img1

BCG Recruitment
Privacy Policy

LAST UPDATED: November 2024

This is the Recruitment Privacy Policy (“Privacy Policy”) for The Boston Consulting Group, Inc. and its subsidiaries and affiliates (“BCG”, “we”, “us”, or “our”). For more details on BCG’s international operations, please see https://www.bcg.com/offices/default. With this Privacy Policy, BCG aims to make sure you understand how BCG collects, discloses, and retains your personal information, explain the purposes of BCG processing your personal information, and additionally inform you on your rights under applicable data privacy laws.

This Privacy Policy only applies to the personal information of job applicants, potential candidates for employment, and participants of our optional recruiting programs and events or personal information collected via our recruiting system or recruiting website. 

Depending on your relationship with BCG, additional or different privacy statements may apply to you. For our privacy practices in connection with the personal information you provide or as you access and use materials on bcg.com or other BCG websites, including BCG subscription pages or other BCG websites or apps, or information that you submit to BCG in response to an email request for information or other outreach from BCG, please see our Privacy Statement. For our privacy practices in connection with the personal information that we obtain from our access to and use of our tools and solutions and the research and development thereof, please see our Solutions Privacy Statement.

If you are a U.S. resident, please see the U.S. Addendum at the end of this Privacy Policy for further details on how we handle your personal information and how to exercise your rights.


LINKS TO OTHER WEBSITES

Some of our online recruiting activities enable access to external sites operated by third parties, which are not governed by this Privacy Policy. We encourage you to review the privacy policies of any such sites before you submit information there.


WHAT PERSONAL INFORMATION DO WE COLLECT?
The types of personal information that BCG requests from you and the ways that we process it are determined by the requirements of the BCG office’s country in which the position is located, and not the country in which you reside. If you apply to more than one location or if the role to which you apply is available in more than one country, the types of personal information we request from you and the ways that we process it are determined by the requirements of all BCG offices’ countries in which the position is located. It can include e.g. your name, contact data of email address, phone number, CV/Resume information, employment and educational history, grades, and data relating to your recruiting performance, where applicable documentation required under immigration laws as well as criminal records or other data revealed during background screenings. When using our recruiting website or our recruiting platform, we may also collect information via cookies and other technologies as described in the “Cookies and Other Tracking Technologies” section to this Privacy Policy below.

In addition to information, you may submit directly to us now, we also collect information from third-party sources, such as professional recruiting firms, resume books, student organizations, and social media sites, and from BCG employees who referred you for the role in order to populate your profile. As a result, you may see information in your profile which you did not provide directly to us. We encourage you to revise any data which you feel is inaccurate or outdated or that you prefer not to include, and we thank you for your help in keeping your profile up to date.

We may collect sensitive personal information about a candidate to the extent prescribed by applicable laws (e.g., U.S. equal opportunity laws) and, where applicable, to support our efforts to support BCG’s diversity goals, evaluate the effectiveness of our equal opportunity policy and create an inclusive and diverse work environment.  We may collect some optional information that may reveal your sensitive personal information when we ask you about your dietary requirements for events registration, or whether you are interested in any BCG affiliation initiatives (e.g. Pride@BCG, AccessAbility@BCG, AsianDiversity@BCG,  Indigenous@BCG, Black@BCG, Latinx@BCG etc.) only to invite you specifically to the events based on your choices, and you may share with us information or a photo or video, which can reveal for instance your ethnicity or disability status. If you choose to provide your sensitive personal information, your data will be shared only with the authorised BCG employees on a strictly need-to-know basis only for the purposes explained at the time of collection, subject to your consent and will never be used for any individual employment decision making. Sensitive personal information is a subset of personal information and includes ethnicity, health, sexual orientation, as well as other categories, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data as prescribed by applicable data privacy laws or other relevant laws.

You are not required to provide any requested information to us but failing to do so may result in not being able to continue your candidacy for the job for which you have applied.

HOW DO WE USE YOUR PERSONAL INFORMATION?

Personal information is processed in the following ways and in accordance with applicable data privacy laws, the processing is based on the lawful bases as stated below:


  • In some situations, as listed below, we may need to process your personal information for the legitimate interests pursued by us for following purposes, unless consent is required specifically under applicable data privacy laws
  • Recruiting and business management reasons including, identifying, and evaluating candidates for potential employment, as well as for future roles that may become available 
  • Inviting you to recruiting events and keeping you informed about recruiting programs
  • In case of active sourcing, analyzing if you might fit with a role and initiating contact with you
  • For assessing suitability for the role that you apply for and to communicate with you in relation to your application
  • In case you accept offer from BCG for a role, running background checks [1], financial checks where applicable, and identity verification
  • Record keeping in relation to recruiting and hiring; we will retain your data for a period of up to five years subject to your consent, if you join a recruiting program
  • To store your data on a global tool which also enable BCG to assess your application for available roles in different BCG offices
  • To provide you with secure log-in and remember your log-in credentials and ensure functionality of our recruiting website and recruiting platform
  • To monitor the performance and allow personalized experiences in connection with our recruiting website and recruiting platform
  • To serve advertisements relevant to your interests and allow for site tracking in connection with our recruiting website and recruiting platform 
  • For marketing communications from BCG based on your consent where required
  • Ensuring compliance with legal requirements (e.g. immigration laws, tax laws), including diversity requirements and practices; and protecting our legal rights to the extent authorized or permitted by law

Whatever the outcome of your application or other interaction with us, we may also analyze, in anonymized form, your personal information or aggregated data to improve our recruitment and hiring process by using such information to build algorithms which will inform our decisions about future candidates and augment our ability to attract successful candidates from diverse backgrounds. 

We process your personal information for the purposes described above: when we have your consent to do so, where applicable; when necessary to enter into an employment contract with you; when necessary for us to comply with a legal obligation; or when necessary for the purposes of our legitimate interests as an employer operating globally. You may withdraw your consent at any time by sending an email to datasubjectrights@bcg.com. For candidates in Germany and Austria please email us at datenschutz@bcg.com.

AUTOMATED SORTING OF CANDIDATES AND ONLINE ASSESSMENTS

Our recruitment process may include data analytics and algorithms to help us to efficiently review the large quantities of candidates and application data that we receive.  When you submit a job application, the information you share with us will be screened and compared to the predefined responses and scores set for the relevant roles to help us score candidates based on professional characteristics that suggest skills and capabilities necessary to perform the role. 

As a part of your recruitment process, you may also undergo a series of online assessments. We may collect data generated by your participation in psychological, technical, or behavioural assessments. The predefined responses are based on data that indicates what good job performance at BCG looks like and/or in relation to these assessments.  You will receive more information about the nature of such assessments before your participation in any of them.

These results are always considered in tandem with, and not in lieu of, human judgement and evaluation of individual candidates.

WHEN WILL WE DISCLOSE YOUR PERSONAL INFORMATION?

BCG may disclose your personal information to carefully selected third-party service providers who:
  • Provide a recruiting software system
  • Process information on our behalf to help run some of our internal business operations including email distribution and IT services
  • Assist us in recruiting talent, administering and evaluating pre-employment screening and testing, and improving our recruiting practices
  • Assist in scheduling, organizing, and hosting events, meetings and interviews

BCG will ensure that legal mechanisms are in place with such third parties to protect your personal information.

We may also disclose your personal information to: 
  • a third party in the context of any reorganization, financing transaction, merger, sale, joint venture, partnership, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings)
  • law enforcement bodies in order to comply with any legal obligation or court order

Lastly, we may disclose certain personal information collected via cookies to the third parties listed in our cookie consent managers.

DO WE TRANSFER YOUR PERSONAL INFORMATION ACROSS GEOGRAPHIES?

Because BCG is a global organization, we may need to transfer personal information across geographical borders to authorized BCG personnel, BCG entities, or our service providers in other countries in accordance with applicable data privacy laws. Our authorized personnel, BCG entities, or our service providers may be based in different countries around the world, including outside of your country of origin. These arrangements or transfers may involve storing your personal information located in systems and applications around the world. The personal information is only accessible by authorized personnel, BCG entities, or service providers who are bound by certain confidentiality and privacy requirements. We only make these arrangements or transfers where we are satisfied that adequate levels of protection are in place to protect personal information held in that country. 

COOKIES AND OTHER TRACKING TECHNOLOGIES

BCG may use cookies and similar tracking technologies on our recruiting website and recruiting platform. A “cookie” is a small amount of data sent from a web server to your browser and stored on your computer’s hard drive. Other tracking technologies work similarly to cookies and place a small amount of data on your devices to monitor your website activity to allow us to collect information about how you use our recruiting website and our recruiting platform. With most internet browsers, you can erase cookies from your computer hard drive, block all cookies, or receive a warning before a cookie is stored on your computer. Please refer to your browser instructions or you can visit https://www.aboutcookies.org/ which will give you more information. Please be advised that certain sections or functionalities of the recruiting website or the recruiting platform may be inaccessible to you if your browser does not accept cookies. We do not currently respond to browser do-not-track signals.

A detailed list of cookies used on our recruiting website and recruiting platform are available on our cookie consent managers.

CHATBOT

On our recruiting website, BCG provides a chatbot operated by our software provider to provide you with information and support. Our chatbot and software service provider does not request or aim to collect any personal information but may collect any information (including personal information) that you may enter or certain device or usage information automatically.

RECORDING OF USER EXPERIENCE

On our recruiting website, BCG utilizes a third-party provider, Contentsquare, to record user sessions, including clicks, hovers, swipes, and what you may be viewing on the website, and create insights based on such information. Before deploying Contentsquare’s technology to conduct such recordings, BCG obtains your consent via our cookie consent manager on the recruiting website. If you have previously provided your consent, but now wish for BCG to stop utilizing Contentsquare’s technology, please adjust your cookie settings on the cookie consent manager on the recruiting website to only utilize essential cookies. For more information on Contentsquare’s privacy practices, please visit Contentsquare’s services privacy policy

HOW DO WE PROTECT YOUR PERSONAL INFORMATION?

BCG has in place appropriate technological and operational security processes designed to protect your personal information. Only authorized employees and providers will have access to any personal information provided by you, and that access is limited by need. Each employee or provider having access to any personal information is obligated to maintain its confidentiality. 

HOW LONG WILL WE RETAIN YOUR PERSONAL INFORMATION?

If we do not employ you, we may continue to retain and use your personal information for a period of time (which may vary depending on the country) for system administration purposes, to perform research, to comply with our legal or tax obligations, and for the establishment, exercise or defense of legal claims. At the expiry of this period, we will retain a minimum amount of your personal information to record your recruiting activity with us. In addition, we may ask you for permission to retain your personal information to consider you for future employment opportunities, as part of our optional recruiting programs. In this case, we will retain your data for a period of up to five years. If you join a recruiting program, but subsequently wish to withdraw, please contact us at datasubjectrights@bcg.com. For candidates in Germany and Austria please email us at datenschutz@bcg.com.

YOUR RIGHTS

Depending on where you reside, you may have the following rights in accordance with applicable data privacy laws. You have a right to request a copy of the personal information we hold about you and details of how we use that information. If any of the personal information held about you is incorrect or out of date, you have the right to amend or rectify such personal information. You also have the right to request that we erase your personal information, stop processing your personal information, restrict the processing of your personal information, and provide your personal information in a portable format.  Where processing of personal information is based on your consent, you may withdraw your consent to such processing. This may not apply if there are other legal justifications to continue processing. You also may have a right to lodge a complaint with a relevant supervisory authority.

If you would like to exercise any of your data protection rights, please contact the appropriate point of contact below. Please note that we may need you to prove who you are (including providing additional information from you) before we can act on your request. 

For further questions, or to exercise any of your data protection rights, you may contact the appropriate data protection point of contact:

Data Protection Office
Boston Consulting Group Inc.
200 Pier Four Boulevard
Boston, MA 02210
Contact the Data Protection Office.

Germany and Austria
Data Protection Officer (Der Datenschutzbeauftragte)
Boston Consulting Group GmbH
Ludwigstrasse 21
80539 Munich Germany
Contact the Germany and Austria Data Protection Officer (Der Datenschutzbeauftragte)

CHANGES TO THIS PRIVACY POLICY 

We may change or update this Privacy Policy from time to time.  When we do, we will communicate changes and updates to this Privacy Policy by posting the updated Privacy Policy on this page with a new “Last Updated” date.
U.S. ADDENDUM 

This U.S. Addendum applies to U.S. residents and supplements the information provided above in the Privacy Policy. This U.S. Addendum provides U.S. residents with certain information under U.S. state data privacy laws, including but not limited to, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CPRA”). 
Collection, Disclosure, Selling, and Sharing of Personal Information and Targeted Advertising
The following table details which categories of personal information we collect and process, as well as which categories of personal information we disclose to third parties for our operational business and hiring and recruitment purposes, including within the 12 months preceding the date this Privacy Policy was last updated.

Categories of Personal InformationDisclosed to Which Categories of Third Parties for Operational Business Purposes
Identifiers, such as name, postal address, unique personal identifiers, IP address, email address, account name, online identifiers, and government-issued identifiers Our affiliates; service providers that provide services such as recruiting, candidate engagement, employment screening and background checks, consulting, IT and other services; the third parties listed in our cookie consent managers; professional advisors, such as lawyers; public and governmental authorities, such as regulatory authorities and law enforcement
Personal information as defined in the California customer records law, such as name, contact information, and financial, education and employment information

Our affiliates; service providers that provide services such as recruiting, candidate engagement, employment screening and background checks, consulting, IT
and other services; professional advisors, such as lawyers; public and governmental authorities, such as regulatory authorities and law enforcement
Protected Class Information, such as characteristics of protected classifications under California or federal law, such as sex, age, gender, race, disability, citizenship, military/veteran status, gender identity and expression, primary language, and immigration statusOur affiliates; service providers that provide services such as employment screening and background checks, consulting, IT
and other services; professional advisors, such as lawyers; public and governmental authorities, such as regulatory authorities and law enforcement
Commercial Information, such as travel expensesOur affiliates; service providers that provide services such as expense reimbursement provider, consulting, IT and other services; professional advisors, such as lawyers; public and governmental authorities, such as regulatory authorities and law enforcement
Internet or network activity information, such as browsing history and interactions with our website and other online portals or services Our affiliates; service providers that provide services such as recruiting, candidate engagement, consulting, IT and other services; the third parties listed in our cookie consent managers; professional advisors, such as lawyers; public and governmental authorities, such as regulatory authorities and law enforcement
Audio/Video Data. Audio, electronic, visual and similar information, such as photographs and call and video recordingsOur affiliates; service providers that provide services such as recruiting, candidate engagement consulting, IT and other services; the third parties listed in our cookie consent managers; professional advisors, such as lawyers; public and governmental authorities, such as regulatory authorities and law enforcement
Education Information subject to the federal Family Educational Rights and Privacy Act such as student transcripts, grade point average, grades, academic standing, disciplinary records, and confirmation of graduationOur affiliates; service providers that provide services such as recruiting, candidate engagement, employment screening and background checks, consulting, IT
and other services; professional advisors, such as lawyers; public and governmental authorities, such as regulatory authorities and law enforcement
Employment Information. Professional or employment-related information, such as work history and prior employer, information from reference checks, work experience, qualifications, training and skills, work authorization, CV, résumé, cover letter, professional and other work-related licensesOur affiliates; service providers that provide services such as recruiting, candidate engagement, employment screening and background checks, consulting, IT
and other services; professional advisors, such as lawyers; public and governmental authorities, such as regulatory authorities and law enforcement
Inferences drawn from any of the Personal Information listed above to create a profile about, for example, an individual’s preferences, characteristics, predispositions, and abilitiesOur affiliates; service providers that provide services such as recruiting, candidate engagement, consulting, IT and other services; the third parties listed in our cookie consent managers; professional advisors, such as lawyers; public and governmental authorities, such as regulatory authorities and law enforcement
Sensitive Personal Information
Social Security, driver’s license, state identification card, or passport number; account log-in; racial or ethnic origin, citizenship, immigration status



Our affiliates; service providers that provide services such as recruiting, talent acquisition, employment screening and background checks, consulting, IT and other services; professional advisors, such as lawyers; public and governmental authorities, such as regulatory authorities and law enforcement

We may also disclose the above categories of personal information to a third party in the context of any reorganization, financing transaction, merger, sale, joint venture, partnership, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).

BCG does not “sell” or “share” your personal information in exchange for monetary consideration. However, we may allow the third parties listed in our cookie consent managers to use cookies and related tracking technologies to collect information about your visits to our websites and use that information to deliver advertisements relevant to your interests. Information collected about you on our websites by third parties could be combined with other information that you have provided to such third parties or that they have collected from your use of their services. Under U.S. state data privacy laws, these disclosures may constitute a “sale” when the personal information is exchanged for non-monetary consideration (anything of value) or “sharing” when the personal information is disclosed for cross-context behavioral advertising purposes. Under U.S. state data privacy laws, such activities may also constitute “targeted advertising”. Accordingly, we may “sell” and “share” the following categories of personal information with the third parties listed in our cookie consent managers for purposes of advertising, internal research, analytics, and development purposes within the preceding 12 months:
  • Identifiers, such as name IP address, and online identifiers 
  • Geolocation data, such as approximate location derived from IP address
  • Internet or network activity information, such as browsing history of BCG sites, assets or prior visits, search history and interactions with our online properties
  • Inferences drawn from any of the personal information listed above to create a profile about, for example, an individual’s preferences or characteristics

Without limiting the foregoing, we do not knowingly “sell” or “share” the personal information, including the sensitive personal information, of minors under 16 years of age.

Categories of Sources of Personal Information
The categories of sources from which the categories of personal information listed above are collected are listed in the “What Personal Information Do We Collection” section of this Privacy Policy.  

Purposes for the Collection of Personal Information
The specific business or commercial purpose for collecting the categories of personal information listed above are listed in the “How Do We Use Your Personal Information” section of this Privacy Policy. 

Personal Information Retention
The criteria used to determine how long we retain your personal information is set forth in the “How Long Will We Retain Your Personal Information” section of this Privacy Policy. 

Use or Disclosure of Sensitive Personal Information  
We do not use or disclose your sensitive personal information outside of the following purposes: (1) performing our services, (2) detecting security incidents, (3) resisting malicious, deceptive, fraudulent, or illegal actions, (4) ensuring physical safety, (5) for short-term transient use, including certain non-personalized advertising, (6) maintaining or servicing accounts, providing customer service, or providing similar services, and (7) verifying and maintaining the quality or safety of a service or product or improving, upgrading, or enhancing a service or product. Accordingly, we do not provide the right to limit the use or disclosure of your sensitive personal information under the CPRA.

Privacy Rights
If you are a U.S. resident, you may, subject to applicable law of the state in which you reside, have the following rights regarding your personal information:
  • The right to know: 
    • Whether we are processing your personal information
    • The categories of personal information we collected about you and the categories of sources from which we collected such personal information
    • The business or commercial purpose for collecting personal information about you; and
    • The categories of personal information about you that we otherwise disclosed, and the categories of third parties to whom we disclosed such personal information
  • The right to correct inaccuracies in your personal information
  • The right to have your personal information deleted, subject to certain exemptions
  • The right to obtain a copy of your personal information
  • The right to opt-out of: (1) the “sale” or “sharing” of your personal information; (2) targeted advertising; or (3) profiling in furtherance of decisions that produce legal or similarly significant effects; although please note BCG does not engage in such profiling
  • The right not to receive discriminatory treatment for exercising your privacy rights

If you are a U.S. resident, to exercise your rights regarding your personal information, please contact us via datasubjectrights@bcg.com or, if you are a California resident, you may also call 1-866-I-OPT-OUT (1-866-467-8688) and enter service code 837# to leave us a message.  We will verify and respond to your request consistent with applicable law, taking into account the type and sensitivity of the personal information subject to the request.  We may need to request additional personal information from you in order to verify your identity and protect against fraudulent requests. If you maintain a password-protected account with us, we may verify your identity through our existing authentication practices for your account and require you to re-authenticate yourself before disclosing or deleting your personal information. If you make a request to delete, we may ask you to confirm your request before we delete your personal information.
You may opt-out of the “sale” or “sharing” of your personal information described above by sending certain browser-enabled opt-out signals, such as the Global Privacy Control. Learn more about the Global Privacy Control. In addition, you may opt-out of the “sale” or “sharing” of your personal information or “targeted advertising” described above by visiting the cookie consent manager and changing settings to only utilize essential cookies.

Authorized Agents
If an agent would like to make a request on your behalf as permitted by applicable law, the agent may use the submission methods noted in the section entitled “Privacy Rights”.  As part of our verification process, we may request that the agent provide, as applicable, proof concerning their status as an authorized agent.  In addition, we may require that you verify your identity as described in the section entitled “Privacy Rights” or confirm that you provided the agent permission to submit the request.

Appeal Process
If you have made a privacy rights request to BCG and believe your request was denied by BCG, you can exercise your right to appeal the results of your request by using the submission methods noted in the section entitled “Privacy Rights”. Please use the same email address that you used to submit the initial privacy rights request when you submit your request to appeal, and please add “Request to Appeal” in the subject line of the email. If you do not use the same email address, we cannot link your request to appeal to your initial privacy rights request. If your appeal is unsuccessful, depending upon the state in which you reside, you may have the right to raise a concern or lodge a complaint with your state attorney general or other applicable authority. 



FOOTNOTES

[1] BCG only uses publicly available information for running background checks.