BlackRock Privacy Notice
Last revised: 1 March 2025
Introduction
BlackRock is committed to safeguarding and processing personal information (“PI”), including sensitive personal information (“SPI”)1, in line with all applicable privacy and data protection laws. Many of our offices are located in countries with laws governing the processing of PI. “BlackRock”, “we”, “us” or “our” means BlackRock, Inc., each of the direct or indirect subsidiaries of BlackRock, Inc. (the “BlackRock Group”) and BlackRock managed products. BlackRock, Inc., BlackRock Group functions and the entity you contract with are the controllers of your PI. Where we process your PI without a contract with you, the controller is the entity providing you with this Privacy Notice.
References to “you” or “your” refers to individuals whose PI is processed by BlackRock, including individual investors, individuals in the alternative business industry, client employees, officers or agents (together “Representatives”) with direct or indirect relationships (such as those who invest through an intermediary); and beneficial owners of an organization or entity in connection with:
- the provision of services to potential and actual clients;
- transactions to which we are party (including those which we effect on behalf of clients); or
- services provided to us by a third-party vendor.
If your contract is with the BlackRock Group, the BlackRock entity you contract with will be the controller of your PI. If you are an investor in a BlackRock managed product, the associated BlackRock management company and the managed product, if a separate legal entity, will be separate controllers. This privacy notice applies to your relationship with BlackRock.
This Privacy Notice sets out the purposes for which we collect, use, and disclose (collectively “Processing”) PI and how it is protected. It also sets outs individuals’ rights in relation to the processing of their PI.
There may be additional terms, conditions and commitments that also govern how we collect, use and disclose your PI, which should be read in conjunction with this Privacy Notice.
PI we collect about you
PI is information relating to an individual, which can be used either alone or with other sources of information to identify that individual. PI does not include information where the identity of the individual or the specific detail of the information has been removed and is therefore non-attributable. Depending on your jurisdiction, SPI is a sub-category of PI that may include PI relating to race or ethnicity, government identifiers, geolocation information, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about health and genetic and biometric data, among others.
The nature of the information that we collect will depend on the services provided, applicable laws and our relationship with you. We categorize the PI we may process as follows (the PI listed for each category are non-exhaustive examples):
- Identification data
Full name, title, gender, marital status, date of birth, passport number, driving license number, national identification number, signature.
- Contact data
Personal address, telephone number, email address.
- Electronic Monitoring data
To the extent permitted by law, we may record and monitor your electronic communications with us, including telephone conversations, email, instant messaging and any other electronic communications.
- Financial data
Account number, client reference number; account statements, investment history.
- Marketing, Behavioral and Communications data
Marketing and communication preferences; information about your use of our websites, our portals and platforms as explained in our Cookie Notice.
- Professional Information data
Firm name, position/job title, work and education history, business address, business telephone number, business email address, B2B social media ID (e.g., LinkedIn profile URL, WeChat ID).
- Profile and Interaction data
Username and password for our online services that you have access to, investments made by you, services requested, as well as participation information and marketing communications in connection with survey responses, e-mail campaigns, chat bot interactions and social media advertisement.
- Services data
Payment details to and from you, details of services you have provided to us, or we have provided to you.
- BlackRock Building and Assets Security data
Records of visits to our premises, CCTV recordings.
- Technical data
Your use of and interaction with our online services, your IP address browser type and version, browser plug in types, geographic location, language, access time, referring website and versions operating system.
- SPI
In limited circumstances we may collect information about criminal convictions and offences, when legally required; dietary requirements, if we are arranging catering; disability, to make reasonable accommodations for you in our buildings; political affiliations, for us to determine whether you are a politically exposed person. Additionally, some of the other information described above may be considered “sensitive” under certain laws. We do not use or disclose SPI for purposes other than those permitted by relevant laws.
We collect PI in relation to you in several ways, including:
- Directly from you when provided to us, for example in connection with a BlackRock product or service; such as a completed investment application form.
- If you are Representative of an organization or entity that is a client or vendor of BlackRock, and that organization or entity provides us with your PI.
- Throughout the course of our relationship with you or your employer, including where you change your details, provide additional PI, or where the services we are providing to you change.
- From documentation we receive in the course of our relationship with from a General Partner or Limited Partner of the company you are engaged with.
- From public sources such as company corporate websites or social media (in particular LinkedIn), regulatory filings and news, including where you have been interacting with us via social media or where you have been notified that your PI is considered for talent acquisition purposes, including via public profiles on social media.
- From e-mail or advertising campaigns and surveys.
- From other BlackRock Group entities or third parties such as credit reference agencies and data brokers.
- From visits to our websites, use of our chat bots or through logging into any of our online services (including by cookies or other tracking tools).
- From attending in-person or virtual events or trainings organized or co-sponsored by BlackRock..
We may also create or derive PI such as creating records of your interactions with us, subject to applicable law.
Unless we otherwise indicate that the provision of specific PI is optional, any PI we request is necessary for us to provide you or your organization or entity with the products and services requested. If you do not provide the PI requested, we may not be able to provide those products and services.
Purpose and legal basis for processing your PI
The below table sets out the purposes and basis for which we process PI.
Processing Purpose
|
Category of PI
|
Basis of Processing
|
To consider opening an account, or entering into a relationship at your request (including preparation steps such as answering queries prior to entering into a contractual relationship), including performing anti-money laundering, anti-terrorism, sanction screening, fraud and other due diligence checks
|
· Identification data
· Contact data
· Electronic Monitoring data
· Financial data
· Professional Information data
· Services data
· SPI
|
· Performance of a contract
· Legal or regulatory obligation
· Legitimate interests: ensuring we do not accept the proceeds of criminal activities or assist in fraudulent or any unlawful activities, such as terrorism
|
To deliver the services you have requested, including liaising with third parties (e.g., brokers for the purposes of executing transactions) and to provide access to our technology solutions services (e.g., Aladdin)
|
· Identification data
· Contact data
· Electronic Monitoring data
· Financial data
· Profile and Interaction data
· Services data
· Technical data
· Marketing, Behavioral and Communications data
· Professional Information data
|
· Performance of a contract
· Legal or regulatory obligation
· Legitimate interests: ensuring that you are provided with the best client services and visitor services we can offer, and securing a prompt payment of any fees, costs and debts in respect of our services
|
To manage payments, fees, and charges and to collect and recover money owed to us
|
· Identification data
· Contact data
· Financial data
· Professional Information data
· Services data
|
· Performance of a contract
· Legitimate interests: ensuring we can manage payments, fees and charges and to collect and recover money owed to us
|
To interact with you (e.g. upon your request to answer questions you submit online)
|
· Identification data
· Contact data
· Profile and Interaction data
· Professional Information data
|
· Legitimate interests: ensuring that you are provided with the best client services and visitor services we can offer
|
To manage our relationship with you which will include notifying you about changes to our terms of business or this privacy notice
|
· Identification data
· Contact data
· Electronic Monitoring data
· Profile and Interaction data
· Marketing, Behavioral and Communications data
· Professional Information data
|
· Performance of a contract
· Legal or regulatory obligation
· Legitimate interests: ensuring that you are provided with the best client services we can offer
|
To interact with governmental or regulatory bodies or other competent national authorities
|
· Identification data
· Contact data
· Electronic Monitoring data
· Financial data
· Services data
· Professional Information data
|
· Legal or regulatory obligation
· Public interest
. Legitimate interests: protecting BlackRock’s interest to comply with governmental and regulatory body requests
|
To detect or prevent fraud and/or other criminal activity and to protect our employees and assets
|
· Identification data
· BlackRock Building and Assets Security data
· Contact data
· Electronic Monitoring data
· Financial data
· Professional Information data
· Profile and Interaction data
· Services data
· Technical data
|
· Legal or regulatory obligation
· Public interest
· Legitimate interests: protecting BlackRock and client assets, detecting, and protecting against breaches of our policies and applicable laws protecting BlackRock employees
|
To manage and protect our business, including improving data security, troubleshooting data and systems, system maintenance and testing, data hosting, managing our offices and other facilities
|
· Identification data
· Contact data
· Electronic Monitoring data
· Profile and Interaction data
· Technical data
· Marketing, Behavioral and Communications data
· Professional Information data
|
· Legal or regulatory obligation
· Legitimate interests: ensuring the efficient and secure running of our business, including through office and facilities administration, maintaining information technology services, network and data security and fraud prevention
|
To manage and improve our products and services with relevant and up-to-date information
|
· Identification data
· Professional Information data
· Profile and Interaction data
· Marketing, Behavioral and Communications data
|
. Consent
. Legitimate interests: ensuring to provide up-to-date products in highest quality to our clients
|
To invite you to take part in market insight or other events, or client seminars or similar, and to manage your participation in them
|
· Identification data
· Contact data
· Profile and Interaction data
· Technical data
· Marketing, Behavioral and Communications data
· Professional Information data
|
· Consent
· Legitimate interests: ensuring our client records are up to date, promoting our client services, receiving feedback, improving our services, identifying ways to expand our business
|
To send you marketing communications and service updates (including by paper and electronic channels and personalization in authenticated instances (i.e. within your respective online environment when you are logged in as a user)) and to better understand our marketing outreach and how our websites and platforms are used and to improve user experience.
|
· Identification data
· Contact data
· Profile and Interaction data
· Technical data
· Marketing, Behavioral and Communications data
· Professional Information data
|
· Consent
· Legitimate interests: reviewing how clients use, and what they think of, our services, identifying ways to improve and expand our business
|
In relation to vendor services:
Purpose and/or activity
|
Type of data
|
Legal basis for processing
|
To engage you or the organization or entity you work for as a new supplier, including performing anti-money laundering, anti-terrorism, sanctions, fraud, and other background checks
|
· Identification data
· Contact data
· Electronic Communications data
· Financial data
· Services data
· Professional Information data
|
· Performance of a contract
· Legal or regulatory obligation
· Legitimate interests: ensuring we do not deal with proceeds of criminal activities or assist in any other unlawful or fraudulent activities for example terrorism
· Public interest
|
To manage payments, fees, and charges and to collect and recover money owed to us
|
· Identification data
· Contact data
· Financial data
· Professional Information data
· Services data
|
· Performance of a contract
· Legitimate interests: ensuring we can manage payments, fees, and charges; to collect and recover money owed to us
|
Where we provide you access to our systems we need to manage and protect our business, including improving data security, troubleshooting data and systems, system maintenance and testing, and data hosting
|
· Identification data
· Contact data
· Profile and Interaction data
· Technical data
|
· Legal or regulatory obligation
· Legitimate interests: ensuring the efficient and secure running of our business, including maintaining information technology services, network, and data security
|
To whom we disclose your PI
In connection with one or more of the purposes outlined in the section ‘Purpose and Legal basis for processing your PI’ above, we may disclose PI in any jurisdiction to:
- other members of the BlackRock Group;
- professional advisors, third parties, agents or independent contractors that provide services to any member of the BlackRock Group (such as IT systems providers, data analysis providers, platform providers, financial advisors, brokers, consultants (including lawyers and accountants));
- goods and services providers (such as providers of marketing, payment and billing services or debt collection agencies where we are permitted to disclose your personal information to them), intermediaries, brokers, and other individuals and entities that partner with us;
- customers and partners (including investors, fund managers, service providers, and advisors in the alternative assets industry) that have subscribed to specific services offered by any member of the BlackRock Group (e.g. data base services);
- competent authorities (including any national and/or international regulatory or enforcement body, agency, court or other form of tribunal or tax authority) or their agents where BlackRock is required or allowed to do so under applicable law or regulation;
- a potential buyer, transferee, merger partner or seller and their advisers in connection with an actual or potential transfer or merger of part or all of BlackRock’s business or assets, or any associated rights or interests, or to acquire a business or enter into a merger with it;
- credit reference agencies or other organizations that help us to conduct anti-money laundering and anti-terrorist financing checks and to detect fraud and other potential criminal activity; and
- any person to whom disclosure is allowed or required by local or foreign law, regulation, or any other applicable instrument.
International transfers and transfers to service providers
To provide global services and in the course of running our business, we may transfer PI to a location outside of the country where you reside or where services are provided to you or the organization or entity you work for, including BlackRock processing and/or research centers in Europe, USA, India, Philippines and Singapore. Although the country to which PI may be transferred may not have the same level of privacy and data protection laws, we apply the same level of security and organizational controls to the processing of PI wherever it is processed. We require by contract that our third-party service providers processing PI on our behalf to comply with BlackRock’s criteria for PI processing.
If we transfer PI out of the EEA, we ensure a similar level of protection for your PI by ensuring the country to which the PI is transferred is considered by the EU Commission to provide an adequate level of protection or putting in place contractual clauses the EU Commission consider provide the same level of protection.
Marketing and exercising your right to opt-out of marketing emails and Personalization
In certain jurisdictions, you will need to expressly consent to receive marketing emails. If you are an authenticated user on our websites and platform, we may provide you with a personalized experience based on your user behaviour.
In all jurisdictions, you can choose not to receive such communications at any time by clicking on marketing opt-out links in any electronic marketing materials we send you, by making a request to your usual BlackRock contact, by using the contact details set out in the “Contacting Us” section of this Privacy Notice, or, in relation to certain third party advertisements, by exercising your rights related to cookies as explained in our Cookie Notice.
Third-party marketing/sale of PI
Some entities in the BlackRock Group may sell certain PI. For example, Preqin sells Identification data; Contact data; and Professional Information data to its customers who subscribe to certain of our databases for their own purposes, including marketing. We also share for targeted advertising or cross-context behavioral advertising purposes the following categories of PI to advertising networks and social media networks: Profile and Interaction data; Technical data; and Marketing, Behavioral and Communications data. We do not knowingly sell or share personal information of individuals under 16 years of age.
Because of certain of these activities, Preqin, a BlackRock Group member, is a data broker under Texas law. To conduct business in Texas, a data broker must register with the Texas Secretary of State (Texas SOS). Information about data broker registrants is available on the Texas SOS website at https://www.sos.state.tx.us/index.shtml.
You will find information on your right to opt-out from such processing in the section “Your rights”.
PI retention
We will process your PI for as long as is necessary to fulfil the purpose for which it was collected or to comply with legal, regulatory, accounting, reporting, internal policy requirements or for the establishment or defense of legal claims.
PI security
We use a range of physical, electronic, and managerial measures designed to ensure a level of security appropriate to the risk of PI processing. These measures may include:
- education and training of relevant staff to ensure they are aware of our privacy obligations when processing PI as well as training around social engineering, phishing, spear phishing, and password risks;
- the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
- the ability to restore the availability and access to PI in a timely manner in the event of a physical or technical incident;
- administrative and technical controls to restrict access to PI;
- technological security measures, including fire walls, encryption (industry standard SSL encryption with 128-bit key lengths), and anti-virus software;
- physical security measures, such building access controls;
- external technical assessments, security audits and vendor due diligence;
- perimeter security;
- segregation of networks;
- application security;
- endpoint security;
- real-time monitoring of data leakage controls;
- layered and comprehensive cybersecurity defences; and
- security incident reporting and management.
The security of data transmitted over the internet (including by e-mail) cannot be guaranteed and carries the risk of access and interception. You should not send us any PI by open/unsecure channels over the internet. We endeavour to protect PI but cannot guarantee the security of data transmitted to us or by us.
Your rights
In certain circumstances you may have the following rights in relation to the processing of your PI:
- Know or Access
To request a copy of the PI we process in relation to you and to be informed about how we collect, use and share your PI.
- Object
To object to the processing of your PI if (i) we are processing your PI on the grounds of legitimate interests or for the performance of a task in the public interest (including profiling); or (ii) if we are processing your PI for direct marketing purposes.
- Opt Out
Depending on the laws of your jurisdiction, to opt out of sales or sharing of your PI including for cross-context behavioral advertising or targeted advertising.
- To opt out of sharing for such advertising purposes through the BlackRock website, you may do so by selecting “Manage Cookies” below and toggling off Marketing/Tracking/Profiling Cookies.
- To opt out of all other sales, please email us at GroupPrivacy@BlackRock.com.
- Withdrawal
To withdraw your consent you have provided at any time. The withdrawal of consent does not affect the lawfulness of processing of your PI based on consent before the withdrawal.
- Correction
To request that we update the PI we process in relation to you, or to correct PI that you think is incorrect or incomplete.
- Erasure
To ask that we delete PI that we process in relation to you where we do not have a legal or regulatory obligation or other valid reason to continue to process it.
- Restriction
To request that we restrict the way in which we process your PI, for example, if you dispute the accuracy of your PI or have raised an objection which is under consideration.
- Portability
To request a copy of your PI that you have provided to us in a commonly used electronic format such as through the completion of an application form.
- Automated decision making
To request manual intervention if you are subject to automated decisions where the decision results in a legal or similar effect to you.
You may exercise your rights at any time by emailing GroupPrivacy@BlackRock.com or using the details set out in the Contacting us section.
To the extent permitted by applicable law or regulation we reserve the right to charge an appropriate fee in connection with you exercising your rights.
We may need to request specific information from you to help us confirm your identity and ensure your right to access to the PI requested, or to exercise any of your other rights. This is to ensure that PI is not disclosed to any person who does not have authority to receive it. We may also request further information in relation to your request to help us to locate the PI processed in relation to you, including, for example, the nature and location of your relationship with us.
We will respond to all legitimate requests in line with the timescales set out in applicable law.
Depending on the laws of your jurisdiction, you may designate an authorized agent to submit a request on your behalf either in writing or through a power of attorney. Before processing your request, we will require the authorized agent to provide written proof of authorization and may require you to verify your own identity and confirm your authorization directly with us.
You will not be disadvantaged in any way by exercising your rights in relation to the processing of your PI.
Under certain U.S. laws, certain members of the BlackRock Group are required to disclose metrics related to how they have responded to rights requests under applicable privacy laws. These metrics are as follows:
|
Received
|
Complied with in Whole or in Part
|
Denied
|
Median Days to Respond
|
Mean Days to Respond
|
Requests to delete personal information
|
0
|
0
|
0
|
0
|
0
|
Requests to know or access personal information
|
0
|
0
|
0
|
0
|
0
|
Requests to know what personal information was sold or shared and to whom
|
0
|
0
|
0
|
0
|
0
|
Requests to opt out of sale or sharing of personal information
|
0
|
0
|
0
|
0
|
0
|
Requests to limit the use and disclosure of sensitive personal information.
|
0
|
0
|
0
|
0
|
0
|
Contacting us
The Global Head of Privacy and Data Protection oversees compliance with privacy and data protection at BlackRock. If you wish to exercise any of your rights, or have questions concerning this notice, please contact:
The Global Head of Privacy and Data Protection
BlackRock
12 Throgmorton Avenue
London
EC2N 2DL
Email: GroupPrivacy@BlackRock.com
If you are a resident of certain U.S. states, you may also call us on +1 855 371 0019 or submitting a request through our Contact Us page.
Complaints
If you have any concerns or complaints about the way your PI is processed, please contact the Global Head of Privacy and Data Protection at GroupPrivacy@BlackRock.com. You may also have a right to complain to a data protection or other competent authority with jurisdiction over privacy and data protection law in the country you live or work, or in the country where you believe an issue in relation to the processing of your PI has arisen.
Depending on the laws of your jurisdiction, you may also appeal our decision related to your rights request where you believe we have not reasonably fulfilled your request. To submit an appeal, please email GroupPrivacy@BlackRock.com with the subject “Appeal.”
Cookie Notice
Please see our separate Cookie Notice.
Linked websites
This Privacy Notice is not applicable to third party websites that we do not own or control, or to any third-party website where BlackRock advertisements are displayed.
Changes to this Privacy Notice
We may modify or amend this Privacy Notice from time to time and you are advised to visit our website regularly to check for any amendments. Any material changes will be communicated to you through an appropriate channel, depending on how we normally communicate with you.
1 Please note not all privacy laws define SPI, for example Hong Kong, Singapore and Canada.