Candidate Privacy Notice

Identity and contact information of the Morningstar entity who collects and uses personal data

Morningstar Inc. and its local Affiliates.

What personal data do we collect?

The information Morningstar collects may include but is not limited to the following:

  • Full name (Employees/Contractors);
  • Address, including, if applicable, home and work address, including data exporter company name (Employees/Contractors)
  • Contact details, including, if applicable, home telephone number, work telephone number, mobile telephone number, web address data, instant messaging data, home and work email address (Employees/Contractors)
  • Gender (Employees/Contractors)
  • Citizenship information (Employees/Contractors)
  • Visa information (Employees/Contractors)
  • National and governmental identification information (Employees/Contractors)
  • Driver’s license information (Employees/Contractors)
  • Passport information (Employees/Contractors)
  • Military service information (Employees/Contractors)
  • Birth date and place (Employees/Contractors)
  • Disability information (Employees/Contractors)
  • Employee identification information (Employees/Contractors)
  • Education information (Employees/Contractors)
  • Languages and special competencies (Employees/Contractors)
  • Certification information (Employees/Contractors)
  • Probationary period and employment duration (Employees/Contractors)
  • Job or position title (Employees/Contractors)
  • Job-type or job code (Employees/Contractors)
  • Job location (Employees/Contractors)
  • Work schedule and status (e.g., part-time vs. full time, regular vs. temporary, current vs. former) (Employees/Contractors)
  • Compensation and related information (Employees/Contractors)
  • Employment history (Employees/Contractors)
  • Work experience (Employees/Contractors)
  • Accomplishment and awards (Employees/Contractors)

Purposes for processing and its legal basis

Morningstar will use your personal data for the legitimate purpose of administering your application or recruitment for employment

Recipients (or categories of recipients) of data

Morningstar stores and processes candidate personal data centrally on the servers of Morningstar companies. For candidates in the European Economic Area or United Kingdom, Morningstar may store or process personal data outside of the EEA or UK, respectively. HR, finance and other Morningstar staff involved in the management of the employee will have only such access to the personal data as is required for their role. Where Morningstar transfers data outside of the EEA or UK, it relies on appropriate data transfer mechanisms, in compliance with applicable law.

In accordance with Morningstar’s data protection policies and information security, where Morningstar uses third parties to process personal information, Morningstar requires these third parties to comply strictly with its instructions as to the processing of the personal data and to be compliant with applicable law.

Any international transfers – details of safeguards in place to protect the transferred personal data

For candidates in the EEA or UK, Morningstar may, in order to perform certain administrative functions, transfers personal data outside the EEA or UK, and in such cases, has ensured that adequate safeguards are in place to protect your personal data in accordance with the requirements of the GDPR.

Period the data is stored for (or the criteria to determine this)

Morningstar will hold information on candidates for as long as it is necessary for the purpose of recruiting and administering its obligations to candidates. Requirements for retention of personal data differ in accordance with relevant legislation in each country where Morningstar operates. Morningstar will hold employee personal data on its systems in accordance with those retention periods. If you have any questions about retention periods that are applicable, please contact

Details of any specific data subject rights Break down into, employee, candidate, former employee

Candidates have data subject rights granted under applicable privacy regulations. Candidates in the EEA or UK are entitled to:

  • Receive a copy of personal data in a commonly used machine-readable format;
  • Store such personal data on a private device for personal use; and
  • Require Morningstar to transmit personal data to another data controller. Responding to a data portability request will not require us to delete that data or should it affect the original retention period.

If you wish to exercise any of these rights, please contact

You are also entitled to request the following information:

  • confirmation that your personal data is being processed;
  • access to your personal data; and
  • supplemental information including, for example, the purposes of processing, the categories of personal data, recipients of the personal data, retention periods and the right to request rectification or erasure and to complain to the applicable privacy regulator.

Morningstar will ensure that the personal data we process is accurate, kept up to date and deleted or corrected without delay if it is inaccurate. You may ask Morningstar to correct any of your personal data that is inaccurate or incomplete and held by us. We will comply with this request without undue delay.

Contact details of the Data Protection Officer

If you have any questions or comments about this Privacy Notice and/or any other privacy enquiries, please contact:

The Data Protection Officer (DPO)

Right to lodge a complaint with the Regulator

If you have any concerns about Morningstar’s information rights practices, you can contact Morningstar’s DPO or the relevant local privacy regulator in your national country.

Breach Notification Procedure

Morningstar has implemented appropriate measures to deal with the breach notification requirements as set out in applicable law.