This Privacy Notice is intended to describe the practices EY follows in relation to the FIA Global impact study surveys (“Survey”) with respect to the privacy of all individuals whose personal data is processed and stored.
2. Who manages the Survey?
“EY” refers to one or more of the member firms of Ernst & Young Global Limited (“EYG”), each of which is a separate legal entity and can act as a data controller in its own right. Also certain entities can act as joint data controllers. EY-Parthenon B.V. and Ernst & Young Australia (Australian Business Number 75 288 172 749) act as joint data controllers when processing your personal data in view of this Survey by use of a tool named SurveyMonkey. SurveyMonkey is from a third party EY uses, which is SurveyMonkey Europe UC. SurveyMonkey is hosted on servers in the United States.
Ernst & Young Australia prepared the data request c.q. surveys and will analyse the output of the surveys. This output will be included in a report – which does not include personal data – to make an estimation of the global social and economic contribution of motor sport. Ernst Young Australia has a coordinating and leading role in this respect and EY-Parthenon B.V. will assist Ernst Young Australia.
EY-Parthenon B.V. prepares and organizes member interviews after you provided us with your consent that EY-Parthenon B.V. may contact you in that respect. EY-Parthenon B.V. has a coordinating and leading role in this respect and Ernst & Young Australia provides EY-Parthenon B.V. with limited ad hoc guidance where required.
The personal data you provide via the Survey is shared by EY with one or more member firms of EYG (see “Who can access your information” section below).
3. Why do we need your information?
The Survey is used to estimate the global social and economic contribution of motor sport. Your personal data processed is used to get in touch with you and discuss your answers to the Survey questions, but only when you have provided us with your consent to do so.
EY relies on your consent as a basis to legitimize the processing of your personal data in the Survey. The provision of your personal data via the Survey to EY is optional. However, if you do not provide all or part of your personal data, we may be unable to carry out the purposes for processing.
4. What type of personal data is processed in the Survey?
The type of personal data which is processed by the Survey:
- your e-mail address;
- in some cases your function (f.e. if you are a club manager);
- in some cases the country/region in which the events you host or participate in are staged;
- in some cases the country or where your organization is located;
- of what motor sport discipline and/or championship you are the primary contact and what this business entails for you (f.e. a championship, sport authority).
5. Sensitive Personal Data
Sensitive personal data reveals your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning sex life or sexual orientation.
EY does not intentionally collect any sensitive personal data from you via the Survey. The Survey its intention is not to process such information.
6. Who can access your information?
Your personal data is accessed by the FIA Global Impact Study project team of EY.
And because we use a tool for the Survey, SurveyMonkey, your personal data could be accessed by: IT support of SurveyMonkey.
The access rights detailed above involves transferring personal data in various jurisdictions (including jurisdictions outside the European Union) in which EY operates (EY office locations are listed at www.ey.com/ourlocations). EY will process your personal data in the Survey in accordance with applicable law and professional regulations in your jurisdiction. Transfers of personal data within the EY network are governed by EY’s Binding Corporate Rules (www.ey.com/bcr).
7. Data retention
The policies and/or procedures for the retention of personal data for the Survey and in the tool are: if you have agreed to sharing personal data, your data will not be kept by EY for more than 6 months after the global impact study has been finalized. After which your deleted data is permanently removed from SurveyMonkey’s servers within 90 days.
Your personal data will be retained in compliance with privacy laws and regulations.
After the end of the data retention period, your personal data will be deleted.
EY is committed to making sure your personal data is secure. To prevent unauthorized access or disclosure, EY has technical and organizational measures to safeguard and secure your personal data. All EY personnel and third parties EY engages to process your personal data are obliged to respect your data’s confidentiality.
9. Controlling your personal data
EY will not transfer your personal data to third parties (other than any external parties referred to in section 6 above) unless we have your permission or are required by law to do so.
You are legally entitled to request details of EY’s personal data about you.
To confirm whether your personal data is processed in the Survey or to access your personal data in the Survey, contact your usual EY representative or email your request to impactstudy@FIA.com (which is managed by EY-Parthenon B.V.) and email@example.com.
10. Rectification, erasure, restriction of processing or data portability
To confirm whether your personal data is processed in the Survey or to access your personal data in the Survey, contact your usual EY representative or email your request to impactstudy@FIA.com and firstname.lastname@example.org.
If you are concerned about an alleged breach of privacy law or any other regulation, contact EY’s Privacy Officer, Rederijstraat 5, Rotterdam 3011 XR or via email at impactstudy@FIA.com and email@example.com or via your usual EY representative. An EY Privacy Officer will investigate your complaint and provide information about how it will be handled and resolved.
If you are not satisfied with how EY resolved your complaint, you have the right to complain to your country’s data protection authority. You can also refer the matter to a court of competent jurisdiction.