11 June 2019
This privacy notice explains how EY collects and uses personal data, and describes the rights you have with respect to your personal data.
In this notice, “EY,” “our”, “we” or “us” refers to the global organization of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity, or refers to one or more of those member firms. The controllers of your personal data are one or more of the EY entities listed here (pdf) (see the list of EY member firms and affiliates).
Certain EY member firms in countries outside the European Union (EU) have appointed a representative in the EU to act on their behalf if, and when, they undertake data processing activities to which the EU General Data Protection Regulation (GDPR) applies. Further information and the contact details of these representatives are available here.
EY processes personal data for a variety of purposes. We collect this personal data directly from you, for example, if you engage us to prepare your tax return, if you visit ey.com (our Site), if you submit your contact details to receive marketing communications from us or submit a job application via the EY careers website. Alternatively, we process your personal data in the context of providing professional services to your employer or service provider, for example, conducting an audit of your bank or payroll for the company you work for. Finally, we obtain your personal data via publicly available sources, such as LinkedIn. This privacy notice is intended to cover all of the above-mentioned scenarios.
Click on the links in our index to take you to the more detailed information regarding various purposes for which we process personal data:
- Visitors to ey.com
- Entrepreneur Of The YearTM
- Individuals whose personal data we obtain in connection with providing services to our clients
- Insolvency services
- Contacts in our customer relationship management (CRM) systems
- Participants of EY meetings, conferences, events and learning sessions
- Individuals who use our applications
- Individuals who visit our social media sites, social media plugins and tools
- Individuals who correspond with EY via email
- Job applicants
- Visitors to EY offices
If you have any questions regarding the processing of your personal data or wish to contact the data protection officer of an EY member firm, please contact the EY data protection team who will direct your query to the appropriate person or team within the organization.
In this privacy notice, “personal data” means any information relating to an individual who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data or an online identifier. Personal data also refers to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of an individual.
It also includes special categories of personal data (special category data) from which we can determine or infer an individual's
- Racial or ethnic origin
- Political opinions
- Religious or philosophical beliefs
- Membership of a trade union
- Genetic data
- Biometric data
- Physical or mental health or condition
- Sex life or sexual orientation
As well as personal data relating to criminal convictions and offenses
You have the following rights in relation to your personal data:
- To access the personal data held by EY about you
- To have your personal data corrected, for example, if it is incomplete or incorrect
- To opt out of receiving marketing communications at any time
- To restrict or object to the processing of personal data or request erasing personal data (in certain circumstances and subject to applicable law)
- To receive a copy of the personal data which you have provided to EY, in a structured, commonly used and machine-readable format (known as “data portability”) (in certain circumstances and subject to applicable law)
- Where you have provided personal data voluntarily, or otherwise consented to its use, the right to withdraw your consent
- The right to complain to a data protection authority (see section “Complaints ”)
If you have a query or wish to exercise your rights, please speak to the person you usually deal with at EY or contact the EY data protection team.
If you are concerned about an alleged breach of privacy law or any other regulation by EY, you can contact the person you usually deal with at EY or the EY global privacy leader, Office of the General Counsel, 6 More London Place, London, SE1 2DA, United Kingdom. An EY privacy leader will investigate your complaint and give you information about how it will be handled.
You also have the right to complain to the data protection authority in your country, or refer the matter to a court of competent jurisdiction or as specified in any applicable engagement agreement with EY.
Personal data that we collect about you when you visit our site falls into several categories.
Information that you provide voluntarily
We collect personal data that you provide voluntarily through our site, for example, when completing online forms to contact us, subscribing to a newsletter, using one of our online benchmark tools, subscribing to receive marketing communications from us, participating in surveys or registering for events that we are organizing. The information we collect about you include the following:
- Job title, job level or job function, role
- Company or organization
- Company data
- Contact information, including primary email, email address and telephone numbers
- Demographic information, such as industry, country, postcode, preferences and interests
- Other information relevant to client surveys or similar research
- Information pertinent to fulfilling our services to you
- Any other personal data that you voluntarily choose to provide to us
We do not intentionally collect sensitive category data, unless you provide us with such data. While there may be free text boxes on the site where you are able to enter any information, we do not intend to process sensitive information. You are not required to provide, and should not disclose, sensitive personal information in the free text boxes. If you choose to provide any sensitive personal information in this manner, you acknowledge you consent to the collection and processing of this sensitive information.
If you register on our site, your personal data will be stored in our CRM system . Data of registrants is deleted after an individual has not actively engaged with EY for 18 months, or sooner if required by law.
If you have opted out of receiving EY publications, your basic contact details will remain on our opt-out list.
Information that we collect automatically
Our site also uses various social media plugins.
Purposes for which we process your personal data as a visitor to our site are:
- To analyze the data of visitors to our site
- To develop our business and services
- To provide you with marketing communications, EY Thought Leadership materials and online benchmarking tools
- To understand how visitors use the features and functions of our site
- To conduct quality and risk management reviews
- Any other purpose for which you provided information to EY
Legal grounds for processing personal data of visitors of our site are:
- Our legitimate interest in developing and improving our site, and your user experience
- Explicit consent of the visitor
EY accepts nominations for the EY Entrepreneur Of The Year™ program via our site. Personal data, including financial data, is required of the nominee and he or she must sign the nomination form. Nomination forms are provided to the program sponsors, and independent national and regional panels of judges in order to select award recipients.
The EY Entrepreneur Of The Year™ global system contains a separate privacy notice. We encourage individuals participating in our Entrepreneur Of The Year™ program to refer to the privacy notice available on that system.
When you engage us to provide you with professional services, we collect and use personal data when we have a valid business reason to do so in connection with those services. For an overview of our services, click here .
In the context of providing professional services to clients, EY also processes personal data of individuals who are not directly our clients (for example, employees, customers or suppliers of our clients). See the section “Individuals whose personal data we obtain in connection with providing services to our clients ” for additional information.
The majority of the personal data we collect and use to provide our services is supplied voluntarily by (or collected by us from third-party sources at the request of) our clients. Because of this, if you are a client of EY, then it will generally be obvious to you what personal data we collect and use. This information can include:
- Contact information, such as your postal address, email address and telephone numbers
- Financial information, such as payment-related information
We use this information:
- To provide services to you
- To administer our relationship and maintain contractual relations
- For accounting and tax purposes
- For marketing and business development
- To comply with our legal and regulatory obligations
- To establish, exercise or defend legal rights
- For historical and statistical purposes
Given the diversity of the services we provide, we process many categories of personal data. Please see below (non-exhaustive) examples of personal data categories for our four main service lines:
- Contact details, such as name, address, telephone numbers and email address
- Details of employment, such as employment number, employment department, role and employment time
- Trade union membership
- Personal identity number
- Information on insurances and occupational pensions
- Other categories of personal data needed for conducting the audit in accordance with good auditor’s and auditing standards
Examples of personal data categories processed by EY tax client engagement teams are:
- Tax return files: liability, dates produced and sent, and comments on tax returns
- Tax equalization data: liability, dates produced, settlement amounts and taxes paid
- Company-specific information: corporate client personnel contacts and division names
Examples of personal data categories received or processed by Advisory client engagement teams are:
- Contact details, such as name, address, telephone numbers and email address
- Health information about individuals receiving specific drugs or treatments
- Personal data of employees potentially impacted by supply chain changes or outsourcing
- Customer data, including race or gender during a customer experience engagement
- Payroll details
- Employment contracts
- Pension and retirement benefits information
- Entries in accident books
- Insurance claims
- Customer lists
- Consumer contracts
- Company registers
In addition, we also process identification and background information as part of our client acceptance, finance, administration and marketing processes, including audit independence, anti-money laundering, conflicts, reputational and financial checks, and to fulfill any other legal or regulatory requirements to which we are subject.
The checks could include the following:
- Identity verification: proof of name and address
- Ultimate beneficial ownership of corporate and other legal entities
- Conflicts checks: to avoid a conflict of interest with any other client
- Anti-money laundering, proceeds of crime and terrorist financing checks
- Adverse media checks
- Government sanctions list checks
- Independence checks
These checks are made for legal, regulatory or business reasons and need to be repeated during the course of our engagement. As part of these checks, we are required to process special category data (for example, to verify if you are a politically exposed person or to collect information about criminal convictions where this is required for anti-money laundering laws). It is important you provide us with all necessary information and documents as this affects our ability to provide services to you.
Legal grounds for processing personal data of our clients are:
Performance of a contract
- Compliance with a legal or regulatory obligation
As part of the professional services EY provides to clients, EY processes personal data of individuals with whom we do not have a direct (contractual or other) relationship. For example, if we perform a statutory audit, our engagement team will be required to audit our client’s books, which could include payroll data for employees of the client, supplier data, financial administration, data regarding claimants and legal proceedings. To take another example: if we undertake a due diligence review of an acquisition of a target on behalf of a client, EY obtains personal data concerning the target’s employees, management and customers.
We seek confirmation from our clients that they have the authority to provide personal data to us in connection with the performance of the services and that any personal data they provide to us has been processed in accordance with applicable law.
Given the diversity of services we provide, we process many categories of personal data such as:
- Personal details (such as name, age, data of birth, gender, marital status and country)
- Contact details (such as phone numbers, email address and postal address)
- Financial details (such as salary, payroll, income, investments, benefits and tax status)
- Employment details (such as role, rank, experience, performance data and employment numbers)
For certain services, we also process special category data. For example, in certain countries performing tax return services involves the processing of details of payments made by our client, his or her spouse and dependents with respect to a trade union membership, to a political party, for medical treatments or to a religious charity. Such data is collected intentionally and will be used only where necessary in connection with the provision of the service for which the data was collected, such as determining the correct taxation of our client’s income and for claiming the correct tax deduction with respect to such payments.
Legal grounds for processing personal data of individuals whose personal data we obtain in connection with providing services to our clients are:
- Compliance with a legal or regulatory obligation
Once a company undergoes an insolvency, one or more EY insolvency practitioners (i.e., administrators and liquidators) could be appointed to manage the company’s affairs, business and property. Similarly, when a debtor is subject to insolvency or a restructuring regime, one or more EY insolvency practitioners could be appointed to manage the debtor’s affairs, business and property.
In this section:
- Office holder refers to the EY insolvency practitioners.
- Company refers to the insolvent entity for which the office holders have been appointed.
- Debtor refers to the individual who is subject to an insolvency or restructuring regime.
- “You” refers to the data subjects concerned by the insolvency procedure of the company or debtor.
In providing insolvency services, EY processes your personal data for the legitimate interests of assisting the office holders in the performance of their legal and regulatory obligations with regard to the insolvency procedures. For clarity purposes, the company or debtor remains data controller of your personal data processed for purposes that are not related to the legal and regulatory obligations of the office holders.
Most of the personal data we process is obtained from you directly, but we also indirectly obtain personal data about you.
The office holders and EY process your personal data for the following (non- exhaustive) purposes:
- Provision of statutory returns
- The reasonable and lawful provision of information to interested parties
- The prevention and detection of crime or fraud
- Complying with legal obligations to which the company or debtor is subject
- Quality and risk management purposes
The types of personal data processed for the above purposes include (but are not limited to) name, address, identifying information, payroll information, as well as any information with your dealings with the company or debtor that are necessary for the performance of the office holders’ statutory obligations during the insolvency procedure.
You have certain rights in relation to your personal data. If you have a query or wish to exercise your rights, please make a written request to the party responsible for your personal data (the company, debtor or the office holder) using the contact details provided in communications about the insolvency.
We process personal data about contacts (former, existing and potential clients and individuals employed by, or associated with, such clients and other business contacts, such as alumni, consultants, regulators and journalists) in our CRM systems. These CRM systems support the marketing operations of EY. Contacts in our CRM systems will be sent EY Thought Leadership materials, newsletters, marketing materials, learning opportunities, surveys and invitations to events.
In our CRM systems, we process the following categories of personal data:
- Name, job title, address, email address, phone and fax numbers
- Name of employer or organization the individual is associated with
- Marketing preferences
- Invitation responses and event attendance confirmations
We do not intentionally collect sensitive category data, unless you provide us with such data (for example, special dietary requirements which reveal your religious affiliation or any food allergies), if you attend one of our events.
Data of business contacts who have not been actively engaged with EY in the past 18 months will be deleted from our CRM systems. If you have opted out of receiving future EY publications, your basic contact details will remain on our opt-out list.
Legal grounds for processing personal data of business contacts are:
- Explicit consent of the business contact
We process personal data about participants in EY meetings, conferences, events and learning sessions (events). We use various applications to manage event registration processes, which applications will contain their own privacy notices explaining why and how personal data is collected and processed by these applications. We encourage participants to refer to the privacy notices available on those applications.
As part of our event management processes, we process the following personal data (but only to the extent required for a specific event):
- Name, age or date of birth
- Client personnel information (home, office and business information)
- Credit or debit card number
- Customer information (home, office and business information)
- Email address
- Home or other physical address
- Names of employers (EY or company)
- Occupation (job title)
- Passport number
- Personal web URL (if you have a personal website that you would like to share)
- Telephone or fax numbers
We do not intentionally collect sensitive category data, unless you provide us with such data (for example, special dietary requirements which reveal your religious affiliation or any food allergies or other data relating to your health necessary to provide support to participants, if needed, for example, if a wheelchair will be required).
Attendees of EY events hosted at external venues are required to bring a photo ID for identification purposes to safeguard our people, assets and information, and to prevent unauthorized people gaining access to off-site EY events.
EY is allowed to take photographs and make audio or video recordings in public areas of the EY events. We use such media in our marketing materials. Images and voices of attendees will be recorded. Recordings will be edited, copied, exhibited, published or distributed.
Legal grounds for processing personal data of participants are:
- Explicit consent of the participant
- Our legitimate interest in organizing events and managing the registration process for such events.
- Our legitimate interest in providing information about EY, our services and events we organize
We provide external users access to various applications managed by us (such as the EY Client Portal). Such applications will contain their own privacy notices explaining why and how personal data is collected and processed by those applications. We encourage individuals using our applications to refer to the privacy notices available on those applications.
Our site contains functions of the Instagram service.
Our site uses plugins from YouTube, which is operated by Google.
LinkedIn Lead Gen Forms
Our site uses the Google Maps map service via an application programming interface (API).
- Our legitimate interest in promoting EY services and brand
- Our legitimate interest in attracting, identifying and sourcing talent
- Our legitimate interest to improve your website experience and to optimize our services
EY uses a variety of tools to maintain the security of our IT infrastructure, including our email facilities. Examples of such tools are:
- Tools that provide end-point threat detection to detect malicious attacks
- Tools that block certain content or websites
If you correspond via email with an EY recipient, your emails will be scanned by the tools EY operates to maintain the security of its IT infrastructure, which could result in content being read by authorized EY persons other than the intended recipient.
Legal grounds for processing personal data of individuals who correspond with EY via email:
- Our legitimate interest in analyzing email traffic
We collect information from and about candidates in connection with available employment opportunities at EY. The information that we collect, the manner in which it is used, and the timing in which it is gathered varies depending on the country in which you apply. As general matter, the data we collect regarding our job applicants includes resumes or CVs, identification documents, academic records, work history, employment information and references.
We use your personal data to match your skills, experience and education with specific roles offered by EY. This information is passed to the relevant hiring managers and persons involved in the recruitment process to decide whether to invite you for an interview. EY will collect further information if you are invited to the interview (or equivalent) stage and onward. Such information includes interview notes, assessment results, feedback and offer details.
In connection with our recruitment activities including applications and onboarding, we also collect special category data from candidates where we have an employment law obligation to do so. This information is relevant to their future working environment at EY or the future provision of employment benefits, or with the individual's explicit consent, where collecting such information is permitted by law. For example, where allowed under applicable law, we will collect information about an individual’s disabilities in order to analyze the diversity of our workforce. Once onboarded, an individual’s provision of information regarding disabilities will also be used to provide a suitable working environment. We will also need to conduct criminal background checks for certain candidates to assess their eligibility to work at EY or for EY clients. In certain countries, we will also ask candidates to provide diversity information about their race and ethnicity, and sexual orientation for diversity monitoring purposes, although the provision of this information will be entirely voluntary. However, where a candidate does not voluntarily provide such information, we could be required by law to make our own assessment of such criteria.
Our recruitment tools and websites contain their own privacy notices explaining why and how personal data is collected and processed by those applications. We encourage individuals using our recruitment tools and websites to refer to the privacy notices available on those tools and websites.
Depending on the country in which you apply, EY collects personal data about candidates (“you”) from the following sources:
- Results of background screening checks
Legal grounds for processing personal data of our job applicants are:
- Explicit consent of the candidate
- Our legitimate interest in attracting, identifying and sourcing talent
- Our legitimate interest to manage our career websites (including conducting statistical analyses)
EY hopes to maintain a lifelong, mutually beneficial relationship with EY alumni (former member firm partners, employees and contractors). If we invite you to our alumni community, your name, contact details, role, last EY office, rank, service line and country will be used to create a record for you in one of our alumni databases, unless you have indicated that you are not interested in participating in the EY alumni program. You have the opportunity to create a more detailed profile and to decide how much additional information you wish to share with EY and the wider alumni community.
Our alumni databases contain their own privacy notices explaining why and how personal data is collected and processed by those applications. We encourage individuals using our alumni databases to refer to the privacy notices available on those applications.
The legal grounds for processing personal data of our alumni are:
- Explicit consent of the alumnus
We process personal data about our suppliers (including subcontractors, and individuals associated with our suppliers and contractors) in order to manage our relationship and contract, and to receive services from our suppliers.
The personal data we process is generally limited to contact information (name, name of employer, phone, email and other contact details) and financial information (payment-related information).
In addition, we also use data about our suppliers to check whether we have a conflict of interest or audit independence restriction to appointing a supplier. Before we take on a new supplier, we also carry out audit independence and other background checks required by law or regulation, for example, adverse media, bribery and corruption, and other financial crime checks.
Legal grounds for processing personal data of our suppliers are:
- Performance of a contract
- Compliance with a legal or regulatory obligation
EY/Ethics provides EY people, clients and others outside of EY with a means to confidentially, and either anonymously or on a disclosed basis, report an activity that involves unethical or illegal behavior that is in violation of professional standards or otherwise inconsistent with our EY Global Code of Conduct. Reports can be made either online or via a telephone hotline.
EY/Ethics contains its own privacy notice and consent form which describes the practices EY follows in relation to EY/Ethics. We encourage individuals using EY/Ethics to refer to this EY/Ethics notice and consent form.
When you visit an EY office, we process your personal data in order to provide you with certain facilities (such as access to our buildings and conference rooms or Wi-Fi), to control access to our buildings, and to protect our offices, personnel, goods and confidential information (for example, by using CCTV).
The personal data we collect is generally limited to your name, contact information, location, and the time you enter and leave our office.
Visitor records and access badges
We require visitors to our offices to sign in at reception and we keep that record of visitors for a short period of time. Visitors to our offices are provided with a temporary access badge to access our offices. Our visitor records will be used to verify that access badges are returned, to look into a security incident and for emergency purposes (for example, if an office needs to be evacuated).
We monitor and log traffic on our Wi-Fi networks. This allows us to see limited information about a user’s network behavior, but will also include being able to see at least the source and destination addresses the user is connecting from and to.
EY uses CCTV monitoring where permitted by law. CCTV images are securely stored and only accessible on a need-to-know basis (for example, to look into an incident). We are allowed to disclose CCTV images to law enforcement bodies. We will also share CCTV images with our insurers for purposes of processing an insurance claim as a result of an incident. CCTV recordings are typically deleted or automatically overwritten after a short period of time unless an issue is identified that requires further investigation.
Legal grounds for processing personal data of visitors to EY offices are:
- Our legitimate interest in protecting our offices, personnel, goods and confidential information
EY member firms operate in more than 150 countries across the globe. Certain aspects of the EY infrastructure are centralized, including information technology services provided to member firms. In addition, where engagements with EY clients span more than one jurisdiction, certain information will need to be accessed by all those within the EY organization who are working on the matter. Therefore, your personal data will be transferred to and stored outside the country in which you are located. This includes countries outside the European Economic Area (EEA) and countries with laws that have not necessarily been determined to provide an adequate level of protection for the processing of personal data under the laws of the EU or other jurisdictions.
We take appropriate security and legal precautions to safeguard the safety and integrity of personal data that is transferred within the EY organization. EY has implemented binding corporate rules (BCRs) that allow for global transfers within the EY organization of personal data originating in the EEA in accordance with applicable European privacy laws. The BCRs require all EY entities worldwide to use the same standards of protection for personal data.
You can access our BCRs here.
Ernst & Young LLP, US, and its affiliated US entities, adheres to the EU-US and Swiss-US Privacy Shield Frameworks published by the US Department of Commerce. To learn more, see Ernst & Young LLP’s Privacy Shield Data Privacy Statement.
Your personal data will also be processed by EY service providers that support our internal ancillary processes. For more information, click the section “Service providers”.
We transfer or disclose the personal data we collect to third-party service providers (and their subsidiaries and affiliates) who are engaged by us to support our internal ancillary processes. For example, we engage service providers to provide, run and support our IT infrastructure (such as identity management, hosting, data analysis, back-up, security and cloud storage services) and for the storage and secure disposal of our hard copy files.
It is our policy to only use third-party service providers that are bound to maintain appropriate levels of data protection, security and confidentiality, and that comply with any applicable legal requirements for transferring personal data outside the jurisdiction in which it was originally collected. For data collected in the EEA or which relates to data subjects in the EEA, EY requires an appropriate transfer mechanism as necessary to comply with applicable law.
EY discloses your personal data:
- Where this is appropriate for the purposes described in the section “Purposes for which we process personal data,” including within the EY organization itself
- If required, by applicable law
- In connection with a reorganization or combination of our organization with another organization
- If we believe that such disclosure is appropriate to enforce or apply terms of engagement, and other agreements or otherwise protect and defend EY rights, property or safety
- In order to comply with a judicial proceeding, court order or other legal obligation, or a regulatory or government inquiry
- With your consent
We would like to draw particular attention to the fact that in certain jurisdictions, EY has a legal obligation to report suspicious transactions and other activity to relevant regulatory authorities under anti-money laundering, terrorist financing, insider dealing or related legislation. EY also reports suspected criminal activity to the police and other law enforcement bodies. We are not always permitted by the law to inform you about this in advance of the disclosure, or at all.
Third-party recipients of personal data include:
- Professional advisors, such as law firms, tax advisors or auditors
- Audit regulators
- Tax and customs, and excise authorities
- Regulatory and other professional bodies
- Stock exchange and listing authorities
- Public registries of company directors and shareholdings
- Providers of identity verification services
- Credit reference agencies
- The courts, police and law enforcement agencies
- Government departments and agencies
- Service providers
EY protects the confidentiality and security of information it obtains in the course of its business. Access to such information is limited, and policies and procedures are in place that are designed to safeguard the information from loss, misuse and improper disclosure. Additional information regarding our approach to data protection and information security is available in our Protecting your data brochure (pdf).
We maintain the accuracy and completeness of the personal data we hold. It is important that you inform us of any updates to your contact details or other personal data so that we have the most up-to-date information about you. Please contact the person you usually deal with at EY. You can also contact our data protection team.
Our policy is to retain personal data only for as long as it is needed for the purposes described in the section “Purposes for which we process personal data.” Note that retention periods vary in different jurisdictions and are set in accordance with local regulatory and professional retention requirements.
In order to meet our professional and legal requirements, to establish, exercise or defend our legal rights, and for archiving and historical purposes we need to retain information for significant periods of time.
We will occasionally update this privacy notice to reflect changes in our practices and services. When we post changes to this privacy notice, we will revise the “last updated” date at the top of this privacy notice. If we make any material changes in the way we collect, use, and share personal data, we will notify you by prominently posting notice of the changes on the website. We recommend that you check this page from time to time to inform yourself of any changes in this privacy notice.