Data protection privacy policies for applicants

Last updated: 04/09/2026

1. Introduction

We are Ernst & Young LLP (“EY”) (“we” or “us”) and are registered in England and Wales under registration number OC300001. Our registered office is at 1 More London Place, London, SE1 2AF, United Kingdom.

This notice explains how we will handle any personal data that you provide, or we otherwise obtain in connection with your application for a job with us. For the purposes of data protection law, we are the ‘controller’ of this personal data.

2. Why do we need your personal data?

EY relies on the following legal bases to process your personal data:

Where processing is necessary for the purpose of legitimate interest pursued by the controller. EY has a legitimate interest in running an effective recruitment process.
Where processing is necessary for the performance of a contract in order to take steps at the request of the data subject prior to entering into a contract. Your personal data will be processed by the Tool for the next steps to entering into a contract.

Your information may be processed for the purpose of ensuring Participation Rules have been followed. For more information, please review the Participation Rules and our privacy policies for applicants.

3. What type of personal data is processed?

In this section we have set out:

o the general categories of personal data that we will process in connection with your application;

o the purposes for which we may process that personal data; and

o the legal basis for that processing.

This data is sourced from you directly, and other third parties, such as EY suppliers and subcontractors for the purposes of providing the service to you and per EY’s legitimate interests. For further information, please refer to our privacy policies for applicants.


Personal data collected	Reason for processing	Lawful basis for the processing	Basis for processing special categories of personal data or data relating to criminal convictions and offences
Registration data: full name, email address, username and password	Creating a user account for you, enabling you to access your account once created, keeping your account secure and communicating with you in connection with your application.	Performance of a contract - enabling applicants to submit, and us to receive and review applications for jobs with us. EY’s legitimate interest in processing and managing applications for roles at EY, including the screening and selection of candidates	N/A
Required verification data: Passport number, passport expiry date, university early career ID number, and university or school admissions team contact names	This information is required to verify your identity at point of offer to avoid against false or suspicious applications	EY’s legitimate interest in avoiding false, suspicious, or fraudulent activity within Early Careers applications to EY.
Username, email address, and Application data	Contacting you about subsequent job opportunities with us in the event that your application for this recruitment round is unsuccessful	EY’s legitimate interest in processing and managing applications for roles at EY, including the screening and selection of candidates If you do not want us to use your username, email address, and Application Data in this way, you can request we stop at any time by sending us an email	N/A
Application data: contact details, educational and employment history, information about your skills, qualifications and experience and any other information we ask you to provide and/or which you choose to provide in your answers	For the purposes of considering your application for a job with us and communicating with you in connection with your application	Performance of a contract - assessing the suitability of applicants for jobs with us EY’s legitimate interest in processing and managing applications for roles at EY, including the screening and selection of candidates	N/A
Equal opportunities data: Age, Gender, Race or ethnic origin, Religion or belief, Disability, Sexual Orientation and socio-economic information	The processing of Age is mandatory. The remaining information is optional We may process equal opportunities data for the purposes of monitoring and promoting equal opportunities within our organisation, complying with our obligations under laws relating to equal opportunities in employment	EY’s legitimate interest in human resource administration and finance Compliance with a legal obligation	Equal opportunities data (e.g., information relating to race or ethnicity, religion, health, and sexual orientation): processing is necessary in the field of employment, social security and social protection law; processing is necessary for reasons of substantial public interest and the relevant substantial public condition under the Data Protection Act 2018 is monitoring equality of opportunity and treatment
Criminal convictions data: information relating to unspent criminal convictions or offences	We may process criminal convictions data for the purposes of considering your suitability for the job that you are applying for	Compliance with a legal obligation (basic criminal record checks are regulatory requirements for most roles) EY’s legitimate interest in hiring, promoting or assigning people to engagements that are trustworthy and suited for the role	To the extent criminal data is processed: processing is necessary in the field of employment law; processing is necessary for the purposes of preventing fraud and regulatory requirements relating to, amongst other things, unlawful acts and dishonesty
Reasonable adjustments data: information related to whether you require any reasonable adjustments	We will not ask you for details of any relevant disability or health condition, but you may tell us if you consider that it is necessary for us to know this information	Performance of a contract - assessing the suitability of applicants for jobs with us Compliance with a legal obligation	Equal opportunities data (information relating to health): processing is necessary in the field of employment, social security and social protection law; processing is necessary for reasons of substantial public interest and the relevant substantial public condition under the Data Protection Act 2018 is monitoring equality of opportunity and treatment
Assessment data: your answers and the results of the assessment and data generated by the assessment system	The source of the assessment data is you and the automated testing system used by us or our assessment service providers. We may process this assessment data for the purposes of assessing your suitability for the job you have applied for and your adherence with our Participation Rules, which may include checks against collusion, plagiarism, and use of OpenAI software. Assessment data is captured within two platforms called SHL and TopScore. Please refer to our privacy policies for applicants.	EY’s legitimate interests - assessing the suitability of applicants for jobs with us, including adherence to EY’s Participation Rules.	N/A
Interview data: information about you recorded following an interview	The source of the interview data is you and the interviewers and/or assessors. This interview data may be processed for the purposes of assessing your suitability for the job you are applying for	Performance of a contract - assessing the suitability of applicants for jobs with us EY’s legitimate interests - assessing the suitability of applicants for jobs with us	N/A
Reference data: relating to your education history, employment history, your character, and your performance at work	The source of the reference data is the referees that you specify in your application. This reference data may be processed for the purposes of considering your application	EY’s legitimate interests - assessing the suitability of applicants	N/A
Contact Data: information contained in or relating to any communication that you send to us or that we send to you in connection with your application	For the purposes of communicating with you, responding to your queries, providing you with assistance in relation to your application, administering your application and our own record-keeping. If you receive an offer of employment from EY, you may be invited to join our online onboarding community	Performance of a contract - proper administration of our business, recruitment in connection with our business and communications with relevant persons	N/A
Use of personal data in connection with legal claims - personal data identified in this table	Where necessary for the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure	EY’s legitimate interests - in the establishment, exercise, or defence of legal claims	To the extent criminal data is processed: processing is necessary in the field of employment law; processing is necessary for the purposes of preventing fraud and regulatory requirements relating to, amongst other things, unlawful acts and dishonesty To the extent special categories of personal data are processed: processing is necessary in the field of employment, social security and social protection law; processing is necessary for the establishment, exercise or defence of legal claims
Proctoring data inc. interaction data, image and IP address	Supervision features (outlined in Participation Rules) are in use throughout our assessments to verify your identity, analyse your conduct during the assessment, and protect the integrity of EY’s recruitment process. We may process this data for the purposes of assessing your eligibility to re-sit an assessment and your adherence with our Participation Rules, which may include checks against collusion, plagiarism, and use of OpenAI software.	EY’s legitimate interests - assessing the suitability of applicants for jobs with us, including adherence to EY’s Participation Rules.	N/A

If your application is successful and you become an EY employee, we will provide a new privacy notice to you explaining our processing of employee personal data, which will supersede this notice.

4. Providing your personal data to others

EY Network: We may disclose the personal data described in section 3 to any relevant members of the global network of Ernst & Young firms if and insofar as this is reasonably necessary for the purposes set out in this notice.

Our insurers and professional advisers: We may disclose the personal data described in section 3 to our insurers and/or professional advisers if and insofar as reasonably necessary for the purposes of obtaining and maintaining insurance coverage, managing risks, obtaining professional advice and managing legal disputes.

Our suppliers and subcontractors: Personal data described in section 3 will be shared with EY suppliers and subcontractors for the purposes of providing the service to you.

For further information, please refer to our privacy policies for applicants.

AmberTrack

AmberTrack is the name of the system on which your application will be processed. AmberTrack is created and owned by AmberJack Global Limited (“AmberJack”). All personal data obtained through AmberTrack will be shared with and processed by AmberJack per EY’s legitimate interest in assessing your suitability for the job you are applying for.

This system hosts all Early Careers applicant information, including data from EY suppliers and subcontractors for the purposes of scheduling, conducting, and reporting on stages in the recruitment process.

Members of AmberJack’s staff (employees and contractors) will also access and process some of the personal data described in section 3 insofar as is reasonably necessary to carry out their allocated tasks in relation to this recruitment. AmberJack uses Microsoft Corporation, Amazon Web Services and Prodec Networks Ltd to host the online application system.

Their processing is generally fully automated and does not involve individual staff accessing personal data, although this might happen in certain circumstances, such as when necessary to provide support services to AmberJack or when required by law to disclose certain information. Some of the personal data may also be shared with providers of online testing, such as SHL and TopScore, to be used as part of our assessment of applicants, insofar as is reasonably necessary to enable applicants to take the test/s and for the supplier to provide us with the results of the test/s.

SHL

SHL is the platform on which online assessments, prior to assessment centre and interview stages, will be conducted. Your personal data is required so you may undertake the relevant required assessments for your application with us. Your name, email address, and images are used so that we can match your assessment results to your application. Your information may be processed for the purpose of ensuring Participation Rules have been followed. SHL is integrated with AmberJack for the purposes of sharing assessment results directly with the candidate application. EY undertakes automated decision-making regarding applications based on assessment results from SHL Group Limited, but does not undertake any AI-based decision making. EY may share sensitive personal data from AmberTrack with SHL for reporting and analytics purposes and to ascertain a fair assessment process for all candidates. All data is shared securely and anonymously with SHL; SHL is not able to identify individuals based on the information they receive.

RARE

RARE is an optional service enabling applicants to have their application reviewed in context of their socio-economic background. An anonymised report is generated which contextualises each candidate’s academic performance against their socioeconomic background, highlighting exceptional achievement relative to opportunity. This is used during application screening, but not during final hiring stages.

TopScore

TopScore is the platform on which any relevant virtual assessment centre and final interview events are scheduled, conducted, and scored, where these are not being assessed in person. Your name, email address, images and ID are used so that we can match your assessment results to your application. Your information may be processed for the purpose of ensuring Participation Rules have been followed.

Enboarder

Enboarder is a software platform used to enhance the onboarding and pre-boarding experience for new hires by providing personalised communication and interactive features. Candidates accepting an offer of employment from EY will be contacted via Enboarder and may opt into sharing additional personal data and images.

5. International transfers of your personal data

In this section, we provide information about the circumstances in which your personal data may be transferred to countries outside the UK and European Economic Area (EEA).

Personal data may be transferred in various jurisdictions (including jurisdictions outside the UK and European Union) in which EY operates (EY office locations are listed at www.ey.com/ourlocations). EY will process your personal data in accordance with applicable law and professional regulations in your jurisdiction. Transfers of personal data within the EY network are governed by EY’s Binding Corporate Rules (www.ey.com/bcr).

6. Data retention

This section sets out our data retention policies and procedure, which are designed to help ensure that we comply with our legal obligations in relation to the retention and deletion of personal data.

Our policy is to retain personal data only for as long as it is needed for the purposes described in section 2. Retention periods vary in different jurisdictions and are set in accordance with local regulatory and professional retention requirements. In order to meet our professional and legal requirements, to establish, exercise or defend our legal rights and for archiving and historical purposes, we need to retain information for significant periods of time. Your personal data will be retained in compliance with privacy laws and regulations.

Successful applicants: personal data that you provide, or we otherwise obtain in connection with your application for a job, will be retained in line with our employee privacy notice, which will be provided to you along with your job offer
Unsuccessful applicants: personal data that you provide, or we otherwise obtain in connection with your application for a job, will be retained for as long as necessary following the end of EY’s current recruitment cycle (each cycle ends 30 September) to comply with regulatory requirements and internal audits. For these purposes, EY retains secure copies of pseudo-anonymised reports in which a unique candidate identification number is the only identifier.

Notwithstanding the other provisions of this section 6, we may retain your personal data where such retention is necessary for compliance with a legal obligation to which we are subject, in order to protect your vital interests or the vital interests of another natural person, or for the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure. In these circumstances we will only retain personal data for as long as is necessary for the relevant purposes and in any event for no longer than 7 years.

7. Security

EY is committed to making sure your personal data is secure. To prevent unauthorized access or disclosure, EY has technical and organizational measures to safeguard and secure your personal data. All EY personnel and third parties EY engage to process your personal data are obliged to respect your data’s confidentiality.

8. Your rights

In this section, we have summarised the rights that you have under data protection law. Some of the rights are complex, and not all of the details have been included in our summaries. Accordingly, you should read the relevant laws and guidance from the regulatory authorities for a full explanation of these rights.

Your principal rights under data protection law in respect of your personal data that we process are:

Right of access. You have the right to obtain a copy of your personal data;
Right to rectification. You have the right to have your personal data amended if it is inaccurate;
Right to erasure. In certain circumstances, you have the right to require us to erase your personal data if the continued processing of that personal data is not justified;
Right to restriction. In certain circumstances, you have the right to require us to limit the purposes for which we process your personal data if the continued processing of the personal data in this way is not justified, such as where the accuracy of the personal data is contested by you; and
Right to portability: In certain circumstances, you have the right to receive a copy of the personal data you have provided to us in a structured, commonly used, machine-readable format or to request the transfer of your personal data to another person.

You also have a right, in some circumstances, to object to any processing based on our legitimate interests. There may, however, be compelling reasons for continuing to process your personal data and we will assess and inform you if that is the case.

Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under the applicable law apply.

You may exercise any of your rights in relation to your personal data by emailing global.data.protection@ey.com

9. Controlling your personal data

EY will not transfer your personal data to third parties (other than our suppliers and subcontractors mentioned above) unless we have your permission or are required by law to do so. You are legally entitled to request details of EY’s personal data about you.

To confirm whether your personal data is processed in the Tool or to access your personal data in the Tool, contact your usual EY representative or email your request to global.data.protection@ey.com.

10. Complaints

If you are concerned about an alleged breach of privacy law or any other regulation, contact EY’s Global Privacy Officer, Office of the General Counsel, 1 More London Place, London, SE1 2AF, United Kingdom or via email at global.data.protection@ey.com or via your usual EY representative. An EY Privacy Officer will investigate your complaint and provide information about how it will be handled and resolved.

If you are not satisfied with how EY resolved your complaint, you have the right to complain to your country’s data protection authority. You can also refer the matter to a court of competent jurisdiction.

Certain EY member firms in countries outside the European Union (EU) have appointed a representative in the EU to act on their behalf if, and when, they undertake data processing activities to which the EU General Data Protection Regulation (GDPR) applies. Further information and the contact details of these representatives are available here.

11. Contact us

If you have additional questions or concerns, contact your usual EY representative or email global.data.protection@ey.com.

12. Updates to this Notice

We may update this notice at any time. If we do so, we will publish an updated copy here as soon as reasonably practical. Further, refer to the top of this notice for the date when it was last updated.

Last updated: 04/09/2026

1. Introduction

This Privacy Notice is intended to describe the practices EY follows in relation to AmberTrack (“Tool”) with respect to the privacy of all individuals whose personal data is processed and stored in the Tool.

2. Who manages the Tool?

“EY” refers to one or more of the member firms of Ernst & Young Global Limited (“EYG”), each of which is a separate legal entity and can act as a data controller in its own right. The entity that is acting as data controller (or similar capacity) by providing the Tool on which your personal data will be processed and stored is Ernst & Young LLP, 1 More London Place, London, SE1 2AF (“EY”) (“we” or “us”). EY licenses the Tool from AmberJack Global Limited, Newbury House, 20 King Road, West Berkshire, RG14 5XR, United Kingdom.

The Tool is hosted on servers in the UK.

3. Why do we need your personal data?

The Tool hosts and manages the EY UK Early Careers recruitment application process. Your personal data processed in the Tool is used to host all relevant information relating to your application with EY.

EY relies on the following legal bases to process your personal data:

Where processing is necessary for the purpose of legitimate interest pursued by the controller. EY has a legitimate interest in running an effective recruitment process.
Where processing is necessary for the performance of a contract in order to take steps at the request of the data subject prior to entering into a contract. Your personal data will be processed by the Tool for the next steps to entering into a contract.

Your information may be processed for the purpose of ensuring Participation Rules have been followed. For more information, please review the Participation Rules and our privacy policies for applicants.

4. What type of personal data is processed in the Tool?

The Tool processes the personal data categories set out in the table below.

This data is sourced from you directly, and other third parties, such as EY suppliers and subcontractors for the purposes of providing the service to you and per EY’s legitimate interests. For further information, please refer to our privacy policies for applicants.


Personal data collected	Reason for processing	Lawful basis for the processing	Basis for processing special categories of personal data or data relating to criminal convictions and offences
Registration data: full name, email address, username and password	Creating a user account for you, enabling you to access your account once created, keeping your account secure and communicating with you in connection with your application.	Performance of a contract - enabling applicants to submit, and us to receive and consider, applications for jobs with us. EY’s legitimate interest in processing and managing applications for roles at EY, including the screening and selection of candidates.	N/A
Required verification data: Passport number, passport expiry date, university Student ID number, and University or school admissions team contact names	This information is required to verify your identity at point of offer to avoid against false or suspicious applications	EY’s legitimate interest in avoiding false, suspicious, or fraudulent activity within Early Careers applications to EY.
Username, email address, and Application data	Contacting you about subsequent job opportunities with us in the event that your application for this recruitment round is unsuccessful	EY’s legitimate interest in processing and managing applications for roles at EY, including the screening and selection of candidates If you do not want us to use your username, email address, and Application Data in this way, you can request we stop at any time by sending us an email	N/A
Application data: contact details, educational and employment history, information about your skills, qualifications and experience and any other information we ask you to provide and/or which you choose to provide in your answers	For the purposes of considering your application for a job with us and communicating with you in connection with your application	Performance of a contract - assessing the suitability of applicants for jobs with us EY’s legitimate interest in processing and managing applications for roles at EY, including the screening and selection of candidates	N/A
Equal opportunities data: Age, Gender, Race or ethnic origin, Religion or belief, Disability and Sexual Orientation	The processing of Age is mandatory. The remaining information is optional. We may process equal opportunities data for the purposes of monitoring and promoting equal opportunities within our organisation, complying with our obligations under laws relating to equal opportunities in employment	EY’s legitimate interest in human resource administration and finance Compliance with a legal obligation	Equal opportunities data (e.g., information relating to race or ethnicity, religion, health, and sexual orientation): processing is necessary in the field of employment, social security and social protection law; processing is necessary for reasons of substantial public interest and the relevant substantial public condition under the Data Protection Act 2018 is monitoring equality of opportunity and treatment
Criminal convictions data: information relating to unspent criminal convictions or offences	We may process criminal convictions data for the purposes of considering your suitability for the job that you are applying for	Compliance with a legal obligation (basic criminal record checks are regulatory requirements for most roles). EY’s legitimate interest in hiring, promoting or assigning people to engagements that are trustworthy and suited for the role	To the extent criminal data is processed: processing is necessary in the field of employment law; processing is necessary for the purposes of preventing fraud and regulatory requirements relating to, amongst other things, unlawful acts and dishonesty
Reasonable adjustments data: information related to whether you require any reasonable adjustments	We will not ask you for details of any relevant disability or health condition, but you may tell us if you consider that it is necessary for us to know this information	Performance of a contract - assessing the suitability of applicants for jobs with us. Compliance with a legal obligation	Equal opportunities data (information relating to health): processing is necessary in the field of employment, social security and social protection law; processing is necessary for reasons of substantial public interest and the relevant substantial public condition under the Data Protection Act 2018 is monitoring equality of opportunity and treatment
Assessment data: your answers and the results of the assessment and data generated by the assessment system.	The source of the assessment data is you and the automated testing system used by us or our assessment service providers. We may process this assessment data for the purposes of assessing your suitability for the job you have applied for and your adherence with our Participation Rules, which may include checks against collusion, plagiarism, and use of OpenAI software. Assessment data is captured within two platforms called SHL and TopScore. Please refer to our privacy policies for applicants.	EY’s legitimate interests - assessing the suitability of applicants for jobs with us, including adherence to EY’s Participation Rules.	N/A
Interview data: Information about you recorded following an interview	The source of the interview data is you and the interviewers and/or assessors. This interview data may be processed for the purposes of assessing your suitability for the job you are applying for	Performance of a contract - assessing the suitability of applicants for jobs with us EY’s legitimate interests - assessing the suitability of applicants for jobs with us	N/A
Contact Data: information contained in or relating to any communication that you send to us or that we send to you in connection with your application	For the purposes of communicating with you, responding to your queries, providing you assistance in relation to your application, administering your application and our own record-keeping. If you receive an offer of employment from EY, you may be invited to join our online onboarding community.	Performance of a contract - proper administration of our business, recruitment in connection with our business and communications with relevant persons	N/A
Proctoring data inc. interaction data, image and IP address	Supervision features (outlined in Participation Rules) are in use throughout EY assessments to analyse your conduct during the assessment and protect the integrity of EY’s recruitment process. We may process this data for the purposes of assessing your eligibility to re-sit an assessment and your adherence with our Participation Rules, which may include checks against collusion, plagiarism, and use of OpenAI software.	EY’s legitimate interests - assessing the suitability of applicants for jobs with us, including adherence to EY’s Participation Rules.	N/A

5. Providing your personal data to others

EY Network: We may disclose the personal data described in section 4 to any relevant members of the global network of Ernst & Young firms if and insofar as this is reasonably necessary for the purposes set out in this notice.

EY suppliers and subcontractors: Personal data described in section 4 will be shared with and/or processed by EY suppliers and subcontractors for the purposes of providing the service to you.

For further information, please refer to our privacy policies for applicants.

6. Special Category Personal Data

Special category personal data reveals your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning sex life or sexual orientation.

The following special category personal data is collected and processed in the Tool should you wish to submit the below information:

Racial or ethnic origin
Sexual orientation
Religion or belief
Health (e.g. disabilities)

The provision of information relating to criminal convictions is mandatory for compliance with legal obligations – see section 4 for more information.

7. Who can access your information?

Your personal data is accessed in the Tool by the following persons/teams:


Organisation (EY, Client name, Third party name)	EY employee, Client employee, Third party employee, Public	Number of individuals with access (estimated if exact number unknown)	Location of individuals with access	Reason for access	Level of access
EY Talent Acquisition	Specific EY employees	50	UK	Admin user	Admin
EY Talent Shared Services	Specific EY employees	50	UK	Admin User	Admin
IBM	Third Party	50	Philippines	EY Helpline support	Admin
Ambertack	Third Party	50	UK	Account management and customer support	Admin
Candidates	Public		Global	Completing applications	Candidate access only

The access rights detailed above involves transferring personal data in various jurisdictions (including jurisdictions outside the European Union) in which EY operates (EY office locations are listed at www.ey.com/ourlocations). EY will process your personal data in the Tool in accordance with applicable law and professional regulations in your jurisdiction. Transfers of personal data within the EY network are governed by EY’s Binding Corporate Rules (www.ey.com/bcr).

We transfer or disclose the personal data we collect to third-party service providers (and their subsidiaries and affiliates) who are engaged by us to support our internal ancillary processes. For example, we engage service providers to provide, run and support our IT infrastructure (such as identity management, hosting, data analysis, back-up, security and cloud storage services) and for the storage and secure disposal of our hard copy files. It is our policy to only use third-party service providers that are bound to maintain appropriate levels of data protection, security and confidentiality, and that comply with any applicable legal requirements for transferring personal data outside the jurisdiction in which it was originally collected.

To the extent that personal data has been rendered anonymous in such a way that you or your device are no longer reasonably identifiable, such information will be treated as non-personal data and the terms of this Privacy Notice will not apply.

8. Data retention

Our policy is to retain personal data only for as long as it is needed for the purposes described in section 3. Retention periods vary in different jurisdictions and are set in accordance with local regulatory and professional retention requirements. In order to meet our professional and legal requirements, to establish, exercise or defend our legal rights and for archiving and historical purposes, we need to retain information for significant periods of time. Your personal data will be retained in compliance with privacy laws and regulations.

Personal data that you provide will be retained up to 6 months after the end of EY’s current recruitment cycle (each cycle ends 30 September). Depending on when you apply, your data may be kept up to 18 months. After the end of the data retention period or when the purpose for processing (see section 3 above) is complete, your personal data will be deleted from the Tool.

9. Security

EY is committed to making sure your personal data is secure. To prevent unauthorized access or disclosure, EY has technical and organizational measures to safeguard and secure your personal data. All EY personnel and third parties EY engage to process your personal data are obliged to respect your data’s confidentiality.

10. Controlling your personal data

EY will not transfer your personal data to third parties (other than any external parties referred to in sections 5 and 7 above) unless we have your permission or are required by law to do so. You are legally entitled to request details of EY’s personal data about you.

To confirm whether your personal data is processed in the Tool or to access your personal data in the Tool, contact your usual EY representative or email your request to global.data.protection@ey.com.

11. Your rights

You can confirm your personal data is accurate and current. You can request rectification, erasure, restriction of processing or a readily portable copy of your personal data.

You also have a right, in some circumstances, to object to any processing based on our legitimate interests. There may, however, be compelling reasons for continuing to process your personal data and we will assess and inform you if that is the case.

Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under the applicable law apply.

You may exercise any of your rights in relation to your personal data by emailing global.data.protection@ey.com

12. Complaints

If you are concerned about an alleged breach of privacy law or any other regulation, contact EY’s Global Privacy Leader, Office of the General Counsel, 1 More London Place, London, SE1 2AF, United Kingdom or via email at global.data.protection@ey.com or via your usual EY representative. An EY Privacy Leader will investigate your complaint and provide information about how it will be handled and resolved.

If you are not satisfied with how EY resolved your complaint, you have the right to complain to your country’s data protection authority. You can also refer the matter to a court of competent jurisdiction.

13. Contact us

If you have additional questions or concerns, contact your usual EY representative or email global.data.protection@ey.com.

14. Updates to this Notice

We may update this notice at any time. If we do so, we will publish an updated copy here as soon as reasonably practical. Further, refer to the top of this notice for the date when it was last updated.

Last updated: 04/09/2026

1. Introduction

This Privacy Notice is intended to describe the practices EY follows in relation to Enboarder Limited (“Tool”) with respect to the privacy of all individuals whose personal data is processed and stored in the Tool.

2. Who manages the Tool?

“EY” refers to one or more of the member firms of Ernst & Young Global Limited (“EYG”), each of which is a separate legal entity and can act as a data controller in its own right. The entity that is acting as data controller by providing the Tool on which your personal data will be processed and stored is Ernst & Young LLP, 1 More London Place, London, SE1 2AF (“EY”) (“we” or “us”).

The Tool is hosted on servers in the UK and Germany.

3. Why do we need your personal data?

Enboarder is a software platform used by EY to enhance the onboarding and pre-boarding experience for new hires by providing personalised communication and interactive features. The Tool is designed to facilitate engagement among users, enabling future employees to network before their official start date.

EY relies on the following legal bases to process your personal data:

Where processing is necessary for the purpose of legitimate interest pursued by the controller. EY has a legitimate interest in running an effective recruitment process.

Where processing is necessary for the performance of a contract in order to take steps at the request of the data subject prior to entering into a contract. Your personal data will be processed by the Tool for the next steps to entering into a contract.

Personal data is primarily used to contact the user following their acceptance of an offer; this communication provides details about the next steps in the onboarding journey and information about EY, including assistance related to employment.

Optional personal information directly sourced from the user, including image and LinkedIn profile URL, is utilised, where provided, to help users build connections and foster a sense of community within their cohort.

Employment data such as job title, role alignment, and office location, is sourced from the EY Employee file and is used to provide information about key contacts and to facilitate networking within the cohort.

4. What type of personal data is processed in Enboarder?

The Tool processes the personal data categories set out in the table below.

This data is sourced from you directly, and other third parties, such as EY suppliers and subcontractors for the purposes of providing the service to you and per EY’s legitimate interests. For further information, please refer to our privacy policies for applicants.


Personal data collected	Reason for processing	Lawful basis for the processing	Basis for processing special categories of personal data or data relating to criminal convictions and offences
Application Data: Full Name, Email Address, Phone Number, Address	Creating a user account in Enboarder enabling end user to access the account once created and communicating with the user in connection with their employment at EY	Performance of a contract	N/A
Personal information directly sourced from the user: Personal photo, LinkedIn profile URL	Data is utilised to help users build connections and foster a sense of community within their cohort	Legitimate Interests	N/A
Employment data sourced from the EY Employee file: Full Name, Job Title, Service line, Sub service line and office location. This data is sourced directly from EY systems.	Data is used to provide information about key contacts and to facilitate networking within the cohort	Performance of a contract	N/A

5. Providing your personal data to others

EY Network: We may disclose the personal data described in section 4 to any relevant members of the global network of Ernst & Young firms if and insofar as this is reasonably necessary for the purposes set out in this notice.

6. Special Category Personal Data

Special category personal data reveals your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning sex life or sexual orientation.

EY does not intentionally collect any special category personal data from you via the Tool. There is no intention of processing such information.

7. Who can access your information?

Your personal data is accessed in the Tool by the following persons/teams:


Organisation (EY, Client name, Third party name)	EY employee, Client employee, Third party employee, Public	Number of individuals with access (estimated if exact number unknown)	Location of individuals with access	Reason for access	Level of access
EY Talent Acquisition	Specific EY employees	50	UK	Admin user	Admin
Enboarder	Third Party	50	UK, India	Account management and customer support	Admin
Candidates	Public		Global	Networking	Candidate access only

The access rights detailed above involves transferring personal data in various jurisdictions (including jurisdictions outside the European Union) in which EY operates (EY office locations are listed at www.ey.com/ourlocations). EY will process your personal data in the Tool in accordance with applicable law and professional regulations in your jurisdiction. Transfers of personal data within the EY network are governed by EY’s Binding Corporate Rules (www.ey.com/bcr).

The information processed within the Tool is accessible to users through the Connection Cards functionality of Enboarder. Access to this information is limited to users within the same onboarding group or cohort, ensuring that only relevant parties have visibility into personal data for networking purposes.

8. Data retention

Your personal data will be retained in compliance with privacy laws and regulations.

After the end of the data retention period or when the purpose for processing (see section 3 above) is complete, your personal data will be deleted. Personal data is automatically deleted from the Tool after 90 days of inactivity.

9. Security

EY is committed to making sure your personal data is secure. To prevent unauthorized access or disclosure, EY has technical and organizational measures to safeguard and secure your personal data. All EY personnel and third parties EY engage to process your personal data are obliged to respect your data’s confidentiality.

You should ensure that your password used to access the Tool is not susceptible to being guessed, whether by a person or a computer program. You are responsible for keeping your password confidential and we will not ask you for your password except when you are logging in to the Tool.

The Tool employs strict access controls and data security measures to ensure that personal information is protected and only shared within the scope necessary to achieve its intended purpose.

10. Controlling your personal data

EY will not transfer your personal data to third parties (other than any external parties referred to in section 6 above) unless we have your permission or are required by law to do so. You are legally entitled to request details of EY’s personal data about you.

To confirm whether your personal data is processed in the Tool or to access your personal data in the Tool, contact your usual EY representative or email your request to global.data.protection@ey.com.

11. Your rights

You can confirm your personal data is accurate and current. You can request rectification, erasure, restriction of processing or a readily portable copy of your personal data.

You also have a right, in some circumstances, to object to any processing based on our legitimate interests. There may, however, be compelling reasons for continuing to process your personal data and we will assess and inform you if that is the case.

Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under the applicable law apply.

You may exercise any of your rights in relation to your personal data by emailing global.data.protection@ey.com

12. Complaints

If you are concerned about an alleged breach of privacy law or any other regulation, contact EY’s Global Privacy Officer, Office of the General Counsel, 1 More London Place, London, SE1 2AF, United Kingdom or via email at global.data.protection@ey.com or via your usual EY representative. An EY Privacy Officer will investigate your complaint and provide information about how it will be handled and resolved.

If you are not satisfied with how EY resolved your complaint, you have the right to complain to your country’s data protection authority. You can also refer the matter to a court of competent jurisdiction.

13. Contact us

If you have additional questions or concerns, contact your usual EY representative or email global.data.protection@ey.com.

14. Updates to this Notice

We may update this notice at any time. If we do so, we will publish an updated copy here as soon as reasonably practical. Further, refer to the top of this notice for the date when it was last updated.

Last updated: 04/09/2026

1. Introduction

This Privacy Notice is intended to describe the practices EY follows in relation to TopScore Technologies Limited (“Tool”) with respect to the privacy of all individuals whose personal data is processed and stored in the Tool.

2. Who manages the Tool?

“EY” refers to one or more of the member firms of Ernst & Young Global Limited (“EYG”), each of which is a separate legal entity and can act as a data controller in its own right. The entity that is acting as data controller by providing the Tool on which your personal data will be processed and stored is Ernst & Young LLP, 1 More London Place, London, SE1 2AF (“EY”) (“we” or “us”). EY licenses the Tool from TopScore Technologies Limited, Manchester, United Kingdom.

The Tool is hosted on servers in the UK.

3. Why do we need your personal data?

The Tool hosts and manages virtual EY UK Early Careers recruitment assessment centres and interviews.

We collect your personal data to support the EY UK Early Careers recruitment team in managing assessment events. This includes scheduling interviews and assessment exercises, enabling you to complete assessments on a single platform, and allowing assessors to submit scores. Your information helps EY identify the strongest candidates based on total scores and make decisions about progressing applicants to interviews or offers. Your full name and email address are used so that we can match your assessment results to your application.

EY relies on the following legal bases to process your personal data:

Where processing is necessary for the purpose of legitimate interest pursued by the controller. EY has a legitimate interest in running an effective recruitment process.
Where processing is necessary for the performance of a contract in order to take steps at the request of the data subject prior to entering into a contract. Your personal data will be processed by the Tool for the next steps to entering into a contract.

Your information may be processed for the purpose of ensuring Participation Rules have been followed. For more information, please review the Participation Rules and our privacy policies for applicants.

4. What type of personal data is processed in the Tool?

The Tool processes the personal data categories set out in the table below.

This data is sourced from you directly, and other third parties, such as EY suppliers and subcontractors for the purposes of providing the service to you and per EY’s legitimate interests. For further information, please refer to our privacy policies for applicants.


Personal data collected	Reason for processing	Lawful basis for the processing	Basis for processing special categories of personal data or data relating to criminal convictions and offences
Registration data: full name, email address, username and password	Creating a user account for you, enabling you to access your account once created, keeping your account secure and communicating with you in connection with your application.	Performance of a contract - enabling applicants to conduct virtual assessments and interviews scheduled on the Tool EY’s legitimate interest in processing and managing applications for roles at EY, including the screening and selection of candidates	N/A
Assessment data and results data: your answers and the results of the assessment and data generated by the assessment system	The source of the assessment data is you and the Tool. We may process this assessment data for the purposes of assessing your suitability for the job you have applied for and your adherence with our Participation Rules, which may include checks against collusion, plagiarism, and use of OpenAI software.	EY’s legitimate interests - assessing the suitability of applicants for jobs with us, including adherence to EY’s Participation Rules.	N/A
Interview data: information about you recorded following an interview	The source of the interview data is you and the interviewers and/or assessors. This interview data may be processed for the purposes of assessing your suitability for the job you are applying for	Performance of a contract - assessing the suitability of applicants for jobs with us EY’s legitimate interests - assessing the suitability of applicants for jobs with us	N/A
Reasonable adjustments data: information related to whether you require any reasonable adjustments	We will not ask you for details of any relevant disability or health condition, but you may tell us if you consider that it is necessary for us to know this information	Performance of a contract - assessing the suitability of applicants for jobs with us. Compliance with a legal obligation	Equal opportunities data (information relating to health): processing is necessary in the field of employment, social security and social protection law; processing is necessary for reasons of substantial public interest and the relevant substantial public condition under the Data Protection Act 2018 is monitoring equality of opportunity and treatment
Proctoring data inc. interaction data and image	Supervision features (outlined in Participation Rules) are in use throughout assessments to verify your identity, analyse your conduct, and protect the integrity of EY’s recruitment process. We may process this data for the purposes of assessing your eligibility to re-sit an assessment and your adherence with our Participation Rules, which may include checks against collusion, plagiarism, and use of OpenAI software.	EY’s legitimate interests - assessing the suitability of applicants for jobs with us, including adherence to EY’s Participation Rules.	N/A

5. Providing your personal data to others

EY Network: We may disclose the personal data described in section 4 to any relevant members of the global network of Ernst & Young firms if and insofar as this is reasonably necessary for the purposes set out in this notice.

EY suppliers and subcontractors: Personal data described in section 4 will be shared with and/or processed by EY suppliers and subcontractors for the purposes of providing the service to you. All personal data obtained through the Tool will be shared with and processed by AmberJack per EY’s legitimate interest in assessing your suitability for the job you are applying for.

For further information, please refer to our privacy policies for applicants.

6. Special Category Personal Data

Special category personal data reveals your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning sex life or sexual orientation.

The following special category personal data is collected and processed in the Tool should you wish to submit the below information:

Biometric data

Facial images are captured and processed uniquely for the purpose of identifying the individual sitting the assessment as the true applicant. No biometric templates or additional biometric data are stored or processed.

7. Who can access your information?

Your personal data is accessed in the Tool by the following persons/teams:


Organisation (EY, Client name, Third party name)	EY employee, Client employee, Third party employee, Public	Number of individuals with access (estimated if exact number unknown)	Location of individuals with access	Reason for access	Level of access
EY Talent Acquisition	Specific EY employees	50	UK	Admin user	Admin
EY Talent Shared Services	Specific EY employees	50	UK	Admin user	Admin
EY	Specific EY employees	1500	UK	Assessor User	Assessor
EY	Specific EY employees	1500	UK	Interview User	Assessor
TopScore	Third Party	50	UK	Account management and customer support	Admin
Candidates	Public		Global	Completing assessments	Candidate access only

8. Data retention

Our policy is to retain personal data only for as long as it is needed for the purposes described in section 3. Retention periods vary in different jurisdictions and are set in accordance with local regulatory and professional retention requirements. In order to meet our professional and legal requirements, to establish, exercise or defend our legal rights and for archiving and historical purposes, we need to retain information for significant periods of time. Your personal data will be retained in compliance with privacy laws and regulations.

Personal data that you provide will be retained up to 6 months after the end of EY’s current recruitment cycle (each cycle ends 30 September). Depending on when you apply, your data may be kept up to 18 months. After the end of the data retention period or when the purpose for processing (see section 3 above) is complete, your personal data will be deleted from the Tool.

9. Security

EY is committed to making sure your personal data is secure. To prevent unauthorized access or disclosure, EY has technical and organizational measures to safeguard and secure your personal data. All EY personnel and third parties EY engage to process your personal data are obliged to respect your data’s confidentiality.

You should ensure that your password used to access the Tool is not susceptible to being guessed, whether by a person or a computer program. You are responsible for keeping your password confidential and we will not ask you for your password except when you are logging in to the Tool.

10. Controlling your personal data

EY will not transfer your personal data to third parties (other than any external parties referred to in sections 5 and 7 above) unless we have your permission or are required by law to do so. You are legally entitled to request details of EY’s personal data about you.

To confirm whether your personal data is processed in the Tool or to access your personal data in the Tool, contact your usual EY representative or email your request to global.data.protection@ey.com.

11. Your rights

You can confirm your personal data is accurate and current. You can request rectification, erasure, restriction of processing or a readily portable copy of your personal data.

You also have a right, in some circumstances, to object to any processing based on our legitimate interests. There may, however, be compelling reasons for continuing to process your personal data and we will assess and inform you if that is the case.

Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under the applicable law apply.

You may exercise any of your rights in relation to your personal data by emailing global.data.protection@ey.com

12. Complaints

If you are concerned about an alleged breach of privacy law or any other regulation, contact EY’s Global Privacy Officer, Office of the General Counsel, 1 More London Place, London, SE1 2AF, United Kingdom or via email at global.data.protection@ey.com or via your usual EY representative. An EY Privacy Officer will investigate your complaint and provide information about how it will be handled and resolved.

If you are not satisfied with how EY resolved your complaint, you have the right to complain to your country’s data protection authority. You can also refer the matter to a court of competent jurisdiction.

13. Contact us

If you have additional questions or concerns, contact your usual EY representative or email global.data.protection@ey.com.

14. Updates to this Notice

We may update this notice at any time. If we do so, we will publish an updated copy here as soon as reasonably practical. Further, refer to the top of this notice for the date when it was last updated.

Last updated: 04/09/2026

1. Introduction

This Privacy Notice is intended to describe the practices EY follows in relation to RARE (“Tool”) with respect to the privacy of all individuals whose personal data is processed and stored in the Tool.

2. Who manages the Tool?

“EY” refers to one or more of the member firms of Ernst & Young Global Limited (“EYG”), each of which is a separate legal entity and can act as a data controller in its own right. The entity that is acting as data controller (or similar capacity) by providing the Tool on which your personal data will be processed and stored is Ernst & Young LLP, 1 More London Place, SE1 2AF (“EY”) (“we” or “us”). EY licenses the Tool from Rare Recruitment Limited, 21-22 Great Sutton Street, London, EC1V 0DY.

The Tool is hosted by AmberJack Global Limited (“AmberJack”), Newbury House, 20 King Road, West Berkshire, RG14 5XR, United Kingdom. The Tool is hosted on servers in the UK.

3. Why do we need your personal data?

The Tool forms part of the EY UK Early Careers recruitment application process. As part of your Early Careers application, you can choose to complete a set of questions related to your socioeconomic background. RARE Flags are assigned to participants based on their answers to contextual questions about socioeconomic, personal and educational background. Providing your answers to these questions is completely optional.

EY relies on consent as the basis for the processing of your personal data in the Tool.

Your personal data processed in the Tool as follows:

The Tool contextualises each participant’s academic performance against their socioeconomic background, highlighting exceptional achievement relative to opportunity through specific flags and a Performance Index based on academic performance.

The Tool analyses responses and provides EY recruiters with an anonymised report on socioeconomic background. This report is transferred to the Application Tracking System, AmberTrack, which is provided by AmberJack, and is used during application screening, but not during final hiring stages.

EY recruiters will review the anonymised report to fairly assess potential, ensuring that RARE Flags inform but do not exclude candidates. The process is designed to maximise fairness and transparency, with candidates assured that providing contextual data will not negatively impact their application.

4. What type of personal data is processed in the Tool?

The Tool processes the personal data categories set out in the table below.

This data is sourced from you directly.


Personal data collected	Reason for processing	Lawful basis for the processing	Basis for processing special categories of personal data or data relating to criminal convictions and offences
Your home postcode at the age of 16 Whether you received free school meals Whether you undertook paid work during the ages of 16-18 If you are the first generation in your family to attend university If you did significant part-time work when aged 16 to 18 or during university term time Whether you are a refugee/asylum seeker Whether you spent time in social care Whether you are/were a young parent or carer The occupation of main household earner when you were aged 14	Application screening and anonymised analysis	Consent	Consent

5. Providing your personal data to others

EY Network: We may disclose the personal data described in section 4 to any relevant members of the global network of Ernst & Young firms if and insofar as this is reasonably necessary for the purposes set out in this notice.

EY suppliers and subcontractors: Personal data described in section 4 will be shared with and/or processed by EY suppliers and subcontractors for the purposes of providing the service to you.

For further information, please refer to our privacy policies for applicants.

6. Special Category Personal Data

Special category personal data reveals your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning sex life or sexual orientation.

EY does not intentionally collect any special category personal data from you via the RARE questionnaire. There is no intention to process such information in this Tool. However, personal information processed can be considered sensitive.

7. Who can access your information?

Your personal data is accessed in the Tool by the following persons/teams:


Organisation (EY, Client name, Third party name)	EY employee, Client employee, Third party employee, Public	Number of individuals with access (estimated if exact number unknown)	Location of individuals with access	Reason for access	Level of access
EY Talent Acquisition	Specific EY employees	50	UK	Admin user	Admin
EY Talent Shared Services	Specific EY employees	50	UK	Admin User	Admin
IBM	Third Party	50	Philippines	EY Helpline support	Admin
Rare	Third Party	50	UK	Customer support	Admin
Amberjack	Third Party	50	UK	Hosts the Tool	Admin
Candidates	Public		Global	Completing applications	Candidate access only

The access rights detailed above involves transferring personal data in various jurisdictions (including jurisdictions outside the European Union) in which EY operates (EY office locations are listed at www.ey.com/ourlocations). EY will process your personal data in the Tool in accordance with applicable law and professional regulations in your jurisdiction. Transfers of personal data within the EY network are governed by EY’s Binding Corporate Rules (www.ey.com/bcr).

We transfer or disclose the personal data we collect to third-party service providers (and their subsidiaries and affiliates) who are engaged by us to support our internal ancillary processes. For example, we engage service providers to provide, run and support our IT infrastructure (such as identity management, hosting, data analysis, back-up, security and cloud storage services) and for the storage and secure disposal of our hard copy files. It is our policy to only use third-party service providers that are bound to maintain appropriate levels of data protection, security and confidentiality, and that comply with any applicable legal requirements for transferring personal data outside the jurisdiction in which it was originally collected.

To the extent that personal data has been rendered anonymous in such a way that you or your device are no longer reasonably identifiable, such information will be treated as non-personal data and the terms of this Privacy Notice will not apply.

8. Data retention

Our policy is to retain personal data only for as long as it is needed for the purposes described in section 3. Retention periods vary in different jurisdictions and are set in accordance with local regulatory and professional retention requirements. In order to meet our professional and legal requirements, to establish, exercise or defend our legal rights and for archiving and historical purposes, we need to retain information for significant periods of time. Your personal data will be retained in compliance with privacy laws and regulations.

Personal data that you provide will be retained up to 6 months after the end of EY’s current recruitment cycle (each cycle ends 30 September). Depending on when you apply, your data may be kept up to 18 months. After the end of the data retention period or when the purpose for processing (see section 3 above) is complete, your personal data will be deleted from the Tool.

9. Security

EY is committed to making sure your personal data is secure. To prevent unauthorised access or disclosure, EY has technical and organisational measures to safeguard and secure your personal data. All EY personnel and third parties EY engage to process your personal data are obliged to respect your data’s confidentiality.

10. Controlling your personal data

EY will not transfer your personal data to third parties (other than any external parties referred to in sections 5 and 7 above) unless we have your permission or are required by law to do so. You are legally entitled to request details of EY’s personal data about you.

To confirm whether your personal data is processed in the Tool or to access your personal data in the Tool, contact your usual EY representative or email your request to global.data.protection@ey.com.

11. Your rights

You can confirm your personal data is accurate and current. You can request rectification, erasure, restriction of processing or a readily portable copy of your personal data.

You also have a right, in some circumstances, to object to any processing based on our legitimate interests. There may, however, be compelling reasons for continuing to process your personal data and we will assess and inform you if that is the case.

Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under the applicable law apply.

You may exercise any of your rights in relation to your personal data by emailing global.data.protection@ey.com

12. Complaints

If you are concerned about an alleged breach of privacy law or any other regulation, contact EY’s Global Privacy Leader, Office of the General Counsel, 1 More London Place, London, SE1 2AF, United Kingdom or via email at global.data.protection@ey.com or via your usual EY representative. An EY Privacy Leader will investigate your complaint and provide information about how it will be handled and resolved.

If you are not satisfied with how EY resolved your complaint, you have the right to complain to your country’s data protection authority. You can also refer the matter to a court of competent jurisdiction.

13. Contact us

If you have additional questions or concerns, contact your usual EY representative or email eystudentrecruitment@uk.ey.com.

14. Updates to this Notice

We may update this notice at any time. If we do so, we will publish an updated copy here as soon as reasonably practical. Further, refer to the top of this notice for the date when it was last updated.

Last updated: 04/09/2026

1. Introduction

This Privacy Notice is intended to describe the practices EY follows in relation to SHL Group Limited (“SHL”) and its subcontractor GTI Group Limited (“GTI”), with respect to the privacy of all individuals whose personal data is processed and stored in the SHL online assessment platform (“Tool”).

2. Who manages the Tool?

“EY” refers to one or more of the member firms of Ernst & Young Global Limited (“EYG”), each of which is a separate legal entity and can act as a data controller in its own right. The entity that is acting as data controller (or similar capacity) by providing the Tool on which your personal data will be processed and stored is Ernst & Young LLP, 1 More London Place, London, SE1 2AF (“EY”) (“we” or “us”). EY licenses the Tool from SHL Group Limited, The Pavillion, 1 Atwell Place, Thames Ditton, Surrey, KT7 0NE, United Kingdom.

The Tool is hosted on Amazon Web Services regional servers in the EU.

3. Why do we need your personal data?

The Tool hosts and manages EY UK Early Careers recruitment online assessments. Your personal data processed in the Tool is used to host all relevant information relating to your online assessments with EY.

EY relies on the following legal bases to process your personal data:

Where processing is necessary for the purpose of legitimate interest pursued by the controller. EY has a legitimate interest in running an effective recruitment process.
Where processing is necessary for the performance of a contract in order to take steps at the request of the data subject prior to entering into a contract. Your personal data will be processed by the Tool for the next steps to entering into a contract.

In order to proceed with your Early Careers application, you will be required to undertake the relevant assessment/s on the Tool. Each assessment produces a score, which is then mapped against set criteria to determine a pass or fail mark using automated decision making. Your assessment results data is used with Candidate Name and Email Address to determine progression through the recruitment process. Progression is based entirely on assessment scores and not on demographic data. This means that, during the assessment, if you fail to meet the pass score, your application will be automatically rejected by EY without human review.

EY is permitted to use automated decision-making where it is necessary for performance of a contract and where appropriate measures are in place to safeguard your rights. If you do not agree with the use of automated decision-making and would like to invoke your right to a review, you may appeal by contacting us at the email address in Section 11.

Supervision features (outlined in Participation Rules) are in use throughout the Interactive Job Preview, Stage 1 and Stage 2 assessments to analyse your conduct during the assessment and protect the integrity of EY’s recruitment process. AI is used to summarise and flag results but these features do not involve any AI-based decision-making. They are designed to capture data, statistics, and metrics for review and assessment by EY personnel or EY-appointed third-party providers.

GTI is subcontracted by SHL to support scoring of video responses submitted during the assessment/s. GTI does not use any AI or automated decision making.

Your information may be processed for the purpose of ensuring Participation Rules have been followed. For more information, please review the Participation Rules and our privacy policies for applicants.

4. What type of personal data is processed in the Tool?

The Tool processes the personal data categories listed below. The Tool holds and processes this data in accordance with the EY’s instructions.

This data is sourced from you directly, and other third parties, such as EY suppliers and subcontractors for the purposes of providing the service to you and per EY’s legitimate interests. For further information, please refer to our privacy policies for applicants.


Personal data collected	Reason for processing	Lawful basis for the processing	Basis for processing special categories of personal data or data relating to criminal convictions and offences
Registration data: full name, email address, username and password, country of residence	Creating a user account for you, enabling you to access your account once created, keeping your account secure and communicating with you in connection with your application. Your full name and email address are used so that we can match your assessment results to your application. Country of residence information is collected to ensure compliance with applicable US, EU, and UK sanctions regimes, as well as other relevant restrictive measures. Candidates located in comprehensively sanctioned jurisdictions, currently Cuba, Iran, North Korea, and Russia, are not permitted to undertake assessments.	Performance of a contract - enabling applicants to conduct virtual assessments on the Tool, and for those assessments to be scored and the results communicated to EY. EY’s legitimate interest in processing and managing applications for roles at EY, including the screening and selection of candidates. The lawful basis for this processing is compliance with a legal obligation to which SHL is subject (Article 6(1)(c) UK and EU GDPR).	N/A
Reasonable adjustments data: information related to whether you require any reasonable adjustments	We will not ask you for details of any relevant disability or health condition, but you may tell us if you consider that it is necessary for us to know this information	Performance of a contract - assessing the suitability of applicants for jobs with us. Compliance with a legal obligation	Equal opportunities data (information relating to health): processing is necessary in the field of employment, social security and social protection law; processing is necessary for reasons of substantial public interest and the relevant substantial public condition under the Data Protection Act 2018 is monitoring equality of opportunity and treatment
Assessment data and results data: your answers and the results of the assessment and data generated by the assessment system Includes audio visual data captured in video submissions in response to set assessment questions	The source of the assessment responses data is you and the Tool. We may process this assessment data for the purposes of assessing your suitability for the job you have applied for and your adherence with our Participation Rules, which may include checks against collusion, plagiarism, and use of OpenAI software.	EY’s legitimate interests – assessing the suitability of applicants for jobs with us, including adherence to EY’s Participation Rules. Performance of a contract – to perform analytics on the characteristic profile required for the role	N/A
Proctoring data inc. interaction data, image and IP address	Supervision features (outlined in Participation Rules) are in use throughout the interactive job preview, stage 1 and stage 2 assessments to analyse your conduct during the assessment and protect the integrity of EY’s recruitment process. We may process this data for the purposes of assessing your eligibility to re-sit a stage 1 or stage 2 assessment and your adherence with our Participation Rules, which may include checks against collusion, plagiarism, and use of OpenAI software.	EY’s legitimate interests - assessing the suitability of applicants for jobs with us, including adherence to EY’s Participation Rules.	N/A

5. Providing your personal data to others

EY Network: We may disclose the personal data described in section 4 to any relevant members of the global network of Ernst & Young firms if and insofar as this is reasonably necessary for the purposes set out in this notice.

EY suppliers and subcontractors: Personal data described in section 4 will be shared with and/or processed by EY suppliers and subcontractors for the purposes of providing the service to you.

SHL subcontracts to GTI for the purposes of reviewing, assessing, scoring and reporting on all video submissions. All videos submitted by you via the Tool will be reviewed and scored by GTI per EY’s legitimate interest in assessing your suitability for the job you are applying for.

For further information, please refer to our privacy policies for applicants.

6. Special Category Personal Data

Special category personal data reveals your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning sex life or sexual orientation.

EY does not intentionally collect any special category personal data from you via the Tool. There is no intention to process such information on this Tool.

EY may share sensitive personal data with SHL for reporting and analytics purposes and to ascertain a fair assessment process for all candidates. All data is shared securely and consists of pseudo-anonymised reports in which a unique candidate identification number is the only identifier.

7. Who can access your information?

Your personal data is accessed in the Tool by the following persons/teams:


Organisation (EY, Client name, Third party name)	EY employee, Client employee, Third party employee, Public	Number of individuals with access (estimated if exact number unknown)	Location of individuals with access	Reason for access	Level of access
EY Talent Acquisition	Specific EY employees	50	UK	Admin user	Admin
EY Talent Shared Services	Specific EY employees	50	UK	Admin User	Admin
SHL	Third Party	50	UK	Account management and customer support	Admin
GTI	Third Party	50	UK	Video screening assessor	Assessor
Candidates	Public		Global	Completing assessments	Candidate access only

8. Data retention

Our policy is to retain personal data only for as long as it is needed for the purposes described in section 3. Retention periods vary in different jurisdictions and are set in accordance with local regulatory and professional retention requirements. In order to meet our professional and legal requirements, to establish, exercise or defend our legal rights and for archiving and historical purposes, we need to retain information for significant periods of time. Your personal data will be retained in compliance with privacy laws and regulations.

Personal data that you provide will be retained up to 6 months after the end of EY’s current recruitment cycle (each cycle ends 30 September). Depending on when you apply, your data may be kept up to 18 months. After the end of the data retention period or when the purpose for processing (see section 3 above) is complete, your personal data will be deleted from the Tool.

9. Security

EY is committed to making sure your personal data is secure. To prevent unauthorized access or disclosure, EY has technical and organizational measures to safeguard and secure your personal data. All EY personnel and third parties EY engage to process your personal data are obliged to respect your data’s confidentiality.

You should ensure that your password used to access the Tool is not susceptible to being guessed, whether by a person or a computer program. You are responsible for keeping your password confidential and we will not ask you for your password except when you are logging in to the Tool.

10. Controlling your personal data

EY will not transfer your personal data to third parties (other than any external parties referred to in sections 5 and 7 above) unless we have your permission or are required by law to do so. You are legally entitled to request details of EY’s personal data about you.

To confirm whether your personal data is processed in the Tool or to access your personal data in the Tool, contact your usual EY representative or email your request to global.data.protection@ey.com.

11. Your rights

You can confirm your personal data is accurate and current. You can request rectification, erasure, restriction of processing or a readily portable copy of your personal data.

You also have a right, in some circumstances, to object to any processing based on our legitimate interests. There may, however, be compelling reasons for continuing to process your personal data and we will assess and inform you if that is the case.

Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under the applicable law apply.

You may exercise any of your rights in relation to your personal data by emailing global.data.protection@ey.com

12. Complaints

If you are concerned about an alleged breach of privacy law or any other regulation, contact EY’s Global Privacy Leader, Office of the General Counsel, 1 More London Place, London, SE1 2AF, United Kingdom or via email at global.data.protection@ey.com or via your usual EY representative. An EY Privacy Leader will investigate your complaint and provide information about how it will be handled and resolved.

If you are not satisfied with how EY resolved your complaint, you have the right to complain to your country’s data protection authority. You can also refer the matter to a court of competent jurisdiction.

13. Contact us

If you have additional questions or concerns, contact your usual EY representative or email global.data.protection@ey.com.

14. Updates to this Notice

We may update this notice at any time. If we do so, we will publish an updated copy here as soon as reasonably practical. Further, refer to the top of this notice for the date when it was last updated.

1. Introduction

This Privacy Notice is intended to describe the practices EY follows in relation to the RMP Enterprise systems with respect to the privacy of all individuals whose personal data is processed in the Integrate Events system and stored in the Integrate Events and RMP-Connect systems.

2. Who manages Integrate?

“EY” refers to one or more of the member firms of Ernst & Young Global Limited (“EYG”), each of which is a separate legal entity and can act as a data controller in its own right. The entity that is acting as data controller by providing the Integrate Events service on which your personal data will be processed and stored is RMP Enterprise, Piano House, 9 Brighton Terrace, Brixton, London SW9 8DJ, UK

The personal data you provide in Integrate Events is shared by Integrate Events with one or more member firms of EYG (see “Who can access your information” section below).

Integrate Events is hosted on servers in Powergate Business Park, Thames Valley

3. Why do we need your information?

Information collected in Integrate Events is used to provide you with information about our future employment opportunities, news, events or for other marketing purposes and is stored in RMP-Connect.

Your personal data processed in Integrate Events is used as follows:

To send you personal information about our future employment opportunities, news, information about our events and other early career recruitment marketing purposes

We will also, on a collective level, run analysis on the information you have provided.

EY relies on the following basis to legitimise the processing of your personal data in Integrate Events: Consent

The provision of your personal data to EY is optional.

What type of personal data is processed in Integrate Events?

Integrate Events processes these personal data categories: name, last name, email address, mobile number, gender, and information about your studies and preferences for working at EY.

This data is sourced directly from the platform.

4. Sensitive Personal Data

Sensitive personal data reveals your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning sex life or sexual orientation.

“EY does not intentionally collect any sensitive personal data from you via Integrate Events. There is no intention to process such information.”

Who can access your information?

Your personal data is accessed in Integrate Events and RMP-Connect by the following persons/teams:

RMP/Integrate Events account managers

The EY UK early career Recruitment Team

The access rights detailed above involves transferring personal data in various jurisdictions (including jurisdictions outside the European Union) in which EY operates (EY office locations are listed at www.ey.com/ourlocations). EY will process your personal data in Integrate Events in accordance with applicable law and professional regulations in your jurisdiction. Transfers of personal data within the EY network are governed by EY’s Binding Corporate Rules (www.ey.com/bcr).

5. Data retention

In relation to the retention of personal data in Integrate Events and RMP-Connect is manually deleted. Accounts are deleted after a period of two-years of inactivity and done on a yearly basis.

Your personal data will be retained in compliance with privacy laws and regulations.

After the end of the data retention period or when the purpose for processing (see question 3 above) is complete, your personal data will be deleted.

6. Security

EY is committed to making sure your personal data is secure. To prevent unauthorised access or disclosure, EY has technical and organisational measures to safeguard and secure your personal data. All EY personnel and third parties EY engages to process your personal data are obliged to respect your data’s confidentiality.

7. Controlling your personal data

EY will not transfer your personal data to third parties (other than any external parties referred to in section 6 above) unless we have your permission or are required by law to do so.

You are legally entitled to request details of EY’s personal data about you.

To confirm whether your personal data is processed in Integrate Events or to access your personal data in the Integrate Events, please visit the early career preference centre which is hosted through RMP-Connect.

8. Rectification, erasure, restriction of processing or data portability

You can confirm your personal data is accurate and current. You can request rectification, erasure, restriction of processing or a readily portable copy of your personal data by visiting the early career preference centre which is hosted through RMP-Connect.Alternatively, you can do this by contacting your usual EY representative or by sending an e-mail to global.data.protection@ey.com.

9. Complaints

If you are concerned about an alleged breach of privacy law or any other regulation, contact EY’s Global Privacy Officer, Office of the General Counsel, 6 More London Place, London, SE1 2DA, United Kingdom or via email at global.data.protection@ey.com or via your usual EY representative. An EY Privacy Officer will investigate your complaint and provide information about how it will be handled and resolved.

If you are not satisfied with how EY resolved your complaint, you have the right to complain to your country’s data protection authority. You can also refer the matter to a court of competent jurisdiction.

10. Contact us

If you have additional questions or concerns, contact your usual EY representative or email global.data.protection@ey.com.

Insights

Trending topics

Spotlight

Services

Spotlight

Industries

Case studies

Careers

Spotlight

About us

Top news

Data protection privacy policies for applicants

Insights

Trending topics

Spotlight

Services

Spotlight

Industries

Case studies

Careers

Spotlight

About us

Top news

Data protection privacy policies for applicants

Privacy Notice for Early Careers Applications

AmberTrack Privacy Notice

Enboarder Privacy Notice

TopScore Privacy Notice

RARE Privacy Notice

SHL Privacy Notice

RMP Enterprise Privacy Notice