Recruitment Privacy Notice

Please consult the various sections for more detailed information about specific processing activities.

We tried to compile a comprehensive overview of our processing activities. However, some processing activities may be missing from this overview. The primary purpose of processing your personal data is to enable you to go through the application process. We continue to evaluate and update this Recruitment Privacy Notice, to ensure that we inform you as accurately and completely as possible about the processing of your personal data. If you have suggestions, please reach out to our Data Protection Officer through privacy.nl@nl.ey.com.

When you are applying for a position with EY, we process your personal data in the following manner.

Purposes of processing.

• Organizing recruitment events;
• Processing, evaluating, and managing of applications;
• Screening and selecting candidates;
• Maintaining contact with applicants;
• Scheduling and conducting (online) interviews;
• Making an offer to successful candidates;
• Conducting a pre-employment screening.

Personal data being processed.

• Name, contact details;
• CV, work experience, geographical preference, skills, and education;
• Information obtained from interviews and assessments;
• Username and password to log into the application system (Yello/SuccessFactors);
• Data provided by the applicant as requested by EY and/or on a voluntary basis, such as references from previous employers.

Please note that during the application process, it may be necessary to process sensitive personal data, such as salary information and the results of a pre-employment screening.

Legal basis for processing.

• Our legitimate interests in:
  • Human resource management;
  • Personnel and/or internal administration.
• Legal / statutory obligation. Sometimes we process personal data not on our own initiative, but to comply with a legal obligation that applies to us. For example, to check if someone is allowed to work in the Netherlands.
   

EY is committed to safeguarding the confidentiality of data concerning you and others. If and to the extent necessary for the purpose of processing, and if we are entitled to do so under applicable law and regulations, we may grant internal or external access to your personal data, or transfer it to other parties, namely:

• Authorized persons working for EY Netherlands and/or affiliated entities within the global EY network.
  As part of a global network, we may share information with other EY member firms.
  All EY entities and employees are required to comply with EY’s data protection and confidentiality policies, which require them to treat, secure, and protect personal data and other information confidentially.
  
  
• Authorized persons working for service providers/subcontractors engaged by EY.
  Some external service providers perform specific assignments for EY, such as suppliers for some of our HR systems and/or activities. Such as:
  
  • HR software (see the specific privacy statements of Yello or SuccessFactors for more information); or
  • Conducting a screening (Validata).

We only share your personal data with these parties if necessary. These parties must treat your data confidentially and must comply with applicable privacy regulations. They are also required to take appropriate measures to protect your data. Where necessary, we have made contractual agreements with these parties.
 

We consider the protection of your privacy and personal data to be of great importance. Therefore, EY has implemented appropriate technical and organizational measures to protect and secure personal data, to prevent breaches of the confidentiality, integrity, and availability of your data.

Everyone within EY, as well as other persons engaged by EY for processing personal data, are required to respect the confidentiality of personal data. The principle is to limit access to personal data based on a "need-to-know" basis.
 

Parties involved in the processing of your personal data may be located in another country. These can be external parties or other entities within the EY network. If these parties are located outside the European Economic Area (EEA), the transfer is legitimized in the manner described below.

• Transfer outside the EEA but within the EY-Network
  
  EY has taken various appropriate technical and organizational measures to ensure the security and integrity of data transferred within the EY network. EY has, in the first place, established Binding Corporate Rules (in Dutch: Bindende Bedrijfsvoorschriften) (BCRs), based on which EY may share personal data within the global EY network. You can consult the BCRs via this link.
  
  
• Transfer outside the EEA and outside the EY-Network
  
  The transfer of your personal data to a third party outside the EEA may be legitimized based on an adequacy decision by the European Commission, such a decision determines that the respective third country provides an adequate level of protection for personal data. See this link for an overview of the valid adequacy decisions.
  
  If your personal data is transferred outside the EY-network and to a country outside the EEA for which no adequacy decision applies, EY enters into an applicable model contract (Standard Contractual Clauses) with the relevant party. This is a standard contract to ensure the protection of your personal data, which has been approved by the European Commission. See this link for various model contracts.
  
  You can contact us if you wish to receive additional information on how we legitimize the transfer of your personal data to countries outside the EEA. Our contact details can be found at the end of this Recruitment Privacy Notice.
   

EY retains your personal data as long as necessary to fulfil the purposes for which EY collected this personal data, unless the law permits or requires EY to retain this data for a longer period. More specifically, the retention periods during an application process are as follows:

• If you are hired by us, the relevant personal data will be included in the personnel file.
• If you are not hired, we will retain the personal data for a maximum of one month after the completion of the application process, unless you have given permission to retain your personal data for a period of up to 1 year.
• If you choose to be included in the talent pool and create a profile in Yello or SuccessFactors, the personal data will be retained for a period of up to 1 year after your latest activity with that profile.
   

You have certain rights regarding the processing of your personal data. EY must respect these rights.

Under certain circumstances, you have the right:

• To access information about how we process your personal data and to receive a copy of this data (not including a copy of the documents containing the personal data);
• To have your personal data corrected or supplemented if it is incorrect or incomplete;
• To request the deletion of your personal data;
• To request that EY restricts the processing of your personal data;
• To object to the processing of your personal data;
• To request to receive your personal data in a structured, commonly used, and machine-readable format or to transfer it to another controller (such as a new employer).

For more information about your rights and how to exercise them, please contact our Data Protection Officer via privacy.nl@nl.ey.com.
 

The EY entity you are applying to is responsible for processing your personal data (e.g., EY Nederland B.V.). If you have any questions or complaints about this Recruitment Privacy Notice or about how EY uses your personal data, please contact our Data Protection Officer via privacy.nl@nl.ey.com. If you are dissatisfied with the response received, you can also contact EY’s Global Data Protection Leader via global.data.protection@ey.com.

You also have the right to lodge a complaint with the local supervisory authority, in the Netherlands this is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
 

This Recruitment Privacy Notice may be updated regularly and without prior notice to reflect any changes in EY's privacy policy. EY will notify you of significant changes to this Privacy statement and will indicate the most recent date on which it was updated.