Privacy Policy EY Interim Professional
- Overview
Processing of personal data by EY Japan member firms
This Privacy Policy explains how EY Interim Professionals (EYIP) collect and use your personal data and describes the rights you have with respect to your personal data.
EY Interim Professionals is a member of the global organization of member firms of Ernst & Young Global Limited (“EY Global”), each of which is a separate legal entity. In this Privacy Policy, “EY,” refers to the global organization of member firms of Ernst & Young Global Limited, or to one or more of those member firms, including EYSC. References to “we”, “our”, or “us” in this policy refers to EYSC or EY as the case requires.
EY IP and the other EY member firms in Japan process personal data for a variety of purposes, including personnel management and dispatching at client sites. We process personal data in compliance with the requirements of the Act on the Protection of Personal Information of Japan (“APPI”) and other applicable laws and regulations, and take appropriate steps so that personal data is appropriately protected.
- Our privacy policies
(1) This Privacy Policy
This Privacy Policy explains how EYIP processes your personal data, including data necessary for personnel management and dispatching services. It also provides information about the sharing and joint use of your personal data with other EY member firms and the provision of personal data by EYIP to third parties such as our service providers.
(2) EY’s Global Privacy Statement
The member firms of EY Global process personal information for various purposes, including personnel management and dispatching at client sites. EY Global provides a Global Privacy Statement to explain how member firms of the EY Global network process personal information, as well as global standards of handling personal data by the member firms generally and in specific service lines, so that each EY member firm can protect personal data in accordance with applicable laws and regulations.
EYIP and the other EY member firms in Japan process personal data consistently with the information provided in the EY Global Privacy Statement and within the scope permitted under the Act on the Protection of Personal Information of Japan (APPI) and other applicable laws and regulations.
(3) Other specific privacy statements
Each EY member firm in Japan may ask you for your consent to process your personal data in separate privacy statements, with regard to the particular services that it offers, including personnel management and dispatching services (“other specific privacy statements”). EY member firms in Japan also comply with these other specific privacy statements.
(4) Browsing and using EY websites
Details of how EY websites collect and process your personal data, as well as the Cookie policy, can be found here.
- Collecting and using personal data
(1) Each member firm of EY Japan collects and processes personal data in relation to the services that it offers, including personnel management and dispatching at client sites. Personal data includes:
- a) information from which an individual can be identified (including name, email address, contact address, date of birth)
- b) information that is needed to provide and perform its services, that is given by you, or by other individuals and entities, such as salary hourly rate, academic background and certifications, work history and professional situation, skills and capabilities, information on projects involved at EY, and resume.
(2) Please refer to the EY Global Privacy Statement and other specific privacy statements for more details of the categories of information processed for individual services, including those related to personnel management and dispatching at client sites.
- Purposes of processing personal data
(1) Purposes
EYIP collects and processes personal data for the following purposes:
- a) To appropriately provide and perform related professional services, including personnel management and dispatching freelancers to client sites.
- b) To respond to inquiries and requests.
- c) To provide information on our services, seminars, and publications, etc.
- d) To comply with legal and regulatory obligations.
- e) To use IT, document management and archiving, and business operation tools and applications, in connection with performing services; for security, and business continuity/disaster recovery purposes.
- f) To conduct analysis, research and development, recommendations related to services that are provided and improvements of such services.
(2) For specific purposes related to services offered by EY, including personnel management and dispatching at client sites, please refer to the EY Global Privacy Statement and other specific privacy statements.
- Use and transfer of personal data
EYIP will not use personal data for any purpose other than the stated purposes of processing, nor provide them to a third party, unless disclosure is required or requested by law or where there is a legitimate reason as permitted by applicable laws and regulations.
- Security
EYIP protects the confidentiality and security of personal data that are processed in the course of its business, including data related to personnel management and dispatching at client sites. We will treat personal data safely under strict management based on applicable laws and our related policies for security protection and management of personal data.
- Support providers
EYIP, other EY member firms in Japan and EY Global network member firms outsource the processing of personal data to other member firms of the EY Global network or to our external support providers, including those necessary for personnel management and dispatching services. For example, we engage our support providers in the following areas including but not limited to:
- a) General office support including printing, document production and management, archiving, and translation services;
- b) Accounting, finance and billing support;
- c) IT functions including system management and security, data storage, business applications, and duplication of systems for business continuity/disaster recovery purposes;
- d) Conflict checking, risk management and quality reviews; and
- e) Business analysis, research and development, service improvements.
When EYIP outsources processing of personal information to our external support providers, EYIP will appropriately contract with them and conduct necessary and appropriate supervision in order to maintain safe management of the processing of personal data, including those related to personnel management and dispatching services.
- Joint use of personal data
EYIP, other EY member firms in Japan and member firms of the EY Global network (collectively, “Network Member Firms”) may jointly use and share personal data to the extent needed to carry out our business operations, including personnel management and dispatching at client sites.
(1) Items of personal data to be jointly used
Network Member Firms may jointly use and share personal data to the extent needed for services and purposes including but not limited to:
- a) Information about personal attributes (name, email address, contact address, date of birth, salary hourly rate, academic background and certifications, work history and professional situation, skills and capabilities, information on projects involved at EY, resume, etc.)
- b) Information necessary for the provision of services (type and content of provided services, materials required to perform services, communication records, service needs, etc.)
- c) Information necessary for determination and management of the provision of services (service usage, transaction status, relationships with related parties, etc.)
- d) Information necessary for responding to your inquiries and applications (content of inquiries, records of responses, other attributes and related information of services required for responses, etc.)
- e) Personal data items listed in each category of the EY Global Privacy Statement
(2) Purposes of joint use and sharing of personal data include the following:
- a) To perform related services provided by Network Member Firms, including personnel management and dispatching freelancers to client sites.
- b) To respond to your inquiries and requests.
- c) To provide information on the services, seminars, and publications of Network Member Firms.
- d) To enable Network Member Firms to comply with applicable laws and regulations.
- e) To perform internal management controls including conflict checks, risk management and quality controls.
- f) To perform operation of services or use supporting services, such as for: IT; document production, management, and archiving; use of business operation tools and applications; security; and systems for business continuity/disaster recovery purposes.
- g) To conduct analysis, research and development, recommendations in relation to services of Network Member Firms, as well as to improve their provision of services.
- h) For the purposes described in the EY Global Privacy Statement.
The Network Member Firms that may share and jointly use personal data are member firms of the EY Global network and can be found here.
The person and entity in charge of managing joint use of personal data is set out below:
Representative Director and President Akira Kondo
EY Strategy and Consulting Co., Ltd.
Address: Tokyo Midtown Hibiya, Hibiya Mitsui Tower,
- Yurakucho, Chiyoda-ku, Tokyo
- Transfer of personal data to outside countries
EY Global Network Member Firms operate in more than 150 countries across the globe. Therefore, your personal data may be transferred to and stored outside the country in which you are located. Please refer to the following for further information on the entities and their locations.
Location of EY offices
Please also refer to the "Transfers of personal data" and "Support providers" section in the EY Global Privacy Statement regarding the transfer of personal data to outside countries.
- EY’s Binding Corporate Rules
EY has established a Data Protection Binding Corporate Rules Program (BCR) to comply with European data protection law and other applicable laws and regulations. EYSC, members of EY Japan firms and EY Network Member Firms comply with the BCRs for the protection of personal data, including those related to personnel management and dispatching at client sites.
- Disclosure and correction of personal data
In accordance with the Act on Protection of Personal Information of Japan (APPI) and other applicable laws and regulations, EYIP will disclose at your request the personal data that we hold about you according to the applicable procedures. If you inform us that your personal data is inaccurate, we will review and correct, add or delete the data as required in accordance with applicable laws, regulations and procedures, including those related to personnel management and dispatching at client sites.
Privacy Policy EY Greenhouse
- Introduction
This Privacy Notice is intended to describe the practices which EY follows in relation to the Greenhouse system (“Tool”) with respect to the privacy of all individuals whose personal data is processed and stored in the Tool.
- Who manages the Tool?
“EY” refers to one or more of the member firms of Ernst & Young Global Limited (“EYG”) each of which is a separate legal entity and can determine the purposes and means for data processing in its own right (i.e., act as a data controller or in a similar capacity).
The entity that is acting as data controller (or similar capacity) by providing this Tool on which your personal data will be processed and stored is:
- For the personal data of EY personnel: The data controller is the EY entity which employs you.
- For the personal data of third-party personnel (including EY clients): The data controller is the EY local member firm with which the third party has a relationship.
You can find a list of local EY member firms and affiliates on the ey.com Privacy Statement.
The personal data in the Tool is shared by the above data controller with one or more member firms of EYG (see “Who can access your personal data” section 6 below).
- How does the Tool process personal data?
The purpose of the Tool is to help EY source, match, and engage contingent workers to open positions.
Your personal data processed in the Tool is used to assess suitability of candidates, select appropriate candidates and on-board contingent workers to and from EY assignments. The Greenhouse Video Interview feature also enables EY to interview candidates online by live video, reducing the need for traditional face-to-face interviews while retaining person to person interaction.
EY relies on the following basis to legitimize the processing of your personal data in the Tool: processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. The specific legitimate interests pursued are Human Resource management, in particular recruitment.
The provision of your personal data to EY is optional, however, please be aware that if you do not provide us with all or part of your personal data, we may not be able to carry out the purposes for processing which are set out above.
In addition, the Tool uses your browser’s local storage to store an encrypted web token. This token saves your Greenhouse identity on your browser. With it, we can keep track of who you are across browser sessions and give you the personalized site experience that matches your user type. Without it, we wouldn’t be able to tell who you were across browser sessions – meaning that you would have to log in every time you refreshed the page. By navigating on the Tool, you agree that we can place web tokens on your computer or device. If you prefer not to receive web tokens, then you should stop using the Tool, or consult your browsing settings. If you want to clear your local storage, use your browser settings to clear the cache / locally stored data for the Tool.
- What type of personal data is processed in the Tool?
The Tool processes the personal information of candidates who upload their resumes into the Tool, including: name (first, last); email address; phone number; address; photo (headshot) – optional; education details; previous occupation; previous employer; resume; skills; desired rate/compensation; certifications; current location; work location preference (e.g., remote); work visa status; availability for next contingent role; recruiter notes (which may be populated by EY and third party recruiters to document conversations and interviews with you); video (live, not recorded); and any other information which candidates provide voluntarily for the purposes of an application.
- Sensitive Personal Data
Sensitive personal data is data revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning sex life or sexual orientation.
The following sensitive personal data is collected and processed in the Tool:
- Last four digits of hired US contractor’s social security number (SSN).
Candidates should not include any other sensitive personal data in their applications, and recruiters should not include any sensitive personal data in their notes.
- Who can access your information?
Your personal data may be accessed in the Tool by the following persons/teams:
- EY Recruiters, including third-party recruiters working on their behalf (located globally) – the individuals who post jobs, review candidate applications and add interview notes. Recruiters have access to the personal data of applicants and candidates who are either located in, or applying for a position in, the same country as the recruiter;
- EY Hiring Managers (located globally) – the individuals who create job requirements and add interview notes. Hiring managers have access to the personal data of applicants and candidates who are either located in, or applying for a position in, the same country as the hiring manager;
- EY Greenhouse Team – the team responsible for technical support and for managing access rights for the Tool. This team may need access to your personal data in order to perform their functions but will not use your data for any other purpose;
- Algolia – a third party hosted search service, which indexes all data in the Tool to enable users to search the tool and optimise their experience;
- Daxtra, a third party hosted search service, which conducts resume parsing for candidate resumes;
- Twilio – a video technology vendor that processes live video for the live video interview feature and, on request, provide development and technical support (note: Twilio is not able to watch the live video or see the identity of the participants);
- US payroll agencies – will have access to the onboarding data mentioned above (only applicable to US contractors);
- You – You will be able to access your own information on the Tool; and
- We may also disclose data in order to comply with our legal, regulatory obligations or professional standards, in response to a non-mandatory request for information made by a governmental or state body, or as part of an investigation of unlawful activity.
The access rights detailed above may involve the transfer of personal data in various jurisdictions (including jurisdictions outside the European Union) in which EY operates (EY office locations are listed at https://www.ey.com/ourlocations). EY will process your persona l data in the Tool in accordance with applicable law and professional regulations in your jurisdiction. Transfers of personal data within the EY network are governed by EY’s Binding Corporate Rules.
Transfers of personal data to Algolia, Daxtra and Twilio are governed by contracts that include standard data protection clauses adopted by the European Commission.
- Data retention
Our policy is to retain personal data only for as long as it is needed for the purposes described in the section “How does the Tool process personal data”. Retention periods vary in different jurisdictions and are set in accordance with local regulatory and professional retention requirements.
In order to meet our professional and legal requirements, to establish, exercise or defend our legal rights and for archiving and historical purposes, we need to retain information for significant periods of time.
The policies and/or procedures for the retention of personal data in the Tool are:
The total retention period varies from the EY Record Country Retention Schedules. The retention period that will be applied follows the Global Retention Schedule (GRS) - Global Retention Schedule (GRS). If you want to learn more abo ut the applicable data retention period in your jurisdiction, please reach out to the contact email id provided under Section 12 of this Privacy Notice.
Log Data will be retained in accordance with the EY IT Logging Policy.
After the end of the data retention period, your personal data will be deleted.
- Security
EY protects the confidentiality and security of information it obtains in the course of its business. Access to such information is limited, and policies and procedures are in place that are designed to safeguard the information from loss, misuse and improper disclosure. Additional information regarding our approach to data protection and information security is available in our ey-protecting-your-data-brochure-v2.pdf brochure.
- Controlling your personal data
EY will not transfer your personal data to third parties (other than any external parties referred to in section 6 above) unless we have your permission or are required by law to do so.
- Your rights in relation to your personal data
Depending on the applicable jurisdiction, you may have certain rights in relation to your personal data, including:
- To request details of the personal data EY processes about you and to access the personal data that EY processes about you
- To have your personal data corrected, for example, if it is incomplete or incorrect
- To restrict or object to the processing of personal data or request the erasure of your personal data
- To receive a copy of the personal data which you have provided to EY in a structured, commonly used and machine-readable format which you can re-use for your own purposes (known as “data portability”)
- Where you have provided consent to the processing of your personal data, the right to withdraw your consent.
- The right to complain to a data protection authority (see section “Complaints”)
If you have any questions about how EY processes your personal data or your rights related to your personal data, please send an e-mail to global.data.protection@ey.com.
- Complaints
If you are concerned about an alleged breach of privacy law or any other regulation, contact EY’s Global Privacy Leader, Office of the General Counsel, 1 More London Place, London, SE1 2AF, United Kingdom or via email at global.data.protection@ey.com or via your usual EY represe ntative. An EY Privacy Leader will investigate your complaint and provide information about how it will be handled and resolved.
If you are not satisfied with how EY resolved your complaint, you may have the right to complain to your country’s data protection authority. You may also have the right to refer the matter to a court of competent jurisdiction.
Certain EY member firms in countries outside the European Union (EU) and the UK have appointed representatives in the EU and the UK respectively to act on their behalf if, and when, they undertake data processing activities to which the EU General Data Protection Regulation (GDPR) and/or the UK General Data Protection Regulation (UK GDPR) applies. Further information and the contact details of these representatives are available below:
EU data protection representative | EY
UK Data protection representative (ey.com)
- Contact us
If you have additional questions or concerns, contact your usual EY representative or email global.data.protection@ey.com.
