ALVAREZ & MARSAL

GLOBAL RECRUITMENT PRIVACY NOTICE

Effective Date:   January 1, 2026

This Global Recruitment Privacy Notice is provided to you by Alvarez & Marsal Holdings, LLC (“Holdings”) on behalf of itself and its subsidiaries, and any other professional services companies operating under the Alvarez & Marsal (or A&M) brand (together, “A&M”, “we”, “our”, “us”).

This Global Recruitment Privacy Notice applies solely to the processing of personal information by A&M about you in the context of your role as a job applicant to A&M (“you”).  For purposes of this Global Recruitment Privacy Notice, the term “job applicant” includes individuals who (i) apply for a position with A&M, (ii) join the A&M Talent Network without applying for a specific position, (iii) are identified by A&M’s search efforts, whether or not recruited by A&M, (iv) are presented as candidates to A&M by third parties, such as executive recruiters or staffing agencies, or (v) contact A&M to enquire about potential roles.

This Global Recruitment Privacy Notice describes:

1. The controller of your personal information.
2. The categories of personal information we collect.
3. The categories of sources from which we collect personal information.
4. Our use of personal information.
5. Our lawful bases to process personal information.
6. Our disclosure of personal information.
7. Cross border transfers of personal information.
8. Confidentiality and security of personal information.
9. Your individual rights.
10. Retention of personal information.
11. Changes to this notice.
12. How to contact us.

If the privacy, data protection or other laws, rules or regulations applicable to the processing of personal information of the country, state or other jurisdiction of your residence or relevant A&M office in which you are being considered as a job applicant (“Applicable Data Protection Laws”) or other laws, rules, regulations, judicial or administrative agency decisions or orders, or executive orders (together, with Applicable Data Protection Laws, “Applicable Laws”) require us to provide you with additional disclosures regarding our processing of your personal information, we will provide that information to you in a separate, jurisdiction-specific supplement (each, a “Local Privacy Supplement”) (also available at https://www.alvarezandmarsal.com/recruitment-privacy-notice).  Local Privacy Supplements may modify or supplement any or all of the following sections of this Global Recruitment Privacy Notice:  Section 1 (Data Controller), Section 2 (Categories of Personal Information We Collect), Section 4 (Use of Personal Information), Section 5 (Lawful Bases to Process Personal Information) (including, where applicable, any specific consents that we may require to process your personal information), Section 6 (Disclosures of Personal Information) (particularly, the categories of recipients), Section 7 (Cross Border Transfers of Personal Information), Section 9 (Individual Rights), and Section 12 (Contact Us).  In the event of any conflict between any Local Privacy Supplement and this Global Recruitment Privacy Notice, the Local Privacy Supplement will prevail.

This Global Recruitment Privacy Notice does not constitute or form any part of an employment, directorship, ownership, partnership, independent contractor or any other type of agreement with us or confer any contractual right on you or place any contractual obligations on us.  If you become an employee, officer, partner, independent contractor, or any other category of worker, you will be provided with a Global Workplace Privacy Notice that supersedes this notice.

1. The Controller of Your Personal Information

Where Applicable Data Protection Laws define the term “controller” (or similar terms), depending on the nature of the processing activity, the controller of your personal information will be (i) the local A&M entity considering you as a job applicant, (ii) our top-level entity within the country of your residence, if different, (iii) Holdings (which is our top-level parent, located in the United States), and/or (iv) other Holdings subsidiaries and members of the A&M group.  “Controller” refers to the person or entity that alone or jointly with others determines the purposes and means of the processing of your personal information.  Where more than one A&M entity is involved in the processing of your personal information, depending on the nature of the processing activity, those entities may each act as independent controllers, as joint controllers, or as a controller and processor.  In all cases, we will have entered into an appropriate intra-group data transfer agreement in compliance with Applicable Data Protection Laws to address data sharing and transfers among the A&M group.  For ease of reading, except where expressly stated otherwise, the terms “A&M”, “we”, “our” or “us” as used in this Global Recruitment Privacy Notice refer only to the relevant controller(s).

Return to top of page.

2. Categories of Personal Information We Collect

As used in this Global Recruitment Privacy Notice, the following definitions shall apply:

• “Personal information” means all “personal data”, “personal information”, “personally identifiable information”, or similarly defined terms under Applicable Data Protection Laws; and in all events any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to a data subject.  Where provided by (and subject to the requirements of) Applicable Data Protection Laws, personal information excludes:
  • Publicly available information, which typically (but not universally) means: (i) information that is lawfully made available from federal, state, or local government records; (ii) information that a business has a reasonable basis to believe is lawfully made available to the general public by the individual or from widely distributed media, or by the individual; or (iii) information made available by a person to whom the individual has disclosed the information if the individual has not restricted the information to a specific audience.
  • Anonymized or deidentified information, which typically (but not universally) means personal information that has been modified to prevent identification of individuals (i.e., identifiable elements, such as names, addresses, identification numbers, or any other data that could be linked to a specific person, have been irreversibly removed or altered) such that re-identification is not reasonably possible using means likely to be used by the controller or a third party.
• “Data subject” means an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• “Process” or “Processing” means any operation or set of operations that is performed on personal information, such as collecting, recording, organizing, storing, modifying, using, disclosing, transferring or deleting such information.
• “Sensitive personal information” means all “special categories of data”, “sensitive personal information”, or similarly defined terms under Applicable Data Protection Laws; and in all events refers to personal information that warrants a greater level of protection because of the increased risk of harm to data subjects that could result from either our intended processing of your personal information or from a security breach.  “Sensitive personal information” typically (but not universally) means:
  • race or ethnicity; religion; sex life or sexual orientation; medical or health information; genetic information; biometric information uniquely processed for the purpose of identifying a person (e.g., retina, palm, or voice recognition); government-issued identifiers; criminal records; financial account, debit card, or credit card number in combination with any required security or access code; username and password; precise geolocation information; citizenship or immigration status; and information from a known child or minor.

In all events, whether your personal information qualifies as sensitive personal information depends on Applicable Data Protection Laws, as may be further specified in a Local Privacy Supplement.

Except where prohibited by (and subject to the requirements of) Applicable Laws, we may collect the following categories of personal information:

• Name and Contact Details:  Name; job title; company; personal address, email, and telephone (home and mobile); and business address, email, and telephone (office and mobile).
• Interview or Assessment Data:  Any information provided or generated during a job interview or assessment, including notes and/or audio video recordings and transcripts made or taken during live or online interviews, responses to online or written tests (including personality or aptitude tests), and business plans.
• Education and Professional Qualifications:  Resume/CV; application; cover letter; education; transcripts; professional history; internships; references; languages, skills, licenses, certifications, and other qualifications; professional affiliations; and other information related to your education, skills and qualifications provided by you or collected by us as part of the recruitment process.
• Work Details:  Job title; company; business unit; job description; office location (country, city); start / end date; category (e.g., equity partner / employee); time type (e.g., full time / 40-hours per week); reporting lines; relocations; secondments; and terms and conditions of employment, partnership, or other agreement; each, in relation to your former employers.
• Social Media Identifiers:  Social media (user)name and contact information (e.g., LinkedIn profile URL, etc.).
• Government-Issued Identifiers:  Social Security number; national insurance or identification number, resident registration number or other unique identification number; taxpayer identification number; passport number; driver’s license number; or other government-issued identifications or numbers.
• Citizenship / Immigration Data:  Citizenship; nationality; proof of eligibility to work and details of any work permit application.
• Compensation and Benefits Data:  Salary, bonus, equity and other compensation and benefits information relating to your prior employers, and your expectations at and offers from A&M.
• Demographic, Family and Household Data:  Age; date of birth; marital status; family composition; family education, employment, and income history; dependent information; language(s); veteran or military status; sensitive personal information, including race, ethnicity, national origin, religion, gender (including gender identity or expression), sex and sexual orientation.
• Photographs:  Headshots, profile images, and other photographs.
• Audio-Video Recordings and Transcripts:  Audio / video recordings and transcripts made or taken during live and online job interviews, which may include names, voices, images and content.
• Background Checks:  Information related to education, employment, government sanctions and enforcement, identity verification, adverse media, conduct, address verification, directorships, professional qualifications, credit history or credit score, and civil litigation and criminal records.
• Building and Office Access Control Systems and CCTV Data:  Security camera footage relating to building, office, and restricted zone access (but excluding CCTV systems controlled by the buildings in which A&M offices are located).
• Health and Medical Data:  Disability or disability status.

Return to top of page.

3. Sources of Personal Information

Except where prohibited by (and subject to the requirements of) Applicable Laws, we may collect personal information about you from multiple sources, including:

• Directly from you:  We collect personal information directly from you during the recruiting, application and interview processes and throughout the course of your candidacy to A&M.  Please note, you must provide us with certain personal information that we require to consider your candidacy or application, including to be able to enter into an employment, partnership or other agreement with you, or to comply with our legal obligations.  Failure to provide us with required information may prevent us from moving forward with your candidacy or from complying with our legal obligations.
• External parties:  During the recruiting process, we collect personal information from your former employers, educational institutions, named referees, and our service providers (including recruitment / staffing agencies, qualifications testing consultants, background check providers).  If you caused your job application or other personal information to be shared with us through a third-party application (e.g., LinkedIn or a job board), we consider that information as having come from an external party.
• Electronic means:  We collect information from you by electronic means as described in our general online privacy notice (here) and cookies notice (here), and from access logs (e.g., security badge swipes) and security camera (CCTV) footage relating to building, office and restricted zone access (but excluding CCTV systems controlled by the buildings in which A&M offices are located).
• Government entities:  We collect information from courts, regulators, and other government agencies.

Return to top of page.

4. Use of Personal Information

Except where prohibited by (and subject to the requirements of) Applicable Laws, we may use your personal information for the following purposes:

• Recruiting / talent acquisition (including contacting you about job opportunities (via email, SMS or through social media platforms, e.g., LinkedIn); managing the A&M talent network; managing the application, screening, shortlisting, interview, assessment (including personality or aptitude tests), and job offer processes (including contacting you via email or SMS); maintaining a record of recruitment decisions; and maintaining a pool of qualified candidates to consider for future opportunities).
• Background and reference checks.
• Emergency/incident management and communication (including to report, manage and/or communicate with you in case of emergencies that pose a public risk, such as riots, terrorism or political unrest, and natural and man-made disasters).
• Non-discrimination in hiring, equality of opportunity or treatment, promoting and maintaining an inclusive workforce, and reporting statistics to government agencies.
• Ensuring compliance with laws and A&M policies (including but not limited to non-discrimination and equal opportunity employment).
• Establishment, exercise, or defense of legal claims.
• Managing and monitoring access to A&M offices and restricted zones.
• In connection with the sale of all or a part of our business, our assets, or a reorganization or combination of our organization with another organization.
• Any other lawful purpose reasonably related to your role as a job applicant to A&M.
• For additional purposes with your consent, where consent is required by Applicable Laws.

Please note:   A&M uses artificial intelligence (“AI”) tools, including internal and third-party applications (e.g., Microsoft Copilot, Jobvite Talent Fit), in accordance with Applicable Laws, for purposes including the following: 

• To record and transcribe interviews to enhance the accuracy and recall of key points discussed.  Recordings and transcripts may include personal information such as names, voices, and shared content. You will be notified when a meeting is being recorded, and such recordings are used in accordance with Applicable Laws and A&M’s internal policies.  For more information regarding Microsoft Copilot see: (1) Data, Privacy, and Security for Microsoft 365 Copilot (https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy) (this page outlines how Microsoft 365 Copilot handles organizational data, privacy protections, and compliance commitments); and (2) Enterprise Data Protection in Microsoft 365 Copilot and Copilot Chat (https://learn.microsoft.com/en-us/copilot/microsoft-365/enterprise-data-protection) (this page details the enterprise-grade data protection measures, including encryption, access controls, and Microsoft's role as a data processor under the Data Protection Addendum (DPA)).
   
• To assist in screening applications. A&M uses AI tools that identify information in candidate-provided resumes and CVs that is responsive to the requirements and qualifications set out in our job descriptions. The tools generate output that our team uses to identify which candidates have a skill set that matches the open position. The decision of whether to advance an application is made by human reviewers. We take reasonable measures to help ensure that our AI recruitment tools are used in a manner intended to be fair, lawful, and non-discriminatory, including maintaining governance and risk-management practices designed to identify, assess, and mitigate reasonably foreseeable risks of unlawful bias.  For more information regarding Jobvite Talent Fit, see: Talent Fit AI Brief (https://help.jobvite.com/hc/en-us/articles/28081495482909-Talent-Fit-AI-Brief) (this page describes Jobvite’s “Talent Fit” AI-powered tool to sort candidate-provided resumes and CVs).

Return to top of page.

5. Lawful Bases to Process Personal Information

Certain Applicable Data Protection Laws require us to have, and to notify you about, our lawful basis to process your personal information. Please refer to Annex 1 to this Global Recruitment Privacy Notice for additional information on our purposes for processing, the types of personal information that may be processed, and our lawful bases for processing in those countries or territories where required.

Return to top of page.

6. Disclosure of Personal Information

Except where prohibited by (and subject to the requirements of) Applicable Laws, we may disclose your personal information to the following categories of recipients in connection with the purposes for which we collected your personal information as described in this Global Recruitment Privacy Notice:

• A&M personnel, in accordance with their roles and responsibilities.
• Other members of the A&M group (including but not limited to A&M Inc. and its subsidiaries).
• Our service providers, including but not limited to information technology / operating systems and platforms, and job application / recruiting platforms; recruitment and staffing agencies, and background screening providers.
• Government entities, including courts, regulators, law enforcement, national security authorities, or tax authorities, or to other constituents in a litigation, in each case where required or permitted by law.  In some cases, in accordance with Applicable Law, it may not be possible to notify you in advance about the details of such disclosures.  A&M will use reasonable efforts to disclose the minimum personal information necessary in such cases.
• Our accountants, lawyers, and other professional advisors.
• Other third parties where reasonably related to your role as a job applicant to A&M.
• Other persons or entities in connection with the sale of all or part of our business, or a reorganization or combination of our business with another organization.
• For additional purposes with your consent, where such consent is required by law.

Return to top of page.

7. Cross Border Transfers of Personal Information

A&M is a global company with offices around the world and with its parent company located in the United States. Except where prohibited by (and subject to the requirements of) Applicable Laws, A&M may transfer your personal information outside the country or territory where you are located (which may be the country or territory of your residence or A&M office where you are being considered as a job applicant) to other countries or territories where A&M, its service providers, or other third parties are located and where Applicable Laws may provide different levels of privacy protection as compared to those where you are located, for the purposes set out in this Global Recruitment Privacy Notice.  The measures we use to protect personal information are subject to the legal requirements of both the country or territory of your residence or A&M office where you are being considered as a job applicant and the jurisdictions to which we transfer personal information, including lawful requirements to disclose information to government entities as described in Section 6 of this Global Recruitment Privacy Notice.

Internal Transfers

When we transfer your personal information within the A&M group to countries or territories outside of the country or territory where you are located, it is pursuant to a companywide Intra-Group Personal Data Sharing and Transfer Agreement that complies with Applicable Data Protection Laws with respect to such transfers.

External Transfers

When we transfer your personal information to third parties (including, but not limited to, processors) located outside of country or territory where you are located, it is our policy to ensure that recipients are bound to maintain appropriate levels of data protection, security and confidentiality, and to comply with the requirements of Applicable Data Protection Laws for such transfers, including but not limited to entering into data processing agreements.

Return to top of page.

8. Confidentiality and Security

A&M implements and maintains physical, technical, and organizational security measures and safeguards reasonably designed to protect your personal information against accidental, unauthorized or unlawful access, use, disclosure, alteration, loss or destruction (including, without limitation, a Supplier Security Policy applicable to our engagement of, and disclosure of personal information to, third party service providers).  Our policies, procedures and practices define roles and responsibilities for handling personal information throughout its lifecycle and provide a framework for its safeguarding and destruction.  For additional information about our information security policies, please contact us using any of the methods described in Section 12.

Return to top of page.

9. Individual Rights

Depending on the law of the country or territory where you are located (which may be the country or territory of your residence or A&M office where you are being considered as a job applicant), you may have rights under Applicable Data Protection Laws, such as the right of access or deletion or to have the processing of your personal information restricted.  Nothing in this Global Recruitment Privacy Notice limits or governs those rights.  Where Applicable Data Protection Laws require us to honor and to notify you about your individual rights, we will provide you with the relevant information in a Local Privacy Supplement.

A&M will make reasonable efforts to accommodate your requests, but A&M is under no obligation to honor any specific request absent a legal requirement.  Subject to the foregoing limitations, to exercise any of your privacy rights, or to submit any request or complaint regarding the processing of your personal information, please contact us in writing using any of the contact methods provided in Section 12.

Please note, to help protect your privacy and maintain security, we may take steps to verify your identity before complying with your request.  For example, we may require you to provide your name, additional contact details, and the nature of your relationship with A&M.  In addition, if you ask us to provide you with specific pieces of personal information or to delete information that we deem to be sensitive, we may require you to sign a declaration under penalty of perjury that you are the data subject whose personal information is the subject of the request.  If you designate an authorized agent to exercise your privacy rights on your behalf, we may require proof (your signed permission) demonstrating that you authorized the agent to act on your behalf; and, further, we may require you to verify your own identity and confirm that you authorized the agent to submit the request on your behalf.  We may deny any request submitted by an agent that does not meet these requirements.  We may charge you a fee to access your personal information; however, we will notify you of any fee in advance.

If we cannot honor your request or are under no legal obligation to do so, we will inform you of the reasons why, subject to any legal or regulatory restrictions.

Return to top of page.

10. Retention of Personal Information

We retain your personal information for as long as reasonably necessary to fulfill the purposes for which it was collected.

If you join the A&M Talent Network without applying for a specific position, we will retain your data for 24 months, after which we will send you a notice requesting that you opt-in for another 24 months.  If you do not opt-in within 30 days of this notice, we will automatically delete your data without any further action on your part.  If you opt-in, we will continue to send this notice to you bi-annually except where you otherwise request that we delete your data.

If you apply for a position or we are otherwise considering you for a role, we will retain your personal information for the duration we are considering your application or candidacy.  If your application or candidacy is successful, we will retain and use your personal information in accordance with our Global Workplace Privacy Notice and any additional privacy notices and policies that we provide to you.

If your application or candidacy is unsuccessful for any reason, we will retain your personal information as follows: (i) recruiting / talent acquisition for so long as your personal information remains relevant for this purpose (including maintaining a record of recruitment decisions; and maintaining a pool of qualified candidates and contacting you about future opportunities (via email, SMS or through social media platforms, e.g., LinkedIn), provided you may request deletion from our candidate pool at any time by contacting us as specified in Section 12 below); (ii) establishment, exercise, or defense of legal claims (including for the duration of any applicable statutes of limitations); (iii) any mandatory periods specified by Applicable Laws (including but not limited to labor and employment laws); and (iv) any other lawful purpose reasonably related to your role as a job applicant to A&M.  Following these retention periods, we will delete your personal information in accordance with our deletion policies and procedures, including electronic overwriting or cryptographic erasure, and/or destruction of physical storage media.

If your data is only useful for a short period (for example, CCTV footage data) we will delete it.

Under some circumstances we may anonymize your personal information so that it can no longer be associated with you.  We reserve the right to use such anonymized and de-identified data for any legitimate business purpose without further notice to you or your consent.

Return to top of page.

11. Changes

We may update this Global Recruitment Privacy Notice from time to time at our discretion to reflect changes to Applicable Data Protection Laws or our personal information processing practices.  If we intend to use previously collected personal information for a new purpose that materially differs from the purposes described in this Global Recruitment Privacy Notice or at the time of collection that would not otherwise be reasonably expected by you, we will provide you with additional notice and, if legally required, seek your consent.

Return to top of page.

12. Contact Us

To exercise any of your individual rights, or to submit any request or complaint regarding our processing of your personal information, please contact us at:

Please check your Local Privacy Supplement for the email address for A&M’s local HR department.

Return to top of page.

ANNEX 1

Legal Grounds for Processing Personal Information

This Annex 1 applies solely in countries or territories where A&M is required by Applicable Data Protection Laws to have a lawful basis to process personal information and/or sensitive personal information.

A&M’s lawful bases to process personal information and sensitive personal information include “Contract”, “Legal Obligation”, “Legitimate Interests”, “Vital Interests”, and “Consent”, as summarized in Table 1 (below).  Specific information on our purposes for processing, the types of personal information that may be processed, and our lawful bases for processing are set out in Table 2 (below).  Always refer to your Local Privacy Supplement for information that may modify or supplement the information in this Annex 1. 

Table 2 (below) identifies the lawful bases on which we process your personal information for the purposes specified in this Global Recruitment Privacy Notice.

SPECIAL NOTICE REGARDING SENSITIVE PERSONAL INFORMATION:  Applicable Data Protection Laws may impose special conditions and/or restrictions to the processing of sensitive personal information, in addition to the requirement for having a lawful basis.   Please check your Local Privacy Supplement for details.

Return to top of page.