10/21/24, 9:43 AM about:blank

Data Privacy Statement

Last updated: April 2024

Privacy Notice – SAP SuccessFactors Recruiting

1. Introduction
This Privacy Notice is intended to describe the practices EY follows in relation to the SAP SuccessFactors Recruiting (“Tool”)
with respect to the privacy of all individuals whose personal data is processed and stored in the Tool. This Privacy Notice
should be read together with the ey.com Privacy Statement, and in case of any conflict with the ey.com Privacy Statement, the
terms of this Privacy Notice will prevail. Please read this Privacy Notice carefully.

2. Who manages the Tool?

“EY” refers to one or more of the member firms of Ernst & Young Global Limited (“EYG”), each of which is a separate legal
entity and can determine the purposes and means for data processing in its own right (i.e. act as a data controller or in a
similar capacity).

The entity that is acting as data controller (or similar capacity) by providing this Tool on which your personal data will be
processed and stored is:

For the personal data of EY personnel: The data controller is the EY entity which employs you.
For the personal data of third party personnel (including EY clients): The data controller is the EY local member firm with
which the third party has a relationship.

You can find a list of local EY member firms and affiliates on the ey.com Privacy Statement:
https://www.ey.com/en_gl/privacy-statement

The personal data in the Tool is shared by the above data controller with one or more member firms of EYG (see “Who can
access your personal data” section 6 below).

The Tool is hosted on servers externally by SAP Success Factors, which is hosted in data centers in St. Leon Rot, Germany
and Amsterdam, the Netherlands. ModernHire is hosted externally on AWS servers in US East 1 Northern Virginia, Dublin,
Ireland, and Sydney, Australia. For IBM Watson AI hosting is on external production servers located in Sterling, Virginia at a
colocation facility (Cyxtera), Washington, D.C., and San Jose, California.

3. How does the Tool process personal data?

The Tool is EY’s candidate engagement System that we use to support EY’s recruitment process including sourcing,
recruiting, selecting and hiring new employees and contractors (EY Talent Community).

The Tool will be EY’s Applicant Tracking System and support EY’s recruitment process including sourcing, recruiting,
selecting and hiring new employees and contractors. The SAP Offer Tool is integrated with SAP SF Recruiting where SF
Recruiting will receive offer letter information consisting of offer letter approvers, offer letter status updates, identification
numbers and signed offer letters. SAP SF Recruiting is integrated with third-party background investigation provider Sterling.
These integrations will send data from the Candidate Application, Candidate Profile, and Requisition to Sterling for the
purposes of initiating a background investigation. This integration with Sterling is only applicable for the US, Canada, and
UK.

In addition, you have the option to opt-in to receiving additional information via email. If you provide your consent, EY
recruiters may use the data you provided to us, to send you tailored communications including job posting notifications or
other tailored email campaigns that may be interesting for you. You have the right to withdraw your consent or to object to
receiving such communications at any time.

Your personal data processed in the Tool is used to source, assess, select, and hire employees for EY job openings. By
applying for a job via the Tool means that you are creating an account and will be included in the EY Talent Community;. A
candidate can leave the community at any moment by withdrawing their consent.
about:blank 1/6
10/21/24, 9:43 AM about:blank
All the data profiled is being processed in compliance with applicable domestic law. Users have the right to object to profiling.
Profiling is where decisions are made about you based on aspects of your personal information. If you have any concerns
regarding profiling, please contact your usual EY representative or EY’s Global Privacy Leader under Section 10.

These are the two ways the data is used in the IBM Watson AI Sourcing and IBM Watson AI Screening systems:

When a candidate applies to an open position (Job description) and has uploaded its Resume, this Candidate Resume will be
validated against this specific open position and ranked by a score. The Recruiter can see all the ranked candidates to this
open position. The Recruiter can see the details of this validation by clicking on the candidate by a hyperlink. After clicking
on this hyperlink and with the help of the tool Proactive Sourcer, the validation details of this specific candidate can be
viewed on a one pager. This can be done via the functionality IBM Watson AI Screening;
When a recruiter has a to be posted (new) open position (Job description) the recruiter can test, with the help of the tool
Proactive Sourcer, if there are high potential qualified Candidate Resumes available in our portfolio. The result of this
validation will be a list of high qualified potential candidate Resumes to this specific job description by returning back the
Unique Identifier of the candidates in SF Recruitment. This Unique Identifier can be used by the recruiter to identify this
candidate’s details in SF Recruitment. This can be done via the functionality IBM Watson AI Sourcing (Talent rediscovery).

The data used in the IBM Watson AI Sourcing and IBM Watson AI Screening Tool is profiling candidates by using candidate
resumes and a job requisition to calculate a Match Score to identify how well candidates’ skills and competencies match the
requirements of specific Job Descriptions. Candidates with skills matching the targeted skillset (required, preferred or soft
skills) will receive a higher ranking/score than candidates with fewer skills. All the data profiled is being processed in
compliance with applicable domestic law. Candidates have the right to object to profiling. Profiling is where decisions are
made about you based on aspects of your personal information. Please note that there is no automated decision-making carried
out by the Tool. If you have any concerns regarding profiling or wish to exercise your right to object to profiling, please
contact your usual EY representative or EY’s Global Privacy Leader under Section 10.

ModernHire tool will improve the overall efficiency of the interview scheduling and management process by integrating with
the Applicant Tracking System to pull candidate profiles and integrating with Outlook for candidates to easily view the
free/busy calendar of hiring managers/interviewers and select a mutually convenient time. Once the candidate selects a
specific time, it will automatically create an entry on hiring manager’s and candidate’s calendar with a link to the virtual
interview. The Tool will be granted access to view/create/delete/manage online meetings for all global users (EY Employees
& EY Contractors) to which a policy is applied to allow that level of access.

EY relies on the following basis to legitimize the processing of your personal data in the Tool:

Candidates/Applicants:

1. Talent Community: We process your personal data based on your consent. The provision of your personal data to EY is
optional. However, if you do not provide all or part of your personal data, we may be unable to carry out the purposes for
processing. You have the right to withdraw your consent at any time.
2. Communications & email campaigns (job postings & career opportunities): We process your personal data based on your
consent. The provision of your personal data to EY is optional. However, if you do not provide all or part of your personal
data, we may be unable to carry out the purposes for processing. You have the right to withdraw your consent at any time.

Please note, that your consent for the Talent Community and your consent to receive additional communications & email
campaigns are separate and individual decisions and that your decision whether or not to opt into receiving communications
& email campaigns will not have any impact on our recruitment processes.

EY Employees:

For the purposes of the legitimate interests pursued by the data controller or by a third party, except where such interests are
overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.
The specific legitimate interest(s) are legitimate interests in ensuring the success of our recruitment practices, including
sourcing, recruiting, selection and hiring of new employees, Human Resource management, including performance reviews
and recruitment.

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data
concerning you based on the above legitimate interest(s).

In some jurisdictions, personal data of the users is being processed pursuant to the relationship resulting from the employment
contract with such data subjects and is necessary for the controller or data subject to carry out their obligations in the field of
employment, and therefore, for the execution of such contracts.

4. What type of personal data is processed in the Tool?

about:blank 2/6
10/21/24, 9:43 AM about:blank
The Tool processes these personal data categories:

External Candidates: Basic candidate profile information including First name, Last name, basic contact information, and
resume/CV, work experience, languages spoken, geographic preferences, area of interest, candidate activities in the account,
logins and status changes.
Applicants: Information required to consider the candidate an applicant for a specific requisition including candidate
profile information above plus interview information, assessment information, and offer details. Other data elements
collected based on country specific regulatory or operational requirements, candidate activities in the account, logins and
status changes, candidate IP addresses, encrypted session cookies.
Agency representative contact information: First name, Last name and email address, name of agency
EY Partners / Employees / Contractors: Basic user contact and organizational data from SuccessFactors Core HR (EC).
As part of the recruiting process, for these individuals to be consider internal candidates, mobility preferences, and personal
contact information is included, General location.

This data is sourced:

From the candidate or applicant, themselves

From third parties in connection with your application such as referees, recruiters, organizations that provide background
checks and assessment results (e.g. CappFinity, Saville, Pymetrics, HireVue, RAI, Sterling for Background assessment
results).
Directly by EY partners, employees or contractors
From a feed from other EY systems (SuccessFactors / Employee Central; Yello)
Information is sourced from SAP Offer Tool where SF Recruiting will receive information on offer letters consisting of
offer letter approvers, offer letter status updates, identification numbers and signed offer letters.

5. Sensitive personal data

Sensitive personal data reveals your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union
membership, genetic data, biometric data, data concerning health or data concerning sex life or sexual orientation.

Sensitive personal data is collected on a country basis in the applications and / or Offer as requested by the country based on
regulatory or operational needs. For example, the Tool may collect sensitive personal data such as race and sexual orientation
for equal opportunities and diversity monitoring purposes.

6. Who can access your personal data?

Your personal data is accessed in the Tool by the following persons/teams:

USER GROUP LOCATION PURPOSE ACCESS AMOUNT

EY Employees, Global May refer other individuals Will have write access with the 300,000
Partners, and for jobs. May apply as ability to create a job requisition to
Contractors candidate for positions. May be approved. Will have write access
serve as adhoc approvers. with ability to apply to EY positions
as internal candidates. Will have
write ability to add referrals (and in
such case will have the ability to see
the status of the recruitment process
for that referral). Will have ability to
approve requisitions that are sent to
them.
EY Hiring Global The individual(s) from the Will have access to see job 100,000
Managers business that will ultimately requisition, review applicants and
manage this role and will approve offers for the job
make hiring decision. requisitions that they are listed as
hiring manager on.
Recruiters Global The individuals responsible Will have access to job requisition, 1800
for managing the overall candidates, applicants and offer
sourcing, recruiting, information for the jobs they are
selection and hiring process. recruiting for. Will have access to
personal information for all
candidates included in the
SuccessFactors database.
Recruiting Global To support the recruiting Will have access to job requisition, 2500
Talent Shared process are given the Talent candidates, applicants and offer

about:blank 3/6
10/21/24, 9:43 AM about:blank
Services and Transactional (TT) and/or information for the job requisitions
Recruiting Admin Hub roles that they are supporting.
Coordinators
Sourcing Global Provide sourcing/recruiting Will have access to job requisition, 350
Recruiters support (ex. identifying candidates, applicants and offer
potential information for jobs requisitions that
candidates/applicants for they are supporting. Will have access
various roles, interview to personal information for all
support, sending marketing candidates included in the
email campaigns) SuccessFactors database.
Recruiting Leads Global Provide oversight and Will have access to job requisition 500
leadership for recruiting and candidate reports for the
team. Will have reporting managerial regions they oversee.
role.
Global System Canada, India, Granted to a limited number Has overall access to system data and 9
Support New Zealand, US, of individuals at EY to functionality required for system
Poland oversee and manage the tool support
at a global level including
overseeing SuccessFactors
Recruiting support and
release activities.
Global US, Poland, India Provides global reporting Has read only access required for 8
Reporting support. To create and report creation globally. Has
manage reports across all permission to create and run reports.
data.
Candidates / Global To allow individuals to Has access to their own personal Unknown
Applicants express interest in EY and data. Has access to create, edit and
apply for any open jobs. delete data on their candidate profile.
Has access to apply for any posted
EY jobs.
Staffing Agency Global Has access to add Has access to add candidates that 500
representatives candidates that they are they are referring as an agency
referring as an agency
SAP Support EU IT Support Has access to system data and 3 to 5
staff functionality required for system
support
Tata Consulting Mexico and India To provide system support Has read/write/edit/delete access to
Services (TCS) all personal data in the Tool. Has
access to a range of capabilities
within the Admin Center.
IBM IT Support Multiple (Canada, To provide IT support Has read/write/edit/delete access to The access to this
Team China, Czech Services including the all personal data in the Tool. Has tool will be given
Republic, Hungary, Digital Talent System access to a range of capabilities based on need and
India, Malaysia, Support Services to level 2 within the Admin Center. role. For Level 2
Mexico, Oceania, and 3 operational and and Level 3
Philippines, release management. support, access
Poland, UK, the will be provided
US, Costa Rica and to 40 (approx.)
Australia) IBM IT support
team members.

The access rights detailed above involves transferring personal data in various jurisdictions (including jurisdictions outside the
European Union) in which EY operates (EY office locations are listed at https://www.ey.com/en_gl/locations). An overview of
EY network entities providing services to external clients is accessible here (See Section 1 (About EY) - “View a list of EY
member firms and affiliates”). EY will process your personal data in the Tool in accordance with applicable law and
professional regulations in your jurisdiction. Transfers of personal data within the EY network are governed by EY’s Binding
Corporate Rules.

We transfer or disclose the personal data we collect to third-party service providers (and their subsidiaries and
affiliates) who are engaged by us to support our internal ancillary processes. For example, we engage service
providers to provide talent & recruitment support or provide, run and support our IT infrastructure (such as identity
management, hosting, data analysis, back-up, security and cloud storage services) and for the storage and secure
about:blank 4/6
10/21/24, 9:43 AM about:blank
disposal of our hard copy files. It is our policy to only use third-party service providers that are bound to maintain
appropriate levels of data protection, security and confidentiality, and that comply with any applicable legal
requirements for transferring personal data outside the jurisdiction in which it was originally collected.

To the extent that personal data has been rendered anonymous in such a way that you or your device are no
longer reasonably identifiable, such information will be treated as non-personal data and the terms of this Privacy
Notice will not apply.

For data collected in the European Economic Area (EEA) or which relates to individuals in the EEA, EY requires
an appropriate transfer mechanism as necessary to comply with applicable law. The transfer of personal data from
the Tool to SAP Success Factors, recruiters and agencies and Tata Consulting Services (TCS), ModernHire, IBM
and Sterling are governed by agreements which includes standard data protection clauses adopted by the
European Commission.

7. Data retention

Our policy is to retain personal data only for as long as it is needed for the purposes described in the section “How does the
Tool process personal data?” Retention periods vary in different jurisdictions and are set in accordance with local regulatory
and professional retention requirements.

In order to meet our professional and legal requirements, to establish, exercise or defend our legal rights and for archiving and
historical purposes, we need to retain information for significant periods of time.

The policies and/or procedures for the retention of personal data in the Tool are:

If you are an external candidate / applicant or otherwise not an EY user of the Tool: your data will be held in line with
EY Records Retention Global Policy. The retention period is triggered based on the last activity date.

If you are an EY user of the Tool: in accordance with the with EY Records Retention Global Policy. The retention period is
triggered based on the last activity date.

Log Data will be retained in accordance with the EY IT Logging Policy.

After the end of the data retention period, your personal data will be deleted.

8. Security

EY protects the confidentiality and security of information it obtains in the course of its business. Access to such
information is limited, and policies and procedures are in place that are designed to safeguard the information
from loss, misuse and improper disclosure. Additional information regarding our approach to data protection and
information security is available in our ey-protecting-your-data-brochure-v2.pdf brochure.

9. Controlling your personal data

EY will not transfer your personal data to third parties (other than any external parties referred to in section 6 above) unless
we have your permission or are required by law to do so.

10. Your rights in relation to your personal data

Depending on the applicable jurisdiction, you may have certain rights in relation to your personal data, including:

To request details of the personal data EY processes about you and to access the personal data that EY processes about you
To have your personal data corrected, for example, if it is incomplete or incorrect
To restrict or object to the processing of personal data or request the erasure of your personal data
To receive a copy of the personal data which you have provided to EY in a structured, commonly used and machine-
readable format which you can re-use for your own purposes (known as “data portability”)
Where you have provided consent to the processing of your personal data, the right to withdraw your consent.
The right to complain to a data protection authority (see section “Complaints”)

If you have any questions about how EY processes your personal data or your rights related to your personal data,
please send an e-mail to [email protected].

11. Complaints

about:blank 5/6
10/21/24, 9:43 AM about:blank
If you are concerned about an alleged breach of privacy law or any other regulation, contact EY’s Global Privacy Leader,
Office of the General Counsel, 1 More London Place, London, SE1 2AF, United Kingdom or via email at
[email protected] or via your usual EY representative. An EY Privacy Leader will investigate your complaint
and provide information about how it will be handled and resolved.

If you are not satisfied with how EY resolved your complaint, you may have the right to complain to your country’s data
protection authority. You may also have the right to refer the matter to a court of competent jurisdiction.

Certain EY member firms in countries outside the European Union (EU) and the UK have appointed representatives in the EU
and the UK respectively to act on their behalf if, and when, they undertake data processing activities to which the EU General
Data Protection Regulation (GDPR) and/or the UK General Data Protection Regulation (UK GDPR) applies. Further
information and the contact details of these representatives are available below:

EU data protection representative | EY

UK Data protection representative (ey.com)

12. Contact us

If you have additional questions or concerns, contact your usual EY representative or email [email protected].

13. Acknowledgement/Consent
Having read and understood the information as set out in the Privacy Notice above, I acknowledge and I am fully aware of my
rights as a Data Subject, the stated purposes of the Processing of my Personal Data and Sensitive Data and the third parties to
which my Data (whether Personal or Sensitive) may be transferred.

“Consent/Acknowledgement Language:

By providing your consent/acknowledgement, you authorize EY to collect, use, transfer, store or otherwise process
(collectively “Process”) your personal data (“Personal Data”) for the purposes described in the tool’s privacy notice. We
may Process Personal Data in various jurisdictions in which we and the other EY member firms operate (which are listed at
www.ey.com), to this effect, you authorize EY to Process your Personal Data, always
in compliance with applicable legislation and regulatory requirements.”

Note: This notice will be reviewed periodically and, if necessary, updated.

about:blank 6/6