EY Survey Tool

This Privacy Notice is intended to describe the practices EY follows in relation to the EY Survey Tool (the "Tool") with respect to the privacy of all individuals whose personal information is processed and stored in the Tool. At EY, we have focused on implementing fair information practices that are designed to protect your privacy and your personal data. We believe that everyone benefits from the free flow of information when that information is gathered and used responsibly. If you have any questions or you feel that your concerns have not been addressed by this Privacy Notice, please feel free to contact your usual EY representative, or you can reach us via ey.com.

We use the Tool to issue surveys.

The circumstances in which we may collect and process information from you in the Tool are as follows:

The provision of your personal information to us is optional, however you will need to provide your email address in order to use the Tool in the case of most surveys. The exception to this requirement will be "open survey" links (i.e., survey links delivered via email or URL) that you may receive from EY which will not require you to provide your email address in order to use the Tool.

"EY" refers to one or more of the member firms of Ernst & Young Global Limited ("EYG"), each of which is a separate legal entity, and each of which can act as a data controller in its own right. EYG, which is the principal coordinating entity of its member firms, is a UK company limited by guarantee. It does not provide services to clients. The entity that is acting as data controller by providing this Tool on which your information will be processed and stored is EY Global Services Limited, a private company limited by shares in England and Wales, registered office 6 More London Place, London, SE1 2DA. EY Global Services Limited's business is confined to the supply of services to EYG and its member firms. It does not provide services to clients. The information you provide in the Tool may be shared by EY Global Services Limited with EYG member firms in various different jurisdictions (see 'Why do we need your information?' section below). Each survey lists which EY member firm is issuing the survey.

EY Global Services Limited has engaged Confirmit Inc. ("Confirmit") in the United States (New York, NY) to provide a license to the Tool we use to issue surveys and each member firm will manage the data collected by the Tool for the surveys they issue. The Tool is hosted on EYG servers located on EY's Global Data Centre in Frankfurt, Germany.

In order to access the Tool you must provide your email address.

For internal EY survey respondents, your full name, EY email address, rank, Global Personnel Number (GPN), and office location are processed.

For external respondents, only the respondent's email address is processed (with the exception of "open survey" links - see above).

The internal and external respondents' responses to the survey questions may contain confidential information. Since the surveys can be delivered to external respondents and confidential client data solicited (especially for benchmarking and industry trend analysis), the Tool is capable of processing many different categories of high-level confidential client data.

EY has a comprehensive global privacy compliance programme which consists of EU approved Binding Corporate Rules and will only disclose your personal information to third parties that have agreed in writing to provide an adequate level of privacy protection. Your personal information may be accessed in the Tool by the following four categories of persons:

Survey Tool Admins: Implement and maintain application with standard configurations, define templates and metadata, configure question bank and logic for branching that is usable by all. There will be approximately 50 EY Survey Tool Admins globally (i.e., across all locations: Americas, EMEIA, Asia-Pac and Japan, as well as GSS/GDN centres). These Admins will arrange for EY personnel to have access to the EY Survey Tool and register users for access and control permissions/rights.

Survey Authors: Create surveys and extend invitations to responders, manage and control access to surveys and corresponding results and created reports based on results.

Survey Respondents: Internal EY professionals and external EY client respondents. Invited and anonymous respondents.

Survey Tool System Admins: Full administrative access to the SurveyTool, SurveyTool Users and Data. Approximately 5-10 EY Survey Tool Admins globally (i.e., across all locations: Americas, EMEIA, Asia-Pac and Japan, as well as GSS/GDN centres).

The access rights detailed above may involve the transfer of personal information in various jurisdictions (including jurisdictions outside the European Union) in which EY operate (EY office locations are listed at www.EY.com). EY will process your personal information in the Tool in accordance with applicable law and professional regulations in your jurisdiction. Transfers of personal information within the EY network are governed by EY's Binding Corporate Rules. EY will take appropriate measures to ensure all transfers of personal information to third parties are legitimised in accordance with applicable law.

Your email address will be used to permit proper user authentication on the Tool while providing you with the ability to exit the survey and re-enter the survey later with your previous responses already saved. Other personal information or high-level corporate data that you provide (including your name and any questions or interaction during the Survey itself) may be used by us for the purpose of conducting benchmarking analytics and industry trend analyses. Therefore please ensure that you do not enter Sensitive Personal Data or confidential information into the Tool if a free-text field is present.

Upon request we will inform you what personal information we are holding about you in the Tool. Should you require your information be updated, amended or deleted from the Tool, please contact your usual EY representative outlining your requirements. As an authorized user of the Tool, you will always have the ability to access your personal profile and correct and update your own details.

If You would like further information on the way in which EY processes and protects your personal information in the Tool, how to access and correct your personal information or to generally know more about the specific rights available to You as a data subject, please contact your usual EY representative, or you can reach us via ey.com.

EY will retain survey response information in the Tool for seven (7) years in accordance with EY's Records Retention Global Policy (or as enhanced/modified by Regional and Local policy requirements).

It is not the intention of the Tool to process sensitive personal data. Accordingly, we request that you please do not enter sensitive personal data into Tool either before or during the survey. Sensitive Personal Data means Personal Data of an individual consisting of information as to the racial or ethnic origin of the data subject, his political opinions, his religious or philosophical beliefs, whether he is a member of a trade union and his position to trade unions, his genetic data, biometric data in order to uniquely identify a person, his physical or mental health or condition, his sex life and sexual orientation, his criminal convictions and offences or related security measures, his social security files.

Data protection laws operating in many countries around the world provide certain rights to data subjects ("You"). You are entitled in most instances to access and obtain a copy of your personal information which EY processes in EY applications such as the Tool. You may request EY to have your personal information corrected if your information is inaccurate. You may request EY to have your information deleted if EY is not processing your information in accordance with applicable privacy laws and regulations operating in your country.

If You would like further information on the way in which EY processes and protects your personal information in the Tool, how to access and correct your personal information or to generally know more about the specific rights available to You as a data subject, please contact your usual EY representative, or you can reach us via ey.com.

EY has implemented accepted standards of technical measures and security policies that protect the personal information in the Tool which it has under its control from unauthorized access, improper use or disclosure, unauthorized modification and unlawful destruction or accidental loss.

This tool is hosted in Netherland, by EY’s external service provider.

If local hosting of the Tool is not available in your country, for certain EY member firms (known as “Red Box” countries) some types of data should not be collected and processed using the Tool because of laws, regulations or client contracts in your country may prohibit the offshore processing and storage of client engagement data and/or personnel data (“Data”).

Please be advised that the following countries have not yet approved the use of the tool due to local data privacy concerns: Australia (Government clients only), Taiwan, Indonesia (OJK clients only), China, Hong Kong, Macau, CESA/Poland, Russia, Kazakhstan, Commonwealth of Independent States (CIS), Germany, Switzerland, Austria and France.

If you need to use the tool in one of the above countries, you must engage the local data privacy team and gain specific documented approval.

By accepting this privacy notice you acknowledge and confirm the above requirements for processing of Data in the Tool for your country.

For more information, please contact your Local Regional GCO team or your Local or Regional Privacy Leader.

If you have questions or you do not feel that your concerns have been addressed in this Privacy Notice, please contact your usual EY representative, or you can reach us via ey.com.