- Who is Collecting Data
- Data We Collect
- Processing of Personal Data
- How Data is Processed
- Storage of Personal Data
- Disclosure/sharing of Personal Data
- Cross-border Transfers
- Your Rights
- Workplace Monitoring
- Automated Decision Making
- Providing Information to Kroll
- Third Party Websites or Services
- Contact Us
- California Privacy Notice and Policy
Kroll Consultant Privacy Notice
Kroll LLC (and all affiliates and subsidiaries, collectively “Kroll”, “we”, “us” or “our”), is committed to protecting personal data and complying with the applicable data privacy and security requirements in the countries in which we operate, including, where applicable, the EU General Data Protection Regulation (GDPR).
This Privacy Notice explains how Kroll processes personal data relating to individual consultants, independent contractors and other individuals who provide services to Kroll, including through an agency, intermediary, or subcontracting arrangement (collectively, “Consultants”).
Please read this Notice carefully. It describes the types of personal data we collect about you, how and why we use it, how long we retain it, with whom we share it (in other words, how we “process” it). It also contains information about your rights under applicable data protection laws.
Where Kroll determines how and why your personal data is processed in connection with your engagement, Kroll acts as a data controller (or equivalent under the local laws).
If you are a California resident who is a Consultant of Kroll, please see the California Privacy section of this policy.
Who is Collecting Data
- Kroll processes your personal data for purposes connected with:
- establishing and managing Kroll’s engagement with you and/or your organization;
- providing and administering your access to Kroll systems and premises where appropriate;
- Ensuring the security of Kroll systems and facilities;
- meeting legal, regulatory and compliance obligations;
- establishing, exercising, or defending legal claims;
- Monitoring and promoting equal opportunity and diversity initiatives.
Where you are supplied through an agency, intermediary, or subcontracting arrangement, that organization may also process your personal data as a separate controller (or equivalent under applicable law) for its own purposes.
Data We Collect
Data we collect may include the following categories, as applicable to your engagement:
- Identity and contact data, such as your name, business contact details, emergency contact if required for safety or continuity purposes.
- Engagement/assignment data, including the start/end date, role, assignment details, and other records relating to the administration of your engagement.
- Onboarding and due diligence data (where applicable), including professional qualifications, certifications, references, right-to-work verification, conflict declarations, and background screening outputs.
- Security and access data: system access requests/approvals, credentials, device identifiers (where Kroll-managed devices are used), access logs, audit trails, including logs relating to use of corporate accounts and tools, DLP events, etc.
- Financial/admin data: invoicing references, bank details and tax identifiers, expense claims, and travel booking information where arranged by Kroll.
- Physical access and security information: identification badge information, building access logs, entry/exit records, visitor registration details, and video surveillance recordings (CCTV) collected at our premises, where applicable.
- Training and compliance records (training enrollment, completion status, assessment scores (where used), certifications, policy acknowledgments (e.g., security, privacy, acceptable use, etc.).
- Timesheets: timesheets, hours worked, utilization metrics, work allocation records, approvals, billing/time coding.
- Communications and correspondence: business communications (email, collaboration tools), meeting notes where relevant to the engagement, service desk tickets, etc.
- Compliance monitoring, investigations and enforcement related information: Information relevant to compliance reviews, monitoring, audit, investigations or related enforcement activities, including information such as complaints or allegations, correspondence, interview notes, audit documentation, system and access logs, CCTV footage (where applicable), and other evidence relating to potential breaches of law, policy, or contractual obligations.
- Diversity and equal opportunity information (where voluntarily provided): Information relating to diversity characteristics, which may include gender or gender identity, race or ethnicity, disability status, veteran or military status, or other protected characteristics, where voluntarily provided for equal opportunity monitoring, diversity reporting, or legal compliance purposes.
Processing of Personal Data
Kroll processes your personal information where processing is necessary for the purposes described in this Notice. In jurisdictions that require a legal basis for processing (such as the UK or EU General Data Protection Regulation), we rely on the legal bases identified below, as applicable to specific circumstances of processing.