Privacy Policy – Candidate Relationship Management (CRM) System


This policy is intended to describe the practices EY follows in relation to this global Candidate Relationship Management (CRM) system with respect to the privacy of all individuals in the online environment and the relevant data protection law. It provides information as to the purpose for which we collect your personal data, how we use and protect this data, and who it is disclosed to.

At EY, we have focused on implementing fair information practices that are designed to protect your privacy and your personal data. We believe that everyone benefits from the free flow of information when that information is gathered and used responsibly.

If you have any questions or you feel that your concerns have not been addressed by this privacy policy, or you just want to talk to us, feel free to contact us.

Expressing an interest in working for EY

This section explains how your information will be used when it is submitted into the CRM system.

The provision of your personal data is optional: however please be aware that your refusal to provide us with your personal data or to process them thereafter may result in the data controller not being able to carry out any candidate relationship activity related to your potential recruitment with EY.

Where you have expressed an interest in EY (through viewing an opportunity, expressing general interest in EY via an online portal or advertisement online) and have provided us with your contact information (e.g. your email address and/or telephone number) you agree to EY recruitment and sourcing personnel contacting you in relation to our candidate relationship management and recruitment programme.

Who manages the system?

"EY" refers to one or more of the member firms of Ernst & Young Global Limited ("EYG"), each of which is a separate legal entity, and each of which can act as a data controller in its own right. EYG, which is the principal coordinating entity of its member firms, is a UK company limited by guarantee. It does not provide services to clients. The entity that is acting as data controller by providing the CRM System on which your information will be processed and stored is EY Global Services Limited, a private company limited by shares in England and Wales, registered office, Becket House, 1 Lambeth Palace Road, London, SE1 7EU. EY Global Services Limited’s business is confined to the supply of services to EYG and its member firms. The information you provide here may be shared by EY Global Services Limited for candidate relationship management and recruitment purposes with one or more member firms of EYG located throughout the world (see 'Why do we need your information?' section below).

The CRM system is hosted on servers situated in Europe; managed on behalf of EY Global Services Limited and EY by Avature Limited, International House, 124 Cromwell Road, Kensington, London, SW7 4ET, United Kingdom. IT support for the CRM system is provided by Avature personnel, located in Europe and Argentina.

Who can access your information?

Access to your information is limited by need. Access to your information within EY will be limited to our recruitment and sourcing staff within the EY member firms worldwide. They are able to access your profile on the CRM system and are able to match your details to current vacancies or future demand. Generally though, the EY recruitment and sourcing staff within your home country or region would be the only people who will access your profile on the CRM system and contact you, unless you express an interest in working outside your home country, or the country talent community which you elect to join. (see below: Applying for a job outside of your home country). Access within the EY network may involve the transfer of personal data between various jurisdictions (including jurisdictions outside the European Union) in which EY and any of the individuals operate (EY office locations are listed at

Avature Limited can access your information as is necessary to perform its functions as an IT vendor (acting on our behalf) in the context of IT related hosting and support issues only, but may not share any information without first obtaining permission from EY Global Services Limited. From time to time we may need to share your information with other third parties (in addition to Avature Limited). However, we will only disclose your personal details for the following reasons:

In addition, where you have expressed an interest in pursuing a specific career opportunity with EY, your information will be automatically moved from the CRM system to EY’s Global Recruitment Management System (GRMS) for application tracking. A copy of our GRMS Privacy Policy can be requested via the following contact us link.

Protecting your privacy is very important to us. We do not disclose your personal data to third parties other than as mentioned above. We will process your personal data (including any potential transfer outside the European Union) in accordance with applicable law and professional regulations in your jurisdiction.

EY does not collect or compile personal data or information obtained by this site for dissemination or sale to outside parties for consumer marketing purposes or host mailings on behalf of third parties.

Why do we need your information?

Your information will be used by EY for administering the candidate relationship management and global recruitment programme of its member firms. This will include planning and monitoring recruitment campaigns, the provision of EY thought leadership materials and information and notifying you from time to time of current vacancies and potential future opportunities.

Applying for a job outside of your home country

If you express an interest in working for EY outside of your home country, your profile on the CRM system may be accessed, and you may be contacted by, the EY recruitment and sourcing staff of the country you have expressed an interest in. This EY team may apply the recruitment and screening processes and questions which are applicable to and common in their particular jurisdiction.

Data Retention

You may of course ask to have your information deleted from the CRM system at any time. Your information will remain in the CRM system as long as you have expressed interest in EY or until you have secured a position with EY. However please note that your data will not be kept more than 18 months after the last contact with you. We will provide you the opportunity to re-opt in to the talent community every 18 months, to ensure we keep your consent record current.

For data subjects in the United States of America only:

Your information will remain in the CRM system as long as you have expressed interest in EY or until you have secured a position with EY. Your data will not be kept more than 36 months after your last response to, or communication with EY, at which time you will be given the opportunity to re-opt in to the talent community. You may, of course, still ask to have you information deleted from the CRM system at any time.

Sensitive personal data

Sensitive personal data is information about an individual that would fall into one or more of the following categories:

We do not collect or process your sensitive personal data in the CRM system.


If you provide any information in relation to third parties, referrals or referees, you are responsible for obtaining their consent and ensuring they are aware that their details will be forwarded to, and used by, the EY network.

Access, rectification and opposition

Data Protection laws operating in various countries around the world (including within the European Union) entitle an individual to a copy of their information. You have the right to object on legitimate grounds to the processing of your personal data and to the data transfers for the purposes stated in this Privacy Policy. If you want to access the information about you in the CRM system or to rectify/update or exercise your right to ask us to stop processing your information please contact us.


EY has implemented accepted standards of technical measures and security policies that protect the personal data it has under its control from:

Changes to this policy

EY may change this policy as needed. If changes are made please note that it may take up to 30 business days before new policy practices are implemented.

Terms applicable to data processing in Russia and CIS countries

EY is processing your data for the performance of the following actions (operations): collection, systematization, accumulation, storage, adjustment (renewal, change), copying, use, provision of your data to third parties, depersonalization, removal, blocking, destruction, and cross-border transfer, including on the territory of foreign states which are not parties to the Convention of the Council of Europe for the Protection of Individuals with regard to Automatic Processing of Personal Data and which do not ensure adequate protection of personal data, and entrusting other entities (including Avature Limited) to process your data by using any methods and operations specified herein.