Privacy statement

When you engage us to provide you with professional services, we collect and use personal data when we have a valid business reason to do so in connection with those services. For an overview of our services, click here .

In the context of providing professional services to clients, EY also processes personal data of individuals who are not directly our clients (for example, employees, customers or suppliers of our clients). See the section “Individuals whose personal data we obtain in connection with providing services to our clients ” for additional information.

The majority of the personal data we collect and use to provide our services is supplied voluntarily by (or collected by us from  sources at the request of) our clients. Because of this, if you are a client of EY, then it will generally be obvious to you what personal data we collect and use. This information can include:

• Basic information, such as your name, the company you work for, your position and your relationship to a person
• Contact information, such as your postal address, email address and telephone numbers
• Financial information, such as payment-related information
• Any other personal data relating to you or other third parties which you provide to us for the purpose of receiving our services

We use this information:

• To provide services to you
• To administer our relationship and maintain contractual relations
• For accounting and tax purposes 
• For marketing and business development
• To comply with our legal and regulatory obligations
• To establish, exercise or defend legal rights
• For historical and statistical purposes

Given the diversity of the services we provide, we process many categories of personal data. Please see below examples of personal data categories for our four main service lines:

As part of the professional services EY provides to clients, EY processes personal data of individuals with whom we do not have a direct (contractual or other) relationship. For example, if we perform a statutory audit, our engagement team will be required to audit our client’s books, which could include payroll data for employees of the client, supplier data, financial administration, data regarding claimants and legal proceedings. To take another example: if we undertake a due diligence review of an acquisition of a target on behalf of a client, EY obtains personal data concerning the target’s employees, management and customers.

We seek confirmation from our clients that they have the authority to provide personal data to us in connection with the performance of the services and that any personal data they provide to us has been processed in accordance with applicable law.

Given the diversity of services we provide, we process many categories of personal data such as:

• Personal details (such as name, age, data of birth, gender, marital status and country)
• Contact details (such as phone numbers, email address and postal address)
• Financial details (such as salary, payroll, income, investments, benefits and tax status)
• Employment details (such as role, rank, experience, performance data and employment numbers)

For certain services, we also process special category data. For example, in certain countries performing tax return services involves the processing of details of payments made by our client, his or her spouse and dependents with respect to a trade union membership, to a political party, for medical treatments or to a religious charity. Such data is collected intentionally and will be used only where necessary in connection with the provision of the service for which the data was collected, such as determining the correct taxation of our client’s income and for claiming the correct tax deduction with respect to such payments.

Legal grounds for processing personal data of individuals whose personal data we obtain in connection with providing services to our clients are:

• Compliance with a legal or regulatory obligation
• Our legitimate interest in making sure our clients are provided with seamless, consistent and high-quality services worldwide
• Improvement of processes and communication within the scope of operational audits 

Once a company undergoes an insolvency, one or more EY insolvency practitioners (i.e., administrators and liquidators) could be appointed to manage the company’s affairs, business and property. Similarly, when a debtor is subject to insolvency or a restructuring regime, one or more EY insolvency practitioners could be appointed to manage the debtor’s affairs, business and property.

In this section the terms listed below have the following meanings:

• Office holder refers to the EY insolvency practitioners.
• Company refers to the insolvent entity for which the office holders have been appointed.
• Debtor refers to the individual who is subject to an insolvency or restructuring regime.
• “You” refers to the data subjects concerned by the insolvency procedure of the company or debtor.

In providing insolvency services, EY processes your personal data for the legitimate interests of assisting the office holders in the performance of their legal and regulatory obligations with regard to the insolvency procedures. For clarity purposes, the company or debtor remains data controller of your personal data processed for purposes that are not related to the legal and regulatory obligations of the office holders.

Most of the personal data we process is obtained from you directly, but we also indirectly obtain personal data about you.

The office holders and EY process your personal data for the following (non- exhaustive) purposes:

• Communicating with the company or debtor’s creditors and individual creditors: specific information essential in order to carry out statutory duties (this information is to be used to assess, for example, an entitlement to any dividend should one be payable)
• Provision of references or reports to government departments, regulatory authorities and appropriate bodies in connection with the holding of public office or responding to requests
• Provision of statutory returns
• Case administration purposes, including the realization of assets, agreement of claims and payment of distributions
• Processing for personal purposes of employees in accordance with the law and the company’s own policies
• Administration of payroll, raising invoices, credit control and other data relating to the company’s finances
• The reasonable and lawful provision of information to interested parties
• The prevention and detection of crime or fraud
• Establishing, exercising or defending legal rights, taking legal advice, taking or defending legal proceedings
• Complying with legal obligations to which the company or debtor is subject
• Quality and risk management purposes

The types of personal data processed for the above purposes include (but are not limited to) name, address, identifying information, payroll information, as well as any information with your dealings with the company or debtor that are necessary for the performance of the office holders’ statutory obligations during the insolvency procedure.

You have certain rights in relation to your personal data. If you have a query or wish to exercise your rights, please make a written request to the party responsible for your personal data (the company, debtor or the office holder) using the contact details provided in communications about the insolvency.

We process personal data about contacts (former, existing and potential clients and individuals employed by, or associated with, such clients and other business contacts, such as alumni, consultants, regulators and journalists) in our CRM systems. These CRM systems support the marketing operations of EY. Contacts in our CRM systems will be sent EY Thought Leadership materials, newsletters, marketing materials, learning opportunities, surveys and invitations to events.

In our CRM systems, we process the following categories of personal data:

• Name, job title, address, email address, phone and fax numbers
• Name of employer or organization the individual is associated with
• Marketing preferences
• Invitation responses and event attendance confirmations

We do not intentionally collect sensitive category data, unless you provide us with such data (for example, special dietary requirements which reveal your religious affiliation or any food allergies), if you attend one of our events.

Legal grounds for processing personal data of business contacts are:

• Explicit consent of the business contact
• Our legitimate interest in managing the relationship with our business contacts and providing information about EY, our services and events we organize

We process personal data about participants in EY meetings, conferences, events and learning sessions (events). We use various applications to manage event registration processes, which applications will contain their own privacy notices explaining why and how personal data is collected and processed by these applications. We encourage participants to refer to the privacy notices available on those applications.

For a general overview of how we process your personal data in connection with our events, please refer to our event data protection declaration.

We provide external users access to various applications managed by us (such as the EY Client Portal). In instances where such applications process personal data that goes beyond basic contact information used for application authentication purposes, such applications will contain their own privacy notices explaining why and how personal data is collected and processed by those applications. We encourage individuals using our applications to refer to the privacy notices available on those applications.

EY uses a variety of tools to maintain the security of our IT infrastructure, including our email facilities. Examples of such tools are:

• Systems that scan incoming emails to EY recipients for suspicious attachments and URLs, in order to prevent malware attacks
• Tools that provide end-point threat detection to detect malicious attacks
• Tools that block certain content or websites

If you correspond via email with an EY recipient, your emails will be scanned by the tools EY operates to maintain the security of its IT infrastructure, which could result in content being read by authorized EY persons other than the intended recipient.

Legal grounds for processing personal data of individuals who correspond with EY via email:

• Our legitimate interest in protecting our IT infrastructure against unauthorized access or data leakage
• Our legitimate interest in analyzing email traffic

If you apply for a job at EY, your data will be processed to check and process your application. Please note that depending on the country in which you apply, different information is required. In general, the data, information that we receive about CVs, certificates and other documents.  Further data is collected if you provide it directly to us or if a legal requirement exists.

Your personal data will only be processed by the responsible specialist departments for the purpose of carrying out the application procedure. For further information, please refer to our data protection declaration for the application procedure

Depending on the country in which you apply, EY collects personal data about candidates (“you”) from the following sources:

• Directly from you – for example, information that you have provided when applying for a position directly through the EY careers website (for additional information about the processing of your personal data via our global recruitment management system, please read the data privacy statement available in this system)
• From recruitment agencies – for example, when a recruitment agency with your details contacts us to suggest you as a potential candidate
• Through publicly available sources online – for example, where you have a professional profile posted online (e.g., on your current employer's website or on a professional networking site, such as LinkedIn)
• By reference – for example, through a reference from a former employee or employer, or from a referee you have identified
• Results of background screening checks

Legal grounds for processing personal data of our job applicants are:

• Our legitimate interest to hire and onboard candidates by making an offer to successful candidates
• Compliance with a legal or regulatory obligation (when carrying out background checks to warrant a candidate is eligible to work)

EY hopes to maintain a lifelong, mutually beneficial relationship with EY alumni (former member firm partners and employees). If we invite you to our alumni community, your name, contact details, role, last EY office, rank, service line and country will be used to create a record for you in one of our alumni databases.

We process personal data about our suppliers (including subcontractors, and individuals associated with our suppliers and contractors) in order to manage our contract and to receive services from our suppliers.

The personal data we process is generally limited to contact information (name, name of employer, phone, email and other contact details) and financial information (payment-related information).

In addition, we also use data about our suppliers to check whether we have a conflict of interest or audit independence restriction to appointing a supplier. 

Legal grounds for processing personal data of our suppliers are:

• Performance of a contract
• Compliance with a legal or regulatory obligation
• Our legitimate interest in managing payments, fees and charges, and to collect and recover money owed to EY
• Our legitimate interest in understanding any conflict of interest or challenge with regard to independence legislation

EY/Ethics provides EY people, clients and others outside of EY with a means to confidentially, and either anonymously or on a disclosed basis, report an activity that involves unethical or illegal behavior that is in violation of professional standards or otherwise inconsistent with our EY Global Code of Conduct. Reports can be made either online or via a telephone hotline.

EY/Ethics contains its own privacy notice and consent form which describes the practices EY follows in relation to EY/Ethics. We encourage individuals using EY/Ethics to refer to this EY/Ethics notice and consent form.

When you visit an EY office, we process your personal data in order to provide you with certain facilities (such as access to our buildings and conference rooms or Wi-Fi), to control access to our buildings, and to protect our offices, personnel, goods and confidential information.

The personal data we collect is generally limited to your name, contact information, location, and the time you enter and leave our office.

Visitor records and access badges
We require visitors to our offices to sign in at reception and we keep that record of visitors for a short period of time. Visitors to our offices are provided with a temporary access badge to access our offices. Our visitor records will be used to verify that access badges are returned, to look into a security incident and for emergency purposes (for example, if an office needs to be evacuated).

Wi-Fi
We monitor and log the traffic on our Wi-Fi networks to ensure the security of our network and to prevent and prosecure violations by users.