Privacy Policy – EY Entrepreneur Of The Year™ and EY World Entrepreneur Of The Year™ 2023

28 March 2023

Introduction

This Privacy Notice is intended to describe the practices EY follows for the EY Entrepreneur Of The Year (“EOY”) and the EY World Entrepreneur Of The Year (“WEOY”) programs (together the “Program”), with respect to the privacy of all individuals whose personal data is collected, processed and stored in the EY systems, judging management software, virtual event and networking platforms and videoconferencing technologies used to deliver the Program (together the “Tools”). For information on the Tools used in the Program, please see Appendix 1 to this Privacy Notice, contact your usual EY representative or email global.data.protection@ey.com.

Participants compete in the EOY program in their local markets. Each EOY Program culminates in the announcement of an overall national winner who goes on to compete for the EY World Entrepreneur Of The Year™ title and to receive global recognition. 

EY Entrepreneur Of The Year and EY World Entrepreneur Of The Year finalists, winners and judges of the Program become part of the prestigious EOY alumni network and benefit from access to a global entrepreneurship community, obtain access to exclusive events, insights and resources to help navigate their growth journey and deliver long-term value to their community and the world.

The Program takes place through a combination of virtual and in-person events and activities including but not limited to nominee submission of applications, interviews, selection of finalists and winners by an independent panel of judges, media promotions, award ceremonies, networking events and alumni connection and engagement. 

This Privacy Notice should be read together with the ey.com Privacy Statement, and in case of any conflict with the ey.com Privacy Statement, the terms of this Privacy Notice will prevail. Please read this Privacy Notice carefully.

  • Who manages the Program?

    “EY” refers to one or more of the member firms of Ernst & Young Global Limited (“EYG”), each of which is a separate legal entity and can determine the purposes and means for data processing in its own right (i.e. act as a data controller or in a similar capacity).

    The entities that are acting as a data controller (or similar capacity) by providing the Tools in which your personal data will be processed and stored are EYGM Limited, EYGS, LLP, and EY Global Services Limited, all EY global entities. 

    The personal data in the Tools is shared by EYGM Limited, EYGS, LLP, and EY Global Services Limited with one or more member firms of EY (see “Who can access your personal data” section 6 below).

  • Why do we need your personal data?

    Personal information that is processed as part of the Program in the Tools is used primarily to support the Program’s nomination, judging, interview, recognition, and alumni engagement phases as follows.

    1. creation of press releases and other marketing and promotional materials, including but not limited to materials aimed at amplifying entrepreneurship through the Program and (if you are a competition participant) materials aimed at recognising your story/journey as an entrepreneur, whether in print, online, or other media;
    2. To communicate and engage with you on an ongoing basis, as it pertains to the Entrepreneur Of The Year, World Entrepreneur Of The Year program, EOY alumni network and the Program;
    3. engagement with Relevant Parties with respect to sponsors’ participation in interviews and other Program activities and for the purposes of discussing potential business opportunities with you, including opportunities with third parties;
    4. authentication of you in relevant tools as further described in the Privacy Notice at Attachment 1;
    5. verification of information obtained through background and/or information checks;
    6. evaluation and development of the Program;
    7. if you are a competition participant, evaluation of your submission by the independent panel of judges to enable you to compete in the Program;
    8. In aggregated or anonymized form, except with respect to an EY Person, a Program judge (if you are a competition participant) or a Program sponsor, for purposes of research, education, or any other purposes, as may be decided by any EY Firm in its sole discretion.

    The accuracy of the personal information processed in the Tools is maintained by Program management teams for each Entrepreneur Of The Year Program and World Entrepreneur Of The Year Program that is undertaken. Once an EY Entrepreneur Of The Year Program is completed, the original nomination form and any financials are not updated any further. EY does keep personal contact information up-to-date and may note company changes) in any client relationship management (CRM) and alumni Tools current and upcoming.

    In the EOY nomination form (or for judges, your judging materials) we will ask your consent to add your contact details in EY’s CRM systems for CRM and analytics purposes. You are free to provide such consent or not. Should you wish to "opt-out" of receiving marketing materials from EY that are unrelated to the EY Entrepreneur Of The Year Program, you can always withdraw your consent by contacting your EY Entrepreneur Of The Year Program Manager.

    EY relies on the following basis to legitimize the processing of your personal data in the Tools:

    • We process your personal data based on your consent. The provision of your personal data to EY is optional. You have the right to withdraw your consent at any time. However, if you do not provide all or part of your personal data, we may be unable to carry out the purposes for processing and you may be unable to continue in the EOY or WEOY program. Please refer to Section 4 for a description of personal data collected.

    If you have any questions about the processing of your personal data in the Tools, please contact your usual EY representative or email global.data.protection@ey.com.

    Additionally, the interviews with the independent panel of judges for the Program may take place using virtual event and networking platforms and videoconferencing technologies (see “other Program Technologies” in Appendix 1 for a list of these technologies). The session may be recorded for purposes of the judging process and only used by judges during the Program judging phase. Materials will be deleted after judging.

    For EY personnel and judges, EY relies on the following basis to legitimize the processing of your personal data in the Tools:

    • Processing of your personal data is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. The specific legitimate interest pursued is administering the Program and conducting the judging of the Program. EY personnel and judges have the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them based on the above legitimate interests.

    #. US State Privacy Rights

    Depending on the US state you reside in, you may have certain additional rights with respect to your personal data.  Please visit our US State Privacy Statement for more information.  To the extent that EY sharing your contact information with EOY Program Sponsors constitutes a sale of personal data under applicable law, you can opt out of such sale of data by contacting us at global.data.protection@ey.com.

  • What type of personal data is processed?

    The following personal data categories are processed: 

    Personal Data processed relates to Program participants including Nominators/Candidates, Judges and EY Personnel who administer the Tools. This data is sourced from: EY systems, EY personnel, EOY judges, nominators, and candidates. Candidates could include EY clients. 

    Nominators/Candidates 

    Personal data processed in the Tools relating to Program nominators and candidates includes their contact information (name, email, work or mobile phone number and address) and company related information (company name, address, URL and affiliated information such as “How long have you been working with your company”. 

    Nominees can also provide personal information about themselves via LinkedIn authentication. Authentication through LinkedIn will include their name (First name and last name), email address and profile picture from their LinkedIn profile. A unique ID generated by LinkedIn is also processed. The LinkedIn user ID will be used internally to map the user authentication method. Any user entry that has the LinkedIn user ID present will validate that the user was authenticated via LinkedIn. We may collect a nominee and/or company social media profile information to facilitate social tagging as part of Program recognition and engagement. 

    It is not mandatory for all the data fields within a nomination form to be completed by Nominators and Nominees. For example, Date of Birth (month and year only),Gender, and Ethnicity are optional fields, may only be collected in some countries, and may only be collected in some countries if the Nominee is applying for a special award category. Mandatory data fields will be marked in the nomination form via a red asterisk. 

    EY may seek information about a Nominee or their company/organization to confirm or supplement information contained within their nomination form for the EY Entrepreneur Of The Year Program ("Background Checks"). Background Checks may include information obtained from publicly available sources such as (social) media, credit history, court and other available registers, record-of-offense searches (to the extent permitted by applicable law) or information from third-party sources. 

    In addition to the Personal Data, which is processed in the Tool, the EOY nomination form also asks Candidates for 3 years of financial information relating to their company/organization and they are asked to provide the following details for each of these years: 

    1. Annual Sales 

    2. Income Before Taxes 

    3. EBITDA 

    4. Total Assets 

    5. Total Equity 

    In submitting the above financial information for the purposes of the Program, Nominees confirm that: the provision of such information does not breach the privacy or any other legal rights of the company/organization that is the subject of the information; they have obtained the information in a duly authorized manner; and they are duly authorized to provide EY with the right to use such information for purposes in connection with the Program. 

    If you are chosen to advance to WEOY, you are required to complete and submit a Criteria Evaluation Report (“Report”). The Report includes an essay section that addresses the following subjects: 

    1. Entrepreneurial Spirit 

    2. Purpose 

    3. Growth 

    4. Impact 

    In addition to the Report, you may also be asked to provide other information, including for example, your headshot photo(s), EY press release, your biography and related biographical information, the pronunciation and recording of your name, the recording of your responses to Program questions, your music selections, and other video and photo materials (“Other Information”). 

    Transfer of materials received from the winner to the independent panel of judges is handled by the local EOY team, using Judging Software to securely transfer, share and manage nominee submissions. 

    Judges

    Personal data processed in the Tools includes their name, contact details (email, telephone number and address), assistant’s contact information, photograph, biography and company related information if appropriate. 

    EY Personnel

    Personal data processed in the Tools includes their name, contact details (email, title, work phone number and address) and company related information. 

    EOY admins will upload documents into the EOY System, Judging Software, and Program Technologies and be responsible to manage and monitor data, and ensuring it is deleted in compliance with local retention policies. 

  • Sensitive personal data

    Sensitive personal data is data revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning sex life or sexual orientation.

    EY may collect sensitive personal data from you via the Tools around racial or ethnic origin if particular countries request such data on a voluntary basis as part of their nomination form; this information will be used solely to conduct an aggregated and deidentified analysis of the diversity composition of the nomination pool in those countries where the data is collected. 

    Please note that free text field(s) should not be populated with excessive personal data (including any sensitive personal data) and/or confidential client information.

  • Who can access your personal data?

    EY will not transfer your personal information to third parties (other than those parties specifically contracted to execute the Program) unless we have your permission or are required by law to do so. We will only disclose your personal information to third parties that have agreed in writing to provide an adequate level of privacy protection. Your personal information may be accessed in the Tools by the following persons in connection with the EOY and WEOY Programs.

    USER GROUP

    LOCATION

    PURPOSE

    ACCESS

    AMOUNT

    NOMINATIONS

    EOY System Admin set up

    Global(Australia, England, France, Netherlands, Poland, Canada, USA)

    Account set up by Award Force Admin set up to EY Program administrators. Access and training

    Update and support

    4

    EOY System Tech support admin

    Global (Australia, England, France, Netherlands, Poland, Canada, USA)

    Supporting the Admin and Users with technical challenges

    Tool support

    2-4 specifically assigned to date specific activities and otherwise tech desk support

    EY Program administrators and support staff

    Global

    Set up of tool. Upload and management of materials.

    Full control

    Varies by country Program

    JUDGING AND INTERVIEWS

    Judges

    Global

    Review and scoring of material for judging process

    View/Read

    Varies by Program, but generally 6-10 per Program.

    Production team

    Varies by Program (Global)

    Access to data including interview recording; Assist with any functional issue related to the virtual experience

    View

    Varies, but minimal based on specific assignment

    Videoconferencing Technologies Support Desk (Microsoft Teams, Zoom, WebEx)

    Global

    Assist with any functionality issues with their technology only

    *only in cases where the tool has problems

    Various Technologies Support Desk

    NETWORKING

    Program Sponsors

    Global

    To contact Program participants and alumni for purposes of networking.

    Access to a Program participant’s contact information.

    Varies by Program

    Program Sponsors (United States only)

    United States only

    The United States EY Entrepreneur Of The Year Program may provide select presenting sponsors access to the contact information of United States nominees for the purpose of contacting United States nominees

    Access to a Program participant’s company/organization financial information organized into banded levels and to a Program participant’s contact information.

    Access managed by EOY Program administrator.

    Other EOY participants

    Global

    To contact Program participants and alumni for purposes of networking.

    Access to any personal data shared by a Program participant to their profile on the EOY System and in any messages they post on the EOY System.

    Varies by Program year.

     

    In addition to the above chart, EY personnel at all levels will have access to personal data on a “need to know basis” for the purposes of the Program. EY personnel are subject to various member firm and professional guidelines governing the use of private information obtained during the course of their work, and these guidelines apply to private information collected for the Program.

    The access rights detailed above involves transferring personal data in various jurisdictions (including jurisdictions outside the European Union) in which EY operates (EY office locations are listed at www.ey.com/ourlocations). An overview of EY network entities providing services to external clients is accessible here (See Section 1 (About EY) - “View a list of EY member firms and affiliates”). EY will process your personal data in accordance with applicable law and professional regulations in your jurisdiction. Transfers of personal data within the EY network are governed by EY’s Binding Corporate Rules.

    EY transfers or discloses the personal data EY collects to third-party service providers (and their subsidiaries and affiliates) who are engaged by EY to support EY’s internal ancillary processes. For example, EY engages service providers to provide, run and support EY’s IT infrastructure (such as identity management, hosting, data analysis, back-up, security and cloud storage services) and for the storage and secure disposal of EY’s hard copy files. It is EY’s policy to only use third-party service providers that are bound to maintain appropriate levels of data protection, security and confidentiality, and that comply with any applicable legal requirements for transferring personal data outside the jurisdiction in which it was originally collected.

    To the extent that personal data has been rendered anonymous in such a way that you or your device are no longer reasonably identifiable, such information will be treated as non-personal data and the terms of this Privacy Notice will not apply.

    For data collected in the European Economic Area (EEA) or which relates to individuals in the EEA, EY requires an appropriate transfer mechanism as necessary to comply with applicable law. The transfer of personal data to Judging Software is governed by an agreement between EY and the Judging Software provider that includes standard data protection clauses adopted by the European Commission. The transfer of personal data to Program Technologies is governed by an agreement between EY and the Program Technologies provider that includes standard data protection clauses adopted by the European Commission.

    The EOY System also uses Adobe Analytics (“Adobe”) in order to provide reporting, visualizations and analysis of data. Your personal data will be processed by Adobe for the following purposes: (i) to capture web metrics about the journey of users within EY websites and applications (e.g. pages viewed and links clicked); (ii) to analyze and understand overall site traffic information; (iii) to allow EY to make informed decisions about EY’s intranet and extranet web sites; and (iv) to authenticate users and permit them to access the EOY System. EY Global Services Limited is the data controller for the purposes of this processing and licenses Adobe from Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Saggart, Dublin 24, Ireland, who hosts it in London, United Kingdom.

    Adobe processes the following types of personal data in relation to its users: username (relating to system administrators only); hashed email address; user country; user country code; user region/office; and/or internal vs. external user information. This personal data will be retained for 37 months and archived for 90 days before deletion. Sensitive personal data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning sex life or sexual orientation, is not processed. This personal data can be accessed by internal EY personnel. This processing is necessary for the purposes of the legitimate interests pursued by EY (except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.) The specific legitimate interest pursued is: reporting on the usage of EY applications and website.

  • Data retention

    Our policy is to retain personal data only for as long as it is needed for the purposes described in the section “Why do we need your personal data?” Retention periods vary in different jurisdictions and are set in accordance with local regulatory and professional retention requirements.

    In order to meet our professional and legal requirements, to establish, exercise or defend our legal rights and for archiving and historical purposes, we need to retain information for significant periods of time.

    The policies and/or procedures for the retention of personal data in the Tools are:

    • Personal Data in the EOY System, such as participants’ contact information, will be deleted 10 years after completion of the EOY Program. For the period beyond 10 years of completion of the EOY Program, the only information that will be retained on participants is their name, the company/organization they are associated with, the year they participated in the EOY Program and whether they were a winner/runner up. This information is retained in the system so that the Program Managers have an entire history of participants in the Program. They are frequently asked if a certain company or person has participated in the EOY contest and if they won an award.
    • Data will be deleted from Judging Software, and Program Technologies and access revoked following the conclusion of each program lifecycle.
  • Security

    EY protects the confidentiality and security of information it obtains in the course of its business. Access to such information is limited, and policies and procedures are in place that are designed to safeguard the information from loss, misuse and improper disclosure. Additional information regarding our approach to data protection and information security is available in our Protecting your data brochure.

  • Controlling your personal data

    EY will not transfer your personal data to third parties (other than any external parties referred to in section 6 above) unless we have your permission or are required by law to do so.

    You are legally entitled to request details of EY’s personal data about you. To confirm whether your personal data is processed in the Tools or to access your personal data in the Tools or (where applicable) to withdraw your consent, contact your usual EY representative or email your request to global.data.protection@ey.com.

  • Object, rectification, erasure, restriction of processing or data portability

    You can confirm your personal data is accurate and current. You can object to the processing of your personal data or request rectification, erasure, restriction of processing or a readily portable copy of your personal data by contacting your usual EY representative or by sending an e-mail to global.data.protection@ey.com.

  • Complaints

    If you are concerned about an alleged breach of privacy law or any other regulation, contact EY’s Global Privacy Leader, Office of the General Counsel, 6 More London Place, London, SE1 2DA, United Kingdom or via email at global.data.protection@ey.com or via your usual EY representative. An EY Privacy Leader will investigate your complaint and provide information about how it will be handled and resolved.

    If you are not satisfied with how EY resolved your complaint, you have the right to complain to your country’s data protection authority. You can also refer the matter to a court of competent jurisdiction. Certain EY member firms in countries outside the European Union (EU) have appointed a representative in the EU to act on their behalf if, and when, they undertake data processing activities to which the EU General Data Protection Regulation (GDPR) applies. Further information and the contact details of these representatives are available here.

  • Contact us

    If you have additional questions or concerns, contact your usual EY representative or email global.data.protection@ey.com.

Appendix 1

Nomination Platform

1.) The EY Entrepreneur Of The Year™ tool is hosted on a Microsoft Azure server that is located in the Republic of Ireland.

Judging Software

1.  Award Force. Award Force Pty Ltd, PO Box Q1118, QVB, NSW 1230, Australia. Award Force is hosted by Award Force on Amazon Web Services (AWS) servers in Frankfurt, Germany.

2.  Venue. Donnelly Financial Solutions, 35 West Wacker Drive, Chicago, Illinois 60601. Hosted on Ensono, LP servers in the U.S.

Other Program Technologies

1.)

Zoom. EY Global Services Limited licenses Zoom from Zoom Video Communications, Inc., 55 Almaden Boulevard, Suite 600, San Jose, CA 95113. Zoom is hosted on AWS servers in the USA in Virginia and California and the Netherlands. Zoom utilizes tier 1 AWS data centers globally for the real-time audio-video capability. European users of Zoom would typically utilize the Amsterdam data center.

2.)

Microsoft Suite including Microsoft Teams and SharePoint. EY Global Services Limited licenses Microsoft Teams from Microsoft Corporation One Microsoft Way Redmond, WA 98052-6399 USA. EYs default (home) tenant location is defined in the European Union with satellite locations currently defined for Australia, Canada, United Kingdom and United States geographies. Further details on specific city locations of data within these regions can be found here.

3.)

WebEx. EYGS LLP licenses WebEx from Cisco Systems Inc. WebEx is hosted externally by the Cisco System, Inc. on servers located in both the EU and the US.