Information we collect
McKinsey collects Personal Data about you when you enter your user account information and participate in course content, including in user posting areas (such as bulletin boards, discussion forums and surveys). We may also automatically collect information about the devices you use to interact with McKinsey Academy, including the location of these devices such as time zone, and OS. The information we automatically collect may include IP address, device identifier, web browser, and browsing information collected through cookies, web beacons, pixels, clear gifs, and other similar technologies (collectively “Cookies and Other Tracking Technologies”) on the site. We also automatically collect information about how you use the McKinsey Academy site, such as what you have bookmarked, searched for and viewed. Further, we collect information about your academic performance and behavior related to test and poll taking, like progress, score, time spent, and your answers to these tests and polls. The information automatically collected will be associated with any other Personal Data you have provided.
McKinsey may also collect Personal Data about you from third parties, such as our clients, data brokers, or aggregators, in the course of its business activities including in connection with some client services. This includes demographic, professional and other information that is publicly available online, including information you choose to make public through social media platforms and other online forums. We may combine this data with existing information we have about you or with information we collected through McKinsey Academy.
Use of information
McKinsey uses your Personal Data to enable you to access courses and McKinsey Academy content. McKinsey also uses your Personal Data to evaluate and improve our services, distribute newsletters and alerts to you, analyze McKinsey Academy performance and functioning, compare the use of McKinsey Academy content among different audiences. We also use your Personal Data to identify other courses, services or offerings provided by us that may be of interest to you. McKinsey may combine the Personal Data collected by McKinsey Academy with other Personal Data collected by McKinsey, including from third parties or through use of McKinsey’s website or other client services. McKinsey may use this combined data for analyses and assessments, including for the purpose of analyzing and benchmarking the impact of McKinsey Academy courses on its users.
McKinsey may anonymize your Personal Data so that the data will no longer be identifiable. We may also use Personal Data to create aggregated datasets that will not identify any individual. We may use anonymized and/or aggregated data for any purpose, including but not limited to, analytical purposes to better understand our users. We may provide the anonymous data to third parties, including Sponsoring Organizations and our clients.
McKinsey Academy does not collect Personal Data about your online activities over time and across third party websites or online services. Accordingly, we do not alter our data collection and use practices in response to “do not track” signals transmitted from web browsers.
Sharing information with your Sponsoring Organization
From time to time we may provide your Sponsoring Organization with user progress and proficiency data with respect to particular McKinsey Academy courses or courses, some of which may constitute your Personal Data (collectively, “Participation Data”). McKinsey shall not be responsible or liable for the use of such information by your Sponsoring Organization, and such use shall be subject to your Sponsoring Organization’s policies (including privacy policies) applicable to you.
The legal basis by which we process your Personal Data
Our processing of your Personal Data for the purposes mentioned above is based
- on our legitimate interests in promoting and protecting McKinsey, building and maintaining relationships, and providing our services, for example where we analyze usage data to see how the Academy is functioning;
- on your consent, for example if you register for our newsletters or alerts;
- to comply with the law, when certain information is necessary to satisfy our legal or regulatory obligations.
Data recipients and international data transfers
Personal Data collected or processed by McKinsey Academy and anonymized or aggregated data may be transferred from time to time to McKinsey or McKinsey subsidiaries and affiliates and their personnel (including employees and contractors) across our global organization, as well as to third party service providers located throughout the world, including in countries where the local law may grant you fewer rights than you have in your own country.
Additionally, McKinsey Academy Content may be viewed and hosted by McKinsey and our third party service providers anywhere in the world. Where required by law, we have put in place legal mechanisms designed to ensure adequate data protection of your Personal Data that is processed by McKinsey subsidiaries, affiliates, and third party service providers, including the transfer of your Personal Data to countries other than the one in which you reside. If you would like more information about these legal mechanisms, which may include the EU’s Standard Contractual Clauses, please contact us at the address below.
In addition, we may disclose information about you:
- If we are required to do so by law or legal process;
- To law enforcement authorities or other government officials;
- When we believe disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation of suspected or actual illegal activity;
- If disclosure is necessary to protect the vital interests of a person;
- To enforce our Terms;
- To protect our property, services and legal rights;
- To prevent fraud against McKinsey, our subsidiaries and affiliates and business partners;
- To support auditing, compliance, and corporate governance functions; or
- To comply with any and all applicable laws.
In addition, we may disclose or transfer your Personal Data in the event of a re-organization, merger, sale, joint venture, assignment, or other transfer or disposition of all or any portion of our business.
You should be aware that whenever you publicly disclose information, even to a limited group of recipients (for example, other users who are enrolled in the same McKinsey Academy course as you), that information could be collected and used by others. McKinsey is not responsible for any action or policies of any third parties, including other McKinsey Academy users, who collect information that users disclose to such third parties.
Third-party websites and platforms
In addition, certain Mobile Offerings may be made available to you through a website, application or platform operated by a Mobile Platform Provider (as such term is defined in the Terms). When you share data with a Mobile Platform Provider, for example to create user credentials allowing you to use their platform to access the Mobile Offering, that Personal Data is stored outside of McKinsey’s control and will be subject to the relevant Mobile Platform Provider’s own terms and privacy policies.
McKinsey has implemented generally accepted standards of technology and operational security to protect Personal Data from loss, misuse, alteration, or destruction. Only authorized McKinsey personnel and third party service providers are provided access to Personal Data, and these personnel and service providers are required to treat this information as confidential. Despite these precautions, McKinsey, however, cannot guarantee that unauthorized persons will not obtain access to your Personal Data.
Data retention policy
Certain local privacy laws may provide you with the right to request access to the Personal Data that we have about you for the purposes of reviewing, modifying, or requesting deletion of the data. You may also have the right to request a copy of the Personal Data that we hold about you and to have any inaccuracies in that data corrected. We will assess each request individually, and in certain circumstances, you may also request that we cease processing your Personal Data.
To help protect your privacy and security, we will take reasonable steps to verify your identity, such as requiring you to provide or confirm your identity, including your User Account Information, before granting access to your Personal Data. We will make reasonable attempts to promptly investigate, comply with, or otherwise respond to your requests as may be required by applicable law. Different laws or circumstances may prevent us from providing access to your Personal Data or otherwise fully complying with your request depending upon the circumstances and the request; such as for example, where producing your information may reveal the identity of someone. We may, including where required by applicable law or contract, notify your Sponsoring Organization of your request and coordinate with your Sponsoring Organization in responding to your request. We reserve the right to charge an appropriate fee for complying with your request where allowed by applicable law, and/or deny your requests where they may be manifestly unfounded, and/or excessive, or otherwise objectionable or unwarranted under applicable law.
Where the processing of your Personal Data is based on consent (for example if we send you newsletters), you may withdraw your consent at any time, by contacting firstname.lastname@example.org and please state that your request concerns McKinsey Academy.
The privacy laws in your geographic area may vary. Please see below for certain rights specific to California residents and individuals located in the United Kingdom or European Economic Area.
Your California privacy rights
In addition, under California law, you may have the right (up to two times in any 12-month period) to request more information about McKinsey’s collection, use, disclosure, and sale of Personal Data about you during the preceding 12 months, including:
- The categories of Personal Data about you that we have collected ,
- The categories of sources from which we have collected that information,
- The commercial or business reason(s) we have collected, used, disclosed, or sold that information, and
- The categories of third parties to whom we have disclosed or sold that information.
- In addition, upon receipt of a verifiable request from you establishing your identity, you may have the right to know about the specific pieces of Personal Data that we have collected about you and/or shared with third parties.
You may also have the right to request deletion of Personal Data about you that we have collected or maintain, which we will honor subject to certain limitations set forth in California law.
If you are a California consumer and you or your authorized agent would like to exercise your privacy rights, please contact us at email@example.com , or call us at +1-888-914-9661 using the six-digit PIN code: 736 415 and please state that your request concerns McKinsey Academy. When we process your request, we may require you to provide certain Personal Data about you in order to verify your identity in accordance with requirements under CCPA. This may include your first and last name, email address, physical address, telephone number, and information about your relationship with us or other information needed to verify your identity. McKinsey will not discriminate against you based on your exercise of any of these rights.
Pursuant to California Civil Code Section 1798.83(c)(2), McKinsey does not share your Personal Data with third parties for those third parties’ direct marketing use.
Your United Kingdom and European Economic Area privacy rights
McKinsey, as a data controller, provides you rights regarding your Personal Data. In accordance with the UK and European regulations regarding the protection of your Personal Data, you have the following rights over your Personal Data:
- Right to access information about how we process your Personal Data, including the categories of Personal Data we process, recipients of your Personal Data, and purposes for our processing.
- Right to rectification of inaccurate Personal Data concerning you, as well as, taking into account the purposes of the processing, the right to have incomplete Personal Data completed.
- Right to erasure (deletion) of Personal Data concerning you where: (a) the Personal Data is no longer necessary in relation to the purposes for which they were collected or otherwise processed; (b) you withdraw your consent and there are no other legal grounds for the processing; (c) you exercise your right to object (see below) and there are no compelling legitimate grounds for the processing; (d) the Personal Data have been unlawfully processed; or (e) the Personal Data have to be erased for compliance with a legal obligation applicable to us.
- Right to restriction of processing (i.e., data will be blocked from normal processing but not erased) where: (a) you contest the accuracy of the Personal Data, for a period enabling us to verify the accuracy; (b) the processing is unlawful and you oppose the erasure of the Personal Data and requests the restriction of their use instead; (c) we no longer need the Personal Data for the purposes of the processing but they are required by you for the establishment, exercise or defense of legal claims; (d) you exercise your right to object (see below) pending the verification whether our legitimate grounds override those of you.
- Where processing is based on your consent, the right to withdraw consent at any time, without affecting the lawfulness of the processing prior to such withdrawal. Please note that even after you have chosen to withdraw your consent we may be able to continue to process your Personal Data in some limited circumstances.
- Where processing is based on your consent, or on a contract, the right to data portability , i.e. the right to obtain a copy of the data concerning you in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from us.
- Right to object to the processing of Personal Data based on our legitimate interests, provided that there are no compelling legitimate grounds for the processing that would override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.
Contact our privacy department
- McKinsey & Company
- Legal Department
- 711 Third Avenue
- New York, NY 10017
- +1 212 446 7000