Privacy statement

When you engage us to provide you with professional services, we collect and use personal data when we have a valid business reason to do so in connection with those services. For an overview of our services, click here.

In the context of providing professional services to clients, EY also processes personal data of individuals who are not directly our clients (for example, employees, customers or suppliers of our clients). See the section “Individuals whose personal data we obtain in connection with providing services to our clients” for additional information.

The majority of the personal data we collect and use to provide our services is supplied voluntarily by (or collected by us from third-party sources at the request of) our clients. Because of this, if you are a client of EY, then it will generally be known to you what personal data we collect and use. This information can include:    

• Basic information, such as your name, the company you work for, your position and your relationship to a person
• Contact information, such as your email address and telephone numbers
• Financial information, such as payment-related information
• Any other personal data relating to you or other third parties which the client/ you provide to us for the purpose of receiving our services

We use this information for the following purposes, subject to applicable law:

• To provide services to our clients
• To administer our relationship and maintain contractual relations
• For accounting and tax purposes
• For marketing and business development (only contact information)
• To comply with our legal and regulatory obligations
• To establish, exercise or defend legal rights
• For historical and statistical purposes

Given the diversity of the services we provide, we process many categories of personal data. Please see below (non-exhaustive) examples of personal data categories for our four main service lines:

In addition, we also process identification and background information as part of our client acceptance, finance, administration and marketing processes, including audit independence, anti-money laundering, conflict-checking, reputational and financial checks, and to fulfill any other legal or regulatory requirements to which we are subject.

These checks could include the following:

• Identity verification: proof of name and address
• Ultimate beneficial ownership of corporate and other legal entities
• Conflicts checks: to avoid a conflict of interest with any other client
• Anti-money laundering, proceeds of crime and terrorist financing checks
• Politically exposed persons (PEP) checks: those with prominent roles in government, judiciary, courts, central banks, embassies, armed forces and state-owned enterprises, including their family members and close associates
• Adverse media checks
• Government sanctions list checks
• Independence checks

These checks are made for legal, regulatory or business reasons and need to be repeated during the course of our engagement. As part of these checks, we are required to process sensitive personal data (for example, to verify if you are a politically exposed person or to collect information about criminal convictions where this is required according to applicable local anti-money laundering legislation). It is important you provide us with all necessary information and documents as this affects our ability to provide services to you.

Legal grounds for processing personal data of our clients are:

• Performance of a contract
• Compliance with a legal or regulatory obligation
• Our legitimate interest in providing you with seamless, consistent, high-quality services and securing prompt payment of any fees, costs and debts in respect of our services
• Our legitimate interest in understanding any conflict of interest or challenge with regard to independence legislation
• Our legitimate interest in safeguarding EY against inadvertently dealing with the proceeds of criminal activities or assisting in any other unlawful or fraudulent activities (for example, terrorism)

Once a company undergoes an insolvency, one or more EY insolvency practitioners (i.e., administrators and liquidators) could be appointed to manage the company’s affairs, business and property, provided that such services may be provided in the relevant country. Similarly, when a debtor is subject to insolvency or a restructuring regime, one or more EY insolvency practitioners could be appointed to manage the debtor’s affairs, business and property, only in countries where such services may be provided.

In this section:

• Office holder refers to the EY insolvency practitioners.
• Company refers to the insolvent entity for which the office holders have been appointed.
• Debtor refers to the individual who is subject to an insolvency or restructuring regime.
• “You” refers to the data subjects concerned by the insolvency procedure of the company or debtor.

In providing insolvency services, EY processes your personal data for the legitimate interests of assisting the office holders in the performance of their legal and regulatory obligations with regard to the insolvency procedures. For clarity purposes, the company or debtor remains data controller of your personal data processed for purposes that are not related to the legal and regulatory obligations of the office holders.

Most of the personal data we process is obtained from you directly, but we also indirectly obtain personal data about you.

The office holders and EY process your personal data for the following (non- exhaustive) purposes:

• Communicating with the company or debtor’s creditors and individual creditors: specific information essential in order to carry out statutory duties (this information is to be used to assess, for example, an entitlement to any dividend should one be payable)
• Provision of references or reports to government departments, regulatory authorities and appropriate bodies in connection with the holding of public office or responding to requests
• Provision of statutory returns
• Case administration purposes, including the realization of assets, agreement of claims and payment of distributions
• Processing for personal purposes of employees in accordance with the law and the company’s own policies
• Administration of payroll, raising invoices, credit control and other data relating to the company’s finances
• The reasonable and lawful provision of information to interested parties
• The prevention and detection of crime or fraud
• Establishing, exercising or defending legal rights, taking legal advice, taking or defending legal proceedings
• Complying with legal obligations to which the company or debtor is subject
• Quality and risk management purposes

The types of personal data processed for the above purposes include (but are not limited to) name, address, identifying information, payroll information, as well as any information with your dealings with the company or debtor that are necessary for the performance of the office holders’ statutory obligations during the insolvency procedure.

You have certain rights in relation to your personal data. If you have a query or wish to exercise your rights, please make a written request to the party responsible for your personal data (the company, debtor or the office holder) using the contact details provided in communications about the insolvency.

EY may process personal data relating to our business contacts for purposes of marketing EY’s services and brand. Such contacts may be sent EY Thought Leadership materials, newsletters, other marketing materials, invites to events, seminars, webinars, surveys etc.

The following categories of personal data and user activities may be processed for marketing purposes:

• Name, job title, email address, phone and fax numbers, and place of work
  
• Name of employer or organization the individual is associated with
• User preferences (such as areas of topics selected for newsletters etc.)
• Opening emails, bounces and opt-outs (unsubscriptions), registration for events, seminars or webinars, attendance or no show at events, seminars or webinars.

Legal grounds for processing personal data for marketing purposes are:

• Your prior consent where this is legally required (e.g. Denmark and Norway), but also when you have provided your consent in other cases.
• In all other cases, we will apply EY’s legitimate interest to provide information about EY and its services to our business contacts in their professional capacity (B2B) and to send invitations to events etc. which we believe are in their professional interest.

All recipients of marketing via electronic communication is offered the possibility to opt out (unsubscribe) from receiving further marketing from EY. If a recipient has opted out from receiving future EY marketing, we will cease processing the personal data for marketing purposes, however the basic contact details of an individual who has opted out will remain on our opt-out list.

We provide external users access to various applications managed by us (such as the EY Client Portal and My EY platform).  In instances where such applications process personal data that goes beyond basic contact information used for application authentication purposes, such applications will contain their own privacy notices explaining why and how personal data is collected and processed by those applications. We encourage individuals using our applications to refer to the privacy notices available on those applications.

When you communicate with EY via email, EY will process your personal data, such as your name, email address, place of work and other contact information provided by you in the email as well as information and data in the email that can be linked to identifiable individuals. EY will also process the email address of other individuals being a recipient of the email or on cc or bcc to the email.

The personal data may be processed for different purposes, for example for provision of professional services (for further information about the processing and the legal grounds click on Individuals whose personal data we obtain in connection with providing services to our clients), to administrate our supplier contracts (for further information about the processing and legal grounds click on Suppliers), or in connection with recruitment (for further information about the processing and legal grounds click on Job Applicants).

Further, EY uses a variety of tools to maintain the security of our IT infrastructure, including our email facilities. Examples of such tools are:

• Systems that scan incoming emails to EY recipients for suspicious attachments and URLs, in order to prevent malware attacks
• Tools that provide end-point threat detection to detect malicious attacks
• Tools that block certain content or websites

Legal grounds for processing personal data of individuals who correspond with EY via email:

• Our legitimate interest in protecting our IT infrastructure against unauthorized access or data leakage
• Our legitimate interest in analyzing email traffic

We collect information from and about candidates in connection with available employment opportunities at EY. The information that we collect, the manner in which it is used, and the timing in which it is gathered varies depending on the country in which you apply.  As general matter, the personal data we collect regarding our job applicants includes names, age, gender, email address, telephone number, resumes or CVs, academic records, work history, employment information and references (if provided).

We use your personal data to match your skills, experience and education with specific roles offered by EY.  This information is passed to the relevant hiring managers and persons involved in the recruitment process to decide whether to invite you for an interview.  EY will collect further information if you are invited to the interview (or equivalent) stage and onward. Such information includes interview notes, references, assessment results, feedback and offer details.

In connection with our recruitment activities including applications and onboarding, we may also collect sensitive personal data from candidates, however only where we have a legal obligation to do so. This information is collected if it is relevant to the future working environment at EY or the future provision of employment benefits, or with the individual's explicit consent. Once onboarded, this information may need to be used to provide a suitable working environment. We may also conduct, however only if permitted by applicable law, criminal background checks for certain candidates to assess their eligibility to work at EY or for EY clients. 

Our recruitment tools and websites contain their own Privacy Notices explaining why and how personal data is collected and processed by those applications. We encourage individuals using our recruitment tools and websites to refer to the privacy notices available on those tools and websites.

Depending on the country in which you apply, EY collects personal data about candidates (“you”) from the following sources:

• Directly from you – for example, information that you have provided when applying for a position directly through the EY careers website (for additional information about the processing of your personal data via our global recruitment management system, please read the data privacy statement available in this system)
• From recruitment agencies – for example, when a recruitment agency with your details contacts us to suggest you as a potential candidate;
• Through publicly available sources online – for example, where you have a professional profile posted online (e.g., on your current employer's website or on a professional networking site, such as LinkedIn)
• By reference – for example, through a reference from a former employee or employer, or from a referee you have identified
• Results of background checks

Legal grounds for processing personal data of our job applicants are:

• Explicit consent of the candidate
• Our legitimate interest in attracting, identifying and sourcing talent
• Our legitimate interest to process and manage applications for roles at EY, including the screening and selecting of candidates
• Our legitimate interest to hire and onboard candidates by making an offer to successful candidates, and carrying out pre-employment background checks
• Our legitimate interest to manage our career websites (including conducting statistical analyses)
• Compliance with a legal or regulatory obligation (when carrying out background checks to warrant a candidate is eligible to work)

We process personal data about our suppliers (including subcontractors, and individuals associated with our suppliers and their subcontractors) in order to manage our relationship and contract, and to receive services from our suppliers.

The personal data we process is generally limited to contact information (name, name of employer, phone, email and other contact details) and if relevant financial information (payment-related information).

In addition, we also use data about our suppliers to check whether we have a conflict of interest or audit independence restriction to appointing a supplier. Before we take on a new supplier, we also carry out audit independence and other background checks required by law or regulation, for example, adverse media, bribery and corruption, and financial checks.

Legal grounds for processing personal data of our suppliers may be:

• Performance of a contract
• Compliance with a legal or regulatory obligation
• Our legitimate interest in managing payments, fees and charges, and to collect and recover money owed to EY
• Our legitimate interest in understanding any conflict of interest or challenge with regard to independence legislation
• Our legitimate interest in safeguarding against EY inadvertently dealing with the proceeds of criminal activities or assist in any other unlawful or fraudulent activities (for example, terrorism)