Privacy Policy – EY Entrepreneur Of The Year™ and EY World Entrepreneur Of The Year™ 2023

“EY” refers to one or more of the member firms of Ernst & Young Global Limited (“EYG”), each of which is a separate legal entity and can determine the purposes and means for data processing in its own right (i.e. act as a data controller or in a similar capacity).

The entities that are acting as a data controller (or similar capacity) by providing the Tools in which your personal data will be processed and stored are EYGM Limited, EYGS, LLP, and EY Global Services Limited, all EY global entities. 

The personal data in the Tools is shared by EYGM Limited, EYGS, LLP, and EY Global Services Limited with one or more member firms of EY (see “Who can access your personal data” section 6 below).

Personal information that is processed as part of the Program in the Tools is used primarily to support the Program’s nomination, judging, interview, recognition, and alumni engagement phases as follows.

1. creation of press releases and other marketing and promotional materials, including but not limited to materials aimed at amplifying entrepreneurship through the Program and (if you are a competition participant) materials aimed at recognising your story/journey as an entrepreneur, whether in print, online, or other media;
2. To communicate and engage with you on an ongoing basis, as it pertains to the Entrepreneur Of The Year, World Entrepreneur Of The Year program, EOY alumni network and the Program;
3. engagement with Relevant Parties with respect to sponsors’ participation in interviews and other Program activities and for the purposes of discussing potential business opportunities with you, including opportunities with third parties;
4. authentication of you in relevant tools as further described in the Privacy Notice at Attachment 1;
5. verification of information obtained through background and/or information checks;
6. evaluation and development of the Program;
7. if you are a competition participant, evaluation of your submission by the independent panel of judges to enable you to compete in the Program;
8. In aggregated or anonymized form, except with respect to an EY Person, a Program judge (if you are a competition participant) or a Program sponsor, for purposes of research, education, or any other purposes, as may be decided by any EY Firm in its sole discretion.

The accuracy of the personal information processed in the Tools is maintained by Program management teams for each Entrepreneur Of The Year Program and World Entrepreneur Of The Year Program that is undertaken. Once an EY Entrepreneur Of The Year Program is completed, the original nomination form and any financials are not updated any further. EY does keep personal contact information up-to-date and may note company changes) in any client relationship management (CRM) and alumni Tools current and upcoming.

In the EOY nomination form (or for judges, your judging materials) we will ask your consent to add your contact details in EY’s CRM systems for CRM and analytics purposes. You are free to provide such consent or not. Should you wish to "opt-out" of receiving marketing materials from EY that are unrelated to the EY Entrepreneur Of The Year Program, you can always withdraw your consent by contacting your EY Entrepreneur Of The Year Program Manager.

EY relies on the following basis to legitimize the processing of your personal data in the Tools:

• We process your personal data based on your consent. The provision of your personal data to EY is optional. You have the right to withdraw your consent at any time. However, if you do not provide all or part of your personal data, we may be unable to carry out the purposes for processing and you may be unable to continue in the EOY or WEOY program. Please refer to Section 4 for a description of personal data collected.

If you have any questions about the processing of your personal data in the Tools, please contact your usual EY representative or email global.data.protection@ey.com.

Additionally, the interviews with the independent panel of judges for the Program may take place using virtual event and networking platforms and videoconferencing technologies (see “other Program Technologies” in Appendix 1 for a list of these technologies). The session may be recorded for purposes of the judging process and only used by judges during the Program judging phase. Materials will be deleted after judging.

For EY personnel and judges, EY relies on the following basis to legitimize the processing of your personal data in the Tools:

• Processing of your personal data is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. The specific legitimate interest pursued is administering the Program and conducting the judging of the Program. EY personnel and judges have the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them based on the above legitimate interests.

#. US State Privacy Rights

Depending on the US state you reside in, you may have certain additional rights with respect to your personal data.  Please visit our US State Privacy Statement for more information.  To the extent that EY sharing your contact information with EOY Program Sponsors constitutes a sale of personal data under applicable law, you can opt out of such sale of data by contacting us at global.data.protection@ey.com.

The following personal data categories are processed: 

Personal Data processed relates to Program participants including Nominators/Candidates, Judges and EY Personnel who administer the Tools. This data is sourced from: EY systems, EY personnel, EOY judges, nominators, and candidates. Candidates could include EY clients. 

Nominators/Candidates 

Personal data processed in the Tools relating to Program nominators and candidates includes their contact information (name, email, work or mobile phone number and address) and company related information (company name, address, URL and affiliated information such as “How long have you been working with your company”. 

Nominees can also provide personal information about themselves via LinkedIn authentication. Authentication through LinkedIn will include their name (First name and last name), email address and profile picture from their LinkedIn profile. A unique ID generated by LinkedIn is also processed. The LinkedIn user ID will be used internally to map the user authentication method. Any user entry that has the LinkedIn user ID present will validate that the user was authenticated via LinkedIn. We may collect a nominee and/or company social media profile information to facilitate social tagging as part of Program recognition and engagement. 

It is not mandatory for all the data fields within a nomination form to be completed by Nominators and Nominees. For example, Date of Birth (month and year only),Gender, and Ethnicity are optional fields, may only be collected in some countries, and may only be collected in some countries if the Nominee is applying for a special award category. Mandatory data fields will be marked in the nomination form via a red asterisk. 

EY may seek information about a Nominee or their company/organization to confirm or supplement information contained within their nomination form for the EY Entrepreneur Of The Year Program ("Background Checks"). Background Checks may include information obtained from publicly available sources such as (social) media, credit history, court and other available registers, record-of-offense searches (to the extent permitted by applicable law) or information from third-party sources. 

In addition to the Personal Data, which is processed in the Tool, the EOY nomination form also asks Candidates for 3 years of financial information relating to their company/organization and they are asked to provide the following details for each of these years: 

1. Annual Sales 

2. Income Before Taxes 

3. EBITDA 

4. Total Assets 

5. Total Equity 

In submitting the above financial information for the purposes of the Program, Nominees confirm that: the provision of such information does not breach the privacy or any other legal rights of the company/organization that is the subject of the information; they have obtained the information in a duly authorized manner; and they are duly authorized to provide EY with the right to use such information for purposes in connection with the Program. 

If you are chosen to advance to WEOY, you are required to complete and submit a Criteria Evaluation Report (“Report”). The Report includes an essay section that addresses the following subjects: 

1. Entrepreneurial Spirit 

2. Purpose 

3. Growth 

4. Impact 

In addition to the Report, you may also be asked to provide other information, including for example, your headshot photo(s), EY press release, your biography and related biographical information, the pronunciation and recording of your name, the recording of your responses to Program questions, your music selections, and other video and photo materials (“Other Information”). 

Transfer of materials received from the winner to the independent panel of judges is handled by the local EOY team, using Judging Software to securely transfer, share and manage nominee submissions. 

Judges

Personal data processed in the Tools includes their name, contact details (email, telephone number and address), assistant’s contact information, photograph, biography and company related information if appropriate. 

EY Personnel

Personal data processed in the Tools includes their name, contact details (email, title, work phone number and address) and company related information. 

EOY admins will upload documents into the EOY System, Judging Software, and Program Technologies and be responsible to manage and monitor data, and ensuring it is deleted in compliance with local retention policies. 

Sensitive personal data is data revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning sex life or sexual orientation.

EY may collect sensitive personal data from you via the Tools around racial or ethnic origin if particular countries request such data on a voluntary basis as part of their nomination form; this information will be used solely to conduct an aggregated and deidentified analysis of the diversity composition of the nomination pool in those countries where the data is collected. 

Please note that free text field(s) should not be populated with excessive personal data (including any sensitive personal data) and/or confidential client information.

EY will not transfer your personal information to third parties (other than those parties specifically contracted to execute the Program) unless we have your permission or are required by law to do so. We will only disclose your personal information to third parties that have agreed in writing to provide an adequate level of privacy protection. Your personal information may be accessed in the Tools by the following persons in connection with the EOY and WEOY Programs.

In addition to the above chart, EY personnel at all levels will have access to personal data on a “need to know basis” for the purposes of the Program. EY personnel are subject to various member firm and professional guidelines governing the use of private information obtained during the course of their work, and these guidelines apply to private information collected for the Program.

The access rights detailed above involves transferring personal data in various jurisdictions (including jurisdictions outside the European Union) in which EY operates (EY office locations are listed at www.ey.com/ourlocations). An overview of EY network entities providing services to external clients is accessible here (See Section 1 (About EY) - “View a list of EY member firms and affiliates”). EY will process your personal data in accordance with applicable law and professional regulations in your jurisdiction. Transfers of personal data within the EY network are governed by EY’s Binding Corporate Rules.

EY transfers or discloses the personal data EY collects to third-party service providers (and their subsidiaries and affiliates) who are engaged by EY to support EY’s internal ancillary processes. For example, EY engages service providers to provide, run and support EY’s IT infrastructure (such as identity management, hosting, data analysis, back-up, security and cloud storage services) and for the storage and secure disposal of EY’s hard copy files. It is EY’s policy to only use third-party service providers that are bound to maintain appropriate levels of data protection, security and confidentiality, and that comply with any applicable legal requirements for transferring personal data outside the jurisdiction in which it was originally collected.

To the extent that personal data has been rendered anonymous in such a way that you or your device are no longer reasonably identifiable, such information will be treated as non-personal data and the terms of this Privacy Notice will not apply.

For data collected in the European Economic Area (EEA) or which relates to individuals in the EEA, EY requires an appropriate transfer mechanism as necessary to comply with applicable law. The transfer of personal data to Judging Software is governed by an agreement between EY and the Judging Software provider that includes standard data protection clauses adopted by the European Commission. The transfer of personal data to Program Technologies is governed by an agreement between EY and the Program Technologies provider that includes standard data protection clauses adopted by the European Commission.

The EOY System also uses Adobe Analytics (“Adobe”) in order to provide reporting, visualizations and analysis of data. Your personal data will be processed by Adobe for the following purposes: (i) to capture web metrics about the journey of users within EY websites and applications (e.g. pages viewed and links clicked); (ii) to analyze and understand overall site traffic information; (iii) to allow EY to make informed decisions about EY’s intranet and extranet web sites; and (iv) to authenticate users and permit them to access the EOY System. EY Global Services Limited is the data controller for the purposes of this processing and licenses Adobe from Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Saggart, Dublin 24, Ireland, who hosts it in London, United Kingdom.

Adobe processes the following types of personal data in relation to its users: username (relating to system administrators only); hashed email address; user country; user country code; user region/office; and/or internal vs. external user information. This personal data will be retained for 37 months and archived for 90 days before deletion. Sensitive personal data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning sex life or sexual orientation, is not processed. This personal data can be accessed by internal EY personnel. This processing is necessary for the purposes of the legitimate interests pursued by EY (except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.) The specific legitimate interest pursued is: reporting on the usage of EY applications and website.

Our policy is to retain personal data only for as long as it is needed for the purposes described in the section “Why do we need your personal data?” Retention periods vary in different jurisdictions and are set in accordance with local regulatory and professional retention requirements.

In order to meet our professional and legal requirements, to establish, exercise or defend our legal rights and for archiving and historical purposes, we need to retain information for significant periods of time.

The policies and/or procedures for the retention of personal data in the Tools are:

• Personal Data in the EOY System, such as participants’ contact information, will be deleted 10 years after completion of the EOY Program. For the period beyond 10 years of completion of the EOY Program, the only information that will be retained on participants is their name, the company/organization they are associated with, the year they participated in the EOY Program and whether they were a winner/runner up. This information is retained in the system so that the Program Managers have an entire history of participants in the Program. They are frequently asked if a certain company or person has participated in the EOY contest and if they won an award.
• Data will be deleted from Judging Software, and Program Technologies and access revoked following the conclusion of each program lifecycle.

EY protects the confidentiality and security of information it obtains in the course of its business. Access to such information is limited, and policies and procedures are in place that are designed to safeguard the information from loss, misuse and improper disclosure. Additional information regarding our approach to data protection and information security is available in our Protecting your data brochure.

EY will not transfer your personal data to third parties (other than any external parties referred to in section 6 above) unless we have your permission or are required by law to do so.

You are legally entitled to request details of EY’s personal data about you. To confirm whether your personal data is processed in the Tools or to access your personal data in the Tools or (where applicable) to withdraw your consent, contact your usual EY representative or email your request to global.data.protection@ey.com.

You can confirm your personal data is accurate and current. You can object to the processing of your personal data or request rectification, erasure, restriction of processing or a readily portable copy of your personal data by contacting your usual EY representative or by sending an e-mail to global.data.protection@ey.com.

If you are concerned about an alleged breach of privacy law or any other regulation, contact EY’s Global Privacy Leader, Office of the General Counsel, 6 More London Place, London, SE1 2DA, United Kingdom or via email at global.data.protection@ey.com or via your usual EY representative. An EY Privacy Leader will investigate your complaint and provide information about how it will be handled and resolved.

If you are not satisfied with how EY resolved your complaint, you have the right to complain to your country’s data protection authority. You can also refer the matter to a court of competent jurisdiction. Certain EY member firms in countries outside the European Union (EU) have appointed a representative in the EU to act on their behalf if, and when, they undertake data processing activities to which the EU General Data Protection Regulation (GDPR) applies. Further information and the contact details of these representatives are available here.

If you have additional questions or concerns, contact your usual EY representative or email global.data.protection@ey.com.