Candidate Privacy Notice | Marsh McLennan Careers

California Candidates: Please review the California Resident Candidate Notice.

MMC Candidate Privacy Notice

This Privacy Notice applies to all candidates to Marsh McLennan and its businesses (Marsh, Mercer, Oliver Wyman Group, Guy Carpenter) or one of our affiliated companies (collectively, “the Company”).

The Company will process your personal information in accordance with this Privacy Notice when you apply for roles or visit or use our global recruitment website (the “Site”).

The Company believes strongly in protecting the privacy of candidates. This Privacy Notice is intended to inform you of the ways in which the Company collects personal information, the uses to which that information will be put, and the ways in which we will protect any personal information you choose to provide us. Generally, personal information is information that can be associated with you as an individual.

What Personal Information do we collect?

In jurisdictions where such collection is lawful, we may collect the following personal information about you (“Candidate Data"):

Categoryxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx	Examplesxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Biographical information	name, date of birth, place of birth, language proficiencies, and information you make publicly available through job search or career networking sites, search engines, public databases, your company or social media profile;
Contact information	title, home address, telephone number(s), personal email address;
Identification information	social security number or other government issued identification number, driver’s license number, passport information, bank account details, income tax declaration, income tax number;
Individual demographic attributes	age, race, citizenship, physical or mental disability, sex (including gender, gender identity, pregnancy or childbirth and related medical conditions), sexual orientation, union membership, veteran or military status, (each only to the extent you choose to disclose these details, or they are required under applicable employment laws);
Professional Information	job history and CV, work status (e.g., full-time/part-time), references, skills, education, professional qualifications, job preferences (such as willingness to relocate and salary expectations);
Screening information	aptitude assessments or information necessary to complete background checks, drug and/or alcohol tests, medical check report, health declaration, salary, remuneration package, and other screens permitted by law;
Internet or other similar network activity	browsing and search history, interaction with a website, application, or advertisement, data from cookies or web beacons, and interactions with our emails, including when you read and respond to emails;
Audio, video, or visual information	teleconference or videoconference recordings of interviews, photographs, voicemails, closed-circuit monitoring if you come on our premises, and recruiting event recordings and pictures;
Expenses and travel information	including details of travel that you undertake and reimbursable expenses you incur in connection with the interview process;
Employment verification information	immigration status and other work authorization information that would allow us to verify your employment eligibility; if you have a disability and would like the Company to consider an accommodation, you may provide that information during the recruiting process as well;
Hiring process documentation	assessments of references, interviewers, and recruiters;
Other information you choose to provide during the application process	information regarding partners and dependents; emergency contact details, disclosure statements, restrictive covenants, and your feedback or survey responses where you choose to identify yourself.

In certain cases, and only in jurisdictions where such collection is lawful, we ask you for sensitive personal information (as defined under local laws, “Sensitive Candidate Data”) for purposes of complying with applicable laws, to promote and assess our efforts to accomplish diverse hiring, to sponsor your residency application and/or where relevant for a position. Such Sensitive Candidate Data could include citizenship, racial or ethnic origin, gender, sexual orientation, health information, and criminal records. See “What Personal Information Do We Collect?” above for further detail.

In most cases, provision of this information is voluntary, though there are some exceptions (such as when the information is required to meet a legal obligation, for fraud prevention or for security reasons). For candidates we extend an offer to, further Sensitive Candidate Data may be required (e.g., national identifier, driver’s license, bank account data.)

The Company processes Sensitive Candidate Data in accordance with this Privacy Notice as necessary for carrying out the Company’s obligations.

For the purpose of compliance with applicable laws, you consent to the Company processing Sensitive Candidate Data in accordance with this Privacy Notice. If the Company intends to collect Sensitive Candidate Data from third parties, you will be provided notice and the opportunity to exercise your legal right where applicable. See “How Do We Use Your Candidate Data?” below for further detail on the legal basis for processing this information.

What are our sources of Candidate Data?

We collect the above Candidate Data directly from you, from individuals you identify to serve as referees and/or from external recruiters or others who may support, recommend or represent you in the application process. We also collect Candidate Data from publicly available sources including for example, career platforms, professional networking sites or similar sites for professional purposes. We also collect Candidate Data from, career or job placements offices at educational institutions, or at job fairs and events in which you participate and choose to engage with us. We also collect Candidate Data via automated means on the Site using cookies, pixels, web beacons, and other online tracking technologies (collectively, “Cookies”). Please review Cookie Notice for further information about Cookies. You can also find a link to manage your cookie preferences in the footer of our page at any time.

In addition, in the course of ensuring network security and consistent service for all users, the Company employs software programs to do such things as monitor network traffic, identify unauthorized access or access to non-public information, detect computer viruses and other software that might damage the Company’s computers or the network, and monitor and fine-tune the performance of the Company network and the Site. During such monitoring, these programs may detect additional information from your computer such as your IP address, addresses from network packets, and other technical information. Any such information is used only for the purpose of maintaining the security and performance of the Company’s networks and computer systems.

How do we use your Candidate Data?

The Company processes Candidate Data for the following purposes by relying on one or more of the following legal bases for processing your personal data:

Purpose of Processing	Lawful basis of processing
Identifying and evaluating candidates for Company roles	Legitimate Interest, where permissable – hiring appropriate talent for our business Consent Contract Performance - to perform an agreement we already have with you or to take steps to enter into an agreement with you (e.g. a contract of employment)
Record-keeping related to hiring processes	Legitimate Interest, where permissable – to administer the hiring process, to conduct interviews and contact candidates Consent Legal Obligation – required to comply with our legal obligations
Obtaining feedback and analysing the hiring process and outcomes	Legitimate Interest, where permissable – to ensure hiring process is working effectively, to evaluate, develop, improve and enhance our recruitment processes Consent
Conducting background and criminal checks, where permitted by law	Legal Obligation – required in relation to applicable regulated posts Legitimate Interest, where permissable – preventing fraud, protecting our business interests, hiring appropriate talent
Communicating with candidates in the context of current and future applications	Consent Contract Performance - to perform an agreement we already have with you or to take steps to enter into an agreement with you (e.g. a contract of employment)

In addition, Candidate Data may be used to comply with the Company’s legal, regulatory and corporate governance requirements. If a candidate is hired, Candidate Data may be transferred into an employee record and used for the purposes of administering employment, benefits and training with the Company, ensuring your health and safety and to fulfil the Company's responsibilities as an employer, such processing shall be consistent with the Company’s employment data protection policies and applicable country specific employee privacy notice.

In addition to using Candidate Data for the position for which you have applied, if at the time of your application there are no suitable positions for your skill set, the Company may retain your Candidate Data to consider you for other positions. Candidate Data may be shared with MMC People Function colleagues, MMC Talent Centre of Excellence and relevant hiring managers. This data will be kept for a reasonable period and/or as otherwise required or allowed by applicable law or to otherwise fulfil a legal obligation. Where required, we will seek your consent to retain your Candidate Data for these purposes. If you do not want to be considered for other positions or would like to have your Candidate Data removed, you may contact privacy@mmc.com.

If you give us information about other individuals, for example, referees, you must first make sure that the individual knows that you might disclose information about them (either specifically to us or, at least, to potential employers) and you have obtained all relevant consents from that individual to do so on their behalf.

Artificial Intelligence (AI) systems and tools with AI components may be used as part of the recruitment process, to create efficiencies in sourcing potential candidates, support interview scheduling, reviewing video interviews and conducting candidate assessments. MMC does not generally use AI or any other form of automated decision making to make hiring decisions.

Who do we share your Candidate Data with?

We will share Candidate Data as follows:

Affiliates	To assist in evaluating you and to enable them to contact you regarding roles that you have expressed an interest in.
Agents and Service Providers	We sometimes contract with other companies and individuals to perform functions or services for us or on our behalf, such as hosting the Site, conducting background checks or screening candidates. They may have access to Candidate Data, including your CV, needed to perform their functions, but are contractually restricted from using it for purposes other than providing services for the Company or on our behalf.
Business Transfers	As we continue to develop our business, we might sell or buy assets. In such transactions, user information generally is one of the transferred business assets. Also, if either the Company itself or any of the Company’s assets were acquired (including through bankruptcy proceedings), Candidate Data may be one of the transferred assets.
Legal Matters	The Company may preserve, and has the right to disclose any information about you or your use of this Site without your prior permission if the Company has a compelling reason to deem such action necessary to: (a) protect and defend the rights, property, or safety of the Company or its affiliates, other users of this Site, or the public; (b) enforce the terms and conditions that apply to use of this Site; (c) respond to claims that any content violates the rights of third parties; (d) respond to claims of suspected or actual illegal activity; (e) respond to an audit or investigate a complaint or security threat; or (f) comply with applicable law, regulation, legal process, or governmental requests.
Online third-party providers	Depending on whether you choose to accept or reject certain Cookies deployed on the Site, your data may be shared with online analytics, AdTech, and other third-party providers. Please review Cookie Noticefor further information about Cookies.
Recruiters, career platforms, career or job placement offices, and others who recommend you for a role	To assist in our evaluation or to provide feedback during the evaluation process.

Except as indicated above, Candidate Data will be accessible only by our authorised personnel and will not be disclosed to any third party.

What steps do we take to protect your Candidate Data?

Our company strives to comply with all applicable cybersecurity and data protection laws. With these goals in mind, MMC has a dedicated Chief Information Security Officer (CISO) and a Global Chief Privacy Officer (GCPO). The CISO is responsible for managing a Global Information Security team and a comprehensive cybersecurity program. As part of our cybersecurity program, we have implemented commercially reasonable physical, administrative, and technical safeguards to protect Personal Information from unauthorized access, use, alteration, and deletion.

The GCPO leads and oversees a Privacy Center of Excellence and a Data Protection Officer Network responsible for implementing our comprehensive global privacy program. The Data Protection Officer Network connects our Data Protection Officers across the world and seeks to implement our privacy program consistently and thoroughly wherever we process data. You can obtain the name and contact information for the Data Protection Officer in your jurisdiction by contacting us at privacy@mmc.com.

How long do we retain your Candidate Data?

Our retention periods for Candidate Data vary based on the nature of the information and applicable laws. We retain Candidate Data in accordance with our records retention schedules and only as long as reasonably necessary for our business purposes and legal obligations. We consider the following obligations when setting retention periods for Candidate Data we maintain. The need to:

retain information to consider you for additional employment opportunities in the future;
accomplish the purposes for which it was collected;
comply with mandatory legal and regulatory record-keeping requirements;
maintain our backup and disaster recovery procedures;
meet other legal requirements such as applicable statute of limitations periods.

When we no longer need to retain Candidate Data, our Company policies require that we either de-identify or aggregate the information (in which case we may further retain and use the de-identified or aggregated information for analytics purposes) or securely destroy it.

Accessing, Correcting and Deleting your Candidate Data

All Candidates: You may access and correct Candidate Data you have submitted on the Site using your log in credentials to access your profile. Alternatively, you can email database.delete@mmc.com at any time with the subject line, “Delete from Database”, and we will remove your Candidate Data from our records.

Candidates in Jurisdictions with Data Subject Rights: Candidates in some jurisdictions may, where permitted by applicable law and subject to certain conditions, may have the right to:

(a) Access and be Informed: You can ask us to provide you with further details on how we make use of your Candidate Data, the sources, categories of persons who have access to the information within our company, and to request a copy of the Candidate Data that we hold about you.

(b) Rectification: You can ask us to update any inaccuracies in the Candidate Data that we hold.

(c) Erasure or anonymization: You can ask us to erase your or anonymize Candidate Data that we no longer have lawful grounds to process.

(d) Withdrawal of consent: You can withdraw your consent to processing so that we stop that particular processing.

(e) Restriction: You can restrict how we use information whilst a complaint is being investigated or while your information is being rectified.

(f) Portability: You can ask us to transmit the Candidate Data that you have provided to us to a third party.

(g) Raise a complaint: You can raise a complaint about our processing with the data protection regulator in your jurisdiction (for example in the UK, the Information Commissioner's Office).

(h) Object: You are entitled to object processing of personal information based on legitimate interests of the controller or with regard to marketing.

(i) Automated decision-making: We use software applications to assist our decision-making across our business, including in relation to our dealings with Candidates. For example, we may use automated sourcing and filtering software to identify potential candidates. We generally do not make recruiting or hiring decisions based solely on automated decision-making. We will notify you where decisions that would significantly affect you are made without any human intervention and provide information about the type of rules the application is applying. In these cases, you are:

a. entitled to obtain human intervention
b. express your point of view;
c. obtain an explanation of the decision from us and challenge it; and
d. in some cases, object to the use of automated decision-making.

To exercise any of these rights, please contact us at hrdataprivacy@mmc.com.

California residents should review the California Candidate Privacy Notice for information about how to submit their requests.

You are generally not required to pay any charge for exercising your rights.

Your jurisdiction may provide for different rights under the applicable data protection laws. We will comply with such requests as required under applicable law.

Transfer of Candidate Data

Your Candidate Data may be accessed in, transferred to, and/or stored at, a destination outside the country, province or territory in which you are located. These countries, provinces or territories do not always afford an equivalent level of privacy protection, but we will, in all circumstances, safeguard personal information as set out in this Privacy Notice to provide an adequate level of protection for Candidate Data. Where the need for such a transfer arises, we will take steps to ensure that there are appropriate safeguards in place to protect your Candidate Data, such as an impact assessment, adequacy decision by the appropriate supervisory authority, the use of approved binding corporate rules or standard contractual clauses, or other legal grounds permitted by applicable legal requirements. If you have questions regarding the specific mechanism, if any, under which your Candidate Data is transferred to another country, if applicable, you may contact us at Privacy@mmc.com.

Binding Corporate Rules

Marsh McLennan's EU Binding Corporate Rules (“EU BCR”) are a means of transferring personal data internationally within the Company group in compliance with applicable data protection legislation in the European Economic Area. The Information Commissioner’s Office (“ICO”), the local Supervisory Authority in the United Kingdom, formally approved them on October 6, 2017. Following Brexit our new lead Supervisory Authority for the EU BCR is the Irish Data Protection Commission. Our EU BCR consist of both Controller and Processor Standards. For further information regarding how our EU BCR operate, click here.

Marsh McLennan’s UK Binding Corporate Rules (“UK BCR”) are a means of transferring personal data internationally within the Company group in compliance with applicable data protection legislation in the UK. Our UK BCRs are supervised by the ICO and consist of both Controller and Processor Standards. For further information regarding how our UK BCR operate, click here.

Changes to Privacy Notice

This Privacy Notice is subject to change at any time. If we make changes to this Privacy Notice, we will update the date at the bottom of this page and post it on the Site. Where required by local law, we will also notify you of any changes we make to this Privacy Notice and the notice provisions in the terms of our engagement. To the extent permitted by law, any changes we make to this Privacy Notice become effective immediately when we post the revised Privacy Notice on the Site. We recommend that you review this Privacy Notice regularly for changes.

Questions or Concerns?
If you have any questions, concerns, or complaints about this Privacy Notice, or our privacy practices in general, email us at Privacy@mmc.com with a subject line of “Candidate Privacy query” and your state/country of residency or write to us at:

Marsh & McLennan Companies
Corporate Communications
Attn: Global Chief Privacy Officer
1166 Avenue of Americas
New York, New York 10036-2774
USA

You may also contact the data protection officer responsible for your jurisdiction by emailing Privacy@mmc.com. In your email, please identify the relevant country.

Last updated: November 2024