In this policy “Roland Berger”, “we”, “us” or “our” refers to one or more companies in the Roland Berger Group , most of which are a separate legal entities. The Roland Berger entity with which you are applying for a job is the data controller under the GDPR (if applicable), as this company uses your personal data in the context of the respective relationship with you. The address and name of this Roland Berger entity can be found here .

We process the data you provide in connection with your application, along with the data generated by interviewers and recruiters based on their interactions with you, to assess your suitability for the position (or any other open position at our companies) and to carry out the application process.

In addition to the data you provide directly to us, we may also gather data from publicly available third-party sources such as professional recruiting firms, resume books, student organizations, search engine results and social media platforms to complete your profile.

Generally, we do not ask you to provide us with special categories of personal data (i.e. information about racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, health or sexual orientation) as part of your application, unless explicitly required or permitted by law in a given case.

• Application portal
  If you use the Roland Berger online application portal, we need to process the personal data you submit through our application portal for the purposes of processing and considering your application. If you are hired, selected contact and CV data may already be used for onboarding purposes before you begin working for us, and data relevant for the employment will be placed in your personnel file. The processing of personal data may also be required for legal prosecution (asserting or defending claim) after the application procedure has been completed.
  When the controller is an entity that is located in the European Union (EU), it will do so on the legal basis of Art. 6 para. 1 lit. f General Data Protection Regulation (GDPR) and on the legal basis of Art. 6 para. 1 lit. b GDPR.
• Analytical tests
  In the event you agree to an analytical test, we will use the information you provide during the analytical test to determine your suitability for the position for which you have applied and, if applicable, for other positions that could be offered to you; we will document your test result for these purposes, in order to view your responses and evaluate them by experienced recruiters. The analytical test and the documentation of the results will take place only if you have given us your consent. EU controllers will do this on the legal basis of Art. 6 para. 1 lit. a GDPR. You may withdraw your consent at any time with future effect. To do so, please contact our Data Protection Officer .
• Participation in a live or question-based interview
  In the event you agree to an online live interview or a question-based video interview, we will use the information you provide during the interview to review your suitability for the position for which you have applied and, if applicable, for other positions that could be offered to you. We may record your live interview for these purposes, in order to view the interview at a later time during the application procedure. EU controllers will do this on the legal basis of Art. 6 para. 1 lit. a GDPR. No systematic analysis, for example, by using speech analysis software, will take place. You may withdraw your consent at any time with future effect. To do so, please contact our Data Protection Officer .
• Membership in Roland Berger candidate communities
  You may choose to become member of one of our Roland Berger candidate communities. This means that with your consent, we will retain all parts of your application, including any results from analytical tests (if any) or other personal information which are generated in the course of the application process, for a maximum period of three years (for jobs in the U.S. four years) in order to match you with and contact you about future career opportunities and other relevant positions within the Roland Berger Group and/or to stay in contact and inform you about recruiting events or other interesting Roland Berger news. Controllers in the EU will do this on the legal basis of Art. 6 para. 1 lit. a GDPR. Your consent is voluntary and will not affect the status of your application. You may withdraw your consent at any time with future effect. To do so, please contact our Data Protection Officer .
• Recruiting events
  In the event you participate on one of our recruiting events your personal data will be collected during your application process. This data will be processed for the purpose to identify you as a registered participant of the event, to grant you access to the event, to send reminders and to inform you if there are any changes to the event (e.g. a change of date and time) and to contact you after the event to ask for your feedback. Controllers in the EU will do this on the legal basis of Art. 6 para. 1 lit. b GDPR.
  In addition, photos can be taken at the event. If you do not wish to be photographed, please let the photographer know on the spot. We process the photos for the purposes of documentation of the event, for printed and for online publicity on our publicly available websites or/and on social media (a.o. Instagram, Facebook, LinkedIn, TikTok). For controllers in the EU the legal basis for taking and publishing of photos is our legitimate interest in reporting on the event pursuant to Art. 6 para. 1 lit. f GDPR. We ask for your separate consent (for controllers in the EU on the legal basis of Art. 6 para. 1 lit. a GDPR) for the publication of photos, if the content and composition of the photos or the intended use requires this.

• Application portal
  Unless your application results in an employment by Roland Berger, we retain your application and personal data for as long as necessary to complete the application process and to comply with the legally required periods for data storage, currently a maximum period of up to six months after the end of the application process. If you apply for a job in the U.S., your data may be stored for a maximum period of four years, if you apply in Mexico, your data may be stored for a maximum period of one year. Should you apply for multiple jobs within six months (in the U.S.: four years, in Mexico: one year), the retention period starts at the end of your last application process. If you have chosen to be added to one of our Roland Berger candidate communities (see below), we will retain your application and personal data for a period of up to three years. If you apply to a position in the U.S. the maximum period is four years.
• Interview data
  In the event you have agreed to an online live interview or a question-based video interview, any video footage or audio files of your remote interview will be deleted six months after we recorded or received it, also if you have chosen to be added to one of our Roland Berger candidate communities (see below). We will also erase this data if you withdraw your consent before then.
• Analytical test data
  In the event you have agreed to an analytical test, your test results will be deleted at the latest six months after the end of the application process. We will also erase this data if you withdraw your consent before then. If, during the application process, you have chosen to be added to one of our Roland Berger candidate communities (see below), we will retain your test results for a period of up to three years after the end of the application process. If you apply to a position in the U.S. the maximum period is four years.
• Applications from headhunters
  Should we receive your application through a headhunter (e.g., for a management position) which we have to pay a fee or agree to other contractual conditions relating to your application or employment, we may store your personal data for a longer period of up to two years (for controllers in the EU the legal basis are Art. 6 para. 1 lit. b and f GDPR).
• Membership in Roland Berger candidate communities
  If you have chosen to be added to a Roland Berger candidate community, we may retain all parts of your application, including any results from analytical tests (if any) or other personal information which are generated in the course of the application process, for a period of up to three years. If you apply to a position in the U.S. the maximum period is four years. Please note, you can decide for each application if you want to be added to our candidate communities. However, not agreeing to this option does not withdraw any community consent you might have given in previous applications. To withdraw your previous consent, please contact our Data Protection Officer .
• Recruiting events
  Roland Berger will store the photos processed for as long as it is necessary for the fulfilment of the aforementioned purposes.

• Within the Roland Berger Group
  Within the legal entity of the Roland Berger Group to which you have applied, only the responsible persons and departments (e.g., managers and employees of the department involved in the application process, recruiting teams, interviewer) will have access to your personal data. The aforementioned persons involved in the recruitment process may belong to different legal entities within the Roland Berger Group , depending on their position. Additionally, if you choose to be added to a Roland Berger candidate community, we may also consider you for vacant positions in different offices of the Roland Berger Group . For these purposes, all parts of your application, including any results from analytical tests (if any) or other personal information which are generated in the course of the application process, may be shared with and processed by the aforementioned persons at other Roland Berger Group offices, including those outside of the European Union. We may also share photos taken on recruiting events with other entities of the Roland Berger Group that may use it for their publicity.
  
  This may include that your personal data is forwarded to or accessible from a country outside of the EU which is not subject to a comparable level of data protection. In this event, we will ensure that the receiving Roland Berger entities and offices provide an appropriate level of protection by concluding the so-called EU standard contractual clauses. These are contracts of the EU Commission, which can be viewed and downloaded here .
• Disclosure of personal data to service providers
  If Roland Berger controllers in the EU involve service providers who support the processing of personal data and who may have access to your personal data, this is only done after the conclusion of a data processing agreement in accordance with Art. 28 GDPR that requires our service providers to only process personal data in accordance with our instructions and to keep such data confidential. Roland Berger Holding GmbH & Co. KGaA holds all contracts with service providers and acts as processor for other Roland Berger controllers. Currently, we work with the following service providers which we may instruct as data processors/sub-processors for processing your personal data:

Who is the service provider and what we are using them for:

• BESTCONSULTANT, 26, rue de Condillac, 33000 Bordeaux, France:
  Providing a platform to manage interview scheduling and feedback process. Processing of the provided personal data as well as application process data.
• Cammio GmbH, Gehrtsstraße 14, 40235 Düsseldorf, Germany:
  Providing a platform for live and asynchronous video interviews.Processing of basic personal data (name, email address and in some cases mobile phone number) as well as recording and processing recorded video sequences (including audio).
• FirstBird GmbH, Gertrude-Fröhlich-Sandner Straße 2-4, Spaces, Tower 9, 1130 Vienna, Austria:
  Providing a referral tool for current employees to refer friends and acquaintances from their network for open positions. Processing of personal data and application outcome in case of employee referrals.
• Korn Ferry (DE) GmbH, Barckhausstr. 12-14, 60325 Frankfurt a.M., Germany:
  Administering analytical tests during the application process. Processing of personal data and test results of candidates selected for analytical test.
• LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland:
  Enabling effective sourcing and managing of potential candidates from LinkedIn. Synchronization of relevant application, candidate and job data to LinkedIn. Processing of the provided personal data and communication.
• Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, 18 D18 P521 Dublin, Ireland:
  Using MS365 cloud services for emails, online meetings via Microsoft Teams, collaboration, etc. (please refer to the supplementary Privacy Notice for Microsoft365 Cloud Services ).
• PitchYou GmbH, Campusallee 9, 51379 Leverkusen, Germany: Providing digital recruiting via WhatsApp, only for applications via WhatsApp (in this case, please refer to supplemantary Data Protection Notice for the Application via WhatsApp )
• Roland Berger Holding GmbH & Co. KGaA, Sederanger 1, 80538 Munich, Germany:
  Holding all contracts with service providers and acting as processor for other Roland Berger controllers
• SmartRecruiters GmbH, Winsstr. 62/63, 10405 Berlin, Germany:
  Providing and developing the cloud platform (“Software as a Service”) for the above purposes. Processing of the provided personal data.

Under certain circumstances, you have rights under data protection laws in relation to your personal data. It is our policy to respect your rights and we will act promptly and in accordance with any applicable law, rule or regulation relating to the processing of your personal data. In particular, you can have the right to:

• request a copy of the personal data we hold about you (in the EU, known as the right of access (Art. 15 GDPR));
• ask that we update the personal data we hold about you, or correct any personal data that you think is incorrect or incomplete (in the EU, known as the right to rectification (Art. 16 GDPR));
• ask that we delete personal data that we hold about you, or restrict the way in which we use your personal data (in the EU, known as the right to erasure (Art. 17 GDPR) and the right to restriction of processing (Art. 18 GDPR));
• object to our processing of your personal data (in the EU, known as the right to object (Art. 21 and 22 GDPR));
• request that your personal data be transferred to you or another data controller (in the EU, known as the right to data portability (Art. 20 GDPR)).

If you are unhappy with the way we have handled your personal data or any data protection query or request that you have raised with us, you have a right to complain to the competent supervisory authority. We would, however, appreciate the chance to deal with your concerns before you approach the data protection authority, so please contact us in the first instance.

We may need to request specific information from you to help us confirm your identity and ensure your right of access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Objection and withdrawal of consent
If you have given us your consent to process your personal data, you can withdraw your consent at any time with future effect. If we process your personal data based on our legitimate interests, you can object at any time to the processing of your personal data for marketing reasons.

Please use either the link included in each Newsletter we send you or, alternatively, contact Roland Berger via mail, fax, email or using the contact details given under 6. Whom to contact.

If you have questions about this Recruitment Privacy Policy, please use the following central contact:

Roland Berger Holding GmbH & Co. KGaA
Sederanger 1
80538 Munich
Germany
Email address: [email protected]

You can also contact the Data Protection Officer at any time:

Data Protection Officer
Roland Berger Holding GmbH & Co. KGaA
Sederanger 1
80538 Munich
Germany
Email address: [email protected]

September 24th, 2024