Privacy policy of Ernst & Young denkstatt GmbH

EY member firms operate in more than 150 countries worldwide. Certain parts of the EY infrastructure, including the IT services provided to member firms, are centralized. In addition, all employees within the EY organization working on these matters must be able to access certain information when engagements span more than one jurisdiction. Therefore, your personal data will be transferred to, and stored at, a destination outside the country in which you are located. This includes countries outside the European Economic Area (EEA) and countries whose legislation does not necessarily provide an adequate level of protection with regard to the processing of personal data under EU or other laws.

We have taken appropriate security and legal precautions to ensure the security and integrity of personal data transferred within the EY organization. EY denkstatt and all member firms implement Binding Corporate Rules (BCRs) that enable the global transfer of personal data from the EEA within the EY organization in accordance with applicable European data protection laws. The BCRs require all EY member firms worldwide to apply the same standards for the protection of personal data.

To read our BCR, please click here.

Your personal data is also processed by service providers who support our internal processes. For more information, please read the following paragraph:

• service provider

We transmit or transfer the personal data we collect to third-party providers (and their subsidiaries and affiliates) if we commission them to support our internal processes. For example, we commission service providers with the provision, operation and support of our IT infrastructure (e.g. identity management, hosting, data analysis, back-ups, security and cloud storage services) and with the archiving and secure disposal of our files and documents in paper form.

As a matter of principle, we only work with service providers who ensure an adequate level of data protection, security and confidentiality and who comply with all applicable legal requirements for the transfer of personal data outside the country in which it was originally collected. For data collected in the EEA that relates to data subjects within the EEA, we require the use of an appropriate data transfer mechanism to comply with applicable legal requirements.

• Involvement of service providers

As part of the execution of assignments, we may use network companies such as members of the global network of Ernst & Young companies (“EY members” – a list of the locations of EY members is available at www.ey.com) as well as selected service providers and IT service providers including external data storage (cloud services).

All service providers used to provide our services are obliged by EY denkstatt, if necessary, to comply with professional secrecy and data protection principles. If we use service providers outside the European Union to provide our services, an adequate level of data protection is ensured.

Please note that, if necessary, the following list of service providers and IT service providers may be amended.

• service provider

We commission the following service providers to ensure the efficient execution of our orders:

d & e consulting GmbH

We commission this service provider to carry out various projects in the field of energy & energy efficiency. In addition to energy audits, this also includes energy monitoring, measure evaluations and decarbonization projects (including roadmaps). Various analysis and data management tools are used to implement these projects. We take appropriate measures to ensure that this third-party provider processes personal data in accordance with applicable data protection laws and our instructions.

denxpert EHS&S software Kft. uses third parties to provide certain services. As part of our business activities, we may pass on personal data that we collect to this third party provider if this is necessary to support these processes. The service provider is responsible for the operation, provision and quality assurance of the relevant software. The IT service provider also has an information security management system certified in accordance with ISO/IEC 27001:2013 to ensure the protection of the information provided.

Mailchimp: To perform certain business functions such as sending e-mails or marketing, we use the “Mailchimp” service provided by The Rocket Science Group LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA. The data you provide (e-mail address, name) is transferred to a Mailchimp server in the USA and stored there. Mailchimp uses this information for sending and statistical analysis on our behalf. Furthermore, Mailchimp may, according to its own information, use this data to optimize or improve its own services, e.g. for the technical optimization of the dispatch and presentation of the newsletter or for economic purposes in order to determine from which countries the recipients come. However, Mailchimp does not use the data to write to them itself or pass it on to third parties.

As Mailchimp is a provider in an insecure third country, we have concluded an order processing contract with the company in which the agreed standard contractual clauses of the European Commission are implemented. Mailchimp’s obligation to comply with the Standard Contractual Clauses (SCC) ensures that your data complies with European data protection standards even if it is transferred to and stored in third countries (such as the USA). Mailchimp undertakes to comply with the European level of data protection.

Vertec: We use the business software Vertec GmbH, Mariahilfer Straße 101/1/23 1060 Vienna, to manage our customers’ contact data, and

Vertec stores customers’ personal data, including name, position and email address. This data is processed for the purpose of customer management and the performance of our contractual obligations in accordance with Art. 6 para. 1 lit. b GDPR.

Matomo: Our website uses Matomo, an open source software for the statistical analysis of visitor access. Matomo uses cookies, which are stored on your computer and enable your use of the website to be analyzed. Your IP address is immediately anonymized, so that you remain anonymous as a user. The information generated by the cookie about your use of this website is not passed on to third parties.

You can prevent the use of cookies by selecting the appropriate settings in your browser software. However, we would like to point out that in this case you may not be able to use all the functions of our website to their full extent.