Privacy Policy

This Privacy Policy was last updated on June 16, 2021.

McKinsey & Company and its subsidiaries and affiliates (collectively, "McKinsey", "us" or "we") understand that your privacy is important to you. We are committed to respecting your privacy and protecting your personal data, which is any information that is capable of identifying you as an individual person ("Personal Data"). This Privacy Policy describes how we handle and protect your Personal Data in connection with McKinsey Academy where we are a data controller.

McKinsey Academy delivers on-line training on behalf of Sponsoring Organizations. When you access McKinsey Academy, information is collected about your progress and performance for your Sponsoring Organization (as such term is defined in the Terms of Use (the "Terms")), which may include grades, evaluation, performance, critiques, usage and engagement data, any User Content which you submit, including bulletin boards, discussion forums and surveys. Your Sponsoring Organization will be the data controller of this information. In addition to the disclosures contained in this Privacy Policy, the Sponsoring Organization is responsible for ensuring that your participation in McKinsey Academy is consistent with all applicable laws, and that it has provided you with appropriate notice and obtained all necessary consents from you regarding your participation in McKinsey Academy. If you want to know more about how such information may be used, you should consult the privacy policies of your Sponsoring Organization. Please see our Terms for more information about our online terms and policies that apply to your use of McKinsey Academy.

Information we collect McKinsey collects Personal Data about you when you enter your user account information and participate in course content, including in user posting areas (such as bulletin boards, discussion forums and surveys). We may also automatically collect information about the devices you use to interact with McKinsey Academy, including the location of these devices such as time zone, and iOS. The information we automatically collect may include IP address, device identifier, web browser, and browsing information collected through cookies, web beacons, pixels, clear gifs, and other similar technologies (collectively "Cookies and Other Tracking Technologies") on the site. We also automatically collect information about how you use the McKinsey Academy site, such as what you have bookmarked, searched for and viewed. Further, we collect information about your academic performance and behavior related to test and poll taking, like progress, score, time spent, and your answers to these tests and polls. The information automatically collected will be associated with any other Personal Data you have provided.

McKinsey may also collect Personal Data about you from third parties, such as our clients, data brokers, or aggregators, in the course of its business activities including in connection with some client services. This includes demographic, professional and other information that is publicly available online, including information you choose to make public through social media platforms and other online forums. We may combine this data with existing information we have about you or with information we collected through McKinsey Academy.

Use of information McKinsey uses your Personal Data to enable you to access courses and McKinsey Academy content. McKinsey also uses your Personal Data to evaluate and improve our services, distribute newsletters and alerts to you, analyze McKinsey Academy performance and functioning, compare the use of McKinsey Academy content among different audiences. We also use your Personal Data to identify other courses, services or offerings provided by us that may be of interest to you. McKinsey may combine the Personal Data collected by McKinsey Academy with other Personal Data collected by McKinsey, including from third parties or through use of McKinsey's website or other client services. McKinsey may use this combined data for analyses and assessments, including for the purpose of analyzing and benchmarking the impact of McKinsey Academy courses on its users.

McKinsey may anonymize your Personal Data so that the data will no longer be identifiable. We may also use Personal Data to create aggregated datasets that will not identify any individual. We may use anonymized and/or aggregated data for any purpose, including but not limited to, analytical purposes to better understand our users. We may provide the anonymous data to third parties, including Sponsoring Organizations and our clients.

McKinsey and its service providers may use first and third party Cookies and Other Tracking Technologies, including web beacons, to manage our Sites and our services and collect analytics about how you use them. McKinsey and its service providers may collect information about whether you open or click any links in the knowledge, research or event communications that we send to you. The information provided throughout this Privacy Policy about cookies also applies to these other tracking technologies. For Docebo, please refer to the Cookie Policy for more details regarding the use of Cookies and Other Tracking Technologies. For all other queries regarding the use of Cookies and Other Tracking Technologies, please reach out to our support team.

McKinsey Academy does not collect Personal Data about your online activities over time and across third party websites or online services. Accordingly, we do not alter our data collection and use practices in response to "do not track" signals transmitted from web browsers.

Sharing information with your Sponsoring Organization From time to time we may provide your Sponsoring Organization with user progress and proficiency data with respect to particular McKinsey Academy courses or courses, some of which may constitute your Personal Data (collectively, "Participation Data"). McKinsey shall not be responsible or liable for the use of such information by your Sponsoring Organization, and such use shall be subject to your Sponsoring Organization’s policies (including privacy policies) applicable to you.

The legal basis by which we process your Personal Data Our processing of your Personal Data for the purposes mentioned above is based

on our legitimate interests in promoting and protecting McKinsey, building and maintaining relationships, and providing our services, for example where we analyze usage data to see how the Academy is functioning;
on your consent, for example if you register for our newsletters or alerts;
to comply with the law, when certain information is necessary to satisfy our legal or regulatory obligations.

Data recipients and international data transfers Personal Data collected or processed by McKinsey Academy and anonymized or aggregated data may be transferred from time to time to McKinsey or McKinsey subsidiaries and affiliates and their personnel (including employees and contractors) across our global organization, as well as to third party service providers located throughout the world, including in countries where the local law may grant you fewer rights than you have in your own country.

Additionally, McKinsey Academy Content may be viewed and hosted by McKinsey and our third party service providers anywhere in the world. Where required by law, we have put in place legal mechanisms designed to ensure adequate data protection of your Personal Data that is processed by McKinsey subsidiaries, affiliates, and third party service providers, including the transfer of your Personal Data to countries other than the one in which you reside. If you would like more information about these legal mechanisms, which may include the EU’s Standard Contractual Clauses, please contact us at the address below.

McKinsey shall not intentionally disclose or transfer (and shall take reasonable steps to prevent the unauthorized or accidental disclosure of) your Personal Data to third parties without your consent unless otherwise permitted by law, whether for such third parties’ own marketing purposes or otherwise, except as follows. McKinsey may provide access to your Personal Data to third party service providers engaged by McKinsey to provide services related to McKinsey Academy, including, for example, administering surveys or communicating with you. We maintain processes designed to ensure that any processing of Personal Data by third party service providers is consistent with this Privacy Policy and protects the confidentiality, availability, and integrity of your Personal Data.

In addition, we may disclose information about you:

If we are required to do so by law or legal process;
To law enforcement authorities or other government officials;
When we believe disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation of suspected or actual illegal activity;
If disclosure is necessary to protect the vital interests of a person;
To enforce our Terms;
To protect our property, services and legal rights;
To prevent fraud against McKinsey, our subsidiaries and affiliates and business partners;
To support auditing, compliance, and corporate governance functions; or
To comply with any and all applicable laws.

In addition, we may disclose or transfer your Personal Data in the event of a re-organization, merger, sale, joint venture, assignment, or other transfer or disposition of all or any portion of our business.

Surveys If you participate in a survey in connection with McKinsey Academy, our research results may be reported as totals or in other aggregated form and no information about you as an individual respondent made public unless you otherwise agree in advance. However, we may be able to identify individual respondents by their email address, and may follow-up with individuals for additional information to improve the overall McKinsey Academy experience. If you prefer that we not follow up with you on your survey responses, please contact us at the address listed below in the Contact Us section of this Privacy Policy.

User forums You should be aware that whenever you publicly disclose information, even to a limited group of recipients (for example, other users who are enrolled in the same McKinsey Academy course as you), that information could be collected and used by others. McKinsey is not responsible for any action or policies of any third parties, including other McKinsey Academy users, who collect information that users disclose to such third parties.

Third-party websites and platforms McKinsey may provide links or directions to third party websites or information as a service to our users. If you use these links, you will leave McKinsey Academy. Such links do not constitute or imply an endorsement, sponsorship, or recommendation by McKinsey of the third party, the third party website, or the information contained therein, and McKinsey shall not be responsible or liable for your use thereof. Such use shall be subject to the terms of use and privacy policies applicable to those sites.

In addition, certain Mobile Offerings may be made available to you through a website, application or platform operated by a Mobile Platform Provider (as such term is defined in the Terms). When you share data with a Mobile Platform Provider, for example to create user credentials allowing you to use their platform to access the Mobile Offering, that Personal Data is stored outside of McKinsey's control and will be subject to the relevant Mobile Platform Provider’s own terms and privacy policies.

Security McKinsey has implemented generally accepted standards of technology and operational security to protect Personal Data from loss, misuse, alteration, or destruction. Only authorized McKinsey personnel and third party service providers are provided access to Personal Data, and these personnel and service providers are required to treat this information as confidential. Despite these precautions, McKinsey, however, cannot guarantee that unauthorized persons will not obtain access to your Personal Data.

Data retention policy McKinsey retains your Personal Data for as long as we are providing services to your Sponsoring Organization. We may retain your Personal Data for up to one year after we have stopped providing services to your Sponsoring Organization, unless we need to retain it to comply with legal obligations or to protect ourselves against legal claims. If you request that we delete your Personal Data, McKinsey will make reasonable attempts to delete all instances of the information in their entirety unless we have a legitimate reason to retain it. For requests for access, corrections, or deletion, please refer to the "YOUR RIGHTS" section of this Privacy Policy.

Your rights Certain local privacy laws may provide you with the right to request access to the Personal Data that we have about you for the purposes of reviewing, modifying, or requesting deletion of the data. You may also have the right to request a copy of the Personal Data that we hold about you and to have any inaccuracies in that data corrected. We will assess each request individually, and in certain circumstances, you may also request that we cease processing your Personal Data.

To help protect your privacy and security, we will take reasonable steps to verify your identity, such as requiring you to provide or confirm your identity, including your User Account Information, before granting access to your Personal Data. We will make reasonable attempts to promptly investigate, comply with, or otherwise respond to your requests as may be required by applicable law. Different laws or circumstances may prevent us from providing access to your Personal Data or otherwise fully complying with your request depending upon the circumstances and the request; such as for example, where producing your information may reveal the identity of someone. We may, including where required by applicable law or contract, notify your Sponsoring Organization of your request and coordinate with your Sponsoring Organization in responding to your request. We reserve the right to charge an appropriate fee for complying with your request where allowed by applicable law, and/or deny your requests where they may be manifestly unfounded, and/or excessive, or otherwise objectionable or unwarranted under applicable law.

Where the processing of your Personal Data is based on consent (for example if we send you newsletters), you may withdraw your consent at any time, by contacting datasubjectrights@mckinsey.com and please state that your request concerns McKinsey Academy.

The privacy laws in your geographic area may vary. Please see below for certain rights specific to California residents and individuals located in the United Kingdom or European Economic Area.

Your California privacy rights If you are a California resident under the age of 18, and a registered user of McKinsey Academy subject to this Privacy Policy, California Business and Professions Code Section 22581 permits you to request and obtain removal of content or information you have publicly posted. To make such a request, please send a detailed description of the specific content or information to datasubjectrights@mckinsey.com and please state that your request concerns McKinsey Academy. Please be aware that such a request does not ensure complete or comprehensive removal of the content or information you have posted and that there may be circumstances in which the law does not require or allow removal even if requested.

As required by the California Consumer Privacy Act (CCPA), this Privacy Policy describes the categories of Personal Data collected, processed, and disclosed by McKinsey, the categories of sources for that data, and the business or commercial purposes for which that data is collected, processed, and disclosed.

In addition, under California law, you may have the right (up to two times in any 12-month period) to request more information about McKinsey's collection, use, disclosure, and sale of Personal Data about you during the preceding 12 months, including:

The categories of Personal Data about you that we have collected,
The categories of sources from which we have collected that information
The commercial or business reason(s) we have collected, used, disclosed, or sold that information, and
The categories of third parties to whom we have disclosed or sold that information.
In addition, upon receipt of a verifiable request from you establishing your identity, you may have the right to know about the specific pieces of Personal Data that we have collected about you and/or shared with third parties.

You may also have the right to request deletion of Personal Data about you that we have collected or maintain, which we will honor subject to certain limitations set forth in California law.

If you are a California consumer and you or your authorized agent would like to exercise your privacy rights, please contact us at datasubjectrights@mckinsey.com, or call us at +1-888-914-9661 using the six-digit PIN code: 736 415 and please state that your request concerns McKinsey Academy. When we process your request, we may require you to provide certain Personal Data about you in order to verify your identity in accordance with requirements under CCPA. This may include your first and last name, email address, physical address, telephone number, and information about your relationship with us or other information needed to verify your identity. McKinsey will not discriminate against you based on your exercise of any of these rights.

Pursuant to California Civil Code Section 1798.83(c)(2), McKinsey does not share your Personal Data with third parties for those third parties' direct marketing use.

Your United Kingdom and European Economic Area privacy rights

McKinsey, as a data controller, provides you rights regarding your Personal Data. In accordance with the UK and European regulations regarding the protection of your Personal Data, you have the following rights over your Personal Data:

Right to access information about how we process your Personal Data, including the categories of Personal Data we process, recipients of your Personal Data, and purposes for our processing.
Right to rectification of inaccurate Personal Data concerning you, as well as, taking into account the purposes of the processing, the right to have incomplete Personal Data completed.
Right to erasure (deletion) of Personal Data concerning you where: (a) the Personal Data is no longer necessary in relation to the purposes for which they were collected or otherwise processed; (b) you withdraw your consent and there are no other legal grounds for the processing; (c) you exercise your right to object (see below) and there are no compelling legitimate grounds for the processing; (d) the Personal Data have been unlawfully processed; or (e) the Personal Data have to be erased for compliance with a legal obligation applicable to us.

Right to restriction of processing (i.e., data will be blocked from normal processing but not erased) where: (a) you contest the accuracy of the Personal Data, for a period enabling us to verify the accuracy; (b) the processing is unlawful and you oppose the erasure of the Personal Data and requests the restriction of their use instead; (c) we no longer need the Personal Data for the purposes of the processing but they are required by you for the establishment, exercise or defense of legal claims; (d) you exercise your right to object (see below) pending the verification whether our legitimate grounds override those of you.

Where processing is based on your consent, the right to withdraw consent at any time, without affecting the lawfulness of the processing prior to such withdrawal. Please note that even after you have chosen to withdraw your consent we may be able to continue to process your Personal Data in some limited circumstances.

Where processing is based on your consent, or on a contract, the right to data portability, i.e. the right to obtain a copy of the data concerning you in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from us.

Right to object to the processing of Personal Data based on our legitimate interests, provided that there are no compelling legitimate grounds for the processing that would override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.

If you wish to exercise any of your rights above, please contact us using the information at the end of this Privacy Policy. We may charge you a reasonable fee in the event you request additional copies of your Personal Data or make other requests that are manifestly unfounded or excessive. If we are unable to honor your request, or before we charge a fee, we will let you know why.

Consent; changes to privacy policy By using McKinsey Academy, including the Site or any Mobile Offering, you acknowledge that we collect, use, and store your information, including your Personal Data, by us in the manner described in this Privacy Policy, the Terms and as otherwise agreed with you. We reserve the right to make changes to this Privacy Policy from time to time. We will alert you to any such changes by updating this Privacy Policy as made available at https://solutions.mckinsey.com/msd/academy-privacy-policy. If we make material changes to this Privacy Policy that increase our rights to use Personal Data that we have previously collected about you, we will obtain your consent either through an email to your registered email address or by prominently posting information about the changes in a manner accessible to McKinsey Academy users.

Contact our privacy department For questions or concerns about our Privacy Policy, or if you would like to communicate with our EU Data Protection Officer or the Data Privacy Team, please contact us at:

McKinsey & Company
Legal Department
711 Third Avenue
New York, NY 10017
+1 212 446 7000
privacy@mckinsey.com