KBRA Europe and KBRA UK GDPR/UK GDPR Recruitment Data Privacy Notice

1. INTRODUCTION

Thank you for considering a job opportunity at Kroll Bond Rating Agency Europe Limited, Kroll Bond Rating Agency UK Limited, KBRA Analytics Europe Limited or KBRA Analytics UK Limited (together "KBRA Europe/UK").
In this Data Privacy Notice ("Notice") the terms "KBRA" "Company" "we", "us" and "our" are references to KBRA Europe/UK and KBRA Holdings, LLC. You are being provided with a copy of this Notice because you are applying for work with us as an employee. ("Recruitment Exercise"). The purpose of this Notice is to make you aware of what personal data we will hold, how and why your personal data will be used, namely for the purpose of the Recruitment Exercise and how long it will be retained for.
Information on the data controller(s) of your personal data is listed in Section 12 below.
We take your data protection rights and our legal obligations seriously. Your personal data will be treated in a secure and confidential manner and only as set out below or otherwise notified to you in writing.
This Notice describes the categories of personal data we collect, how your personal data is processed, why we process your data, how long it will be retained for and how your right to privacy is safeguarded in the course of the Recruitment Exercise. It is intended to comply with our obligations to provide you with information about our processing of your personal data under privacy laws. It does not form part of any contract of employment or engagement.
If you have any questions about this Notice or would like to access the information it contains in a different format, please contact [email protected]. If you have any questions regarding the processing of your personal data or if you believe your privacy rights have been violated, or if you are aware of an unauthorised use or disclosure of data please contact [email protected].
Where we receive a CV via third party recruitment agency or a third level education institution (together "Recruiter"), we encourage you to read the relevant Recruiter's data protection notice to understand how your personal data is processed by such a Recruiter as the controller of your personal data independently of us.

2. WHAT DATA DO WE PROCESS?

Personal data means any information describing or relating to an identified or identifiable individual. In the course of the Recruitment Exercise, we will collect various types of personal data about you for the purposes described in this Notice including:
1. Personal details: your title and name, personal contact details (e.g. address, telephone number(s), email address), gender, date and place of birth, national ID number (for example a PPSN in Ireland or National Insurance Number in the UK), passport details, driving licence, eligibility to work information, languages spoken, the results of vetting checks, and emergency contact information;
2. Special category data and data relating to criminal convictions and offences: information concerning your physical or mental health, including details of any disability and any reasonable adjustments or accommodations required during the Recruitment Exercise and any other special category data you choose to provide voluntarily; immigration and eligibility to work information, including work permit, visa, residency or citizenship information; and, in limited circumstances and only where permitted by applicable law, information relating to criminal convictions and offences, including the results of criminal record or vetting checks;
3. Recruitment and selection data: skills and experience, qualifications and education details, CV and application, interview and assessment data (including interview notes, employment history (including job title, description, performance evaluation), historic compensation details, current and historic salary/income, information contained in publicly available professional profiles and other publicly available sources (for example LinkedIn, and, where relevant, other social media platforms), information related to the outcome of your application and details of any offer made to you;
4. Use of AI assisted recruitment tools: We may use AI assisted tools to support certain recruitment activities, such as organising and reviewing applications and identifying skills and experience relevant to a role. These tools are used to support our recruitment processes and do not make recruitment decisions. All recruitment decisions involve meaningful human review and assessment.
5. Security data: CCTV footage and images captured through the operation of security cameras at our premises.
6. Any other personal data which you choose to disclose to us during the course of the Recruitment Exercise whether verbally or in written form (for example, in work emails).

3. SPECIAL CATEGORY DATA AND DATA RELATING TO CRIMINAL CONVICTIONS AND OFFENCES

To the extent permitted by applicable laws the Company will collect and process a limited amount of personal data within the above data listed at section 2.1 falling into special categories, sometimes called "sensitive personal data". This term means information relating to:
1. racial or ethnic origin;
2. political opinions;
3. religious or philosophical beliefs;
4. physical or mental health (including details of accommodations or adjustments);
5. trade union membership;
6. sex life or sexual orientation;
7. criminal records and information regarding criminal offences or proceedings; and
8. biometric and genetic data, although we do not collect or expect to hold this type of data.
We only process such special category data where necessary for the purpose of carrying out the obligations, and exercising specific rights, of the Company or of a prospective employee under employment law or for the assessment of your working capacity or where you choose to provide such information on a voluntary basis in your application.

4. HOW DO WE COLLECT DATA?

The Company mainly collects your personal data directly from you. You will provide this information directly to the Company personnel managing the Recruitment Exercise or enter it into our systems (for example, through your participation in recruitment and selection processes, emails or through verbal information which is recorded electronically or manually).
We also obtain some information from third parties: for example, references from a previous employer, previous or current schools/universities, recruiters (including LinkedIn Recruiter) or publicly available resources (e.g. LinkedIn), or where we employ a third party to carry out a background check (if applicable, and subject to applicable law).
If particular information is required by contract or law this will be indicated at the time of collection. We will also let you know where there are consequences of you not providing the information requested. Failure to provide some information will mean that we cannot continue with the Recruitment Exercise as the Company will not have the personal data we believe to be necessary for the effective administration of the Recruitment Exercise.
In some circumstances, data is collected indirectly from monitoring systems (for example, building and location access control and monitoring systems and CCTV systems), if permitted by applicable laws. In these circumstances, the data may be collected by us or a third-party provider of the relevant service.

5. WHAT ARE THE PURPOSES FOR WHICH DATA IS PROCESSED AND WHAT IS OUR LEGAL BASIS FOR CARRYING OUT THE PROCESSING?

1. Whenever we process your personal data, we have a legal basis to do so. Processing of special category data is always justified on the basis of an additional lawful condition. In the majority of cases, the processing of your personal data will be justified on one of the following bases:
  1. The processing is necessary for compliance with a legal obligation to which we are subject; or
  2. Where there is no legal obligation, we will process your data where the processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into such a contract.
  3. Where the above two grounds do not apply, we may process your personal data where the processing is necessary for the legitimate interests pursued by us or a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data.
  4. In limited scenarios, the processing may be necessary to protect your vital interests.
2. In exceptional circumstances we may carry out the processing on the basis of your consent (for example where you permit us to use your image in marketing materials). Where we rely on consent, we will make this clear at the time.
We have set out below the purposes we may use your personal data for and the legal basis we rely on in each case.
The purposes we use personal data for and the legal basis that applies
We have identified a number of purposes for collecting and processing your personal data. These are set out below together with the legal basis we rely on in each case:

No.	Purpose for processing	The lawful basis we rely on
1.	Recruitment and selection Considering your suitability to work for us in the role you have applied for, or where we have identified you as a potential candidate, comparing you to other candidates and making recruitment decisions, including managing and administering recruitment and selection processes, sourcing and identifying potential candidates through recruiters and recruitment platforms (including LinkedIn Recruiter and LinkedIn Hiring Assistant), with recruitment decisions always involving human review and assessment	Some of this processing is necessary for the compliance with legal obligations to which the Company is subject including the requirement to make reasonable adjustments or accommodations where appropriate in the event that you choose to disclose that you have a disability. Some of this processing is necessary for taking steps at your request prior to entering into a contract with you, including assessing your application, determining your suitability for the role and deciding whether to make an offer of employment or engagement. Additional processing is necessary for the purpose of the legitimate interests pursued by the Company, namely the Company's legitimate interest in fully assessing applicants to determine that only suitable and appropriate candidates are selected, to compare candidates and make a fair decision on the most appropriate candidate for the position. The Company aims to recruit the best person for each vacancy through fair, systematic, effective recruitment and selection procedures. This will contribute towards the Company continuing to meet its business objectives, maintain its reputation and attract high calibre employees.
2.	Pre-employment verification and screening Appropriate pre-employment screening including, where relevant and appropriate, identity check, right to work verification, reference check, relevant employment history, relevant regulatory status and relevant professional and educational qualifications. Criminal record checks in limited circumstances, if and to the extent permitted by applicable laws.	Some of this processing is necessary for the compliance with legal obligations to which the Company is subject including establishment of the right to work in the country in which you are employed. Screening which is not legally required is necessary for the purpose of the legitimate interests pursued by the Company, namely the Company's legitimate interest in ensuring that candidates for employment or engagement do not pose an unacceptable risk to the business or its clients and considers the verification carried out necessary to prevent crime and other unlawful acts and to protect the business and clients from fraud, dishonesty or incompetence.
3.	Offers of employment and on-boarding Making job offers, providing contracts of employment or engagement and preparing to commence your employment or engagement where you accept an offer from us	Some of this processing is necessary for the compliance with legal obligations to which the Company is subject including the requirement to issue written particulars or terms of employment and the requirement not to unlawfully discriminate in the terms of any offer to you. Additional processing is necessary to take steps to enter into the contract between you and the Company and to perform that contract because we will need information to make an appropriate offer to you and administer your employment contract if you join us. The remainder of the processing is necessary for the purpose of the legitimate interests pursued by the Company, namely, the Company's legitimate interest in ensuring the effective engagement of staff on appropriate terms and conditions of employment and that there is a smooth transition into employment for successful candidates and that information supplied in the recruitment process which is relevant to ongoing employment is maintained. This will contribute towards the Company's continuing to meet its business objectives, maintain its reputation and attract high calibre employees.
4.	Future job opportunities To contact you if you are not successful in your initial application should another potentially suitable vacancy arise during the eighteen month period following completion of the recruitment process for the role you originally applied for	This processing is necessary for the purpose of the legitimate interests pursued by the Company, namely, the Company's legitimate interest in maintaining an appropriate pool of talent who have shown an interest in working for the Company and who are potentially suitable candidates for employment. This will potentially benefit both initially unsuccessful candidates and the Company. It will contribute towards the Company continuing to meet its business objectives, maintain its reputation and attract high calibre employees.
5.	Recruitment feedback and complaints To deal with any query, challenge or request for feedback received in relation to our recruitment decisions	This processing is necessary for ensuring compliance with legal obligations to which the Company is subject including ensuring that the Company is able to demonstrate its compliance with data protection laws and employment equality laws. Beyond legal compliance, the processing is necessary for the legitimate interests pursued by the Company, namely, the Company's legitimate interest in being able to provide feedback to candidates and to be able to defend any challenge or claim made in connection with our recruitment decision. This will assist the Company to avoid the risk of financial exposure or costs incurred through challenges to recruitment decisions and to maintain its reputation.
6.	Safety, security and preventing and detecting inappropriate or unlawful activities Safety and security including the use of CCTV; and preventing, detecting and investigating a wide range of activities and behaviours, such as relating to our premises generally and liaising with regulatory authorities	Some of this processing is necessary for compliance with legal obligations to which the Company is subject including health and safety laws, our duty of care and regulatory laws to which the Company is subject. Additional processing is necessary for the purpose of the legitimate interests pursued by the Company, namely the Company's legitimate interest in ensuring that its premises, business, clients, employees and systems are protected, and that action is taken to mitigate risk and to prevent and detect matters which may put the Company or its business or stakeholders at risk. This includes carrying out risk assessments; detecting and preventing crimes or criminal activity or other unlawful or unethical activity; ensuring that only appropriate employees are engaged in our business; and ensuring compliance with other legal or regulatory requirements placed upon us or related official guidance. It also includes providing ways for persons to report conduct or compliance issues and the appropriate consideration and investigation of matters drawn to the Company's attention. It also includes facilitating, controlling and restricting access to appropriate locations and systems. To be effective these must be monitored and kept up to date. Effective business protection is important for business continuity and to protect the Company's reputation. This supports the Company's immediate and long-term business goals and outcomes.
7.	Complaints, claims and litigation To enforce our legal rights and obligations, and for any purposes in connection with any complaint or legal claim made by, against or otherwise involving you, such as queries or complaints relating to the recruitment process and related compliance investigations.	This processing is necessary for the purpose of the legitimate interests pursued by the Company namely, the Company's legitimate interest in protecting its organisation from breaches of legal obligations owed to it and defending itself against litigation. This is needed to ensure that the Company's legal rights and interests are protected appropriately, to protect the Company's reputation and to protect the Company from other damage or loss. This is important to protect the business of the Company and ensure its continued success and growth. This supports the Company's immediate and long-term business goals and outcomes.
8.	Legal or regulatory disclosures To comply with lawful requests by public authorities (including without limitation law enforcement requirements), discovery requests, or where otherwise required or permitted by applicable laws, court orders, government regulations, or regulatory authorities (including without limitation data protection, tax and employment), whether within or outside your country	This processing is necessary for the compliance with legal obligations to which the Company is subject where there is a legal obligation to disclose information or a court or other legal order to provide information is in place. Where not legally required, processing is necessary for the purpose of the legitimate interests pursued by the Company, namely the Company's legitimate interest in co-operating with relevant authorities, government bodies or regulators for the provision of information where appropriate. The Company wishes to maintain its reputation as a good corporate citizen and to act ethically and appropriately in all the countries in which it does business.
9.	Commercial transactions or outsourcing Planning, due diligence and implementation in relation to a commercial transaction or service transfer involving the Company for example mergers and acquisitions	Processing is necessary for the purpose of the legitimate interests pursued by the Company. The Company has a legitimate interest in managing its business operations in the most effective way. The Company needs to make decisions relating to the future of its business in order to preserve its business operations or grow its business or maximise efficiency and effectiveness. In the event that the Company makes a decision to outsource a function or acquire or transfer a business or part of a business the Company and the third party with whom the Company is seeking to transact each have a legitimate interest in ensuring that the recruitment pipeline is sufficiently understood prior to committing to the transaction and to ensure a smooth transition of recruitment processes if a transaction goes ahead. Business change programmes and transformation support business continuity and improvement and support the Company in achieving its long-term business goals and outcomes.

No.

Purpose for processing

The lawful basis we rely on

Recruitment and selection

Considering your suitability to work for us in the role you have applied for, or where we have identified you as a potential candidate, comparing you to other candidates and making recruitment decisions, including managing and administering recruitment and selection processes, sourcing and identifying potential candidates through recruiters and recruitment platforms (including LinkedIn Recruiter and LinkedIn Hiring Assistant), with recruitment decisions always involving human review and assessment

Some of this processing is necessary for the compliance with legal obligations to which the Company is subject including the requirement to make reasonable adjustments or accommodations where appropriate in the event that you choose to disclose that you have a disability.

Some of this processing is necessary for taking steps at your request prior to entering into a contract with you, including assessing your application, determining your suitability for the role and deciding whether to make an offer of employment or engagement.

Additional processing is necessary for the purpose of the legitimate interests pursued by the Company, namely the Company's legitimate interest in fully assessing applicants to determine that only suitable and appropriate candidates are selected, to compare candidates and make a fair decision on the most appropriate candidate for the position. The Company aims to recruit the best person for each vacancy through fair, systematic, effective recruitment and selection procedures. This will contribute towards the Company continuing to meet its business objectives, maintain its reputation and attract high calibre employees.

Pre-employment verification and screening

Appropriate pre-employment screening including, where relevant and appropriate, identity check, right to work verification, reference check, relevant employment history, relevant regulatory status and relevant professional and educational qualifications.

Criminal record checks in limited circumstances, if and to the extent permitted by applicable laws.

Some of this processing is necessary for the compliance with legal obligations to which the Company is subject including establishment of the right to work in the country in which you are employed.

Screening which is not legally required is necessary for the purpose of the legitimate interests pursued by the Company, namely the Company's legitimate interest in ensuring that candidates for employment or engagement do not pose an unacceptable risk to the business or its clients and considers the verification carried out necessary to prevent crime and other unlawful acts and to protect the business and clients from fraud, dishonesty or incompetence.

Offers of employment and on-boarding

Making job offers, providing contracts of employment or engagement and preparing to commence your employment or engagement where you accept an offer from us

Some of this processing is necessary for the compliance with legal obligations to which the Company is subject including the requirement to issue written particulars or terms of employment and the requirement not to unlawfully discriminate in the terms of any offer to you.

Additional processing is necessary to take steps to enter into the contract between you and the Company and to perform that contract because we will need information to make an appropriate offer to you and administer your employment contract if you join us.

The remainder of the processing is necessary for the purpose of the legitimate interests pursued by the Company, namely, the Company's legitimate interest in ensuring the effective engagement of staff on appropriate terms and conditions of employment and that there is a smooth transition into employment for successful candidates and that information supplied in the recruitment process which is relevant to ongoing employment is maintained. This will contribute towards the Company's continuing to meet its business objectives, maintain its reputation and attract high calibre employees.

Future job opportunities

To contact you if you are not successful in your initial application should another potentially suitable vacancy arise during the eighteen month period following completion of the recruitment process for the role you originally applied for

This processing is necessary for the purpose of the legitimate interests pursued by the Company, namely, the Company's legitimate interest in maintaining an appropriate pool of talent who have shown an interest in working for the Company and who are potentially suitable candidates for employment. This will potentially benefit both initially unsuccessful candidates and the Company. It will contribute towards the Company continuing to meet its business objectives, maintain its reputation and attract high calibre employees.

Recruitment feedback and complaints

To deal with any query, challenge or request for feedback received in relation to our recruitment decisions

This processing is necessary for ensuring compliance with legal obligations to which the Company is subject including ensuring that the Company is able to demonstrate its compliance with data protection laws and employment equality laws.

Beyond legal compliance, the processing is necessary for the legitimate interests pursued by the Company,

namely, the Company's legitimate interest in being able to provide feedback to candidates and to be able to defend any challenge or claim made in connection with our recruitment decision. This will assist the Company to avoid the risk of financial exposure or costs incurred through challenges to recruitment decisions and to maintain its reputation.

Safety, security and preventing and detecting inappropriate or unlawful activities

Safety and security including the use of CCTV; and preventing, detecting and investigating a wide range of activities and behaviours, such as relating to our premises generally and liaising with regulatory authorities

Some of this processing is necessary for compliance with legal obligations to which the Company is subject including health and safety laws, our duty of care and regulatory laws to which the Company is subject.

Additional processing is necessary for the purpose of the legitimate interests pursued by the Company, namely the Company's legitimate interest in ensuring that its premises, business, clients, employees and systems are protected, and that action is taken to mitigate risk and to prevent and detect matters which may put the Company or its business or stakeholders at risk. This includes carrying out risk assessments; detecting and preventing crimes or criminal activity or other unlawful or unethical activity; ensuring that only appropriate employees are engaged in our business; and ensuring compliance with other legal or regulatory requirements placed upon us or related official guidance. It also includes providing ways for persons to report conduct or compliance issues and the appropriate consideration and investigation of matters drawn to the Company's attention. It also includes facilitating, controlling and restricting access to appropriate locations and systems. To be effective these must be monitored and kept up to date. Effective business protection is important for business continuity and to protect the Company's reputation. This supports the Company's immediate and long-term business goals and outcomes.

Complaints, claims and litigation

To enforce our legal rights and obligations, and for any purposes in connection with any complaint or legal claim made by, against or otherwise involving you, such as queries or complaints relating to the recruitment process and related compliance investigations.

This processing is necessary for the purpose of the legitimate interests pursued by the Company namely,

the Company's legitimate interest in protecting its organisation from breaches of legal obligations owed to it and defending itself against litigation. This is needed to ensure that the Company's legal rights and interests are protected appropriately, to protect the Company's reputation and to protect the Company from other damage or loss.

This is important to protect the business of the Company and ensure its continued success and growth. This supports the Company's immediate and long-term business goals and outcomes.

Legal or regulatory disclosures

To comply with lawful requests by public authorities (including without limitation law enforcement requirements), discovery requests, or where otherwise required or permitted by applicable laws, court orders, government regulations, or regulatory authorities (including without limitation data protection, tax and employment), whether within or outside your country

This processing is necessary for the compliance with legal obligations to which the Company is subject where there is a legal obligation to disclose information or a court or other legal order to provide information is in place.

Where not legally required, processing is necessary for the purpose of the legitimate interests pursued by the Company, namely the Company's legitimate interest in co-operating with relevant authorities, government bodies or regulators for the provision of information where appropriate. The Company wishes to maintain its reputation as a good corporate citizen and to act ethically and appropriately in all the countries in which it does business.

Commercial transactions or outsourcing

Planning, due diligence and implementation in relation to a commercial transaction or service transfer involving the Company for example mergers and acquisitions

Processing is necessary for the purpose of the legitimate interests pursued by the Company.

The Company has a legitimate interest in managing its business operations in the most effective way. The Company needs to make decisions relating to the future of its business in order to preserve its business operations or grow its business or maximise efficiency and effectiveness.

In the event that the Company makes a decision to outsource a function or acquire or transfer a business or part of a business the Company and the third party with whom the Company is seeking to transact each have a legitimate interest in ensuring that the recruitment pipeline is sufficiently understood prior to committing to the transaction and to ensure a smooth transition of recruitment processes if a transaction goes ahead.

Business change programmes and transformation support business continuity and improvement and support the Company in achieving its long-term business goals and outcomes.

Additional grounds we rely on where we process special category data
The special categories of personal data that are processed by the Company are set out above. Where we process special category data it will be justified by a condition set out at 5.1 above and also by one of the following additional conditions:
1. The processing is necessary for the purposes of carrying out the obligations and exercising the rights of you or the Company in the field of employment law, social security and social protection law, to the extent permissible under applicable laws;
2. The processing is necessary for the purposes of preventive or occupational medicine, for the assessment of your working capacity, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services, to the extent permitted by applicable laws;
3. The processing is necessary to protect your vital interests or of another person where you are physically or legally incapable of giving consent (for example in exceptional emergency situations, such as a medical emergency);
4. The processing is necessary for the establishment, exercise or defence of legal claims;
5. The processing is necessary for purposes authorised by applicable law; or
6. In exceptional circumstances the processing is carried out subject to your explicit consent (as explained below).
The purposes for which we use special category data or data relating to criminal convictions and offences and the additional grounds which apply
We have identified a number of purposes for collecting and processing your special category personal data. These are set out below together with the additional legal basis we rely on in each case:

No.	Purpose for processing	Additional lawful basis for special category data processing
1.	Right to work documentation We may use your data to: Assess your eligibility to work for KBRA in your location (e.g. work permits, residency, or proof of citizenship).	To carry out obligations and exercise rights under employment, social security, and social protection law (where permitted by law). To confirm you are legally permitted to work in your jurisdiction.
2.	Disability status We may use your data to: comply with equality laws or to review our commitment to equal opportunity.	To carry out obligations and exercise rights under employment, social security, or social protection law (where permitted). Where not legally required, for the public interest in promoting equality of opportunity or treatment.
3.	Health and medical information We may use your data to: comply with employment, health and safety, or social security laws (e.g., to make reasonable adjustments and avoid discrimination).	To carry out obligations and exercise rights under employment, social security, or social protection law (where permitted). If managed by occupational health advisers, it may be used for preventive or occupational medicine, assessing fitness for work, or providing health care, as permitted by law.
4.	Special category data in claims or litigation We may use your data if: There is a complaint, claim or legal dispute involving you.	Necessary to establish, exercise or defend legal claims.

We may seek your consent to certain processing which is not otherwise justified under one of the above bases. If consent is required for the processing in question, it will be sought from you separately to ensure that it is freely given, informed and explicit. Information regarding such processing will be provided to you at the time that consent is requested, along with the impact of not providing any such consent. You should be aware that it is not a condition or requirement of your recruitment to agree to any request for consent from the Company.
Processing data relating to criminal convictions and offences
Personal data relating to criminal convictions and offences will only be processed where authorised by applicable laws. For example:
1. a criminal record check may be carried out on recruitment or transfer or intermittently where ongoing screening is required where authorised by applicable laws; or
2. an allegation of a criminal offence or conviction arising during your relationship with the Company may be processed where required or authorised by applicable law. For example:
  1. where we have a legal or regulatory requirement to report an offence; or
  2. where applicable laws authorise the Company to process information about the offence (e.g. in a disciplinary process) for the purpose of making decisions regarding your relationship with the Company.

6. AUTOMATED DECISION MAKING AND PROFILING

The Company does not have systems or procedures that make a decision without human intervention. Therefore, there are no circumstances where decisions will be taken about you using fully automated means, however we will notify you in writing if this position changes.

7. RETENTION OF PERSONAL DATA

The Company endeavours to ensure that personal data are kept as current as possible, and that irrelevant or excessive data are deleted or made anonymous as soon as reasonably practicable.
We generally retain personal data for as long as is required to satisfy the purpose for which it was collected. This will usually be the period of the Recruitment Exercise plus the length of any applicable statutory limitation period thereafter. However, some personal data may be retained for varying time periods in order to comply with legal and regulatory obligations and for other legitimate business reasons.
Where you are a successful job applicant, the personal data generated by us and provided by you over the course of the Recruitment Exercise will be retained by us for the purpose of your contract of employment. Such personal data will be retained in accordance with our Employee Data Privacy Notice (which will be available to you when you commence onboarding and employment).

8. DISCLOSURES OF PERSONAL DATA

Within the Company, your personal data can be accessed by or may be disclosed internally on a need-to-know basis to:
1. local, regional and global Human Resources, (including managers and team members in the US involved in the Recruitment Exercise);
2. local, regional and executive management responsible for managing or making decisions in connection with your relationship with the Company;
3. system administrators; and
4. where necessary for the performance of specific tasks or system maintenance by staff in the Company teams such as the IT Department.
Your personal data is also accessed by third parties whom we work together with (including without limitation service providers or vendors under contract who assist us with our business operations and their associated companies and sub-contractors).
Personal data will also be shared with certain interconnecting systems such as the main HR system and local payroll and benefits systems. Data contained in such systems may be accessible by providers of those systems, their associated companies and sub-contractors.
Examples of third parties with whom your data will be shared include IT administrators, lawyers, consultants and other professional advisors. The Company expects such third parties to process any data disclosed to them in accordance with applicable law, including with respect to data confidentiality and security.
In addition, we may share personal data with national authorities in order to comply with a legal obligation to which we are subject. This is for example the case in the framework of imminent or pending legal proceedings or a statutory audit.

9. SECURITY OF DATA

The Company is committed to protecting the security of the personal data you share with us. The Company uses a variety of technical, physical and organisational measures to secure personal data in accordance with applicable laws.

10. INTERNATIONAL TRANSFER OF YOUR PERSONAL DATA

In the course of the Recruitment Exercise your personal data (including special categories of personal data) will be transferred to international sites of the Company to process for the purposes described in this Notice. This will be applicable, for example, due to the global nature of our business, where our group HR is based and whether the relevant company or a manager from that group company is responsible for conducting or approving the Recruitment Exercise.
Some of these international sites or managers are located outside the European Union or the UK (for example in the US or Japan). Personal data will also be transferred to third parties (e.g. service providers or regulators as set out above), who may have systems or suppliers located outside the European Union or the UK.
As a result, in some circumstances your personal data will be transferred to countries outside of the country in which you work or outside of the European Union or the UK to countries whose data protection laws may be less stringent than those of the country in which you reside. We will put appropriate or suitable safeguards in place to protect your personal information, and to transfer your personal information in compliance with applicable data protection laws.
Where required by applicable data protection laws, the Company and its service providers (including our international sites) will ensure appropriate safeguards are in place to ensure personal data transferred is subject to an equivalent level of protection. Unless the country outside the UK/EEA has an adequacy decision as listed here: (a) data protection adequacy for non-EU countries or (b) UK approach to international data transfers, then, we rely on Standard Contractual Clauses, or the UK International Data Transfer Agreement, together with any supplementary measures as applicable. You can obtain a copy of any standard contractual clauses in place which relate to transfers of your personal data please contact [email protected].
The Company has an intra-group data transfer agreement in place which regulates cross-border transfers of personal data within the Group.
You have a right to request a copy of any data transfer agreement under which your personal data is transferred, or to otherwise have access to the safeguards used. Any data transfer agreement made available to you may be redacted for reasons of commercial sensitivity. To request sight of these, please contact [email protected].
Further information as to the measures taken to safeguard your personal information where it is transferred outside of the European Union or the UK can be obtained by contacting [email protected].

11. YOUR RIGHTS AS A DATA SUBJECT

Right to access, correct and delete your personal data
You have the right to request access to any of your personal data that the Company may hold, and to request correction of any inaccurate data relating to you. You furthermore have the right to request deletion of any irrelevant data we hold about you.
Data portability
Where we are relying upon your consent or the fact that the processing is necessary for the performance of a contract to which you are party as the legal basis for processing, and that personal data is processed by automatic means, you have the right to receive all such personal data which you have provided to the Company in a structured, commonly used and machine-readable format, and also to require us to transmit it to another controller where this is technically feasible.
Right to restriction of processing
You have the right to restrict our processing of your personal data where:
1. you contest the accuracy of the personal data until we have taken sufficient steps to correct or verify its accuracy;
2. the processing is unlawful, but you do not want us to erase the data;
3. we no longer need the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims; or
4. you have objected to processing justified on legitimate interest grounds (see below) pending verification as to whether the Company has compelling legitimate grounds to continue processing.
Where personal data is subjected to restriction in this way, we will only process it with your consent or for the establishment, exercise or defence of legal claims.
Right to withdraw consent
Where we have relied on your consent to process particular information and you have provided us with your consent to process data, you have the right to withdraw such consent at any time.
Right to object to processing justified on legitimate interest grounds
Where we are relying upon legitimate interest to process data, then you have the right to object to that processing. If you object, we must stop that processing unless we can either demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms or where we need to process the data for the establishment, exercise or defence of legal claims. Where we rely upon legitimate interest as a basis for processing, we believe that we can demonstrate such compelling legitimate grounds, but we will consider each case on an individual basis.
Right to complain
If you are based in the UK, you have the right to lodge a complaint with us about our processing of your personal data if you consider that it infringes applicable law.
We do ask that you please attempt to resolve any issues with us first, but you do have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes applicable law. A list of the authorities in the EU can be found here. In Ireland, the relevant supervisory authority is the Data Protection Commission who can be contacted through this webform. In the UK, the relevant supervisory authority is the ICO who can be contacted through this webform or by phone at 0303 123 1113.

12. DATA CONTROLLER INFORMATION

The data controllers for the processing of your personal data are (1) KBRA Holdings, LLC and (2) the KBRA entity listed in section 1.1 above, in the country from which you would work if you were offered a job at KBRA. If you are unsure which entity this would be, please contact [email protected]. You are entitled to exercise the rights as a data subject described in Section 11 above against any or all of these joint controllers to the extent that it or they act as a joint controller of your Personal Data by directing any such requests to [email protected] or to the details listed in Section 13 below.
In limited circumstances (such as our use of social media, including LinkedIn), we may act as a joint controller with another non-KBRA party. In such circumstances, upon your request to exercise any of the above rights we will advise you if there is another controller who you should contact. Please note that any other such joint controller will have its own privacy notice.

13. CONTACT US

For further information regarding your rights, or to exercise any of your rights, please contact:

Kroll Bond Rating Agency Europe Limited or KBRA Analytics Europe Limited

2^nd Floor, One George's Quay Plaza,
George's Quay,
Dublin 2 D02 E440
Ireland
T: +353 1 588 1210 | M: +353 87 442 7658

[email protected]

Kroll Bond Rating Agency UK Limited or KBRA Analytics UK Limited

1^st Floor, Marble Arch House,
66-68 Seymour Street,
London W1H 5BT
United Kingdom
T: +44 208 148 1010 | M: +44 7771 936570

[email protected]

Last updated: 14 October 2026