Morningstar Candidate Privacy Notice

Last updated: September 16, 2026

This Candidate Privacy Notice (“Candidate Notice”) describes our information practices relating to individuals who apply or are considered for employment, internship, or officer or director positions with Morningstar Inc. and its affiliate companies (“Morningstar,” “we,” “our” or “us”), wherever they reside (each a “Candidate” or “you”). The Morningstar entity to which you apply will be the relevant data controller (or data collector) for applicable data protection legislation.

This Candidate Notice is intended to comply with Morningstar’s obligations to provide you with information about our collection, use, disclosure and/or processing of your personal data (as hereinafter defined) under applicable data privacy laws.

Some locations in which we operate require additional disclosures to Candidates. Further information for Candidates in the following locations can be found in the Appendices to this Candidate Notice:

1. Scope and Relation to Other Policies

This Candidate Notice applies to the personal data we collect about Candidates in the context of the recruitment process at Morningstar, i.e. any information that identifies, relates to or could reasonably be linked with you and which can identify you directly or indirectly (“ personal data ”). The term personal data shall include “personal information” or other analogous terms as defined in applicable data privacy laws. This Candidate Notice also applies to the cases where you send us your resume, CV or application on an unsolicited basis.

We may provide you additional notices about our information practices for specific reasons, depending on the role that you are applying for. This Candidate Notice does not address or apply to our information practices that concern or relate to information which is not personal data.

This Candidate Notice also does not apply to the personal data we collect from you in the context of your personal use of our products and services or when you visit our other websites, which are subject to different notices. For additional information on our general privacy practices in this context, including how we use cookies and similar technologies, please visit our Privacy Center .

If you accept an offer of employment or engagement with Morningstar, the applicable Employee Privacy Notice will prevail over this notice and govern the processing of your personal data from the start of that relationship onward.

2. What Personal Data Do We Collect, Use and/or Process?

The following identifies the categories of personal data we collect about Candidates (some of which will vary by location, as permitted or required by local law).

Identifiers: Name (including preferred names), gender, nationality, address, unique personal identifier, online identifier (including IP address from which you access Morningstar recruitment systems), email address and other contact details (e.g. personal telephone or mobile number) and/or national ID number, immigration and eligibility to work information, and other government identifiers.
Professional or Employment-Related Information: Skills and experience, qualifications, education data, references, CV or resume, cover letter, employment history, compensation expectations or history (where permitted by applicable law), record of interview, interview notes, transcription and assessment, vetting and verification information (e.g. results of credit reference check, financial sanction or criminal record checks where carried out and required by applicable law and where justified by the specific role), professional license and academic credential verification, information related to the outcome of your application, information relating to prior applications and details of any offer made to you.
Audio, Electronic, Visual, or Similar Information: Audio, electronic, visual, or similar information, including information collected via authorised recorded interviews (whether virtual or telephonic, where disclosed and consented to as required by law), and video footage (including CCTV images, where permitted by local law).
Sensitive Personal Data. Depending on your location, we may request or collect data regarding protected characteristics, including gender, age, race or ethnic origin, nationality, disability status or other data relating to physical or mental health (including details of accommodations or adjustments), military or veteran status, or other data related to a protected ground under applicable anti-discrimination or human rights laws, as long as strictly relevant to fulfil our obligations and exercise our rights in the context of employment, safety and social security legislation, in so far as this is permitted by applicable law. We may also collect other sensitive personal data, such as data relating to criminal records. Wherever we process special categories of personal data we will do so in line with local requirements. In accordance with the principle of data minimisation, we ask you not to include in your resume or CV special categories of personal data that are not relevant to the role, and any such data that is not pertinent to the evaluation of your application will not be taken into consideration.

You may choose to provide or not to provide us with your personal data. Depending on your location, if you refuse to provide relevant personal data, we may not be able to consider your application or to complete the hiring process.

If you provide personal data related to another individual to us (such as a reference), you are required to provide them with a copy of this Candidate Notice.

3. Where Do We Get Your Personal Data?

We generally collect personal data identified above from the following categories of sources:

Directly from you, including through application forms, resumes or CVs, cover letters, interviews, assessments, documentation and communications during the recruitment process as well as our application website;
From your designated references or former employer;
From Morningstar or its third-party providers: (i) when monitoring our premises (for example, from our facility entry systems, or site security systems such as CCTV systems or when you connect your devices or otherwise use our networks); (ii) recruiters and recruiting platforms; and (iii) other service providers, representatives, and agents, including those that conduct background checks, assessments, or identity verification;
From publicly available information and sources, such as professional networking profiles, where relevant to the role and permitted by applicable law; and
From educational institutions or professional licensing bodies.

4. Why Do We Collect Personal Data?

We generally collect and process personal data, including sensitive or special category personal data (as described above) to the extent permitted by applicable laws and as necessary for a variety of purposes in the context of your candidacy for employment or engagement. In addition to the legal bases described below, we will obtain your consent where required under applicable law. Where required by applicable law, we rely on the following legal bases for processing personal data:

Purposes for which we will process personal data	Legal basis for processing
To evaluate your application, assess your qualifications, skills, and suitability for the role and potentially for other roles that are available or may become available, conduct interviews, determine hiring eligibility and make hiring decisions.	The processing is necessary to take steps at your request prior to entering into an employment relationship or employment or services contract. Where the legal basis described above does not apply, the processing is necessary for the legitimate interests pursued by Morningstar in identifying qualified candidates and making informed hiring decisions, evaluating candidates for available roles, including determining whether their qualifications, experience and skills match the business and operational requirements of the position.
Perform assessments and tests undertaken by you, as relevant to the role being applied for.	The processing is necessary to take steps at your request prior to entering into an employment relationship or employment or services contract. Where the legal basis described above does not apply, the processing is necessary for the legitimate interests pursued by Morningstar in identifying qualified candidates and making informed hiring decisions, evaluating candidates for available roles, including determining whether their qualifications, experience and skills match the business and operational requirements of the position.
Perform background or reference checks or evaluate legal rights to work as permitted by applicable law.	Where required by applicable law, including in connection with verification of a candidate’s right to work or regulatory suitability requirements applicable to certain roles, the processing is necessary for compliance with a legal obligation to which Morningstar is subject. Where such checks are not legally required but are relevant to the role, the processing is necessary to take steps at your request prior to entering into an employment relationship or employment or services contract or, where this legal basis does not apply, for Morningstar’s legitimate interests in verifying information provided by candidates, assessing their qualifications, experience, integrity and suitability for the role, conducting an effective recruitment process, and meeting internal compliance and risk-management requirements, provided that such checks are permitted by applicable law and proportionate to the position. Criminal record checks will only be carried out where permitted by applicable law and justified by the nature of the role.
Where required or permitted by applicable laws, monitoring or reporting programmes to ensure equality of opportunity and diversity with regard to personal characteristics protected under applicable anti-discrimination or human rights laws or to meet local reporting requirements.	Where required or permitted by applicable law, Morningstar may operate monitoring or reporting programmes designed to assess and promote equal opportunity, with regard to personal characteristics protected under applicable anti-discrimination laws, or to meet local reporting requirements. Where such processing is required by applicable law, the processing is necessary to ensure Morningstar complies with its legal obligations. Where the processing is not legally required, it is necessary for the purposes of Morningstar's legitimate interests in identifying potential barriers or disparities in recruitment processes, and supporting fair and non-discriminatory hiring practices, to the extent permitted by applicable law and subject to appropriate safeguards.
To support HR administration and management and maintaining and processing general records necessary to manage the recruitment process, such as preparing assessments, reviews, and reports.	The processing is necessary to take steps at your request prior to entering into an employment relationship or employment or services contract, including to administer and manage the recruitment process. Where applicable, the processing is necessary for compliance with legal obligations in record-keeping. Where the processing is not legally required, it is necessary for the purposes of Morningstar's legitimate interests to manage the recruitment process effectively.
To communicate with you throughout the recruitment process and to engage with you on future opportunities that we consider would be suitable for you.	The processing is necessary for the legitimate interests pursued by Morningstar in conducting our recruitment process.
To monitor our premises and network activity and safeguard Morningstar data and assets, which may require that we capture some of your information (e.g. access control, CCTV, device information, IP address) along with network activity. We will only engage in monitoring activities where permitted by applicable local law.	The processing is necessary for the legitimate interests pursued by Morningstar in protecting its premises, personnel, systems, networks, confidential information and other assets, preventing and detecting unauthorised access, misuse, theft, fraud and other security incidents, ensuring the integrity and security of its IT environment, and investigating suspected security or compliance breaches.
To protect and defend our legal rights and interests and those of third parties, including to manage and respond to legal claims or disputes, subpoenas, court orders or binding information requests and to otherwise establish, defend or protect our rights or interests, including without limitation, Morningstar’s confidential information, trade secrets and other intellectual property, the rights, property, and reputation of Morningstar and its workforce, or the rights, interests, health or safety of you or others, in anticipation of a legal claim or where there is a relevant suspicion of conduct in breach of the applicable laws and internal policies or to the detriment of Morningstar, its agents and shareholders.	The processing is necessary for the legitimate interests pursued by Morningstar in the establishment, exercise or defence of legal claims, including managing and responding to legal claims or disputes, subpoenas, court orders, or binding information requests.
To manage proposed or actual business reorganisation, merger, sale, joint venture, assignment, transfer, divestment or other disposition of all or any portion of Morningstar business, assets or stock (including in connection with any bankruptcy or similar proceeding).	The processing is necessary for Morningstar’s legitimate interests in planning and implementing such changes or transactions, including sharing relevant information with advisors, potential buyers, acquirers, successors or other transaction parties, including legal counsel, where necessary.
To share personal data with other Morningstar group companies where necessary for the recruitment process, internal administration, recruitment coordination or consideration of your application by relevant hiring teams.	The processing is necessary to take steps at your request prior to entering into an employment or services contract where the sharing is necessary for your application. Where this does not apply, the processing is necessary for Morningstar’s legitimate interests in internal administration and coordinating recruitment across the Morningstar group, provided that such interests are not overridden by your rights and interests.
For other purposes as directed or consented to by you.	We may process your data for other purposes you direct us to or consent to, such as considering you for other opportunities, where permitted by applicable law.

5. Sensitive Personal Data and Special Category Personal Data

If and to the extent relevant for and permitted by applicable laws, personal data or special category personal data (as described above) may also be collected, used and/or processed by Morningstar as necessary for the following purposes:

Purposes for which we will process sensitive personal data	Legal basis for processing
To assess and review eligibility to work for Morningstar in the location the position is located.	The processing of documentation such as work permits, details of residency, proof of citizenship and proof of work authorisation necessary for Morningstar to comply with legal obligations in verifying a candidate's right to work status. This is justified through Morningstar carrying out its legal obligations in the field of employment law in ensuring the candidate has the right to work.
To comply with anti-discrimination or human rights law or to keep Morningstar’s commitment to equal opportunity under review.	The processing of your racial or ethnic origin, gender, age, disability status, veteran status or other protected ground is necessary for the purposes of carrying out the obligations and exercising the rights of you or Morningstar in the field of employment law, social security and social protection law, to the extent permissible under applicable laws.
To respond to requests for reasonable accommodations or adjustments in the recruitment process.	This processing is necessary for the purposes of carrying out the obligations and exercising the rights of you or Morningstar in the field of employment law, social security and social protection/human rights law, to the extent permissible under applicable laws.
In the event of a complaint relating to the recruitment process where such characteristics or information are relevant to the particular complaint, in order to comply with applicable law obligations.	The processing of your racial or ethnic origin, gender, age, disability status, veteran status, or other protected ground is necessary to establish, exercise or defend legal claims.

Personal data relating to criminal convictions and offences will only be used and/or processed where required or permitted by applicable laws.

We will also collect your consent to process sensitive personal data or special category data where required by law.

6. Disclosure of Personal Data

We may disclose your personal data to:

Morningstar companies and personnel: hiring managers, interview panels, and human resources personnel within Morningstar group companies in your location of residence or of affiliates located worldwide who need to know your personal data for the purposes described in this Candidate Notice. Morningstar companies are listed at https://www.morningstar.com/company/global-contacts
Service Providers: Companies that provide products and services to Morningstar such as vendors that provide tools, AI systems and other technology which assist the selection and hiring process, such as, background checks, application screening, assessment platform providers, provider of recruitment platform and recruitment agencies.
Public and Governmental Authorities: Entities that regulate or have jurisdiction over you or Morningstar such as regulatory authorities, law enforcement, public bodies, and judicial bodies.
Professional Advisors. We may disclose personal data to legal counsel, auditors, and other professional advisors as necessary to obtain advice, conduct investigations, or comply with legal obligations.
Other third parties: Our partners or counterparties in connection with any proposed or actual reorganisation, merger, sale, joint venture, assignment, transfer, divestment or other disposition of all or any portion of Morningstar business, assets or stock (including in connection with any bankruptcy or similar proceeding).

Personal Data will only be disclosed to Recipients where strictly necessary and be limited to those who have a need to know the information to fulfil the above-mentioned purposes. These parties are either bound by legal or professional duty or are contractually required to protect the confidentiality and security of personal data and only use personal data for the provision of services in compliance with applicable laws.

These recipients may be located outside your location of residence, as described in Section 9 below.

7. How Long Do We Retain Personal Data?

We store your personal data for as long as needed based on the purposes for which we obtained it, to comply with a legal obligation and/or for the establishment, exercise or defence of legal claims, in each case in accordance with applicable law. Morningstar endeavours to ensure that personal data are kept as current as possible and that irrelevant or excessive data are deleted or deidentified at the end of the relevant retention period. Specifically:

If your application is subject to United Kingdom (UK) or European Economic Area (EEA) laws, we will retain your information for one (1) year following your application, unless you agree to retain it for longer to consider you for future job opportunities. In such case, with your consent, we may retain your information for up to two (2) years in total from your original application date.

If your application is subject to laws in any other location, we will retain your information for five (5) years following your application.

Personal data may be retained beyond the periods described above where this is necessary to comply with a legal obligation to which we are subject or for the establishment, exercise or defence of legal claims, in each case in accordance with applicable law.

If you accept an offer of employment or engagement, your candidate personal data will become part of your personnel file and will be retained in accordance with the applicable Employee Privacy Notice and Morningstar’s records retention policies.

Rather than delete your personal data, we may also deidentify or aggregate it in accordance with applicable laws.

8. Security

Your personal data may be kept in various formats by us, our related companies and relevant third-party providers, which includes electronic records (including cloud-based systems) and, in limited circumstances, physical records.

Morningstar takes reasonable and appropriate administrative, technical, and physical measures designed to protect the personal data we collect from accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Our electronic records are stored in systems protected by industry standard security controls. Our security and privacy policies are periodically reviewed and enhanced as necessary and only authorised individuals have access to the information provided.

Please be aware that, despite our efforts, no data security measures can guarantee security. You should take steps to protect against unauthorised access to your passwords and login details used to access Morningstar recruitment systems.

9. International Transfers of Personal Data

Morningstar operates globally and may transfer your personal data – including the special categories of data described above – to locations other than the location in which you are located for the purposes described in this Candidate Notice. This will be applicable, for example, where the hiring team, human resources function, or recruitment service provider is located in a different location from the one in which you reside.

Morningstar is headquartered in the United States and often transfers personal data collected in other locations to the U.S. as part of the application and hiring process. Depending on the context of your application, Morningstar may also transfer personal data to its entities and associated service providers located in: Australia, Belgium, Brazil, Canada, Chile, China, Denmark, Finland, France, Germany, Hong Kong, India, Italy, Japan, Jersey, Luxembourg, Mexico, the Netherlands, New Zealand, Norway, Singapore, South Africa, South Korea, Spain, Sweden, Switzerland, Taiwan, Thailand, the United Arab Emirates, and the United Kingdom.

As a result, in some circumstances your personal data will be transferred to locations outside of the location in which you are located to locations whose data protection laws may be less stringent than yours. When we transfer personal data to these locations, we use safeguards to protect your personal data, such as those provided for in the European Commission’s Standard Contractual Clauses or UK International Data Transfer Addendum. Where deemed necessary, such appropriate safeguards will be complemented by supplementary measures for ensuring an essentially equivalent level of data protection to that found under the exporting locations.

Where required by applicable data protection laws, Morningstar has ensured that service providers (including other companies within the Morningstar group) have implemented a lawful cross-border transfer mechanism, such as an adequacy decision, standard contractual clauses or another safeguard or derogation permitted by applicable law.

You can request information on the applicable transfer mechanism by contacting us at privacyenquiries@morningstar.com .

10. Use of AI Tools and Automated Processing

Morningstar uses tools incorporating artificial intelligence (“AI”), developed either internally or by third parties. These systems may process your personal data and generate outputs—such as content, predictions, recommendations, classifications, or insights—that are used at certain stages of the recruitment and hiring process. We will only use AI tools where permitted and in compliance with the safeguards required by applicable law.

AI-generated outputs used in connection with your candidacy will not be used as the sole basis for decisions that produce legal or similarly significant effects for you, including rejection and hiring decisions, and will remain subject to meaningful review of recruiters, hiring managers, or other relevant personnel. You may also exercise your rights relating to automated decision-making, as described in Section 11 below.

11. Your Privacy Rights

(A) Candidate Privacy Rights

You may be able to right to exercise one or more of the following rights regarding your personal data, depending on the laws applicable to your candidacy and Morningstar.

Right to Know/Access. You can request access to any of your personal data that Morningstar holds about you and to receive a copy of that data in an accessible format. This includes information about the purposes of processing, categories of data processed, recipients of your data, and the retention period.
Right to Rectification. If you notice that personal data about you is inaccurate or incomplete, you can have your personal data rectified or completed without undue delay. If we do not agree to make a correction you request, where required by applicable law we ‎‎will annotate the personal data under our control with a note that the ‎correction was requested but ‎‎not made‎.
Right to Object. You can object to our processing of your personal data where we rely on legitimate interests as the legal basis. We will consider your request and stop the processing unless we have compelling legitimate grounds or where we need to continue process the data for the establishment, exercise or defence of legal claims.
Right to Erasure. You can request deletion of personal data that we have collected from you, for example where the data is no longer necessary for the purposes for which it was collected, where you withdraw consent (if consent was the legal basis), or where the data has been unlawfully processed. Please note, that Morningstar may not be able to delete personal data where retention is necessary to comply with legal obligations, for the establishment or defence of legal claims, or for other legitimate purposes permitted by law. We will inform you of any refusal and the reasons for it.
Right to Request the Restriction of Processing. You can request that Morningstar restricts its processing of your personal data in certain situations, including: (a) while we verify the accuracy of contested data; (b) where the processing is unlawful but you prefer restriction over deletion; (c) where we no longer need the data but you require it for legal claims; or (d) while we verify whether our legitimate interests override yours following your objection. Where processing is restricted, we will store but not further process the data without your consent, except for legal claims or the protection of the rights of another.
Right to Data Portability. Where processing is based on your consent or on a contract and carried out by automated means, you can receive the personal data you have provided to us based on consent or a contract, in a structured, commonly used and machine-readable format, and to have this data transmitted directly to another controller where technically feasible.
Right to Withdraw Consent. To the extent that the processing of your personal data is based on your consent, you can withdraw such consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. If you withdraw your consent and there is no other legal ground for the processing, you have the right to have your personal data erased in accordance with the above (see Right to Erasure). You may withdraw your consent by contacting us using the details set out below. If you withdraw your consent we ‎may not be able to continue to consider your application for employment or engagement.
Rights Relating to Automated Decision-Making.
- Not to Be Subject to Solely Automated Decision-Making , including profiling, that produces legal effects or similarly significantly affects you.
- To Transparency and Explanation, receive meaningful information about the use of AI tools or automated systems in connection with your candidacy, the system and the logic involved, the potential consequences of a decision, recommendation or output that significantly affected you.
- To Request Human Review and Contest, of a consequential automated assessment or decision, express your point of view, provide additional information, and contest the outcome.
Right to Complain to Morningstar. You can complain to Morningstar if you believe we haven't handled your personal data properly under data protection law, including if you believe we haven't respected your data subject rights.
Right to Complain to a Supervisory Authority. If you believe that the processing of your personal data infringes applicable data protection law, you can lodge a complaint with the data protection supervisory authority. Contact details for relevant supervisory authorities are set out in the addenda below.

(B) Exercising Your Privacy Rights

To exercise any of these rights, except for the right to complain to a supervisory authority, you may submit a request through one of the following methods:

Email: privacyenquiries@morningstar.com . If you email us, please indicate you are exercising your “data privacy rights.” We may request additional information to confirm your identity before fulfilling the request. If we are unable to verify your identity after a good faith attempt, we may deny the request and, if so, will explain the basis for the denial. We will respond to your request within the timeframe provided for by applicable law. If we refuse to act on your request, we will inform you of the reasons for our refusal and your right to lodge a complaint with a supervisory authority.

For the right to complain to a supervisory authority, see Addendum B – Notice to European Economic Area (EEA) and United Kingdom (UK) Residents , if you are resident in the EEA or UK and/or are applying for a position with a Morningstar group company in the EEA and/or the UK.

12. Changes to This Candidate Notice

We may amend this Candidate Notice at any time (subject to applicable law).

This Candidate Notice is reviewed and updated periodically consistent with applicable law and to ensure it accurately describes our information practices and procedures. When we update this Candidate Notice, we will also revise the “Last Updated” date at the top of this document.

13. Contact Us or Our Data Protection Officer

If you have questions or concerns regarding this Candidate Notice or the handling of your personal data, please contact us through one of the following methods:

Morningstar Data Privacy Team: privacyenquiries@morningstar.com . You may also contact our Data Protection Officer at dpo@morningstar.com .

Morningstar People and Culture: AskHR@morningstar.com

You may also contact the privacy regulator for your location if you have questions about your rights or would like to submit a complaint.

Appendix A – California Supplemental Notice

This Candidate Notice applies to any job applicants who are residents of California, under the California Consumer Privacy Act, as amended from time to time including by the California Privacy Rights Act, and the applicable regulations (together, “CCPA”).

Any terms used but not defined in this Notice have the same meaning as defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the 'CCPA').

Sales and Sharing for Targeted Advertising. Morningstar does not “sell” or “share” personal information that it collects for recruitment purposes, as those terms are defined by CCPA.

Sensitive Personal Information. For categories of Sensitive Personal Information that we collect, process or disclose, we will not use or disclose such Sensitive Personal Information about applicants beyond the purposes authorized by the CCPA.

Your CCPA Rights.

California candidates have the following rights under the CCPA with respect to their personal information, subject to certain limitations and exceptions:

Know/access : the right to know what personal information we have collected about them, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about them.
Deletion: the right to request deletion of their personal information that we have collected about them.
Correction : the right to request correction of inaccurate personal information we maintain about them.
Limit use or disclosure of sensitive personal information: the right to request to limit certain uses and disclosures of sensitive personal information. However, we do not use or disclose candidate sensitive personal information beyond the purposes authorized by the CCPA, thus this right is not available to candidates.
Non-retaliation and non-discrimination: the right not to be subject to retaliatory or discriminatory treatment for exercising their rights under the CCPA.

Submitted CCPA Requests

Under the CCPA, you may exercise the rights listed above yourself or you may designate an authorized agent to make these requests on your behalf. Please note, we will request your authorized agent to provide signed permission from you as proof that they are authorized to submit the request on your behalf. We may also request that you verify your own identity with us directly or confirm directly with us that you provided the authorized agent permission to submit the request.

Please note that to protect your personal information we may need to verify your identity before processing your request. In some cases, we may need to collect additional information to verify your identity, such as a government issued identification.

To exercise your rights, contact us at privacyenquiries@morningstar.com or by mail at

Morningstar, Inc. c/o Data Privacy,
22 W. Washington Street,
6 ^thFloor, Chicago, IL 60602.

Appendix B - European Economic Area (EEA), United Kingdom (UK) and Switzerland Supplemental Notice

This notice applies to any job applicants who are residents in the EEA and UK, and whose personal data is subject to the General Data Protection Regulation (EU) 2016/679 ( GDPR ) and the GDPR as transposed into UK law ( UK GDPR ), as applicable, and as amended from time to time.

When exercising the Right to Complain to a Supervisory Authority:

If you are an EEA resident, the contact details for your applicable Supervisory Authority are available at: https://www.edpb.europa.eu/about-edpb/our-members_en
if you are located in Germany, you may contact in particular the Supervisory Authority in the German federal state of your habitual residence, (future) place of work, or the place of the alleged infringement. Contact details of the German federal and state supervisory authorities are available at: https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html
if you are a UK resident, the contact details for the Information Commissioner's Office are available at: https://ico.org.uk/global/contact-us/

Specifically for France. You have the right to give Morningstar special instructions regarding the retention, deletion and disclosure of your personal data after your death. You may also define general directives of your personal data after your death with a certified trusted third party responsible for ensuring that your wishes are respected, in accordance with the French applicable regulations.

Appendix C – Australia Supplemental Notice

This notice applies to any job applicants who are residents in Australia, and whose personal data is subject to the Australian Privacy Principles contained in the Privacy Act 1988 (Cth) ( Privacy Act ), as amended from time to time.

You may contact us using the contact details in Section 13 of this Candidate Notice to raise a concern or inquiry regarding our handling of personal data.

If you are not satisfied with the outcome of our investigation, you may contact the Office of the Australian Information Commissioner using the contact details available at https://www.oaic.gov.au/contact-us to lodge a complaint.

Appendix D – China Supplemental Notice

This Addendum applies to any Candidates who are residents of the People's Republic of China ("China"). To the extent that the provisions of the main body of the Candidate Notice and those of this Addendum conflict, the provisions of this Addendum will prevail for Chinese residents.

1. Sensitive personal data:

Among the categories of personal data that we process, the following categories may (but not necessarily) constitute “sensitive personal data” depending on the specific context under which the personal data is processed: social security number, national ID number, driver’s license number, other government identifiers, disability status, personal data relating to criminal convictions and offence, and personal data of your dependents under the age of 14.

Unauthorised processing of, or access to, your sensitive personal data may easily lead to infringement of human dignity or harm to your personal or property safety. We will, therefore, take enhanced security measures to protect your sensitive personal data, and only process your sensitive personal data with your separate consent if required by law.

2. Legal basis:

We rely on the following legal bases (as applicable) to carry out the processing activities that, in other locations, could have been based on "legitimate interest" as outlined in the main body of the Candidate Notice:

Your explicit consent; or
Public information: We may process your personal data within reasonable scope without your consent if the personal data being processed has already been legally disclosed to the public by yourself or by third parties.

3. Changes to this Candidate Notice

If we make any changes to this Candidate Notice, we will endeavour to provide you prior notice and obtain your consent to the changes if required by law.

Appendix E – Dubai International Financial Centre (DIFC) Supplemental Notice

This Addendum applies to Candidates whose personal data is processed by a Morningstar entity established in the Dubai International Financial Centre ( DIFC ), or whose personal data is otherwise subject to the Data Protection Law, DIFC Law No. 5 of 2020 (the DIFC DP Law ).

1. Supervisory Authority

For DIFC Candidates, the relevant supervisory authority is the DIFC Commissioner of Data Protection. If you wish to exercise your right to lodge a complaint, you may contact the Commissioner at: commissioner@dp.difc.ae or via the DIFC’s website at: https://www.difc.ae/business/operating/data-protection/

2. International Transfers

Where your personal data is transferred outside the DIFC to a jurisdiction that does not ensure an adequate level of protection as is provided under the DIFC DP Law, Morningstar will ensure appropriate safeguards are in place, which may include the use of DIFC standard contractual clauses approved by the Commissioner, Binding Corporate Rules, or other lawful transfer mechanisms.

The Commissioner maintains a list of adequate jurisdictions, which includes the EEA member states, the UK, and certain other jurisdictions. You may request information on the applicable transfer mechanism by contacting us.

3. Use of AI and Automated Systems

Where AI tools or automated systems are used in our recruitment processes, we take steps to comply with the obligations of the DIFC DP Law. This includes providing you with notice of any technology that processes your personal data autonomously (i.e., not human-initiated, controlled or directed), the purposes for which such processing occurs, and any impact on your ability to exercise your data protection rights. You may request information about: (a) how the AI system operates and the principles on which it has been designed; (b) the output generated by the system and how it is used; (c) any safeguards built into the system to ensure compliance with data protection requirements; and (d) how you can access your personal data processed by such systems. We ensure meaningful human review of any AI-assisted decisions that produce legal or similarly significant effects concerning you.

4. Additional Rights Under DIFC DP Law

In addition to the rights set out in Section 11 of this Candidate Notice, DIFC Candidates have a right to non-discrimination, meaning Morningstar will not discriminate against you for exercising your data protection rights, including by denying goods or services, charging different prices, or providing a less favourable level of service.

To exercise your rights under the DIFC DP Law, contact us at privacyenquiries@morningstar.com or at AskHR@morningstar.com .

Appendix F – Japan Supplemental Notice

This notice applies to any job applicants who are residents in Japan, and whose personal data is subject to the Act on the Protection of Personal Information (APPI), and as amended from time to time.

1. Compliance with the APPI

To the extent this notice applies, we will process your personal data in accordance with the APPI and any other applicable laws and guidelines.

2. Data sharing within Morningstar (Joint Use Notice)

We may, in accordance with Article 27, paragraph 5, item 3 of the APPI, jointly use your personal data within Morningstar group companies to the extent necessary to achieve the purposes of use set forth in Section 4 "Why Do We Collect Personal Data?" The scope of joint users includes Morningstar, Inc. and its affiliates and subsidiaries. The categories of personal information subject to joint use are as described in Section 2 “What Personal Data Do We Collect, Use and/or Process?” The entity responsible for the management of the jointly used personal information is:

Morningstar Japan Inc. / Ibbotson Associates Japan Inc.
Hibiya Building 6F
1-1-1, Shinbashi, Minato-Ku
Tokyo, 105-0004
Japan

3. Cross-border Transfers of Personal Data

Where your personal data is provided to recipients located outside Japan, the EEA member states or the UK, Morningstar will (i) ensure that such recipients continuously implement data protection measures equivalent to those required, and (ii) upon request, provide information regarding the foreign country in which the recipient is located, including information on the personal information protection system of such country, and the protective measures taken by the recipient, in accordance with Article 28, paragraph 3 of the APPI.

4. Contact Us

If you have questions or concerns about this notice or our information practices, or if you wish to exercise your data subject rights, please contact us at privacyenquiries@morningstar.com .

Appendix G – Hong Kong Supplemental Notice

This Appendix supplements the main body of this Candidate Notice and applies to Candidates who are residents in Hong Kong or applying for positions in Hong Kong or whose personal data is otherwise subject to the Personal Data (Privacy) Ordinance. In the event of any inconsistency between this Appendix and the main body of the Candidate Notice, this Appendix shall prevail.

1. Mandatory information for you to provide

Where required by law, we will indicate (for example, with an * on a form) where it is mandatory for you to provide your personal data. If you do not provide that mandatory information, we may not be able to consider your application or advance to complete your hiring process.

2. Legal basis for processing

In addition to the legal bases for processing set out in Sections 4 and 5 of the main body of this Candidate Notice, where required or permitted to do so by applicable law, we will rely on your consent or other statutory bases to process your personal data for the purposes.

3. Exercising your privacy rights

To exercise your rights regarding your personal data, you may submit a request either as described in Section 10(B) of the main body of this Candidate Notice, or by contacting our Privacy Office at privacyenquiries@morningstar.com .

4. Changes to the Candidate Notice

Where required by applicable law, we will obtain your consent to changes to this Candidate Notice (including this Appendix) when we update it.

Appendix H – Singapore Supplemental Notice

This Appendix supplements the main body of this Candidate Notice and applies to Candidates who are residents in Singapore or applying for positions in Singapore or whose personal data is otherwise subject to the Personal Data Protection Act 2012. In the event of any inconsistency between this Appendix and the main body of the Candidate Notice, this Appendix shall prevail.

1. Personal Data related to another individual

If you provide personal data related to another individual to us (such as a reference or dependents), you confirm that you are entitled to do so and have informed them that their personal data may be processed by us in accordance with this Candidate Notice and obtained their consent to such processing.

2. Legal basis for processing

3. Right to know/access

In addition to the right to request access to any of your personal data that Morningstar may hold (subject to certain exemptions), you may have the right to request information about how we process your personal data, specifically information about the ways in which we may have used or disclosed your personal data during the past year.

4. Changes to the Candidate Notice

Where required by applicable law, we will obtain your consent to changes to this Candidate Notice (including this Appendix) when we update it.

Appendix I – South Africa Supplemental Notice

This Candidate Notice applies to any Candidates where the processing of their personal data is subject to South Africa's Protection of Personal Information Act, 2013, as amended from time to time ( POPIA ).

Where this Candidate Notice applies to Candidates whose personal data is subject to POPIA reference to "personal data" shall include personal information as defined in POPIA, reference to "controller" shall include a responsible party as defined in POPIA, reference to "Supervisory Authority" shall include the Information Regulator in South Africa and reference to "special categories of data/sensitive data" shall include special personal information as defined in POPIA.

When exercising the Right to Complain to the Supervisory Authority in South Africa, the contact details for the Information Regulator in South Africa are as follows:

Woodmead North Office Park
54 Maxwell Drive
Woodmead
Johannesburg;

P.O Box 31533
Braamfontein
Johannesburg
2017
South Africa

Email address: POPIAComplaints@inforegulator.org.za

If you are a data subject whose processing of personal data is subject to POPIA, the contact details for the information officer of the controller / responsible party are as follows:

Email: privacyenquiries@morningstar.com

Address: Morningstar Investment Management South Africa (Pty) Ltd
5th Floor, 20 Vineyard Road
Claremont
Cape Town 7708