Effective Date: September 22, 2023

Last modified: June 28, 2024

 

 1. Introduction

Your privacy is important to us. The Goldman Sachs Office of Alumni Engagement (“OAE”) connects Goldman Sachs and its alumni through its global Alumni Network. The purpose of this privacy policy  (as updated from time-to-time, this “Privacy Policy”) is to explain how we use your personal data so that you understand what we do with it, why we use it, who we share it with, the circumstances in which we’ll share it, the steps we’ll take to keep it secure and your rights. When we use “we, “us,” or “our” we mean the OAE.

 

This Privacy Policy applies to personal data that the OAE collects, including through (i) the Alumni Network website, which is available at via gsalumninetwork.com (the “Website”); and (ii) the OAE’s provision of events, including marketing, networking, business development and charitable events, conferences and seminars (collectively, the “Services”). Goldman Sachs’ global entities and Goldman Sachs offer the Services and is the controller of your personal data.

Members of the Alumni Network (“Members”) may share their professional and biographical information with other Members through the Services. This Privacy Policy does not apply to, and we do not control, Members’ use of information and personal data that you make available through our Services.

 

Who this Privacy Policy applies to

This Privacy Policy applies to Members and all users of the Services. When we use “you” or “your” in this Privacy Policy, we mean you as a Member of the Alumni Network or as user of our Services. This Privacy Policy will continue to apply even if you stop using our Services.

 

California Notice at Collection

California residents have the right under the California Consumer Privacy Act ("CCPA") to receive notice of the collection, use, and disclosure of their personal information. The below links will take you to sections in this Privacy Policy which, together, constitute our Notice at Collection:

• The categories of personal information we collect;
• The purposes for which personal information are collected and used;
• Whether we sell or share, as defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”), personal information; and
• The criteria we use to determine how long to retain personal information.
   

2. How we collect personal data

We collect and process personal data in many different scenarios - these are described below.

 

We collect personal data when:

• You provide it to Goldman Sachs either during your employment, or after your employment ends.
• You provide it in connection with our Services.
• You access, view, or otherwise interact with the Website.
• You communicate with us (for example, by email, over the phone, through surveys, by post or through our social media platforms).
• You attend or register to attend our events.
• It is provided to us by an authorized third party.
• We view publicly available sources that contain information about you.

 

3. What personal data we collect, generate and use

The type of personal data we collect and generate may differ depending on your relationship with us and how you use our Services. The table below provides further details.

4. Why we use personal data
We use personal data for the following purposes and as otherwise described in this Privacy Policy or at the time of collection:

 

To provide our Services   
We use personal data to deliver an enhanced experience for our alumni through in-person connectivity, engagement and online community.

 

To meet our legal obligations
We use personal data to help us comply with the relevant laws and regulations that apply to us and Services, including laws and regulations which relate to:

•  complying with requests from public authorities, regulators, governmental bodies or law enforcement agencies, and investigating and preventing fraud and other crime; and

•  meeting our regulatory record keeping obligations.
 

When using personal data is necessary for our legitimate business interests
We use personal data where it is within our legitimate business interests to do so. The table below includes details of our legitimate interests to use personal data, but in each case we may have other legal reasons for using it, for example, to meet our legal obligations and to ensure appropriate documentation of compliance, to fulfil our rights or obligations under a contract, or to establish, exercise or defend our legal claims.

We have legitimate business interests to use personal data in connection with the following
Profile maintenance — to maintain a profile for you on our Website which may involve verifying your information.
Offering and providing our Services – to ensure the proper provision of the Alumni Network and other Services which support and connect our alumni and to keep appropriate records.
Managing our relationship with Members and related or connected parties – to compile and utilize internal reports and notes, manage Member files, allow you to access our Website and any other Services, and, where applicable, manage any agreement or arrangements between us and you.
Communicating with you — to communicate with you in person, by telephone, mail and email, keep records of our communications with you, and manage any complaints.
Carrying out operational and administrative functions – to carry out any administration, operate information technology systems, archive and back up data.
Helping us to improve our Services – to conduct market research and analysis of our Members and their preferences, evaluate potential new services, increase engagement with existing Services, evaluate the effectiveness of our communications, test new systems and upgrade existing systems
Prudently managing our business and protecting and enforcing our rights — to assess, monitor and manage financial,reputational and other risk, conduct audits of our Services, liaise with our regulator, protect data we use, establish and enforce our legal rights and defendagainst legal claims.
Prevention of crime – to protect you, us and third parties against fraud and crime, and to investigate circumstances of suspected fraud and crime.
Training – to help train our staff so that we can maintain the quality of our Services.
Risk management – to produce management information and reports to help us identify potential issues, and to ensure we are managing our risk appropriately. This includes assessing, monitoring and managing reputational and other risks, liaising with our regulators.

With consent
We may occasionally ask an individual for specific consent to process their personal data.
 

For other reasons
We may also process personal data for the establishment, exercise or defense of legal claims, where it is in the substantial public interest, or as otherwise permitted by law.
 

5. Emails – including your right to opt out
When we invite you to join the Alumni Network, you can choose not to receive certain email communications from us.
If you do choose to receive them, you can opt out at any time by logging into your account on the Website and changing your preferences, clicking the unsubscribe link in one of our emails or by calling our OAE team.
If you unsubscribe or ask us to stop sending you emails, it may take us a short period of time to update our systems to fulfil your request. During this brief period, you may continue to receive emails from us. 
 

6. Who we share personal data with and why
We share personal data only when it is lawful to do so and in accordance with this Privacy Policy.
Our Website enables other Members to view your profile and the content you choose to ‘like’ and ‘favorite’ (or similar action). Only Members of the Alumni Network can view your profile on the Website. The only information which we automatically display on your profile page is the first and last name you had while employed by Goldman Sachs, your preferred first and last name, your last office, last business, and your start year. We may give you the option to display additional information on your profile so that it can be visible to other Members. If you choose to display such information, you can change your mind at any time.
We share your personal data with third party service providers, who act on our instructions and on our behalf. Some third parties to whom we disclose personal data (i.e., companies outside the Goldman Sachs group) may process personal data in accordance with their own privacy policies and practices.

Members of the Alumni Network and recipients of your personal data may be located in countries all over the world (please see section 8 for further details).

The table below provides additional detail on why we share your personal data and who we share it with:

For other reasons
We may also share your personal data where it is in the substantial public interest, or as otherwise permitted by law.

We may share aggregated, anonymized, or de-identified information within and outside of the Goldman Sachs group of companies with partners such as research groups and data aggregators. Such information will not constitute your personal data.

 

7. Data Retention
We retain personal data for varying time periods depending on our relationship with you or your company and the status of that relationship. When determining how long to keep personal data, we take into account our legal and regulatory obligations and our legitimate interests (such as, preventing fraud, responding to regulatory, supervisory or ombudsmen enquiries, and establishing, exercising or defending legal claims, disputes or complaints).
 

8. Data Subject Rights
This section only applies to you to the extent that our processing of your personal data is subject to the GDPR or UK GDPR.

Data Subject Rights
If you have any questions about your rights or you wish to exercise any of your rights, please contact us using the contact details set out in the “Contact us” section below. You should understand that these rights do not apply in all circumstances and are subject to exceptions.

Access
You have the right to be provided with information about the personal data we have about you and details of how we use it, as well as the right to receive a copy of such personal data.

 

Rectification
You have the right to request that we rectify your personal data if it is incomplete or inaccurate. If your personal data changes, we encourage you to let us know or change the information yourself in your account profile. You can also ask us to update incorrect or incomplete information.

Erasure (right to be forgotten)
You have the right to request that we erase your personal data in certain circumstances. We may continue to store your personal data if we are entitled or required to retain it.

Restriction of processing
You can request that we restrict use of your personal data in certain circumstances. There may be situations where we are entitled to continue using your information and/or to refuse your request.

Data Portability
In certain circumstances, you may have the right to request a copy of the personal data that we hold about you in a commonly used format, so you can pass it to a third party, or, where technically possible, to have us transmit such data directly to a third party. You may have this right if we are using your data based on your consent or our contractual obligations with you and if we are using an automated method to process it.

Object
In certain cases, we use your personal data where it is necessary for our legitimate interests to do so (see section 4 for more information). When this is the case, you have the right to object to us using your personal data in this way. There may be situations where we are entitled to continue processing your personal data and/ or to refuse your request.

Withdrawal of consent
Where we rely upon your consent to use your personal data, you have the right to withdraw your consent at any time. This does not affect the lawfulness of the processing of your data carried out with your consent before the withdrawal. If you withdraw your consent, we may not be able to provide you with Services. If this applies to you, we will provide you with more information at the relevant time.

Complaints
If for any reason you’re not satisfied with our approach to using your personal data, you have the right to lodge a complaint with a supervisory authority in your country (if that is in the UK or EU Member State). If your complaint relates to Cayman Islands controllers, you may lodge a complaint with the Cayman Islands' data protection Ombudsman.


9. Transfers Outside of the UK and EEA
We may transfer personal data to jurisdictions whose data privacy laws are different than those in your country. For example, we rely on services provided to us by our group companies throughout the United States, United Kingdom, India and elsewhere. Some of our service providers may also process personal data in additional countries. In connection with any such transfer, we will comply with applicable data protection laws.

Where recipients of your personal data are located in countries that do not provide for the same level of data protection as considered adequate in your country, we take appropriate measures to ensure that your data is protected as required by applicable data protection laws.

For instance, where required, our service providers and Goldman Sachs group entities have entered into appropriate agreements on the basis of the EU and / or UK Standard Contractual Clauses and implemented supplementary safeguards to ensure a level of protection comparable to the protection in the European Union and / or UK (as applicable).

To find out more about our international data transfers and the measures we take to protect your personal data, please contact us using the contact details in Section 11.

10.  Security
The OAE takes the security of your personal data seriously and works to limit access to personal data to authorized employees, agents, contractors, or vendors. We also maintain physical, electronic and procedural safeguards designed to protect information while in our possession.

We encourage security professionals to practice responsible disclosure and let us know right away if a vulnerability is discovered on our Website. We will investigate all legitimate reports and follow up if more details are required. Goldman Sachs has engaged with HackerOne to manage all submissions. You can submit vulnerability reports at this link: https://hackerone.com/goldmansachs.

11.  Updates to this Privacy Policy
We may update this Privacy Policy without prior notice to you to reflect changes to our policies and practices. When we do, we will notify you of the changes by updating the date of the Privacy Policy and posting the revised version on our Website and providing such other notice as may be required by law.

12.  Contact Us
If you would like to exercise any data subject rights you may have under applicable law, please contact us at gs-privacy@gs.com.

In addition, you may learn more about how Goldman Sachs processes personal data in contexts other than the Alumni Network by viewing www.goldmansachs.com/privacy-and-cookies.

13. Additional information for California residents

California residents should be aware that this section does not apply to:

• Personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) and its implementing regulations, the California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994; or
• Other information subject to a California Consumer Privacy Act (CCPA) exception.

Collection and Use
In the past 12 months, we have disclosed each category of personal data listed in Section 3 ("What personal data we collect, generate and use") to one or more of the categories of recipients listed in Section 5 ("Who we share personal data with and why") for the business purposes listed in Section 4 ("Why we use personal data"). 

We may create, maintain, and use deidentified information of California residents, and if we do, we will not attempt to reidentify that information unless permitted by California law.

 

Your Rights
California residents have certain rights in relation to their personal data pursuant to the CCPA. These include the right to:

• Information about the personal data that we collect about you and the manner in which we use, process and disclose that information;
• Obtain the specific pieces of personal information that we have collected about you;
• Correct inaccurate personal information that we maintain about you;
• Delete certain personal information that we have collected about you; and
• Not be discriminated against as a result of exercising any of the aforementioned rights.

 

Although we collect certain categories of sensitive personal information as described in Section 3 (“What personal data we collect, generate and use"), we do not use sensitive personal information in ways that the CCPA permits you to limit.

Sale and Sharing
The CCPA requires that we describe disclosures of personal information where:

• We receive monetary or other valuable consideration (i.e., selling, as defined under the CCPA); or
• We disclose personal information about you through our Website to a third party for cross-context behavioral advertising (i.e., sharing, as defined under the CCPA).

We do not sell or share, and have not sold or shared in the preceding 12 months, personal information to third parties. We do not knowingly sell or share the personal information of minors under 16 years of age. Since we do not sell or share personal information, our Website is not designed to support the Global Privacy Control (GPC).

Exercising Your Rights
If you would like to discuss or exercise such rights to access, delete, or correct your personal information, please contact us via email at here or by phone at 1-844-930-0648.

The CCPA requires us to verify the requests we receive from you when you exercise certain of the rights listed above. To verify your request, we will check the information you provide us in your request against third party identity verification tools, as well as verify that any personal information relates to you. As part of this process, we may call you after you submit your request to verify information. You may also designate an authorized representative to exercise certain of the rights listed above on your behalf by providing the authorized representative with power of attorney pursuant to the California Probate Code or by executing other documentation we may require, and the representative may make the request on your behalf by following the instructions above. If an authorized representative submits a request on your behalf, we will contact you to verify that they represent you.

13. Cookie Notice

What are cookies?
Cookies are small data files that are placed on your computer or mobile device when you visit a website. Cookies are widely used by website owners in order to make their websites work, or to work more efficiently, as well as to provide aggregated reporting information. We use the term ‘cookies’ to include all technologies that work in a similar way.

Cookies set by a website owner (in this case, us) are called "first party cookies". Cookies set by parties other than the website owner are called "third party cookies". On the Website we only use first party cookies.

Why do we use cookies?
We use first party cookies for several reasons. Some cookies are required for technical reasons in order for the Website to operate. For example, if you want to access a secure area of Website we need to check you have authority to do so. Other cookies are required to make the Website function well in the way you would like it to. For example, we measure use of the Website to optimize it and we provide aggregated information about suspicious activity to other departments, to assess fraud and ensure your information is kept safe. We refer to these all as "strictly necessary" cookies.

Do you serve targeted advertising?
We do not currently serve targeted advertising to visitors of our Website.

How can you control cookies?
Because the only cookies we use are strictly necessary to provide the Website to you, you cannot refuse them. We do not use third party cookies, advertising cookies or social media cookies.

You can however set or amend your web browser controls to accept or refuse all cookies. If you choose to reject all cookies, you may still use our Website though your access to some functionality and areas of our Website will be restricted. As the means by which you can refuse cookies through your web browser controls vary from browser-to-browser, you should visit your browser's help menu for more information.

Do Not Track
Our Website does not respond to "Do Not Track" technology.

More Information
If you have other relationships with Goldman Sachs that are not covered by this Notice, please visit the Goldman Sachs Privacy and Cookies Website for more information about how your personal information is processed and to understand your rights and choices for those services.

14.     Contact us
If you would like to contact us regarding the processing of your personal data, please contact the Alumni Network at alumni@gs.com or our data protection officer at gs-privacy@gs.com or at the following addresses:
(i)           In the UK: the Office of the Data Protection Officer, Plumtree Court, 25 Shoe Lane, London EC4A 4AU, United Kingdom; or
(ii)          In the EU: the Office of the Data Protection Officer, Marienturm, Taunusanlage 9-10, 60329 Frankfurt am Main, Germany.