30 March 2021
This Data Privacy Statement is intended to describe the practices EY follows in relation to the Global Recruitment Management system (“system”) with respect to the privacy of all users of the system.
At EY, we have focused on implementing fair information practices that are designed to protect your privacy and your personal information. We believe that everyone benefits from the free flow of information when that information is gathered and used responsibly. Therefore, EY has set itself the task of providing you with comprehensive information about how we will use your personal information within this system and to inform you about your rights in this regard.
If you have any questions regarding the processing of your personal information in the system, please contact the EY data protection team.
This section explains how your personal information will be used when you submit information into the system.
The provision of your personal information is optional at any time. However, please be aware that your refusal to provide us with your personal information or to process it in the system may result in the data controller not being able to carry out any activity related to your recruitment in this online environment. You have the option to send your application directly to an EY recruiter within your country. You can contact the EY recruiter directly by e-mail or by telephone. The relevant contacts to all EY member firms can be found here.
The data controller for your personal information is the EY member firm which is responsible for the advertised position and to whom you address your application. Details of the EY member firm responsible for your application can be found in our Careers site on EY.com.
It is possible that EY member firms may be jointly responsible for your personal information if you submit applications to multiple EY member firms via the system.
Our purpose for processing your personal information is to assess your suitability for a role you have applied for, to contact you for future potential roles that might be of interest to you and to help us develop and improve our recruitment process.
The lawful basis we rely on for processing your personal data in the context of the role you have applied for is article 6(1)(b) of the EU General Data Protection Regulation (GDPR), which relates to processing necessary to perform a contract or to take steps at your request, before entering a contract.
The lawful basis we rely on for processing your personal data in the context of future roles that might be of interest to you is article 6(1)(a) of the GDPR, which relates to processing for which you have given consent. Please email us if you would like to withdraw your consent.
If you provide us with any information about reasonable adjustments you require – for example under the UK Equality Act 2010 - the lawful basis we rely on for processing this information is article 6(1)(c) GDPR to comply with our legal obligations.
The lawful basis we rely on to process any information you provide as part of your application which is special category data, such as health, religious or ethnicity information is article 9(2)(b) of the GDPR, which relates to our obligations in employment and the safeguarding of your fundamental rights.
EY Global Services Limited ("EYGS"), a private company limited by shares in England and Wales, registered office, 6 More London Place, London SE1 2DA, United Kingdom, registered number 5483856, licenses the system from Taleo Corporation, 4140 Dublin Boulevard Suite 400, Dublin, California 94568 (“Taleo”). Taleo manages the system on behalf of EYGS for the benefit of EY member firms globally. The servers which host the system are owned by Taleo and situated in the United States of America. Taleo has certified to the EU-US Privacy Shield Framework administered by the US Department of Commerce which provides organisations a mechanism to comply with EU data protection requirements when transferring personal data from the European Union to the United States.
The information you provide in the system may be shared by EYGS for recruitment purposes with one or more EY member firms located throughout the world (see the 'Why do we need your personal information?' section below). EYGS is acting as a joint data controller with each EY member firm which advertises a position on the Careers site of EY.com.
Access to your personal information is limited by need. All recruitment staff within the EY member firms worldwide have access to your profile on the database and are able to match your details to current and future vacancies.
Oracle can access your personal information as is necessary to perform its functions but may not share any information without first obtaining permission from EYGS. Tata Consultancy Services (TCS) located in India and Mexico will also have access to the Tool in order to provide system support services.
IBM located in Canada, China, Czech Republic, Hungary, India, Malaysia, Mexico, Oceania, Philippines, Poland, UK and US will also have access to the Tool for the purposes of providing IT system support.
From time to time, in addition to Oracle, TCS and IBM, we may need to share your personal information with other third parties (see for an example, the section on “IBM Watson” below). However, we will only disclose your personal details for the following reasons:
- When it is necessary to involve a third party service provider in order to facilitate or extend recruitment services.
- When it is necessary for (internal or external) auditors to audit our recruitment services.
- When explicitly requested by you.
- As required by a court order or any other legal or regulatory requirement.
We take appropriate security and legal precautions to safeguard the safety and integrity of personal data that is transferred within the EY organization. EY has implemented binding corporate rules (BCRs) that allow for global transfers within the EY organization of personal data originating in the EEA in accordance with applicable European privacy laws. The BCRs require all EY entities worldwide to use the same standards of protection for personal data.
You can access our BCRs here.
Ernst & Young LLP, US, and its affiliated US entities, adheres to the EU-US and Swiss-US Privacy Shield Frameworks published by the US Department of Commerce. To learn more, see Ernst & Young LLP’s Privacy Shield Data Privacy Statement.
To the extent your personal information originating from the European Economic Area (EEA) or Switzerland is transferred to Oracle, TCS and IBM locations outside the EEA or Switzerland that have not received a binding adequacy decision by the European Commission or by a competent national data protection authority, such transfers are subject to terms of the EU model clauses approved by the European Commission which apply to the agreement between EYGS and Oracle, EYGS and TCS and EYGS to IBM.
You have a responsibility to ensure you submit accurate information into the system and keep it up to date. This can be done via the "Candidate Profile". The Candidate Profile requires a valid e-mail address as a login, along with other information, some of which is mandatory. Mandatory information will be marked accordingly. Your email address allows us to communicate with you if your qualifications and/or preferences match job opportunities, or if you opt to receive automated notifications of job postings at any EY member firm.
Your Candidate Profile also makes it possible for you to access the system to monitor the progress of your application or to amend your personal details should you wish to do so.
If you wish to apply for a job in a country outside of your home country, we may need to ask you questions that are specific to the country where the job is located. This is because in certain countries, before we can offer someone a job, we have to ask certain additional questions. These questions will be relevant and necessary for the job advertised and consistent with EY's Values.
When applying for a job in Poland, your agreement and consent is obtained in accordance with Polish Data Protection Act, from 29 August 1997, about personal data protection Dz. U. Nr 133, poz. 883.
When applying for a job in Peru your agreement and consent is obtained in accordance in accordance with article 12 of Law N° 29733 Personal Data Protection. Further information can be found by accessing this web page.
When applying for a job in Mexico your agreement and consent is obtained in accordance with the Federal Law for Protection of Personal Data in Possession of the Private Sector from July 6, 2010 about personal data protection. Further information can be found by accessing the following web page www.ey.com/mx.
When applying for a job in Colombia, your agreement and consent will be obtained under applicable Data Protection regulations. You are not forced to answer questions related to the special category data. For further information please consult our local Data Protection Policy.
When applying for a job in Malaysia, your agreement and consent is obtained in accordance with the Personal Data Protection Act 2010 (Act 709). Further information can be found by accessing this web page.
1. Purposes for which personal information will be used
Applicant's personal information will be used only within the scope of the following purposes:
- Announcing, and receiving applications for, various seminars and other events related to hiring
- Screening applicants for hiring
- Contacting applicants regarding, and handling administrative affairs related to, the screening of applicants for hiring
- Statistical analysis for future hiring activities
- In cases of applicants who have been hired, the following purposes after commencement of their employment
- Audit and other assurance activities, advisory activities, risk management and control related activities, transaction service related activities, and other various service activities
- Announcement of, and activities involved in the operation of, various seminars and study meetings
- Personnel affairs, accounting, and other management activities
- Internal control activities, such as independency and quality control
2. Shared use of personal data within the EY member firms
Personal information provided by applicants will be stored in Taleo’s servers located in the U.S. and will be shared among the EY member firms (including those located in foreign countries), including EY Global Services Limited (UK), for the purposes listed in (1) above.
Person responsible for the management of shared personal data:
- Chairman, Ernst & Young ShinNihon LLC.
- Leader, Ernst & Young Tax Co.
- President, Ernst & Young Transaction Advisory Services Co., Ltd.
- Representatives, EY Advisory & Consulting Co., Ltd.
- President, EY Japan Co., Ltd.
Items of shared personal information: Name, e-mail address, address, telephone number, educational background, work experience, etc.
For the scope of the EY member firms, please visit this web page.
For the scope of the EY Japan member firms, please visit this web page.
3. Safety management of personal information
In order to prevent applicants’ personal information from being divulged or otherwise misused, we will handle such personal information safely under strict management in accordance with our “Policies on protecting personal information” and “Control Rules for the Protection of Personal Information.”
Personal information of those who are hired after screening for hiring will be appropriately managed as basic information after joining us. Personal information of those who are not hired will be disposed of or deleted appropriately after completion of the screening activities.
Taleo uses IBM Watson Recruitment Express (“IBM Watson”) to assist with the screening of candidates for jobs within EY. Your personal data will be processed by IBM Watson for the following purpose: to perform an artificial intelligence analysis and provide a suitability score to EY recruiters in relation to your job application. Although IBM Watson provides an automated recommendation based on a candidate’s suitability score, an EY recruiter is required to manually make the final decision about which candidates are successful.
EY Global Services Limited is the data controller and licenses IBM Watson from IBM Global Business Services, PO Box 41, North Harbour, Portsmouth, PO6 3AU, United Kingdom. IBM Watson is hosted on servers in Sterling, Virginia at a colocation facility (Cyxtera), Washington, D.C., and San Jose, California.
IBM Watson processes all of the categories of personal data that you add to the system. This includes any sensitive personal data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning sex life or sexual orientation to the extent that you may have added them to the system. This personal data will be retained only in line with EY business need. IBM Watson does not retain your personal data after the job opportunity is closed for applications and will only retain your personal data while the job opportunity is open for applications so that it can update your suitability score relative to other candidates. Your personal data is purged periodically based on the system’s data retention policy set out in the section entitled “Data Retention” of this Data Privacy Statement. Once the system is purged, your personal data will be removed from IBM Watson (even if the job opportunity remains open for applications). You may request for your personal data to be manually removed from IBM Watson at any given time.
Your personal data can be accessed by:
- third party IBM users who have access to EY’s instance of IBM Watson to provide technical support upon EY’s request; and
- internal EY Recruiters who process the suitability scores as part of the candidate screening process.
This processing is necessary for the purposes of the legitimate interests pursued by us (except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data). The specific legitimate interest pursued is: human resource management, including performance reviews and recruitment.
You may wish to forward an advertised job vacancy in the system to a friend. You can do this by clicking on the "SHARE" link which can be found in each job description. When you use this functionality, we may require your e-mail address and the e-mail address of the recipient, your friend. We collect this information so that we can forward the job description and your e-mail address to avoid the possibility of the information being treated as spam. In addition, when we contact your friend, he/she will be provided with full details of how their information will be used, specifically in relation to their rights and details of the EY Member Firm acting as a data controller, in line with this statement.
The policies and/or procedures for the retention of personal data in the system are:
For GDPR countries only:
You may of course ask to have your information deleted from the system at any time. Your personal data remains in the system as long as you have expressed interest in EY or until you have secured a position with EY. However, please note that your data will not be kept more than 18 months after the last contact with you. We will provide you the opportunity to re-opt in every 18 months. If you do not opt-in, your data will be removed from the system.
For some countries, a different retention period will be applied:
6 months: Germany & India
12 months: Austria, Switzerland, Sweden, Norway, Denmark, Iceland, Finland & the Netherlands
24 months: France
36 months: Albania, Bosnia & Herzegovina, Bulgaria, Croatia, Cyprus, Czech Republic, Estonia, Greece, Hungary, Kosovo, Latvia, Lithuania, FYR of Macedonia, Malta, Moldova, Montenegro, Poland, Romania, Serbia, Slovakia, Slovenia & Turkey
For all other countries:
You may of course ask to have your information deleted from the system at any time. Your information will remain in the system as long as you are actively pursuing positions with EY. However, your personal information will not be kept more than 36 months after the end of the application process. At that point, we may contact you to inform you that your details will be removed from the system unless you instruct us otherwise.
In the initial stages of the recruitment process, we do not seek to collect special categories personal information from you (this is also known as “sensitive personal information”). Special categories of personal information includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric data for the purpose of uniquely identifying a natural person, information concerning health, information concerning a natural person's sex life or sexual orientation and in some cases, social security numbers or financial information.
We may need to collect special categories of personal information from you at a later stage in the recruitment process if local employment laws or regulations require us to do so. To the extent you provide us with any special categories of personal information to support your application or as part of your personal profile, you agree that we may use this information in accordance with local applicable law or regulations and in line with this Data Privacy Statement.
Your Candidate Profile contains free-text boxes. If you provide us with personal details for your application or as part of your Candidate Profile, please do not include any special categories of personal information. If you provide us with this information, you agree that we may use this information in accordance with applicable local law or regulations and in line with this Data Privacy Statement.
If you provide any information in relation to third parties or referees, you are responsible for obtaining their consent and ensuring they are aware that their details will be forwarded to, and used by, the EY network.
EY does not collect or compile personal information obtained by this site for dissemination or sale to outside parties for consumer marketing purposes or host mailings on behalf of third parties.
You are legally entitled to request details of the personal information we hold about you. We provide you with the ability to make sure your personal information is accurate and up to date in the system through your Candidate Profile. You can request a copy of your personal information, or seek rectification, erasure or restriction of processing of your personal information by sending an e-mail to EY data protection team.
EY is committed to making sure that your personal information processed in the system is kept secure and has implemented accepted standards of technical measures and security policies that protect the information it has under its control from:
- Unauthorized access.
- Improper use or disclosure.
- Unauthorized modification.
- Unlawful destruction or accidental loss.
All EY personnel and any third parties which EY engages to process your personal information are obliged to respect the confidentiality of your information.
This site is not intended for use by children. We understand the importance of protecting children’s information, especially in an online environment, and we do not knowingly collect or maintain information about children.
EY may change this data privacy statement as needed. If changes to the statement are made, please note that it may take up to 30 business days before new privacy practices are implemented. Check this page periodically if you would like to monitor changes.
If you are concerned about an alleged breach of privacy law or any other regulation by EY, you can contact EY’s General Counsel’s office and/or EY’s Global Privacy Leader, 6 More London Place, London, SE1 2DA, United Kingdom or via EY data protection team. An EY Privacy Leader will be made available to investigate your complaint and give you information about how it will be handled.
If you are not satisfied with the way in which EY has resolved your complaint, you have the right to complain to the data protection authority in your country. You may also refer the matter to a court of competent jurisdiction.
Certain EY member firms in countries outside the European Union (EU) have appointed a representative in the EU to act on their behalf if, and when, they undertake data processing activities to which the EU General Data Protection Regulation (GDPR) applies. Further information and the contact details of these representatives are available here.