Roland Berger – Alumni Data Protection Notice
The relevant domestic and international data protection framework that applies to Roland Berger requires the protection of our alumni's personal data. In addition, the lawfulness and transparency of all data processing operations is a guiding principle for Roland Berger. We therefore provide you with the following information about our data processing operations on the platform of the Roland Berger Alumni Network:

I. Who is responsible for the data processing operations and who can I contact?
The responsible controller is:
Roland Berger Holding GmbH & Co. KGaA, Sederanger 1, 80538 München, Germany
alumni.network@rolandberger.com

For data protection inquiries, please contact:
Roland Berger Holding GmbH & Co. KGaA, Sederanger 1, 80538 München, Germany
dataprotection@rolandberger.com

II. What are the purposes of the processing operations and on what legal basis do we process the data?
Purposes of the processing operations
The purposes of our processing operations are:
• To stay in contact with you and invite you to alumni events and other events organized by our corporate group
• To stay in touch with your former colleagues and other alumni to maintain a network, utilize business contacts, establish business relationships with other alumni, and grow your ongoing careers
• To send you useful professional information and material or give you the opportunity to request it
• To make job openings available to you
• To support you in your professional development when we see opportunities to do so
• To establish new business relations with you or develop business opportunities where appropriate
• To carry out the admission and registration process
• You also have the possibility to contact the Alumni team using this contact form or email addresses, telephone and fax numbers provided on the platform of the Roland Berger Alumni Network. When you contact us through the above channels, we will store and process the resulting personal data for the purposes of dealing with your request. All data are used exclusively for the processing of your request.

Legal basis for the processing operations
In case of your consent, the legal basis for the processing operations is Article 6 (1) lit. a) GDPR. In case of contract initiations or executions, the legal basis for the processing operations is Article 6 (1) lit. b) GDPR. In all other cases, the legal basis for the processing operations is Article 6 (1) lit. f) GDPR.

III. Who will receive my data?
We will make the information you provide available to other alumni, as well as selected employees of the Roland Berger Group via password-protected access to our alumni database. We offer visibility settings that allow you to choose what information you share publicly. These personal settings can be changed at any time. As members of our network, you and your former colleagues as well as other alumni can use publicly shared information to stay in touch, maintain a network, utilize business contacts, establish business relationships with other alumni, and grow your ongoing careers.
You will also be able to search and respond to job listings advertised by other alumni, Roland Berger offices, hiring companies, or executive search companies in our database. Roland Berger may correspondingly make your personal data available to HR departments of other companies or offices of the Roland Berger Group in accordance with this Privacy Notice. In addition, we may also make your data available to hiring companies or executive search companies. We ensure that your personal data is treated strictly confidentially within the Roland Berger Group and only used for the above-mentioned purposes. In case of such an intra group data sharing, and with respect to any data processing operation according to this Alumni Data Protection Notice, you can contact and enforce your rights against Roland Berger under the contact details given above under I. If your personal data is transferred to a country outside European Union (EU) or the European Economic Area (EEA) which is not subject to a comparable level of data protection, we will ensure that the data transfer is based on an adequacy decision or conclusion of the EU standard contractual clauses.
Access to personal data is also technically possible for service providers and contract partners that we use to operate our IT systems. These external providers are obliged to use your personal data only to provide the services requested by us or otherwise in accordance with our instructions. Apart from these transmissions, your personal data will not be disclosed or passed on to third parties.

IV. What cookies are used (Cookie Declaration)?

V. How is Google analytics used?

If you have given your consent, this website uses Google Analytics 4, a web analytics service provided by Google LLC. The responsible party for users in the EU/EEA and Switzerland is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").

Scope of processing
Google Analytics uses cookies that enable an analysis of your use of our websites. The information collected by means of the cookies about your use of this website is generally transferred to a Google server in the USA and stored there.
We use the User ID function. User ID allows us to assign a unique, persistent ID to one or more sessions (and the activities within those sessions) and to analyze user behavior across devices.
We use Google Signals. This allows Google Analytics to collect additional information about users who have personalized ads enabled (interests and demographics) and ads can be delivered to these users in cross-device remarketing campaigns.
Google Analytics 4 has IP address anonymization enabled by default. Due to IP anonymization, your IP address will be shortened by Google within member states of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there. According to Google, the IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.

During your website visit, your user behavior is recorded in the form of "events". Events can be:

• Page views
• First visit to the website
• Start of session
• Your "click path", interaction with the website
• Scrolls (whenever a user scrolls to the bottom of the page (90%))
• Clicks on external links
• Internal search queries
• Interaction with videos
• File downloads
• Seen / clicked ads
• Language settings

Also recorded:

• Your approximate location (region)
• Your IP address (in shortened form)
• Technical information about your browser and the end devices you use (e.g. language setting, screen resolution)
• Your internet service provider
• The referrer URL (via which website/advertising medium you came to this website)

Purposes of processing
On our behalf, Google will use this information to evaluate your use of the website and to compile reports on website activity. The reports provided by Google Analytics serve to analyze the performance of our website and the success of our marketing campaigns.

Recipients
Recipients of the data are/may be:

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as processor under Art. 28 DSGVO).
• Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
• Alphabet Inc, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA

It cannot be ruled out that US authorities may access the data stored by Google.

Third country transfer
Insofar as data is processed outside the EU/EEA and there is no level of data protection corresponding to the European standard, we have concluded EU standard contractual clauses with the service provider to establish an appropriate level of data protection. The parent company of Google Ireland, Google LLC, is based in California, USA. A transfer of data to the USA and access by US authorities to the data stored by Google cannot be ruled out. The USA is currently considered a third country from a data protection perspective. You do not have the same rights there as within the EU/EEA. You may not be entitled to any legal remedies against access by authorities.

Duration of storage
The data sent by us and linked to cookies are automatically deleted after 14 months. The deletion of data whose retention period has been reached occurs automatically once a month.

Legal basis
The legal basis for this data processing is your consent pursuant to Art.6 para.1 p.1 lit. a GDPR.

Revocation
You can revoke your consent at any time with effect for the future by accessing the cookie settings and changing your selection there. The lawfulness of the processing carried out on the basis of the consent until the revocation remains unaffected.
You can also prevent the storage of cookies from the outset by setting your browser software accordingly. However, if you configure your browser to reject all cookies, this may result in a restriction of functionalities on this and other websites. In addition, you can prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) to Google and the processing of this data by Google, by
a. not giving your consent to the setting of the cookie or
b. downloading and installing the browser add-on to disable Google Analytics HERE.

For more information on Google Analytics' terms of use and Google's privacy policy, please visit https://marketingplatform.google.com/about/analytics/terms/us/ and at https://policies.google.com/?hl=en.

We process and store your personal data as long as it is necessary for the fulfilment of our contractual and legal obligations. If the data are no longer required for these obligations, they are regularly deleted, unless their temporary further processing is required for legal reasons. Temporary processing may be necessary, for example, due to social security and tax regulations.

VII. What are my rights?
Every Alumni has the following rights:
• Right of access, Article 15 GDPR
• Right to rectification, Article 16 GDPR
• Right to erasure, Article 17 GDPR
• Right to restriction of processing, Article 18 GDPR
• Right to data portability, Article 20 GDPR
• Right to object, Article 21 GDPR
Furthermore, you are entitled to lodge a complaint with a data protection supervisory authority (Article 77 GDPR). In addition, you can revoke any potentially given consent to the processing of personal data at any time with effect for the future by sending an email to dataprotection@rolandberger.com or by contacting us via the contact details given above under I.
 
VIII. Am I obliged to provide data?
The provision of your personal data (contact data) is required for your participation in the Alumni network.

IX. To what extent does Roland Berger carry out automated decision making (including profiling) within the Alumni network?
Roland Berger does not carry out automated decision making or profiling within the Alumni network.

Please also refer to our general Privacy Notice and our Pathfinder Privacy Notice.