GDS 2020 - Young Tax Professional of the Year

1. Introduction

This Privacy Notice is intended to describe the practices EY follows in relation to the Expert Rating Tool (“Tool”) with respect to the privacy of all individuals whose personal data is processed and stored in the Tool. This Privacy Notice should be read together with the ey.com Privacy Statement, and in case of any conflict with the ey.com Privacy Statement, the terms of this Privacy Notice will prevail. Please read this Privacy Notice carefully.

2. Who manages the Tool?

“EY” refers to one or more of the member firms of Ernst & Young Global Limited (“EYG”), each of which is a separate legal entity and can determine the purposes and means for data processing in its own right (i.e. act as a data controller or in a similar capacity). The entity that is acting as data controller by providing this Tool on which your personal data will be processed and stored is EY Global Services Limited. EY Global Services Limited licenses the Tool from Expert Rating Solutions (“Vendor”), DLF IT Park, Tower D, GF, Rajiv Gandhi Chandigarh Technology Park, Chandigarh, India 160101.

The personal data you provide in the Tool is shared by EY Global Services Limited with one or more member firms of EYG (see “Who can access your information” section below).

The Tool is hosted on servers of vendor’s third-party hosting provider- SoftLayer (an IBM Company) 1950 N. Stemmons Freeway, 75207 Dallas, Texas, USA.

3. Why do we need your personal data?

The Tool is used to implement the assessment process (online assessments to include aptitude based questions like logical reasoning, analytical and communication skills & case study based assessment) for the Young Tax Professional of the Year (“YTPY”) competition for EY GDS.

Your personal data processed in the Tool is used as follows:

The vendor will share the registration link to the YTPY core team members, which will be shared to the students by YTPY core team.

The students register using the registration link. The information provided by the students in the registration link (Name, mobile number and email address) is used by YTPY core team members to send online link to the assessment along with the test PIN to the students’ email address. By clicking on the link, the participant candidates will be directed to the web page of the Tool to register to the competition and take up the assessment.

The students then enter the Tool using their email address and test PIN to take the assessments.

The assessment scores are used to filter the students taking the assessment (“participant candidates”) and adjudge the winners.

The information of the students who do not proceed to participate and take the YTPY assessment are used to analyse the number of interested students per college for future outreach and communications purposes.

The participant candidates’ images are recorded during the course of taking the assessments and are used to monitor any malpractice by the participant candidates during the assessment.

The EY Partners and employees’ information is used for login to the Tool and in order to download the assessment reports. The information is also used by the Vendor to send the assessment reports via email.

EY relies on the following basis to legitimize the processing of your personal data in the Tool:

Processing of your personal data is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. The specific legitimate interest(s) are Learning and Events registration and management.

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you based on the above legitimate interest(s).

4. What type of personal data is processed in the Tool?

The Tool processes these personal data categories:

The following information is processed about the students:

• First and Last name
• Email address
• Date of Birth
• College Name
• Mobile number
• Email address
• College roll number
• Graduation / Post Graduation details
• Gender

The following information is processed about the participant candidates:

• First and Last Name
• Mobile number
• Date of Birth
• Email address (personal)
• College name
• College Roll Number
• Graduation/Post Graduation details
• Assessment evaluation and scores
• Images (for proctoring)
• Time taken to complete the assessment
• Gender

The following information is processed about EY Partners and employees:

• First and Last Name
• EY email address
• Password
• IP Address
• Time stamp of login
• Time stamp of logout

This data is sourced from:

• Provided directly by EY Partners, employees or contractors.
• Provided by other parties
  • The students express their interest in the YTPY event and assessment process by entering their information through the registration link provided by the YTPY core team.
  • The participant candidates enter their information directly into the Tool and take the assessment.

5. Sensitive Personal Data

Sensitive personal data reveals your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning sex life or sexual orientation.

The following sensitive personal data is collected and processed in the Tool:

• Images of the participant candidates may reveal racial or ethnic origin

6.Who can access your personal data?

Your personal data is accessed in the Tool by the following persons/teams:

The following two Vendor personnel located in India will have access to the Tool (read, edit, delete):

• IT Manager
• Chief Technology Officer

Vendor personnel (with administrator access) will not be required to access the information on a routine basis. However, in the event that trouble shooting is required, Vendor personnel may access the Tool if absolute necessary.

The following eight EY Partners and employees located in India will have access to the Tool:
• YTPY core team (administrator) (Read only)

The 3000 plus participant candidates located in India access the Tool to take the assessment. (Read and edit). The participant candidates access the Tool to take the assessment. The participant candidates cannot see their assessment results in the Tool. The participant candidates cannot access the Tool once they complete the assessment.

The access rights detailed above involves transferring personal data in various jurisdictions (including jurisdictions outside the European Union) in which EY operates (EY office locations are listed at www.ey.com/ourlocations). An overview of EY network entities providing services to external clients is accessible here (See Section 1 (About EY) - “View a list of EY member firms and affiliates”). EY will process your personal data in the Tool in accordance with applicable law and professional regulations in your jurisdiction. Transfers of personal data within the EY network are governed by EY’s Binding Corporate Rules.
We transfer or disclose the personal data we collect to third-party service providers (and their subsidiaries and affiliates) who are engaged by us to support our internal ancillary processes. For example, we engage service providers to provide, run and support our IT infrastructure (such as identity management, hosting, data analysis, back-up, security and cloud storage services) and for the storage and secure disposal of our hard copy files. It is our policy to only use third-party service providers that are bound to maintain appropriate levels of data protection, security and confidentiality, and that comply with any applicable legal requirements for transferring personal data outside the jurisdiction in which it was originally collected.

To the extent that personal data has been rendered anonymous in such a way that you or your device are no longer reasonably identifiable, such information will be treated as non-personal data and the terms of this Privacy Notice will not apply.

For data collected in the European Economic Area (EEA) or which relates to individuals in the EEA, EY requires an appropriate transfer mechanism as necessary to comply with applicable law.

7. Data retention

Our policy is to retain personal data only for as long as it is needed for the purposes described in the section “Why do we need your personal data”. Retention periods vary in different jurisdictions and are set in accordance with local regulatory and professional retention requirements.

In order to meet our professional and legal requirements, to establish, exercise or defend our legal rights and for archiving and historical purposes, we need to retain information for significant periods of time.

The policies and/or procedures for the retention of personal data in the Tool are:
Common Data: The data is retained for a period of 6 months from the date of YTPY Global Finale. The image data is deleted after EY YTPY India finale

• Archived Data : 1 year
• Log Data: 6 months
After the end of the data retention period, your personal data will be deleted.

8. Security

EY protects the confidentiality and security of information it obtains in the course of its business. Access to such information is limited, and policies and procedures are in place that are designed to safeguard the information from loss, misuse and improper disclosure. Additional information regarding our approach to data protection and information security is available in our Protecting your data brochure.

9. Controlling your personal data

EY will not transfer your personal data to third parties (other than any external parties referred to in section 6 above) unless we have your permission or are required by law to do so.  

You are legally entitled to request details of EY’s personal data about you.

To confirm whether your personal data is processed in the Tool or to access your personal data in the Tool, contact your usual EY representative or email your request to global.data.protection@ey.com.

10. Object, rectification, erasure, restriction of processing or data portability

You can confirm your personal data is accurate and current. You can object to the processing of your personal data or request rectification, erasure, restriction of processing or a readily portable copy of your personal data by contacting your usual EY representative or by sending an e-mail to global.data.protection@ey.com.

11. Complaints

If you are concerned about an alleged breach of privacy law or any other regulation, contact EY’s Global Privacy Leader, Office of the General Counsel, 6 More London Place, London, SE1 2DA, United Kingdom or via email at global.data.protection@ey.com or via your usual EY representative. An EY Privacy Leader will investigate your complaint and provide information about how it will be handled and resolved.

If you are not satisfied with how EY resolved your complaint, you have the right to complain to your country’s data protection authority. You can also refer the matter to a court of competent jurisdiction.



12. Contact us

If you have additional questions or concerns, contact your usual EY representative or email global.data.protection@ey.com.


Please check to proceed