Global Privacy Policy – Yello Recruitment Site

January 2023

1. Introduction

This Privacy Notice is intended to describe the practices EY follows in relation to Yello (“Tool”) with respect to the privacy of all individuals whose personal data is processed and stored in the Tool. This Privacy Notice should be read together with the ey.com Privacy Statement, and in case of any conflict with the ey.com Privacy Statement, the terms of this Privacy Notice will prevail. Please read this Privacy Notice carefully.

Please note that some content of this Privacy Policy is not applicable if you apply for a position at one of the EY entities in the EU which are subject to the General Data Protection Regulation (“GDPR”).  Corresponding content is marked with a (*). 

2. Who manages the Tool?

“EY” refers to one or more of the member firms of Ernst & Young Global Limited (“EYG”), each of which is a separate legal entity and can determine the purposes and means for data processing (i.e., act as a data controller or in a similar capacity). The entity that is acting as data controller (or similar capacity) by providing this Tool on which your personal data will be processed and stored is the EY entity that posted the position for which you are applying, or the EY entity with which you are engaged in any other way.

You can find a list of local EY member firms and affiliates on the ey.com Privacy Statement. The personal data in the Tool is shared by the above data controller with one or more member firms of EYG (see “Who can access your personal data” section 6 below).

The Tool is hosted on Amazon Web Services servers in Ireland and Frankfurt.

3. How does the Tool process personal data? 

The Tool support EY in conducting its recruitment activities. The Tool has two functionalities: (i) to act as a recruiting tool for the submission of job applications; and (ii) to act as a pool of applicants for job roles.

If you are a candidate or applicant, or make use of the Tool in another capacity, your personal data that is processed in the Tool is used for one or more of the following purposes:

• Account creation;
• Logging into Yello;
• Sending invitations for, and managing, campus events;
• Submission of job applications;
• Conduct of digital interviews;
• Processing, evaluating, and managing job applications;
• Managing candidate nurturing and communication (for example, marketing emails in respect of those candidates/applicants who have opted into the talent pool);
• Making job offers;
• Scheduling interviews; and
• Providing updates after interviews.

We base the processing of your personal data (depending on the country and stage of the recruitment process) in context of this Tool on one of the following legal grounds:

In the scope of the GDPR, the data are processed based on a pre-contractual relationship, your consent, legal obligations and/or legitimate interest.

Insofar we process your sensitive personal data, this will only be done to comply with a legal obligation to which the respective controller is subject, or - if you have voluntary provided the information - on the basis of your explicit consent. However, if you do not provide us with all or part of your personal data, we may not be able to fulfill some of the purposes of the processing. You have the right to withdraw your consent at any time. Please contact: global.data.protection@ey.com.

If you are an internal EY user of the Tool, your personal data that is processed in the Tool is used as follows:

• Account creation;
• Logging into Yello;
• Creation of job requisitions and events;
• Sending invitations for, and managing, campus events;
• Conduct of digital interviews;
• Assessment of job applications;
• Managing candidate nurturing and communication; and
• Selection of successful candidates for hiring;
• Scheduling interviews;
• Providing updates after interviews; and
• Identifying interviewers.

Processing of your personal data is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. The specific legitimate interest(s) are:

• Human Resource management, including performance reviews and recruitment; and
• Success of EY’s recruiting practices, including sourcing, Recruiting, Selection and Hiring.

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you based on the above legitimate interest(s). Please contact: global.data.protection@ey.com.

If you are a campus representative, your personal data that is processed in the Tool is used as follows:

• Account creation;
• Logging into the Tool;
• Sending invitations for, and managing, campus events; and
• may be processed during the selection of successful candidates for hiring.

4. What type of personal data is processed in the Tool?

If you are a candidate or applicant, or make use of the Tool in another capacity, and if legally permitted by EY under applicable law, the Tool may process these personal data categories:

• Candidate profile information (name, contact details, educational information, resume/CV, languages spoken, geographic preferences, location, job applied for/job offered; 
• Diversity information, photo;
• Applicant information for a specific job requisition, interview information (*including via video/recorded interviews), assessment information, information pertaining to country-specific regulatory or operational requirements;
• Sensitive personal data (racial and ethnic origin, health data, sexual orientation);
• Government identifiers such as passport numbers, visa details and national ID numbers); and
• Data related to (for the job relevant) criminal convictions will be collected but only in the form of a “yes” or a “no”. No further information on criminal convictions will be processed.

We obtain your personal data in various ways:

• Provided by you. Some personal data we receive straight from you. Examples include information in your messages to us and information you enter in a web contact form or online portal.
• Obtained internally. It is possible that we obtain your personal data from other EY systems. An example for clients is the data which is included into our CRM system. This data may come from the following sources:
  • Candidates/applicants themselves via registration in Yello; 
  • EY Partners, employees, or contractors (as a referral);
  • SuccessFactors/Employee Central;
  • SF Recruiting; and
  • EY tools such as CappFinity, Saville, Pymetrics, and HireVue.

If you are a campus representative, the Tool processes these personal data categories:

• Name, email address, title, phone number, college/university department. This data is sourced from:
• yourself; and
• College/university websites or the college/university itself.

5. Sensitive personal data

According to the definition of the GDPR, sensitive personal data reveals your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning sex life or sexual orientation.

The collection and processing of sensitive or special personal data may also be necessary in some countries where this is mandatory or required by applicable law:

• Racial and ethnic origin;
• Health data;
• Sexual orientation;
• Government identifiers such as passport numbers, visa details and national ID numbers; and
• Data relating to criminal convictions (please note that only a “yes” or “no” is recorded via the Tool in relation to criminal convictions – no further information or details of those convictions is recorded). 
  

6.  Who could access your personal data?

Your personal data is accessed in the Tool by the following persons/teams:

• EY Employees, Partners, and Contractors
• EY Hiring Managers
• Recruiters
• Recruiting Talent Shared Services and Recruiting Coordinators
• Sourcing Super User
• Global System Support
• Global Reporting
• Candidates / Applicants
• Yello Support staff
• Tata Consulting Services (TCS)
• IBM IT Support Team

It is our policy to only use third-party service providers that are bound to maintain appropriate levels of data protection, security, and confidentiality, and that comply with any applicable legal requirements for transferring personal data outside the jurisdiction in which it was originally collected.

The access rights detailed above may involve the transferring of personal data in various jurisdictions (including jurisdictions outside the European Union) in which EY operates (EY office locations are listed at https://www.ey.com/en_gl/locations). EY will process your personal data in the Tool in accordance with applicable law and professional regulations in your jurisdiction. Transfers of personal data within the EY network are governed by EY’s Binding Corporate Rules.

For data collected in the European Economic Area (EEA) or which relates to individuals in the EEA, EY requires an appropriate transfer mechanism as necessary to comply with applicable law. The transfer of personal data from the Tool to RECSOLU, Inc., DBA Yello, and from the Tool to TCS and IBM, are governed by agreements between EY and these service providers that includes standard data protection clauses adopted by the European Commission.

You can contact us via global.data.protection@ey.com if you want additional information about the way in which we legitimize the transfer of your personal data to countries outside the EEA. 

7. Data retention

Our policy is to retain personal data only for as long as it is needed for the purposes described in the section “How does the Tool process personal data”. Retention periods vary in different jurisdictions and are set in accordance with local regulatory and professional retention requirements.

In order to meet our professional and legal requirements, to establish, exercise or defend our legal rights and for archiving and historical purposes, we need to retain information for significant periods of time.

The policies and/or procedures for the retention of personal data in the Tool are:

• If you are a candidate, applicant or make use of the Tool in another capacity, your data will be held in line with the respective local EY retention policies. After the end of the data retention period, your personal data will be deleted or anonymized (in which case your data will no longer be personal data and you will not be identifiable from such anonymous data). If you have any questions on our data retention practices, please contact us via global.data.protection@ey.com.
• If you are an EY user of the Tool, your data will be held in line with the EY Records Retention Global Policies and the relevant Country Retention Schedule (CRS). After the end of the data retention period or in the event of revocation of consent your personal data will be deleted or anonymized (in which case your data will no longer be personal data and you will not be identifiable from such anonymous data).

After the end of the data retention period, your personal data will be deleted.

8. Security

EY protects the confidentiality and security of information it obtains in the course of its business. Access to such information is limited, and policies and procedures are in place that are designed to safeguard the information from loss, misuse and improper disclosure. Additional information regarding our approach to data protection and information security is available in our Protecting your data (pdf) brochure.

9. Controlling your personal data

EY will not transfer your personal data to third parties (other than any external parties referred to in section 6 above) unless we have your permission or are required by law to do so.

10. Your rights in relation to your personal data 

Depending on the applicable jurisdiction, you may have certain rights in relation to your personal data, including:

• To request details of the personal data EY processes about you and to access the personal data that EY processes about you
• To have your personal data corrected, for example, if it is incomplete or incorrect
• To restrict or object to the processing of personal data or request the erasure of your personal data
• To receive a copy of the personal data which you have provided to EY in a structured, commonly used and machine-readable format which you can re-use for your own purposes (known as “data portability”)
• Where you have provided consent to the processing of your personal data, the right to withdraw your consent.
• The right to complain to a data protection authority (see section “Complaints”)

If you have any questions about how EY processes your personal data or your rights related to your personal data, please send an e-mail to data protection team.

11. Complaints

If you are concerned about an alleged breach of privacy law or any other regulation, contact EY’s Global Privacy Leader, Office of the General Counsel, 6 More London Place, London, SE1 2DA,United Kingdom or via email at data protection team or via your usual EY representative. An EY Privacy Leader will investigate your complaint and provide information about how it will be handled and resolved.

If you are not satisfied with how EY resolved your complaint, you may have the right to complain to your country’s data protection authority. You may also have the right to refer the matter to a court of competent jurisdiction.

Certain EY member firms in countries outside the European Union (EU) and the UK have appointed representatives in the EU and the UK respectively to act on their behalf if, and when, they undertake data processing activities to which the EU General Data Protection Regulation (GDPR) and/or the UK General Data Protection Regulation (UK GDPR) applies. Further information and the contact details of these representatives are available below:

EU data protection representative

UK Data protection representative

12. Contact us

If you have additional questions or concerns, contact your usual EY representative or email data protection team.