Privacy Notice – CAPP Finity Tool

1. Introduction

This Privacy Notice is intended to describe the practices EY follows in relation to the CAPP Finity Tool (“Tool”) with respect to the privacy of all individuals whose personal data is processed and stored in the Tool.

2. Who manages the Tool?

“EY” refers to one or more of the member firms of Ernst & Young Global Limited (“EYG”), each of which is a separate legal entity and can act as a data controller in its own right. The entity that is acting as data controller by providing this Tool on which your personal data will be processed and stored is EY Global Services Limited. EY Global Services Limited licenses the Tool from an external vendor, Capp & Co Limited (“Capp”) (2230-2235 Regents Court, The Crescent, Birmingham Business Park, B37 7YE).

The personal data you provide in the Tool is shared by EY Global Services Limited with one or more member firms of EYG (see “Who can access your information” section below).

The Tool is hosted externally by the vendor or its third party hosting provider in the Rackspace data center (Greater London, UK).

3. Why do we need your information?

The Tool assesses competencies and aptitude of candidates using a digital psychometric assessment based on game technology.

Your personal data processed in the Tool is used as follows:

Candidate response data is processed in the Tool using an algorithm. The resulting analysis is used as candidate identifiers in order to determine progression through the recruitment process. Progression is based entirely on assessment scores and not on demographic data.

EY relies on the following basis to legitimize the processing of your personal data in the Tool:

• The data subject has given consent to the processing of their personal data for one or more specific purposes.
• Processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. The specific legitimate interest(s) pursued are as follows: Human Resource management, including performance reviews and recruitment.

The provision of your personal data to EY is optional. However, if you do not provide all or part of your personal data, we may be unable to carry out the purposes for processing. 

4. What type of personal data is processed in the Tool?

The Tool processes these personal data categories: 

EY Personnel:

• EY Recruiters
  • Full name
  • Email address
  • Audit logs relating to user login

Other:

• Candidates
  • Full name
  • Email address
  • Assessment data
  • Audit logs relating to user login
    

This data is sourced from:

• A feed from other EY Systems (GRMS – Taleo)
  • EY Recruiters
    • Full name
    • Email address
• Provided directly by Candidates
  • Candidates
    • Full name
    • Email address
    • Assessment data

5. Sensitive Personal Data

Sensitive personal data reveals your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning sex life or sexual orientation.

It is possible that Sensitive Personal Data will be processed by the Tool as part of evaluations, but this is not collected by Tool as part of the recruitment process (e.g. ethnicity).

It is possible that reasonable adjustment requirements will be collected / processed by Tool in order to provide reasonable adjustments within the process as needed. This is simply a statement check box that a candidate requires reasonable adjustments. This would be considered to relate to a candidate’s health condition.

The Tool also processes personal data relating to personality. There is a possibility, in certain jurisdictions, that this may be classed as health data and therefore as sensitive personal data.  

6. Who can access your information?

Your personal data is accessed in the Tool by the following persons/teams:

EY:

• EY Recruiters: EY Recruiters will have access to candidate assessment results for candidates in their respective countries. EY Recruiters can also gain access to a report for each candidate to obtain more details on their specific traits.
• EY Local Recruitment Leadership (a subset of EY Recruiters) will have the same rights as the EY Recruiters, and elevated administrative rights that will allow them to modify recipient access rights.

Other:

• Candidates: Candidates will be able to log in and view their results.
• Vendor Personnel: Capp Software Engineers will have access to the data in the system on a global level.
• Tata Consultancy Services (TCS) will access the Tool to investigate and resolve technical problems and help requests.

EY access locations will be dependent on EY roll outs of the Tool.

EY Recruiters will only be able to see the data relevant to their locations. CAPP has full access to all data in the Tool.

The access rights detailed above involves transferring personal data in various jurisdictions (including jurisdictions outside the European Union) in which EY operates (EY office locations are listed at www.ey.com/ourlocations). EY will process your personal data in the Tool in accordance with applicable law and professional regulations in your jurisdiction. Transfers of personal data within the EY network are governed by EY’s Binding Corporate Rules.

The transfer of personal data to Tata Consultancy Services (TCS) and IBM are governed by contracts that includes standard data protection clauses adopted by the European Commission.

7. Data retention

The policies and/or procedures for the retention of personal data in the Tool are:

Data retention is in accordance with EY Records Retention Global Policy and the applicable Global, Area, Region or Country Retention Schedule.

EY will define data retention according to local laws. It will apply the Taleo retention policy for this Tool.

Taleo retention policy: They currently have an automated data purge task in Taleo that removes/deletes all candidate files that meet purge criteria. The criteria is: no activity has taken place in the file for 3 years or the file does not include a hire.

Your personal data will be retained in compliance with privacy laws and regulations.

After the end of the data retention period, your personal data will be deleted. 

8. Security

EY is committed to making sure your personal data is secure. To prevent unauthorized access or disclosure, EY has technical and organizational measures to safeguard and secure your personal data. All EY personnel and third parties EY engages to process your personal data are obliged to respect your data’s confidentiality.

9. Controlling your personal data

EY will not transfer your personal data to third parties (other than any external parties referred to in section 6 above) unless we have your permission or are required by law to do so.  

You are legally entitled to request details of EY’s personal data about you.

To confirm whether your personal data is processed in the Tool or to access your personal data in the Tool, contact your usual EY representative or email your request to data protection team.

10. Rectification, erasure, restriction of processing or data portability

You can confirm your personal data is accurate and current. You can request rectification, erasure, restriction of processing or a readily portable copy of your personal data by contacting your usual EY representative or by sending an e-mail to data protection team.

11. Complaints

If you are concerned about an alleged breach of privacy law or any other regulation, contact EY’s Global Privacy Leader, Office of the General Counsel, 6 More London Place, London, SE1 2DA, United Kingdom or via email at data protection team or via your usual EY representative. An EY Privacy Leader will investigate your complaint and provide information about how it will be handled and resolved.

If you are not satisfied with how EY resolved your complaint, you have the right to complain to your country’s data protection authority. You can also refer the matter to a court of competent jurisdiction.  

12. Contact us

If you have additional questions or concerns, contact your usual EY representative or email to data protection team.