Skip to Content

    California Notice at Collection

    Last updated: September 30, 2024

    This California Notice at Collection (“Notice”) provides additional information for California residents and describes our information practices pursuant to the California Consumer Privacy Act 2018, as amended by the California Privacy Rights Act 2020, and its implementing regulations (the “CCPA”). Depending on how you interact or engage with us, we may provide you with other privacy notices with additional details about our privacy practices. This section applies to “personal information” as defined in the CCPA, whether collected online or offline. This section does not address or apply to our handling of personal information that is exempt under the CCPA, such as publicly available information, information governed by the Gramm-Leach-Bliley Act, or deidentified or aggregated information. Please note that Morningstar or its affiliates collect and consolidate public information about public and private equity markets for its Services. Some of this public information may include information about individuals. Generally, since it is public data, it is not governed by this Notice or applicable law.

    Where Morningstar has committed to maintaining and using personal information in a deidentified form, Morningstar agrees not to reidentify deidentified data except as permitted by applicable law.

    Personal Information We Collect. We may collect (and have collected) the following categories of personal information about you depending on how you use the Services:

    • Identifiers. Such as name, alias, email, phone number, billing address, unique personal identifier, online identifier, IP address, account name, or other similar identifiers.
    • Customer Records. Such as your account and profile information and customer records that contain personal information, such as name, account name, address, phone number and other contact information, account credentials, communications preferences, billing and payment information, customer service and support tickets and records, and other information you provide to use our Services.
    • Commercial Information. Such as records relating to Morningstar products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
    • Internet or Other Electronic Network Activity Information. Such as, but not limited to, browsing history, clickstream data, search history, and information regarding interactions with our website, mobile applications, advertisements, or emails, including other usage data related to your use of any of our Services or other online services.
    • Geolocation Data. Such as general location information about a particular individual, IP address or device.
    • Audio, Electronic, Visual or Similar Information. Such as information collected via call recordings if you are interacting with us in a customer service capacity or if you call us on a recorded line, recorded meetings and webinars, videos, photographs, user profile images, and security video footage used to secure our offices and premises.
    • Professional and Employment Information. Such as current and former employer(s) and position(s), business contact information, educational institutions attended, and professional memberships, interests, skills, or certifications.
    • Inferences. Such as inferences drawn from any of the personal information described in this section about a consumer including inferences reflecting the consumer’s preferences, characteristics, behaviors, attitudes, abilities, and aptitudes.
    • Sensitive Personal Information. In limited circumstances, we may collect social security numbers.

    Sources of Personal Information. We generally collect personal information from the following categories of sources: directly or indirectly from you; our affiliates and subsidiaries; your employer, conference and event organizers, or other business partners; your financial advisor, depending on their use of the Services; customers and clients; data analytics providers and data brokers; government entities; social networks; internet service providers; operating systems and platforms; and our vendors and service providers.

    Purposes for Collecting and Disclosing Personal Information. In general, we collect and process the personal information we collect for the following business or commercial purposes:

    • Services and Support – to provide, operate, administer, and support our Services, including by providing you relevant content and creating and administering your account.
    • Account Management, Billing, and Personalization – to enable you to make a purchase, communicate with you, verify your identity, personalize the content you receive, send you white papers or other content you may be interested in, administer our relationship with you or your employer, including as needed to manage billing and other inquiries, and administer the contracts we have with you or your employer.
    • Monitor, Develop, and Improve the Services – to monitor your use of the Services, conduct research and administer surveys/questionnaires, and develop and improve the features and functions of our Services, which may include combining usage information with other information about you.
    • Events and Conferences – to enable you to engage with, attend, and/or participate in our conferences and events, including by verifying your identity, facilitating payments, or contacting you.
    • Customer Support – to provide account, technical and product support.
    • Marketing, Analytics, and Advertising – to conduct marketing and advertising, including running third-party advertisements.
    • Artificial Intelligence – to enhance your user experience, sort and retrieve articles and information you have access to as part of your subscription, and produce new content based on the data you provide to us.
    • Safety, Protection, and Enforcement of Rights – to protect your, our, or third parties’ networks, systems, property, or safety, enforce our contracts, terms, and conditions, or otherwise exercise our legal rights.
    • Comply with Applicable Laws and Lawful Requests – to comply with laws and regulations that apply to us or third parties with whom we work, and comply with requests from regulatory agencies, law enforcement, and other public and government authorities.
    • Deidentified or Aggregated Data – to generate deidentified or aggregated data that we use for research and product development. We may publish or otherwise provide the results of this research data in our products and Services.
    • Corporate Transaction – to participate in any merger, acquisition, bankruptcies, sales, restructuring, or other corporate transaction that may involve the sale or disposal of some or all our assets or business interests.
    • Audit and Compliance – to meet our or third parties' audit and compliance requirements.
    • Other – as otherwise required or permitted by law, or as otherwise disclosed to you.

    Sensitive Personal Information. Notwithstanding the purposes described above, we do not use or disclose sensitive personal information for purposes beyond those authorized by the CCPA. 

    Disclosure of Personal Information to Third Parties and Other Recipients. The categories of personal information we have disclosed for a business purpose include: identifiers, customer records, commercial information, Internet or other electronic network activity information, geolocation data, audio, video, and other electronic data, and inferences.

    The categories of third parties and other recipients to whom we may disclose personal information for a business purpose may include: affiliates, subsidiaries, and business partners, vendors and service providers, professional services, customers and clients, acquirers of business assets, advertising networks, internet service providers, marketing, advertising, and data analytics providers, government entities, operating systems and platforms, and social networks.

    Sales and Sharing of Personal Information. The CCPA defines "sale" as disclosing or making available personal information to a third-party in exchange for monetary or other valuable consideration, and “sharing” includes disclosing or making available personal information to a third-party for purposes of cross-contextual behavioral advertising. We may “share” the following categories of personal information: identifiers, professional and employment information, and Internet or other electronic network activity information. We disclose these categories to third-party advertising networks, analytics providers, and social networks for purposes of marketing and advertising. We do not sell or share personal information about individuals we know are under age sixteen.

    Additionally, in the last twelve months, our affiliate, PitchBook Data, Inc. (“PitchBook”) has sold personal information. PitchBook makes information relating to the ownership of privately held companies available to its subscribers. This data includes identifiers (name and contact information) and professional or employment-related information (job titles and other similar information). You can find out more about PitchBook and its privacy practices here.

    Retention.  We retain the personal information we collect only as reasonably necessary for the purposes described or otherwise disclosed to you at the time of collection.

    California Residents Rights

    If you are a resident of California, you have the following rights subject to certain limitations:

    • Right to Know/Access. You have the right to request (subject to certain exemptions):
      • The categories of personal information we collected about you;
      • The sources from which we have collected that personal information;
      • Our business or commercial purpose for collecting, selling, or sharing that personal information;
      • The categories of third parties to whom we have disclosed that personal information; and
      • A copy of the specific pieces of personal information we have collected.
    • Right to Correct. You have the right to request that we correct inaccuracies in your personal information.
    • Right to Delete. Subject to certain exceptions, you have the right to request deletion of personal information that we have collected from you. Please note, Morningstar is not obligated to delete personal information that is necessary to provide Services that you request or required to comply with applicable laws.
    • Right to Opt-Out of Sales and Sharing. You have the right to opt-out of “sales” and “sharing” of your personal information, as those terms are defined under the CCPA. While we do not “sell” personal information in the traditional sense (i.e., for money, and with the exception noted above regarding PitchBook), our use of third-party analytics and advertising cookies may be considered “selling” and “sharing” under CCPA. To exercise your right to opt-out of the “sale” or “sharing” of your personal information, use the Do Not Sell or Share My Personal Information link in the "Exercising Your California Privacy Rights" section below, or the link at the bottom of our website. You also have the right to opt-out of “sales” and “sharing” of your personal information using an opt-out preference signal. If our website detects that your browser or device is transmitting an opt-out preference signal, such as the “global privacy control”—or GPC— signal, we will opt that browser or device out of cookies on our Site that result in a “sale” or “sharing” of your personal information. If you come to our Site from a different device or from a different browser on the same device, you will need to opt out, or use an opt-out preference signal, for that browser and/or device as well.
    • Right to Limit Use and Disclosure. Subject to certain conditions and exceptions, you may have the right to limit the use and disclosure of “Sensitive Personal Information,” as defined under the CCPA. However, we do not engage in activities triggering this right.
    • Right to Non-Discrimination. We will not discriminate against you for exercising any of the rights described in this section.

    Exercising Your California Privacy Rights

    Do Not Sell or Share My Personal Information

    To exercise any of these rights (other than the right to opt-out of sale and/or sharing via the website, which may be exercised via the link directly above), you may submit a request through one of the methods listed below:

    Verification. Generally, before responding to certain requests, we must first verify your identity using the personal information you provided to us or that we maintain about you. You must provide us with your name and email address and additional information we request at the time. We will take steps to verify your request by matching the information provided by you with the information we have in our records. In some cases, we may request additional information to verify your identity, or where necessary to process your request. If we are unable to verify your identity after a good faith attempt, we may deny the request and, if so, will explain the basis for the denial.

    Authorized Agent. You may designate someone as an authorized agent to submit requests and act on your behalf. Authorized agents will be required to provide proof of their authorization, and we may also require that the relevant consumer directly verify their identity and the authority of the authorized agent.