Personal Data Processing and Protection Policy

PwC (“We”) is strongly committed to protecting personal data. This transparency notice describes why and how we collect and use personal data and provides information about individuals’ rights. We may use personal data provided to us for any of the purposes described in this transparency notice or as otherwise stated at the point of collection. Personal data is any information relating to an identified or identifiable living person. PwC processes personal data for numerous purposes, and the means of collection, lawful basis of processing, use, disclosure, and retention periods for each purpose may differ.  

When collecting and using personal data, our policy is to be transparent about why and how we process personal data.

To ensure the security of your personal data during processing, we take all necessary and sufficient legal, organisational and technical measures to protect personal data from unauthorised or accidental access, destruction, alteration, blocking, copying, disclosure, or distribution, as well as against other unlawful actions with respect to personal data.

We adhere to internationally recognised security standards. Our information security management system relating to client confidential data has been independently certified as compliant with ISO/IEC 27001: 2013.

We have a framework of policies, procedures and training in place covering data protection, confidentiality and security, and regularly review the appropriateness of the measures we have in place to keep the data we hold secure.

We may collect the following types of data:

• personal data you provide to us when filling out information fields on our websites, including filling out contact forms, subscribing to news mailouts or registering for our events;
• personal data and other information contained in the messages you send to us;
• personal data you provide on our career website;
• personal data you provide to us when you visit our offices;

• technical data automatically transmitted by the device you use to access our websites including the device’s specifications, IP address, cookies, browser information, date and time of access, addresses of the pages searched, and other similar information. Please visit our cookie policy to learn more about cookies;
• personal data that we need to obtain and process in order to render services and provide or receive professional advice and deliverables.

We may process your personal data only for the purposes for which it has been provided, including the following:

• registering you on our websites to grant access to selected sections;
• providing you with information about PwC, our services and events;
• answering your requests and enquiries for additional information;
• organising your participation in our events and surveys;
• sending you our news casts;
• distributing requested reference materials;
• submitting curriculum vitae;
• discharging legal, regulatory and professional obligations imposed on PwC in compliance with the law or by a professional body of which we are a member. We need to keep certain records to demonstrate that our services are provided in compliance with those obligations and those records may contain personal data;
• conducting client acceptance procedures;
• providing or receiving professional services;
• developing our businesses and services;
• making personal data available to PwC employees for performing services and for offering new services;
• identifying clients with similar needs;
• performing analytics such as on market trends, relationships maps or sales opportunities; in addition, the PwC CRM uses an algorithm to evaluate the strength of interactions between a PwC user and a contact. This ranking is primarily based on interaction frequency, duration, recency and response time;

• administering managing and developing our businesses and services, including:
  • managing our relationship with clients;
  • developing our businesses and services (such as identifying client needs and improvements in service delivery);
  • maintaining and using IT systems;
  • hosting or facilitating the hosting of events; and
  • administering and managing our website and systems and applications;
• security, quality and risk management activities, including:
  • detecting, investigating and resolving security threats;
  • monitoring the quality of our services and managing risks in relation to our clients as part of our client engagement and acceptance procedures;
  • monitoring the quality of our services and managing risks in relation to our suppliers and subcontractors as part of our contracting procedures.
• other purposes upon your consent.

We process technical data to:

• ensure the operability and security of our websites;
• improve the quality of our websites.

We do not place your personal data in publicly available sources. We do not make any decisions that would have adverse legal implications for or otherwise violate your rights and rightful interests based on personal data automated processing only.

The legal basis for each processing activity is specified in the relevant sections above. When we process personal information for our legitimate interests, we make sure to consider and balance any potential impact on a data subject (both positive and negative), and the data subject’s rights under data protection laws. Our legitimate business interests do not automatically override the interests of data subjects. We will not process personal data for activities where our interests are overridden by the impact on the data subject (unless we have their consent or are otherwise required or permitted to by law).

Your personal data will be retained for the term of your contract. After that, your personal data may be stored only for the period indicated by the law or as long as you or we may pursue legal claims towards one another.

We will only share personal data with others when we are legally permitted to do so. When we share data with others, we put contractual arrangements and security mechanisms in place to protect the data and to comply with our data protection, confidentiality and security standards.

We are part of a global network of firms and, in common with other professional service providers, we use third parties located in other countries to help us run our business. As a result, personal data may be transferred outside the countries where we and our clients are located.

For personal data that is regulated by EU legislation, please note that cross border transfers may include countries outside the European Economic Area ("EEA") and to countries that do not have laws that provide specific protection for personal data. We have taken steps to ensure all personal data is provided with adequate protection and that all transfers of personal data outside the EEA are done lawfully.

Where we transfer personal data outside of the EEA to a country not determined by the European Commission as providing an adequate level of protection for personal data, the transfers will be under an agreement that covers the EU requirements for the transfer of personal data outside the EEA, such as the European Commission approved standard contractual clauses. The European Commission standard contractual clauses are available here.

• Other PwC member firms. For details of our member firm locations, please click here. We may share personal data with other PwC member firms where necessary for administrative purposes and to provide professional services to our clients (e.g. when providing services involving advice from PwC member firms in different territories). Our business contacts are visible to and used by PwC users from other PwC member firms to learn more about a contact, client or opportunity they have an interest in.
• Third-party organisations that provide applications/functionality, data processing or IT services to us.
• We use third parties to support us in providing our services and to help provide, run and manage our internal IT systems. For example, providers of information technology, cloud based software as a service providers, identity management, website hosting and management, data analysis, data back-up, security and storage services. The servers powering and facilitating that cloud infrastructure are located in secure data centres around the world, and personal data may be stored in any one of them.

• Third-party organisations that otherwise assist us in providing goods, services or information.
• Auditors and other professional advisers.
• Law enforcement or other government and regulatory agencies or to other third parties as required by, and in accordance with, the law or regulations.
• Occasionally, we may receive requests from third parties with authority to obtain the disclosure of personal data, such as to check that we are complying with the law and regulations, to investigate an alleged crime, or to establish, exercise or defend someone’s legal rights. We will only fulfil requests for personal data where we are permitted to do so in accordance with the law or regulations.

We recognise that transparency is an ongoing responsibility. As such, this privacy statement is subject to regular review.

This privacy statement was last updated on 16 August 2021.

The data controller is PwC Armenia or such PwC member firm, listed under this https://www.pwc.com/gx/en/about/office-locations.html, that is a contracting party for the purposes of providing or receiving services or the entity you have contacted.

The data controllers are PricewaterhouseCoopers Tax & Advisory LLP and PricewaterhouseCoopers LLP.

Please find the contact details of the controller here:

Business Center “AFD”, building “A”, 4 floor, 
34 Al-Farabi Avenue, Almaty, Kazakhstan, A25D5F6
T: +7 (727) 330 32 00

If you do not  agree with data processing, please let us know. Otherwise we will suppose that the consent is duly accepted. 

If you do not want to receive such emails further, you can unsubscribe.

Individuals have certain rights over their personal data and data controllers are responsible for fulfilling these rights.  Where we decide how and why personal data is processed, we are a data controller and include further information about the rights that individuals have and how to exercise them below.

You have the right to access your personal data held by us (as a data controller). This right may be exercised by emailing us at kz_privacy@pwc.com.

To update personal data submitted to us, you may email us at kz_privacy@pwc.com or, where appropriate, contact us via the relevant website registration page or by amending the personal details held on relevant applications with which you registered.

When practically possible, once we are informed that any personal data processed by us is no longer accurate, we will make corrections (where appropriate) based on your updated information.

Where we process personal data based on consent, individuals have the right to withdraw their consent at any time. We do not generally process personal data based on consent (as we can usually rely on another legal basis). To withdraw your consent to our processing of your personal data, please email us at kz_privacy@pwc.com. To unsubscribe from a PwC marketing list, please click on the unsubscribe link in the relevant email received from us.  

You have the right to restrict or object to the processing of your personal information at any time, on reasonable grounds relating to your particular situation, unless the processing is required by law.

In such case, we will no longer process or restrict the processing of the personal data, unless we can demonstrate compelling legitimate grounds for the processing or for the establishment, exercise or defence of legal claims.

This transparency notice is intended to provide information about what personal data we collect about you and how it is used. As well as rights of access, amendment and restriction or objection to processing referred to above, individuals may have other rights in relation to the personal data we hold, such as a right to erasure/deletion and the right to data portability.

If you wish to exercise any of these rights, please send an email to kz_privacy@pwc.com.