Last updated: January 2023
Privacy Notice – EY Tax Suite
1. Introduction
This Privacy Notice is intended to describe the practices EY follows in relation to the EY Tax Suite (“Tool”) with the active modules and Tax Intelligence Center (TINC Web) with respect to the privacy of all individuals whose personal data is processed and stored in the Tool. This Privacy Notice should be read together with the ey.com Privacy Statement, and in case of any conflict with the ey.com Privacy Statement, the terms of this Privacy Notice will prevail. Please read this Privacy Notice carefully.
2. Who manages the Tool?
“EY” refers to one or more of the member firms of Ernst & Young Global Limited (“EYG”), each of which is a separate legal entity and can determine the purposes and means for data processing in its own right (i.e. act as a data controller or in a similar capacity). The entity that is acting as data controller (or similar capacity) by providing this Tool on which your personal data will be processed and stored is:
Ernst & Young GmbH Wirtschaftsprüfungsgesellschaft, Flughafenstraße 61, 70629 Stuttgart, Germany.
- For the personal data of EY personnel: The data controller is the EY entity which employs you.
- For the personal data of third party personnel (including EY clients): The data controller is the EY local member firm with which the third party has a relationship.
You can find a list of local EY member firms and affiliates on the ey.com Privacy Statement.
The personal data in the Tool is shared by the above data controller with one or more member firms of EYG (see “Who can access your personal data” section 6 below).
The Tool is hosted on servers in European data centers.
3. How does the Tool process personal data?
TINC Web consists of multiple functionalities that allow the documentation and monitoring of tax risks and their controls.
Your personal data processed in the Tool is used as follows:
- Authentication of users;
- Assignment of user roles and responsibilities within tax monitoring and controlling workflows; and
- Identification of the legal entities involved in each workflow
EY relies on the following basis to legitimize the processing of your personal data in the Tool:
Processing of your personal data is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. The specific legitimate interest(s) are:
- Conducting client engagements;
- Complying with regulatory and legal obligations; and
- Quality & Risk Management, including complying with EY policies.
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you based on the above legitimate interest(s).
4. What type of personal data is processed in the Tool?
The Tool processes these personal data categories:
- User Account:
- User ID
- Surname
- First name
- Email address
- Telephone number
- Last login date and time (for system log)
- Uploaded files and documents:
- Legal entities
- Other personal data, such as contact information (listed above).
- “Consulted” is a free text box field (part of the RACI roles), intended for the name of the “consulted” person; this person may be external and does not need to have a user account.
This data is sourced directly from EY Partners, employees or contractors, and EY clients.
5. Sensitive personal data
Sensitive personal data reveals your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning sex life or sexual orientation. EY does not intentionally collect any sensitive personal data from you via the Tool.
6. Who can access your personal data?
[TINC]:
Your personal data is accessed in the Tax Intelligence Center (TINC Web) by the following persons/teams:
- EY clients are the primary users of the Tool.
- EY Partners and employees (i. e., engagement team) may also have access to the system for functional support (i. e., during implementation period)
- During project implementation, employees of EY will be Administrators to set up EY client users and other users. After implementation, employees of EY can be removed and the client continues the maintenance of permissions.
Your data is furthermore accessed in the administration module by the following persons/teams:
- EY clients as the primary user of the tool.
- EY Partners and employees (i. e., engagement team) may also have access to the system for functional support (i. e., during the implementation period or for continuous maintenance)
- During project implementation, employees of EY will be Administrators to set up EY client users and other users. After implementation, employees of EY can be removed if the client continues the maintenance of permissions.
The access rights detailed above involves transferring personal data in various jurisdictions (including jurisdictions outside the European Union) in which EY operates (EY office locations are listed at www.ey.com/ourlocations). An overview of EY network entities providing services to external clients is accessible here (See Section 1 (About EY) - “View a list of EY member firms and affiliates”). EY will process your personal data in the Tool in accordance with applicable law and professional regulations in your jurisdiction. Transfers of personal data within the EY network are governed by EY’s Binding Corporate Rules.
We transfer or disclose the personal data we collect to third-party service providers (and their subsidiaries and affiliates) who are engaged by us to support our internal ancillary processes. For example, we engage service providers to provide, run and support our IT infrastructure (such as identity management, hosting, data analysis, back-up, security and cloud storage services) and for the storage and secure disposal of our hard copy files. It is our policy to only use third-party service providers that are bound to maintain appropriate levels of data protection, security and confidentiality, and that comply with any applicable legal requirements for transferring personal data outside the jurisdiction in which it was originally collected.
To the extent that personal data has been rendered anonymous in such a way that you or your device are no longer reasonably identifiable, such information will be treated as non-personal data and the terms of this Privacy Notice will not apply.
For data collected in the European Economic Area (EEA) or which relates to individuals in the EEA, EY requires an appropriate transfer mechanism as necessary to comply with applicable law. The transfer of personal data from the Tool to Microsoft Azure (solely for hosting) is governed by an agreement between EY and the service provider that includes standard data protection clauses adopted by the European Commission. The transfer to EY Partners and employees is governed by EY BCRs.
7. Data retention
Our policy is to retain personal data only for as long as it is needed for the purposes described in the section “Why do we need your personal data”. Retention periods vary in different jurisdictions and are set in accordance with local regulatory and professional retention requirements.
In order to meet our professional and legal requirements, to establish, exercise or defend our legal rights and for archiving and historical purposes, we need to retain information for significant periods of time.
The EY Tax Suite is used as part of a Software-as-a-Service agreement with the client. EY is processor of the Data. Data is retained until the Software-as-a-Service agreement is terminated.
After the end of the data retention period, your personal data will be deleted.
8. Security
EY protects the confidentiality and security of information it obtains in the course of its business. Access to such information is limited, and policies and procedures are in place that are designed to safeguard the information from loss, misuse and improper disclosure. All EY employees and third parties engaged by EY to process your personal data are obligated to uphold the confidentiality of your data.
9. Controlling your personal data
EY will not transfer your personal data to third parties (other than any external parties referred to in section 6 above) unless we have your permission or are required by law to do so.
You are legally entitled to request details of EY’s personal data about you.
To confirm whether your personal data is processed in the Tool or to access your personal data in the Tool or (where applicable) to withdraw your consent, contact your usual EY representative or email your request to global.data.protection@ey.com.
10. Object, rectification, erasure, restriction of processing or data portability
You can confirm your personal data is accurate and current. You can object to the processing of your personal data or request rectification, erasure, restriction of processing or a readily portable copy of your personal data by contacting your usual EY representative or by sending an e-mail to global.data.protection@ey.com.
11. Complaints
If you are concerned about an alleged breach of privacy law or any other regulation, contact EY’s Global Privacy Leader, Office of the General Counsel, 6 More London Place, London, SE1 2DA, United Kingdom or via email at global.data.protection@ey.com or via your usual EY representative. An EY Privacy Leader will investigate your complaint and provide information about how it will be handled and resolved.
If you are not satisfied with how EY resolved your complaint, you have the right to complain to your country’s data protection authority. You can also refer the matter to a court of competent jurisdiction.
Certain EY member firms in countries outside the European Union (EU) have appointed a representative in the EU to act on their behalf if, and when, they undertake data processing activities to which the EU General Data Protection Regulation (GDPR) applies. Further information and the contact details of these representatives are available here.
12. Contact us
If you have additional questions or concerns, contact your usual EY representative or email global.data.protection@ey.com.