Privacy Statement for Job Applicants

Introduction

PwC is committed to protecting the privacy of your personal data. In accordance with the provisions of the GDPR[1] and other applicable legislation, this statement explains how PwC processes the personal data (i.e. information about you as an individual) that you submit when you apply for a position with us and we assess your application, and that we process.

Please note that PwC is the data controller with respect to the information you provide.

“PwC”, “we”, and “us” refers to the PwC member firm that has posted the position for which you are applying. Each member firm in the PwC network is a separate legal entity. For further details, please see www.pwc.com/structure.

This Privacy Statement applies to personal data provided to us, either by you or by others (such as your employer). When processing personal data our policy is to only process personal data that is strictly necessary for assessing your application. We also make it our priority to be transparent about why and how we process personal data. We will only use personal data provided to us for the purposes described in this privacy statement.

It is a prerequisite for assessing your application that you read this privacy statement and confirm to us that you have received appropriate and intelligible information about the processing of your personal data.

Collecting your personal data

It would be impossible to complete the recruitment process without processing certain personal data about you. In order to process your application for employment with PwC, you will be asked to provide information about you (including your name, email address, telephone number, address, your academic and professional qualifications and experience, etc.). You may choose to provide these directly to PwC or import information about yourself into PwC systems from other websites (for example, from LinkedIn). In connection with your application, you may choose to provide other information about yourself, such as a photograph or additional biographical information. We will use and process all personal data provided in the course of the application process in the manner described in this Privacy Statement. To the extent the terms of use of other websites require consent to import their data, you agree you will obtain such consent prior to importing any information into PwC’s systems. PwC accepts no liability for the lawfulness of any data import.

PwC may obtain information about your professional background by contacting the organisations or individuals you have referenced, the organisation or individual referring you, or other third parties, as part of processing your personal data for the purposes set out in this Privacy Statement. To the extent permitted by applicable legislation, PwC may also collect information about you from publicly available sources (e.g. online databases), in accordance with the principles of purpose limitation and data minimization. In no event will we collect or store information about you that is irrelevant to the assessment of your application.

Special categories of personal data

As part of your application to a PwC member firm you may choose to share with us personal data that fall into special categories of personal data.

Special categories of personal data include data concerning the following:

• racial or ethnic origin
• political opinion
• religion or beliefs
• trade union membership
• sex life or sexual orientation, or
• genetic data and biometric data for the purpose of uniquely identifying a natural person (e.g. fingerprints) and
• data concerning health

Under no circumstances will PwC ask you to provide such data.

Please note that if you nevertheless choose to provide data falling into special categories of personal data, we will only be able to process such data if you explicitly consent to such processing. Accordingly, in such cases please indicate your explicit consent to such processing in a documented manner (e.g. by e-mail or by making a statement to this effect in one of the materials you upload).

Updating and accessing your personal data

Please inform us immediately if there is a change in the personal data that you have previously provided. You can access your profile at any time to review or update your personal data.

Purpose and legal basis of processing

PwC and other PwC member firms with which your personal data is shared in the course of applying for a position may use your personal information for any or all of the following purposes:

• assessing your application(s) for employment, evaluating you for open positions throughout the PwC network, and managing your candidate profile;
• evaluating your suitability for employment (including for example providing your personal information to third parties to conduct background checks);
• liaising in connection with your application;
• if your application is unsuccessful, notifying you if a position relevant to you subsequently opens at PwC (provided that you explicitly consent to receiving such notifications, see below).

The legal basis for processing the personal data you provide in the course of submitting your application is PwC's legitimate interest in being able to decide on assessing your application and to select the most suitable candidate for the position.

If no employment relationship is established between PwC and you as a result of the recruitment process, PwC will, subject to your explicit consent, continue to process your personal data after the recruitment process has been completed so that we can notify you of other positions that may be relevant to you.

Data retention

We will retain your personal data for as long as is considered strictly necessary for the purpose(s) for which it was collected. Data retention periods were determined, on the one hand, with regard to the relevant mandatory retention periods required by law and, on the other hand, the statute of limitations applicable to pursuing legal claims, if any.

If, as a result of the assessment of your application, no employment relationship is established between PwC and you, but you have previously agreed to further processing of your personal data for the purposes of receiving notifications about future job offers, PwC will process the data you provide for up to two years calculated from the date of assessment of your application.

If you have not consented to further processing of your personal data as referred to above, PwC will, following assessment of your application,

• if no employment relationship is established, immediately (or, taking into consideration the time required for administration of the erasure procedure, as soon as possible) erase such data;
• if an employment relationship is established, further process such data in order to prepare and subsequently maintain the employment contract, for which it will provide you with a separate privacy statement.

When and how we share personal data

We will only share your personal data with third parties if we are legally permitted to do so. When we share personal data with third parties, we put in place appropriate contractual arrangements and other security mechanisms set out in the General Data Protection Regulation to protect personal data. To that end, we also have strict data protection, confidentiality and security standards and policies of our own.

PwC is part of a global network with member firms around the world. Accordingly, in certain cases it may be necessary to transfer and disclose your personal data provided in the course of your application to other PwC member firms. As a result, your personal data may be transferred to a country other than the country where you reside or stay. For a list of countries and regions where PwC firms are located, please see https://www.pwc.com/gx/en/about/office-locations.html.

Your personal data will only be transferred outside the European Economic Area (EEA) to the following recipients and in the following cases:

• recipients in a jurisdiction which, on the basis of an adequacy decision of the European Commission, offers an adequate level of protection for personal data as required by the European Union;
• recipients with whom PwC has an agreement that covers the EU requirements and safeguards for the transfer of personal data to recipients outside the EEA.

To help provide, run and manage our internal IT systems we use services provided by third parties, who typically act as our data processors. (Such services include, for example: information technology services, including the services of cloud-based software as a service providers, identity management, website hosting and management, data analysis, data backup, security, and storage services).

The third-party providers may use their own subcontractors that have access to personal data (sub-processors). It is our policy to use only third party providers that provide adequate safeguards for the protection of personal data and process personal data transferred to them only in accordance with PwC’s documented instructions, and to flow those same obligations down to their sub-processors.

In addition to the above, PwC may, to the extent required by applicable law, also disclose your personal data to law enforcement, regulatory and other government agencies, and to professional bodies and other third parties, as required by and/or in accordance with applicable law or regulation.

Your rights in relation to data processing and how to exercise them

You have certain rights under the General Data Protection Regulation and other applicable legislation in relation to the personal data we process about you.

In this context, you have the right to:

• request a copy of personal data we hold about you;
• ask that we update the personal data we hold about you, or correct such personal data that you think is incorrect or incomplete;
• ask that we delete personal data that we hold about you, or restrict the way in which we process such personal data;
• request a copy of your data in a machine-readable format (e.g. as an email attachment or on a data carrier) or request that it be transferred to a third party (right to data portability);
• withdraw your consent to processing of your personal data (to the extent such processing is based on consent), or object to the processing of your personal data (if such processing is carried out on grounds of a legitimate interest of PwC or a third party);
• make a complaint, initiate official proceedings, and seek judicial remedy in relation to data processing.

To exercise any of the abovementioned rights, please contact us as set forth below. We will individually look into and respond, in line with applicable legislation, within one month to any complaints or inquiries we receive. We recommend that you provide a clear and precise description of your request.

Right of access

You have the right to obtain information at any time as to whether PwC processes personal data about you, and if so, how, including the categories of personal data processed, the purposes for which the data are processed, the recipients to whom the personal data are disclosed, the source from which PwC has obtained the personal data, the period for which the personal data are retained, your rights relating to processing of your personal data, and information on automated decision-making or profiling, if any, and in the case of transfer to third countries and international organisations, information on additional safeguards relating to such transfer.

When exercising your right of access, you also have the right to receive a copy of your personal data. In the case of a request filed electronically, unless otherwise noted, PwC will provide the requested information electronically (as an email attachment).

For the sake of completeness, please note that if your right of access would adversely affect the rights or freedoms of others, including in particular their trade secrets or intellectual property, PwC may, to the extent necessary and proportionate, refuse to act on your request.

Right to rectification

You have the right to request PwC to amend or rectify your personal data where it is inaccurate. If there is any doubt regarding the data to be amended, PwC may request you to verify the data by any appropriate means (primarily by means of an official document). If PwC has disclosed the personal data concerned to third parties, PwC will promptly communicate any rectification of personal data to each third party to whom the data have been disclosed, unless this proves impossible or involves disproportionate effort. On request, PwC will inform you about these third parties.

Right to erasure (“right to be forgotten”)

If you request PwC to erase any or all of your personal data, PwC will erase the personal data concerned without undue delay if:

• PwC no longer needs the personal data for the purposes for which they were collected or otherwise processed;
• you withdraw your consent on which the processing is based, and there is no other legal basis for the processing;
• the processing was carried out on grounds of the legitimate interests of PwC or a third party, but you have objected to the processing, and there are no overriding legitimate grounds for the processing;
• PwC has unlawfully processed the personal data or the personal data have to be erased for compliance with a legal obligation.

If PwC has disclosed the personal data concerned to third parties, PwC will promptly communicate any erasure of such personal data to each third party to whom the data have been disclosed, unless this proves impossible or involves disproportionate effort. On request, PwC will inform you about these third parties.

Please note that PwC’s obligation to erase personal data will not apply to the extent that processing is required for the establishment, exercise or defence of legal claims.

Please also note that PwC must process your personal data in order to consider you for a position as part of the recruitment process. Accordingly, if you ask to have your personal information deleted by PwC, PwC may need to terminate your application. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

Notwithstanding the above, PwC may retain certain information related to your application for a reasonable but limited period to exercise or defend related legal claims.

Right to restriction of processing

You may request restriction of processing of your personal data in the following cases:

• if you contest the accuracy of the personal data, for a period enabling PwC to verify the accuracy of the personal data;
• if the processing is unlawful but you oppose the erasure of the personal data and request the restriction of their use instead;
• if PwC no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims, or
• you have objected to the processing, pending verification of whether PwC’s legitimate grounds override your rights.

Where processing has been restricted, PwC will, with the exception of storage, only process such personal data with your consent. PwC may, even in the absence of such consent, process personal data for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State.

PwC will inform you before the restriction of processing is lifted. If PwC has disclosed the personal data concerned to third parties, PwC will promptly communicate any restriction of processing of such personal data to each third party to whom the data have been disclosed, unless this proves impossible or involves disproportionate effort. On request, PwC will inform you about these third parties.

Right to object

If the data processing is carried out on grounds of the legitimate interests of PwC or a third party, you have the right to object to the processing. PwC may refuse to comply with the objection if PwC demonstrates compelling legitimate grounds

• for the processing which override your right to object, or
• for the establishment, exercise or defence of legal claims.

Data security

We have extremely strict organisational and IT measures in place to keep the data we process secure. We adhere to internationally recognised security standards, and our information security management system relating to client data is independently certified as complying with the requirements of ISO/IEC 27001:2013. We have a framework of policies, procedures and training in place covering data protection, confidentiality, and data security, and we ensure that our staff continuously improve their privacy awareness through regular data protection training.

We consult other member firms in the PwC network in order to improve the efficiency of our internal privacy and data security procedures, and to bring them into line with the applicable regulations.

We regularly review our internal processes, data processing practices and related documentation.

We also have a Data Protection Officer who monitors the lawfulness of data processing, and, through his operations staff, serves as a point of contact for data subjects and for Hungary’s National Authority for Data Protection and Freedom of Information (“NAIH”).

Contacts and judicial remedy

Data Protection Officer:

Name: Dr. Orsolya Hosszú
Email: hu_dataprotection@pwc.com
Phone: +36 70 657 3209

If you have a question or comment, or wish to make a complaint about our use of personal data, please send an email with the details of your complaint to hu_dataprotection@pwc.com. We will individually look into and respond within one month to any complaints we receive.

You also have the right under applicable legislation to lodge a complaint with your local supervisory authority responsible for data protection matters. In Hungary, you may turn to the National Authority for Data Protection and Freedom of Information (“NAIH”).

You may contact NAIH at:

Website: http://naih.hu/

Address: 1055 Budapest, Falk Miksa utca 9-11.
Mailing address: 1374 Budapest, Pf. 603.
Phone: +36-1-391-1400
Fax: +36-1-391-1410

E-mail: ugyfelszolgalat@naih.hu

Without prejudice to your right to lodge a complaint, you have the right to judicial remedy for breach of your rights as described above. You also have the right to judicial remedy against a legally binding decision of a supervisory authority concerning you.

Furthermore, you have the right to judicial remedy where the supervisory authority does not handle a complaint or does not inform you within three months on the progress or outcome of the complaint you have lodged.

Notwithstanding the above, please contact us before seeking administrative or judicial remedy; we will do our best to answer your question or resolve your complaint to your satisfaction.

Changes to this privacy statement

This privacy statement was last updated in January 2023. We may update this privacy statement at any time by publishing an updated version. The new updated or amended privacy statement will apply from that revision date.

[1] Regulation (EU) 2016/678 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)