720728, 2:30 Pat aboutblank Data Privacy Statement ovember 2022 st update Privacy Notice — SAP SuccessFactors Recruiting 1. Introduction This Privacy Notice is intended to describe the practices EY follows in relation to the SAP SF Recruiting (“Tool”) with respect to the privacy of all individuals whose personal data is processed and stored in the Tool. This Privacy Notice should be read together with the ey.com Privacy Statement, and in case of any conflict with the ey.com Privacy Statement, the terms of this Privacy Notice will prevail. Please read this Privacy Notice carefully. 2. Who manages the Tool? “EY” refers to one or more of the member firms of Erast & Young Global Limited ("EYG"), each of which is a separate legal entity and can determine the purposes and means for data processing in its own right (ie. act as a data controller or in a similar capacity) . The entity that is acting as data controller (or similar capacity) by providing this Tool on which your personal data will be processed and stored is: ‘© For the personal data of EY personnel: The data controller is the EY entity which employs you, ‘© For the personal data of third-party personnel (including EY clients): The data controller is the EY local member firm with which the third party has a relationship. You can find a list of local EY member firms and affiliates on the ey.com Privacy Statement The personal data in the Tool is shared by the above data controller with one or more member firms of EYG (see “Who can access ‘your personal data” section 6 below). The Tool is hosted on servers externally by SAP Success Factors, which is hosted in data centers in St. Lean Rot, Germany and “Amsterdam, the Netherlands. 3. How does the tool process personal data? The Tool will be EY’s Applicant Tracking System and support EY’s recruitment process including sourcing, recruiting, selecting and iring new employees and contractors. Your personal data processed in the Tool is used to source, assess, select, and hire employees for EY job openings. EY relies on the following basis to legitimize the processing of your personal data in the Tool: for the purposes of the legitimate interests pursued by the data controller or by a third party, except where such interests are overridden by the interests o fundamental rights and freedoms of the data subject which require protection of personal data. The specific lgitimate interest(s) are legitimate interests in ensuring the success of our recruitment practices, including sourcing, recruiting, selection and hiring of new employees. You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you based on the above legitimate interest(s) 4, What type of personal data is processed in the Tool? The Tool processes these personal data categories: about blank 18720728, 2:30 Pat aboutblank ‘© EY Partners / Employees / Contractors: Basie user contact and organizational data from SuccessFactors Core HR (EC). AAs part, of the recruiting process, for these individuals to be consider internal candidates, mobility preferences, and personal contact information is included ‘+ External Candidates: Basie candidate profile information including First name, Last name, basic contact information, and resume/CY, work experience, languages spoken, geographic preferences ‘© Applicants: Information required to consider the candidate an applicant for a specific requisition including candidate profile information above plus interview information, assessment information, and offer details, Other data elements collected based oon country specifie regulatory or operational requirements. ‘© Agency representative contact information: First name, Last name and email address, name of agency ‘This data is sourced: ‘© Directly by EY partners, employees or contractors From a feed from other EY systems (SuccessFactors / Employee Central; Yello) From the candidate or applicant themselves From third parties in connection with your application such as referees, recruiters, organizations that provide background checks and assessment results e.g. CappFinity, Saville, Pymetries, HireVue, RAD) 5. Sensitive personal data Sensitive personal data reveals your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union ‘membership, genetic data, biometric data, data concerning health or data concerning sex life or sexual orientation and government identifiers such as passport numbers, visa details and national ID numbers. Sensitive personal data is collected on a country basis in the applications and / or Offer as requested by the country based on rogulatory or operational needs. For example, the Tool may collect sensitive personal data such as race and sexual orientation for equal opportunities and diversity monitoring purposes. 6. Who ean access your personal data? ‘Your personal data is accessed in the Tool by the following personsteams EY Employees, Partners, and Contractors EY Hiring Managers Recruiters Recruiting Talent Shared Services and Recruiting Coordinators Sourcing Recruiters Recruiting Leads Global System Support Global Reporting Candidates / Applicants Staffing Agency representatives SAP Support staff Tata Consulting Services (TCS) TBM TT Support Team 13H PURPOSE ACCESS AMOUNT GROUP EY Employees, | Global May refer other individuals for_| Willhave write access with the ability | 300,000 Partners, and Jobs. May apply as candidate for | to create a job requisition to be Contractors positions. May serveas adhoc | approved. Will have write access with approvers. abilty to appiy to EY positions as internal candidates. Will have write ability to add referrals. Will have about blank 216720728, 230 Pa sboutblank ability to approve requisitions that are sent to them about blank EY Hiring Global ‘The individual(s) from the ‘Will have access to see job 100,000 Managers business that will ultimate | requision review applicants and manage thisrole and will make | approve offers forthe job requisitions hing deision that they are listed as hiring manager Tecnites | Global | The individuals responaibe for | Willhave acces to job reaustion, | 1800 managing the overall sourcing, | candidates, applicants and offer recrulting seletion and hing | information forthe obs they are process recruiting for Renting | Global | Tosuppor the reruing process | wilhave access tojob reuistion, | 2500 Tent Shared are given the Talent candidates, applicants and offer Services and ‘Transactional (TT) and/or Admin | information for the job requisitions Recruiting Hub roles that they are supporting. Coordinators Sourcing | Global | Provide sourcing/recrating | Willhave access tojob equation, | 350 Recruiters suppor (ex. identtying potential | canddats, applicants and offer candidates/applicants for information for jobs requisitions that various oles, interview support) | they are supporting Tecraing | Global | Provide versign anc leadership |" Will have access to job equation | 500 Leas for recruiting team, Willhave | and candidate report for the reporting oe managerial regions they oversee Global System | Canada, | Granted oa ited number af | Has overall acces to system dato and | 9 Support Ina, New | individuals a to oversee and_| functionality required for system Zealand, US, | manage the tool at global level | support Poland | including overseeing SuccessFactors Rerutng suppor and release activites, Global Us, Poland, | Provides global reporting Tas read only access requred for] 8 Reporting. India support. To create and manage | report creation globally. Has reports ars al data, permision to ereate and run reports Candidates? | Global | Toallow individuals to express | Has acess to ther own personal | Unknown Aplicants Interestin EY and apply for any | data. Has accesso create, edt and open jobs. delete data on tei candidate profile. Has access to apply for any posted EY jobs Sang Global | Has acess to add candidates | Has acess todd candidates that | 500 Agency that they are refering san | they are reterting as an agency rspresenatives agency SAP Suppo | EU TT Support Haz acces to system dato and Bos salt functionality required for system support Tt Consalting | Mexico and | To provide system support | Has veadwiteleidset accan tall Services (TCS) | India personal data in the Too. Has access toa ange of capabilities within the ‘Admin Comer TMT ‘Matiple | To provide TPsuppor Sondses | Has rea/wrteledluclte acces wall | The acces Support Team | Canada, | including the Digital Talent | porsnal dats in the Tool. Has access | to this ol China, Czech] System Support Services to level | to a range of capabilities within the will be Republic, 2 and 3 operational and release Admin Center. given based Hungary, management. on need and masa toe. For Mexico” bevel 2 and Oceanis Pilppines supper, 36720728, 230 Pat sboutblank Poland, UK, access will the US, Coste be provided Rica and to40 Austealia) (approx.) IBMIT support team members ‘The access rights detailed above involves transferring personal data in various jurisdictions (including jurisdictions outside the European Union) in which EY operates (EY office locations are listed at hitps:/www.ey.com/en_gllocations), An overview of EY network entities providing services to external clients is accessible here (See Section 2 (About EY) ~ “View a list of EY membs firms and affiliates”), EY will process your personal data in the Tool in accordance with applicable law and professional regulations in your jurisdiction, Transfers of personal data within the EY network are governed by EY’s Binding Corporate Rules, We transfer or disclose the personal data we collect to third-party service providers (and their subsidiaries and affliates) who are engaged by us to support our internal ancillary processes. For example, we engage service providers to provide, run and support our IT infrastructure (such as identity management, hosting, data analysis, back- Up, security and cloud storage services) and for the storage and secure disposal of our hard copy files. It is our policy to only use third-party service providers that are bound to maintain appropriate levels of data protection, security and confidentiality, and that comply with any applicable legal requirements for transferring personal data outside the jurisdiction in which it was originally collected. To the extent that personal data has been rendered anonymous in such a way that you or your device are no longer reasonably identifiable, such information will be treated as non-personal data and the terms of this Privacy Notice will not apply. For data collected in the European Economic Area (EEA) or which relates to individuals in the EEA, EY requires an appropriate transfer mechanism as necessary to comply with applicable law. The transfer of personal data from the Tool to SAP Success Factors, recruiters and agencies and Tata Consulting Services (TCS) and IBM, are governed by agreements which includes standard data protection clauses adopted by the European Commission. 7. Data retention Our policy is to retain personal data only for as long as itis needed for the purposes described in the section “How does the Tool process personal data”. Retention periods vary in different jurisdictions and are set in accordance with local regulatory and professional retention requirements, In order to meet our professional and legal requirements, o establish, exercise or defend our Tegal rights and for archiving and historical purposes, we need to retain information for significant periods of time. ‘The policies and/or procedures for the retention of personal data in the Tool are: ‘© Ifyou ate an EY user of the Tool: in accordance with the EY Records Retention Global Policy and the relevant Country 1 Schedule, The retention period is triggered based on the last activity date ‘© Ifyou are an external candidate / applicant or otherwise not an EY user of the Tool: your data will be held in line with your ‘country retention regulations. The retention period is triggered based on the last activity date. about blank 406720728, 2:30 Pat aboutblank After the end of the data retention period, your personal data will be deleted, 8, Security EY protects the confidentiality and security of information it obtains in the course of its business. Access to such information is limited, and policies and procedures are in place that are designed to safeguard the information from loss, misuse and improper disclosure. Additional information regarding our approach to data protection and information security is available in our ey-protecting-your-data-2018,paf brochure. 9. Controlling your personal data EY will not transfer your personal data to third parties (other than any extemal partes referred to in section 6 above) unless we have your permission or are required by law to do so. 10. Your rights in relation to your personal data Depending on the applicable jurisdiction, you may have certain rights in relation to your personal data, including: To request details of the personal data EY processes about you and to access the personal data that EY processes about you To have your personal data corrected, for example, if it is incomplete or incorrect ‘© To restrictor object to the processing of personal data or request the erasure of your personal data ‘© To receive a copy of the personal data which you have provided to EY in a structured, commonly used and machine-readable format which you can re-use for your own purposes (known as “data portability”) ‘© Where you have provided consent to the processing of your personal data, the right to withdraw your consent. ‘© The right to complain to data protection authority (see section ) ‘omplaint If you have any questions about how EY processes your personal data or your rights related to your personal data, please send an e-mail to global data protection@ey.com, 11, Complaints If you are concemed about an alleged breach of privacy law or any other regulation, contact EY’s Global Privacy Leader, Office of the General Counsel, 6 More London Place, London, SEI 2DA,United Kingdom or via email at global data protection(@ey.com ‘or via your usual EY representative. An EY Privacy Leader will investigate your complaint and provide information about how it will be handled and resolved, If you are not satisfied with how EY resolved your complaint, you may have the right to complain to your country’s data protection authority. You may also have the right to refer the matter to a coutt of competent jurisdiction Certain EY member firms in countries outside the European Union (EU) and the UK have appointed representatives in the EU and the UK respectively to act on their behalf if, and when, they undertake data processing activities to which the EU General Data Protection Regulation (GDPR) and/or the UK General Data Protection Regulation (UK GDPR) applies. Further information and the contact details of these representatives are available below: EU data protection representative | EY UK Data protection representative (ey.com 12. Contact us Ifyou have additional questions or concerns, contact your usual EY representative or email global data protection@ey.com, about blank 516720728, 2:30 Pat boutblank about blank 216