1. Who we are

This is the ESG Data Governance Initiative Privacy Policy (“Privacy Policy”) for The Boston Consulting Group, Inc. and its subsidiaries and affiliates (“BCG”, “we”, “us”, or “our”). This Privacy Policy was last updated in July 2025. For more detail on BCG’s international operations please see https://www.bcg.com/offices/default.

2. Applicability of this Privacy Policy

This Privacy Policy applies only to:

• Your use of the ESG Data Convergence Initiative Website (“Site”) where you are provided with information about and a link to our interactive tool to help you simplify data sharing process for Environmental Social Governance (“ESG”) metrics, translating ESG to material impact, allowing you to benchmark against peers and make these metrics meaningful, while shaping how private equity ownership is evolving private company ESG performance.
• You registering your interest via the Site to join the initiative and receive and participate in an industry benchmark on consolidated ESG metrics across over 4300 companies.
• You signing up to receive notifications and newsletters about the initiative.

Please note that we do not collect any personal data as part of the ESG benchmarking exercise conducted for the initiative.

For information on our other privacy practices, please see our Privacy Statement.

The Site may contain links to external sites or services which are not governed by this Privacy Policy. We encourage you to review the privacy policies of any such sites before you submit information there.

3. Important information about this Privacy Policy

BCG understands that your privacy is important. BCG is committed to protecting your privacy and personal data you provide in relation to your access and use of the Site. This Site is not intended for and does not intentionally target or solicit to children or anyone of 18 years of age and younger. Please read the following carefully to understand our practices regarding your personal data and how we will treat it.

4. Changes to this Privacy Policy

Please note that BCG may, in its discretion, amend this Privacy Policy from time to time. To ensure you are able to remain informed, changes to this Privacy Policy will be reflected here.

5. The data we collect about you

When you register your interest for an account, we collect information from you, including the following personal data: name, company name, business email address, and commitment status. By your use of the Site, we may also collect, use, store, and transfer the following personal data about you: location data, IP address, geolocation, user activity (e.g. pages visited and how long stayed there.)

We also collect, use and share aggregated data such as statistical data that does not identify you or anyone else for any purpose.

We do not collect any special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences. Please note BCG does not use or disclose your sensitive personal data outside of the following purposes: (1) performing our services, (2) detecting security incidents, (3) resisting malicious, deceptive, fraudulent, or illegal actions, (4) ensuring physical safety, (5) for short-term transient use, including certain non-personalized advertising, (6) maintaining or servicing accounts, providing customer service, or providing similar services, and (7) verifying and maintaining the quality or safety of a service or product or improving, upgrading, or enhancing a service or product. Accordingly, we do not provide the right to limit the use or disclosure of your sensitive personal data.

6. Authentication through okta

In order to use the Site, you will need to authenticate with the third-party provider Okta Inc. (301 Brannan St Ste 300, San Francisco, CA 94107) with your personal username and a personal password. To do this, download the Okta Verify app and perform the authentication process. The regulations and data protection declaration of Okta, Inc. apply. We have no influence on and are not responsible for the data collection by Okta Inc. Your data will be processed exclusively for the purpose of authentication. After successful authentication you will receive personal access to our app. Here you register once with your e-mail address.

7. How your personal data is collected

We may collect your personal data in different ways: based on your consent you provide by filling in forms on the Site for login; or by corresponding with us (for example, by email or chat). It includes information you enter when you register or when you report a problem with the Site. If you contact us, we will keep a record of that correspondence.

8.Cookies and other tracking technologies

BCG may use cookies and similar tracking technologies on this Site. A “cookie” is a small amount of data sent from a web server to your browser and stored on your computer’s hard drive. Other tracking technologies work similarly to cookies and place a small amount of data on your devices to monitor your website activity to allow us to collect information about how you use this Site. With most internet browsers, you can erase cookies from your computer hard drive, block all cookies, or receive a warning before a cookie is stored on your computer. Please refer to your browser instructions or you can visit https://www.aboutcookies.org/ which will give you more information. Please be advised that certain sections or functionalities of the Site may be inaccessible to you if your browser does not accept cookies. We do not currently respond to browser do-not-track signals.

9. Purpose for use of your personal data

We process your personal information for the following purposes:

• Corresponding with you via email
• Managing usage of the Site; providing you with support related to accessing and using the Site; monitoring logins and log-outs
• Improving the Site content and navigation; informing you about updates to the Site
• Understanding the user population; determining whether the Site is designed to work with the device settings of a majority of users
• Send marketing communications via emails, chat, social media from BCG based on your consent where required.

We process your personal data for the purposes described above: when we have your consent to do so, where applicable; when necessary to enter into a contract with you; when necessary for us to comply with a legal obligation; or when necessary for the purposes of our legitimate interests as a company operating globally.

10. Disclosure of personal data

Because BCG is a global organization, personal data may be processed across the BCG group of companies (https://www.bcg.com/offices/default) to help operate our business efficiently a as well as to external service providers appointed by BCG or another BCG company to perform IT services, IT infrastructure, cloud storage, business, administrative, and management functions for BCG. These arrangements may involve your personal data located in various countries around the world where BCG and such third parties maintain and store personal data in systems and applications where privacy laws differ. The personal data is only accessible by authorized persons or vendors who are bound by privacy requirements, and we only make these arrangements or transfers where we are satisfied that adequate levels of protection are in place to protect personal data held in that country.

We may also disclose your personal data to law enforcement agencies, courts, other government authorities or other third parties where we believe necessary to comply with a legal or regulatory obligation.

Further, we may disclose your personal data to a third party in the event of any reorganization, financing transaction, merger, sale, joint venture, partnership agreement, transfer, or other disposition of all or any portion of our business assets, or stock (including in connection with any bankruptcy or similar proceedings).

11. Personal data retention

Personal data will only be kept as long as is reasonably necessary to fulfil the purpose for which it was collected. We may retain your personal data for longer if it may be the subject of a legal claim, may otherwise be relevant for future litigation, or retention is advisable considering our legal position (such as in regard to our employee records, applicable statutes of limitations, litigation, or regulatory investigations).

In some circumstances we will anonymise and/or aggregate your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

12. Personal data security

BCG has in place appropriate technological and operational security processes designed to protect personal data. Only authorized individuals will have access to any personal data provided by you via this Site. Each individual having access to any personal data is obligated to maintain its confidentiality and receive related training. Although we take steps that are generally accepted as industry standard to protect your personal data, BCG cannot guarantee that your personal data will not become accessible to unauthorized persons, and BCG cannot be responsible for any actions resulting from a breach of security when personal data is supplied over the internet or any public computer network.

13. Your personal data rights

Depending on where you reside, you may have the following rights in accordance with applicable data protection laws. You have a right to request a copy of the personal data we hold about you and details of how we use that information. If any of the personal data held about you is incorrect or out of date, you have the right to amend or rectify it. You also have the right to require us to erase your personal data, stop processing your personal data, restrict the processing of your personal data, and provide your personal data in a portable format. Where processing your personal data is based on your consent, you may withdraw your consent to such processing. This may not apply if there are other legal justifications to continue processing. You also may have a right to lodge a complaint with a relevant supervisory authority, state attorney general, or other applicable authority and the right not to receive discriminatory treatment for exercising your privacy rights. You may also have the right to opt-out of: (1) the “sale” or “sharing of your personal data; (2) targeted advertising; or (3) automated decision-making or profiling in furtherance of decisions that produce legal or similarly significant effects; although please note BCG does not engage in automated decision-making or profiling in connection with this Site.

If you (or an authorized agent acting on your behalf) would like to exercise any of your data protection rights, or you believe your request was denied by BCG and would like to appeal, please contact the appropriate data protection contact in the “Contact Us” section of this Privacy Policy below. Please note that we need you to prove who you are (including providing additional information from you) before we can act on your request.

15. Contact us

For further questions, or to exercise any of your data protection rights, you may contact the appropriate data protection contact:

Data Protection Office
Boston Consulting Group Inc.
200 Pier Four Boulevard
Boston, MA 02210
Contact Us

Germany and Austria
Data Protection Officer (Der Datenschutzbeauftragte)
Boston Consulting Group GmbH
Ludwigstrasse 21
80539 Munich Germany
Contact Us