl.kearney.com
Norway	Kearney AS Henrik Ibsens Gate 100 N-0255 Oslo Norway	https://www.kearney.com/locations/norway/
Poland	Kearney Sp. z o.o. Królewska 18, 00-103, Warsaw Poland	https://www.kearney.com/locations/poland
Portugal	Kearney (Portugal) Lda Edifício Heron Castilho, Rua Braamcamp nº40 – 10º 1250-050 Lisbon Portugal	https://www.kearney.com/locations/
Romania	Kearney Management Consulting S.R.L. Magheru One Building 1-3, Gh. Magheru Street, 5th Floor 1st District, Bucharest, Romania	https://www.kearney.com/locations/romania
Spain	Kearney, S.A. Paseo de la Castellana, 31 28046 Madrid Spain	https://www.es.kearney.com
Sweden	Kearney AB Biblioteksgatan 11, Box 1751 S-111 87 Stockholm Sweden	https://www.kearney.com/locations/sweden/
Switzerland	Kearney (International) AG Weberstrasse 4 8004 Zurich Switzerland	https://www.kearney.ch/
United Kingdom	Kearney Limited Adelphi 12th Floor 1-11 John Adam Street London WC2N 6HT	https://www.kearney.com/locations/uk-ireland