Privacy statement

Personal data that we collect about you when you visit Our Site falls into several categories.

Registration is not required for you to use Our Site. If you are an unregistered visitor, we do not collect any personal data about you, except to the limited extent, as described below (Information that we collect automatically). 

Information that you provide voluntarily

We collect personal data that you provide voluntarily through Our Site, for example, when completing online forms to contact us, subscribing to a newsletter, using one of our online benchmark tools, subscribing to receive marketing communications from us, participating in surveys or registering for events that we are organizing. The information we collect about you may include the following:

• Name
• Job title, job level or job function, role
• Company or organization
• Company data
• Contact information, including primary email address, email address and telephone numbers
• Demographic information, such as industry, country, postcode, preferences and interests
• Other information relevant to client surveys or similar research
• Information pertinent to fulfilling our services to you
• Any other personal data that you voluntarily choose to provide to us

We do not intentionally collect sensitive personal data about you, unless you provide us with such data. While there may be free text boxes on Our Site where you are able to enter any information, we do not intend to process sensitive personal data.  You are not required to provide, and should not disclose, sensitive personal data in the free text boxes. If you choose to provide any sensitive personal data in this manner, you acknowledge your consent to the collection and processing of such personal data.

If you register on Our Site, your personal data will be stored in our CRM (client relationship management) system. Data of registrants is deleted after an individual has not actively engaged with EY for 18 months, or sooner if required by law.

If you have opted out of receiving EY publications, your basic contact details will remain on our opt-out list.

Information that we collect automatically

When you visit Our Site, we collect certain personal data automatically from your device. Specifically, the data we collect automatically include information, such as your IP address, device type, unique device identification number, browser type, operating system, broad geographic location (e.g., country or city-level location) and other technical information. We also collect information about how your device has interacted with Our Site, including the pages accessed, current URL, time you visited the site and links clicked. Collecting this information enables us to better understand the visitors who come to Our Site, where they come from and what content on Our Site is of interest to them. We use this information for our internal analytics purposes, and to improve the quality and relevance of Our Site to our visitors. Information will be collected using cookies and similar tracking technology, as explained further in the EY Cookie Policy. Note that if the “Do Not Track” or “Global Privacy Control” setting in your browser is enabled, Marketing/Targeting cookies will be disabled by default.

Our Site uses Adobe Analytics (“Adobe”) to provide reporting, visualisations and analysis of data. Adobe processes the following types of personal data: your IP address (to populate geo segmentation reports and to identify internal EY and external users accessing Our Site) and user IDs, email addresses, names and passwords to the extent provided directly by visitors of the site. Your personal data will be processed by Adobe for the following purposes: (i) to capture web metrics about the journey of users within Our Site (e.g. pages viewed and links clicked); (ii) to analyze and understand overall site traffic information; (iii) to allow us to make informed decisions about Our Site; and (iv) to authenticate users and permit them to access Our Site. EY Global Services Limited is the data controller for the purposes of this processing and licenses Adobe from Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Saggart, Dublin 24, Ireland, who hosts it in London, United Kingdom. Click here to learn more about Adobe’s privacy practices and to make choices regarding Adobe’s tracking activities.

Our Site also uses various social media plugins.

Purposes for which we process your personal data as a visitor to our site are:

• To administer and manage Our Site, including to confirm and authenticate your identity, and prevent unauthorized access to restricted areas of Our Site
• To personalize and enrich your browsing experience by displaying content (including targeted advertising) that is more likely to be relevant and of interest to you
• To analyze the data of visitors to Our Site and site traffic information
• To analyze the data of visitors to Our Site and site traffic information
• To determine the company, organization, institution or agency that you work for or with which you are otherwise associated
• To develop our business and services
• To provide you with marketing communications, EY Thought Leadership materials and online benchmarking tools
• To conduct benchmarking and data analysis (for example, regarding usage of Our Site and demographic analyses of visitors of Our Site)
• To understand how visitors use the features and functions of Our Site
• To monitor and enforce compliance with applicable terms of use
• To conduct quality and risk management reviews
• To enable the better management of EY events, including World Entrepreneur of the Year
• To enable teams managing events to coordinate their email campaigns and event notifications more effectively
• To allow for event and webinar sign-up
• To allow for content download and lead capturing
• To allow services and information to be delivered effectively to you
• Any other purpose for which you provided information to EY

Legal grounds for processing personal data of visitors of our site are:

• Our legitimate interest in the effective delivery of information and services to the visitor, and the effective and lawful operation of our businesses
• Our legitimate interest in developing and improving Our Site, and the visitor’s user experience, or
• Explicit consent of the visitor 

When you engage us to provide you with professional services, we collect and use personal data when we have a valid business reason to do so in connection with those services. For an overview of our services, click here.

In the context of providing professional services to clients, EY also processes personal data of individuals who are not directly our clients (for example, employees, customers or suppliers of our clients). See the section “Individuals whose personal data we obtain in connection with providing services to our clients” for additional information.

The majority of the personal data we collect and use to provide our services is supplied voluntarily by (or collected by us from third-party sources at the request of) our clients. Because of this, if you are a client of EY, then it will generally be known to you what personal data we collect and use. This information can include:    

• Basic information, such as your name, the company you work for, your position and your relationship to a person
• Contact information, such as your email address and telephone numbers
• Financial information, such as payment-related information
• Any other personal data relating to you or other third parties which the client/ you provide to us for the purpose of receiving our services

We use this information for the following purposes, subject to applicable law:

• To provide services to our clients
• To administer our relationship and maintain contractual relations
• For accounting and tax purposes
• For marketing and business development (only contact information)
• To comply with our legal and regulatory obligations
• To establish, exercise or defend legal rights
• For historical and statistical purposes

Given the diversity of the services we provide, we process many categories of personal data. Please see below (non-exhaustive) examples of personal data categories for our four main service lines:

As part of the professional services EY provides to clients, EY processes personal data of individuals with whom we do not have a direct (contractual or other) relationship. For example, if we perform a statutory audit, our engagement team will be required to audit our client’s books, which could include payroll data for employees of the client, supplier data, financial administration, data regarding claimants and legal proceedings. To take another example: if we undertake a due diligence review of an acquisition of a target on behalf of a client, EY may process personal data concerning the target’s employees, management and customers.

We seek confirmation from our clients that they have the authority to provide personal data to us in connection with the performance of the services and that any personal data they provide to us has been processed in accordance with applicable law.

Given the diversity of services we provide, we process many categories of personal data such as:

• Personal details (such as name, age, data of birth, gender, marital status and country)
• Contact details (such as phone numbers, email address and postal address)
• Financial details (such as salary, payroll, income, investments, benefits and tax status)
• Employment details (such as role, rank, experience, performance data and employment numbers)

For certain services, we may also process sensitive personal data. For example, in certain countries performing tax return services involves the processing of details of payments made by our client, his or her spouse and dependents with respect to a trade union membership, to a political party, for medical treatments or to a religious charity. Such data is collected intentionally and will be used only where necessary in connection with the provision of the service for which the data was collected, such as determining the correct taxation of our client’s income and for claiming the correct tax deduction with respect to such payments.

Legal grounds for processing personal data of individuals whose personal data we obtain in connection with providing services to our clients are:

• Compliance with a legal or regulatory obligation
• Our legitimate interest in making sure our clients are provided with seamless, consistent and high-quality services worldwide

Once a company undergoes an insolvency, one or more EY insolvency practitioners (i.e., administrators and liquidators) could be appointed to manage the company’s affairs, business and property, provided that such services may be provided in the relevant country. Similarly, when a debtor is subject to insolvency or a restructuring regime, one or more EY insolvency practitioners could be appointed to manage the debtor’s affairs, business and property, only in countries where such services may be provided.

In this section:

• Office holder refers to the EY insolvency practitioners.
• Company refers to the insolvent entity for which the office holders have been appointed.
• Debtor refers to the individual who is subject to an insolvency or restructuring regime.
• “You” refers to the data subjects concerned by the insolvency procedure of the company or debtor.

In providing insolvency services, EY processes your personal data for the legitimate interests of assisting the office holders in the performance of their legal and regulatory obligations with regard to the insolvency procedures. For clarity purposes, the company or debtor remains data controller of your personal data processed for purposes that are not related to the legal and regulatory obligations of the office holders.

Most of the personal data we process is obtained from you directly, but we also indirectly obtain personal data about you.

The office holders and EY process your personal data for the following (non- exhaustive) purposes:

• Communicating with the company or debtor’s creditors and individual creditors: specific information essential in order to carry out statutory duties (this information is to be used to assess, for example, an entitlement to any dividend should one be payable)
• Provision of references or reports to government departments, regulatory authorities and appropriate bodies in connection with the holding of public office or responding to requests
• Provision of statutory returns
• Case administration purposes, including the realization of assets, agreement of claims and payment of distributions
• Processing for personal purposes of employees in accordance with the law and the company’s own policies
• Administration of payroll, raising invoices, credit control and other data relating to the company’s finances
• The reasonable and lawful provision of information to interested parties
• The prevention and detection of crime or fraud
• Establishing, exercising or defending legal rights, taking legal advice, taking or defending legal proceedings
• Complying with legal obligations to which the company or debtor is subject
• Quality and risk management purposes

The types of personal data processed for the above purposes include (but are not limited to) name, address, identifying information, payroll information, as well as any information with your dealings with the company or debtor that are necessary for the performance of the office holders’ statutory obligations during the insolvency procedure.

You have certain rights in relation to your personal data. If you have a query or wish to exercise your rights, please make a written request to the party responsible for your personal data (the company, debtor or the office holder) using the contact details provided in communications about the insolvency.

We process personal data about our business contacts such as former, existing and potential clients and individuals employed by, or associated with, clients and other business contacts, such as alumni, consultants, regulators and journalists in our CRM systems.

In our CRM systems, we process the following categories of personal data:

• Name, job title, work address, email address, phone and fax numbers
• Name of employer or organization the individual is associated with

Data of business contacts who have not been actively engaged with EY in the past 18 months will be deleted from our CRM systems. 

Legal grounds for processing personal data of business contacts are:

• Legitimate interest in managing the relationship with our business contacts as described above

EY may process personal data relating to our business contacts for purposes of marketing EY’s services and brand. Such contacts may be sent EY Thought Leadership materials, newsletters, other marketing materials, invites to events, seminars, webinars, surveys etc.

The following categories of personal data and user activities may be processed for marketing purposes:

• Name, job title, email address, phone and fax numbers, and place of work
  
• Name of employer or organization the individual is associated with
• User preferences (such as areas of topics selected for newsletters etc.)
• Opening emails, bounces and opt-outs (unsubscriptions), registration for events, seminars or webinars, attendance or no show at events, seminars or webinars.

Legal grounds for processing personal data for marketing purposes are:

• Your prior consent where this is legally required (e.g. Denmark and Norway), but also when you have provided your consent in other cases.
• In all other cases, we will apply EY’s legitimate interest to provide information about EY and its services to our business contacts in their professional capacity (B2B) and to send invitations to events etc. which we believe are in their professional interest.

All recipients of marketing via electronic communication is offered the possibility to opt out (unsubscribe) from receiving further marketing from EY. If a recipient has opted out from receiving future EY marketing, we will cease processing the personal data for marketing purposes, however the basic contact details of an individual who has opted out will remain on our opt-out list.

We process personal data about participants in EY meetings, conferences, events, seminars, webinars and similar activities (jointly referred to as "events"). We use various applications to manage event registration processes, which applications will contain their own privacy notices explaining why and how personal data is collected and processed by these applications. We encourage participants to refer to the Privacy Notices available on those applications.

As part of our event management processes, we may process the following personal data (but only to the extent applicable and required for the specific event):

• Name, age or date of birth
• Client personnel information (office and business information)
• Credit or debit card number
• Customer information (office and business information)
• Email address
• Gender
• Home or other physical address
• Names of employers
• Occupation (job title)
• Passport number
• Personal web URL (if you have a personal website that you would like to share)
• Telephone or fax numbers
• Event-related data such as: food preferences or other special requirements, registration status, participant status/type, media interview attendance, previous event experience, arrival time/departure time, hotel check-in/check-out time, flight information (airline, arrival and departure dates)

We do not intentionally collect sensitive personal data, unless you provide us with such data (for example, special dietary requirements which reveal your religious affiliation or any food allergies or other data relating to your health necessary to provide support to you at an event, for example, if a wheelchair will be required). We may have collected this information when you signed up for the event or seminar, however such information will be deleted after the event or seminar.

Participants of EY events hosted at external venues are required to bring a photo ID for identification purposes to safeguard our people, assets and information, and to prevent unauthorized people gaining access to off-site EY events.

EY may take photographs and make audio or video recordings (jointly “Recordings”)  in public areas of the EY events, hence personal data of participants to our events may be processed in such Recordings. Recordings may be edited, copied, exhibited, distributed to the participants and/or published in digital as well as in printed media for marketing purposes, however subject to the below stated.

Legal grounds for processing personal data in relation to EY events:

• Legal grounds for processing the personal data referred to above in connection with the administration of EY events is based on consent in accordance with Art. 6 (1) (a) GDPR, which is provided in connection with the registration for the event. The personal data is processed to enable EY to organize, administrate and follow up on events, and to prevent unauthorized people from gaining access to EY events (e.g. by using badges) as well as to protect assets and information that may be available at such events.
• The legal grounds for processing information about specific dietary requirements or allergies provided by a participant in connection with registration for an event is also consent. This information is processed by us to pre-order food and beverages for the event. Such data is deleted after the event.

Legal grounds for processing personal data in form of Recordings of participants to EY events:

• The legal grounds for processing pictures, video recordings etc. of participants to EY events which have been taken in general situations (not close-ups) is that EY has a legitimate interest in accordance with Art. 6 (1) (f) GDPR to process the personal data to inform about and market EY’s business, which overrides the participants’ interests and rights and freedoms, provided that the picture, video recordings etc. is taken in a general situation with no intention to picture any specific individual.
• The legal grounds for processing Recordings of a specific participant to an EY event (a close-up) for example when interviewing a participant to an event, is consent in accordance with Art. 6 (1) (a) GDPR, i.e. the participant has given his/her consent to the processing of Recordings in which the participant occurs for the stated purpose. In such case, EY will obtain and document the consent provided by the participant

We provide external users access to various applications managed by us (such as the EY Client Portal and My EY platform).  In instances where such applications process personal data that goes beyond basic contact information used for application authentication purposes, such applications will contain their own privacy notices explaining why and how personal data is collected and processed by those applications. We encourage individuals using our applications to refer to the privacy notices available on those applications.

When you communicate with EY via email, EY will process your personal data, such as your name, email address, place of work and other contact information provided by you in the email as well as information and data in the email that can be linked to identifiable individuals. EY will also process the email address of other individuals being a recipient of the email or on cc or bcc to the email.

The personal data may be processed for different purposes, for example for provision of professional services (for further information about the processing and the legal grounds click on Individuals whose personal data we obtain in connection with providing services to our clients), to administrate our supplier contracts (for further information about the processing and legal grounds click on Suppliers), or in connection with recruitment (for further information about the processing and legal grounds click on Job Applicants).

Further, EY uses a variety of tools to maintain the security of our IT infrastructure, including our email facilities. Examples of such tools are:

• Systems that scan incoming emails to EY recipients for suspicious attachments and URLs, in order to prevent malware attacks
• Tools that provide end-point threat detection to detect malicious attacks
• Tools that block certain content or websites

Legal grounds for processing personal data of individuals who correspond with EY via email:

• Our legitimate interest in protecting our IT infrastructure against unauthorized access or data leakage
• Our legitimate interest in analyzing email traffic

EY’s phone service is hosted internally at EY. When you call EY personnel, only your phone number will be stored on EY servers and will be delivered to the recipient of your call on their handset and via an email. No other personally identifiable information is collected but technical logs and reports may be stored for trouble shooting purposes.

EY’s voicemail service is provided by Microsoft. When you call EY personnel and leave a voicemail, this voicemail and any personal data contained within it will be stored on global Microsoft Azure servers and will be delivered to the recipient of your call as an MP3 voice clip in an email. Microsoft will not keep call logs in relation to your calls to EY personnel.

Legal grounds for processing personal data of individuals who correspond with EY via phone and voicemail services:

Our legitimate interest in maintaining communication networks.

We collect information from and about candidates in connection with available employment opportunities at EY. The information that we collect, the manner in which it is used, and the timing in which it is gathered varies depending on the country in which you apply.  As general matter, the personal data we collect regarding our job applicants includes names, age, gender, email address, telephone number, resumes or CVs, academic records, work history, employment information and references (if provided).

We use your personal data to match your skills, experience and education with specific roles offered by EY.  This information is passed to the relevant hiring managers and persons involved in the recruitment process to decide whether to invite you for an interview.  EY will collect further information if you are invited to the interview (or equivalent) stage and onward. Such information includes interview notes, references, assessment results, feedback and offer details.

In connection with our recruitment activities including applications and onboarding, we may also collect sensitive personal data from candidates, however only where we have a legal obligation to do so. This information is collected if it is relevant to the future working environment at EY or the future provision of employment benefits, or with the individual's explicit consent. Once onboarded, this information may need to be used to provide a suitable working environment. We may also conduct, however only if permitted by applicable law, criminal background checks for certain candidates to assess their eligibility to work at EY or for EY clients. 

Our recruitment tools and websites contain their own Privacy Notices explaining why and how personal data is collected and processed by those applications. We encourage individuals using our recruitment tools and websites to refer to the privacy notices available on those tools and websites.

Depending on the country in which you apply, EY collects personal data about candidates (“you”) from the following sources:

• Directly from you – for example, information that you have provided when applying for a position directly through the EY careers website (for additional information about the processing of your personal data via our global recruitment management system, please read the data privacy statement available in this system)
• From recruitment agencies – for example, when a recruitment agency with your details contacts us to suggest you as a potential candidate;
• Through publicly available sources online – for example, where you have a professional profile posted online (e.g., on your current employer's website or on a professional networking site, such as LinkedIn)
• By reference – for example, through a reference from a former employee or employer, or from a referee you have identified
• Results of background checks

Legal grounds for processing personal data of our job applicants are:

• Explicit consent of the candidate
• Our legitimate interest in attracting, identifying and sourcing talent
• Our legitimate interest to process and manage applications for roles at EY, including the screening and selecting of candidates
• Our legitimate interest to hire and onboard candidates by making an offer to successful candidates, and carrying out pre-employment background checks
• Our legitimate interest to manage our career websites (including conducting statistical analyses)
• Compliance with a legal or regulatory obligation (when carrying out background checks to warrant a candidate is eligible to work)

EY hopes to maintain a lifelong, mutually beneficial relationship with EY alumni (former member firm partners, employees and contractors). If we invite you to our alumni community, your name, contact details, role, last EY office, rank, service line and country will be used to create a record for you in one of our alumni databases, unless you have indicated that you are not interested in participating in the EY alumni program. You have the opportunity to create a more detailed profile and to decide how much additional information you wish to share with EY and the wider alumni community.

Our alumni databases contain their own privacy notices explaining why and how personal data is collected and processed by those applications. We encourage individuals using our alumni databases to refer to the privacy notices available on those applications.

The legal grounds for processing personal data of our alumni are:

• Explicit consent of the alumnus
• Our legitimate interest in maintaining a strong relationship with our alumni, sending publications about EY and our services, inviting alumni to events, and helping alumni keeping in touch with other alumni

We process personal data about our suppliers (including subcontractors, and individuals associated with our suppliers and their subcontractors) in order to manage our relationship and contract, and to receive services from our suppliers.

The personal data we process is generally limited to contact information (name, name of employer, phone, email and other contact details) and if relevant financial information (payment-related information).

In addition, we also use data about our suppliers to check whether we have a conflict of interest or audit independence restriction to appointing a supplier. Before we take on a new supplier, we also carry out audit independence and other background checks required by law or regulation, for example, adverse media, bribery and corruption, and financial checks.

Legal grounds for processing personal data of our suppliers may be:

• Performance of a contract
• Compliance with a legal or regulatory obligation
• Our legitimate interest in managing payments, fees and charges, and to collect and recover money owed to EY
• Our legitimate interest in understanding any conflict of interest or challenge with regard to independence legislation
• Our legitimate interest in safeguarding against EY inadvertently dealing with the proceeds of criminal activities or assist in any other unlawful or fraudulent activities (for example, terrorism)

EY/Ethics provides EY people, clients and others outside of EY with a means to confidentially, and either anonymously or on a disclosed basis, report an activity that involves unethical or illegal behavior that is in violation of professional standards or otherwise inconsistent with our EY Global Code of Conduct. Reports can be made either online or via a telephone hotline.

EY/Ethics contains its own privacy notice and consent form which describes the practices EY follows in relation to EY/Ethics. We encourage individuals using EY/Ethics to refer to the EY/Ethics privacy notice and consent form.

When you visit an EY office, we process your personal data in order to provide you with certain facilities (such as access to our buildings and conference rooms or Wi-Fi), to control access to our buildings, and to protect our offices, personnel, goods and confidential information (for example, by using CCTV).

The personal data we collect is generally limited to your name, contact information, location, and the time you enter and leave our office.

Visitor records and access badges

We require visitors to our offices to sign in at reception and we keep that record of visitors for a short period of time. Visitors to our offices are provided with a temporary access badge to access our offices. Our visitor records will be used to verify that access badges are returned, to look into a security incident and for emergency purposes (for example, if an office needs to be evacuated).

Wi-Fi

We monitor and log traffic on our Wi-Fi networks. This allows us to see limited information about a user’s network behavior but will also include being able to see at least the source and destination addresses the user is connecting from and to.

CCTV

EY may use CCTV monitoring when permitted by applicable law. CCTV images are securely stored and only accessible on a need-to-know basis (for example, to look into an incident). As a general rule we are allowed to disclose CCTV images to law enforcement bodies upon their request. CCTV recordings are typically deleted or automatically overwritten after a short period of time unless an issue is identified that requires further investigation. For more specific information, see the CCTV privacy notices below.

Privacy notice for CCTV at EY's office in Copenhagen

Privacy notice for CCTV at EY's office in Stockholm

Legal grounds for processing personal data of visitors to EY offices are:

Our legitimate interest in protecting our offices, personnel, goods and confidential information

Our legitimate interest in preventing and detecting crime, and establishing, exercising and defending legal claims