Changes to this privacy statement

We recognise that transparency is an ongoing responsibility so we will keep this privacy statement under regular review.

This privacy statement was last updated on 7th September 2020.

Collection of personal data

We will collect personal data in connection with Club membership as described below.

Personal data provided directly by you:

• Name (Required)
• Social enterprise name (Required)
• Phone number (Optional)
• Email address (Required)
• PwC Office*
• Local Line of Service*
• Registered business address
• Issues/areas you would most like support with from PwC (coaching sessions) (Optional)
• Feedback following Club sessions you attend (Optional - this can be submitted anonymously and any reporting is aggregated and anonymised)
• Your knowledge and/or experience of a particular subject ahead of a workshop you are attending (Optional)
• Ad hoc correspondence about matters as part of your Club membership (Optional)

(Fields marked wth * are for PwC staff only)

Special category data provided directly by you (optional):

• Ethnicity

Please note that you must not input any special category data when using the mentoring application as PwC does not need special category personal data within the application.

Personal data captured, created, inferred or derived from your use of the mentoring application:

• Personal and professional biography created as part of creating a profile on the mentoring application (Required)
• Your mentoring preferences (Required) eg. areas you would most like to focus on with your mentor and geographical area you would prefer your mentor to be in
• When and how often app users login (using their GUID or SSO password) and how users interact with the application. This data will be aggregated
• Data automatically uploaded from PwC’s identity and access management system (IdAM)*

PwC Social Entrepreneurs Club will hold the following information about you populated from IdAM:

• First and last name
• Email address
• Organisation
• Country of residence
• Business Unit (PwC users only)
• Grade (PwC users only)
• Office location (PwC users only)

PwC may also have collected your phone number as part of the IdAM user pre-registration process, but only if you opted to provide it.

Unless your mobile phone number is included in your IdAM registration, you won’t be able to access PwC websites or systems which require users to input authentication information sent to their mobile phone. If you want to be able to access those systems, please ask your PwC contact to include your mobile phone number in your IdAM registration.

When and how we share personal data and locations of processing

We will only share personal data with others when we are legally permitted to do so.  When we share data with others, we put contractual arrangements and security mechanisms in place to protect the data and to comply with our data protection, confidentiality and security standards.

The PwC Social Entrepreneurs Club application is hosted by PwC UK in the UK.

We share personal data processed in connection with the mentoring application as follows:

• The Mentors (PwC) will be able to see the profiles of other Mentors (PwC).
• The Mentors (PwC) will also be able to see the profiles of the Mentees (Club members)
• The Mentees (Club members) will only see the profiles of Mentors (PwC) who send them a connection request

Information about your mentoring relationship (shared between mentor and mentee) will not be made available for other app users to see.

We share personal data processed in connection with Club membership as follows:

Other PwC member firms:

Our business contacts are visible to and used by PwC users from other PwC member firms to learn more about a contact, client or opportunity they have an interest in.  Please see our website privacy statement for further information.  See our website for details of our member firm locations.

We have the European Commission approved standard contractual clauses in place with the other PwC member firms to provide appropriate safeguards for personal data transferred outside of the EU. See the standard contractual clauses.

Third party organisations that otherwise assist us in providing goods, services or information

The School for Social Entrepreneurs (SSE)

The SSE supports PwC to deliver mentoring training and our Club coaching sessions. We share personal data processed in connection with specific coaching sessions members register for and the name and social enterprise name of our app users.

Where the locations of processing are outside of the EU, we have the European Commission approved standard contractual clauses in place to provide appropriate safeguards for personal data transferred outside of the EU. See the standard contractual clauses are available.

Third party organisations that provide applications/functionality, data processing or IT services to us

We are part of a global network of firms and in common with other professional service providers, we use third parties to help us run our business and these third parties may be located in other countries.  We share personal data processed in connection with the mentoring application as follows:

Microsoft Limited (used to host the back end Web Resource Manager Application and Database), Microsoft Campus, Thames Valley Park, Reading RG6 1WG, UK

Individuals’ rights and how to exercise them

You have certain rights over your personal data.  Data controllers are responsible for fulfilling these rights.  Where we decide how and why personal data is processed, we are a data controller.

Individuals’ rights are the right of access to personal data, to rectification of personal data, to erasure of personal data / right to be forgotten, to restrict processing of personal data, to object to processing of personal data, to data portability, the right to withdraw consent at any time (where processing is based on consent) and the right to lodge a complaint with a supervisory authority.

Please see further information about these rights (and when they are available) below.  You may exercise your rights as follows:

• To exercise your rights in relation to personal data for which your employer is controller, please contact your employer.
• To exercise your rights in relation to personal data for which PwC is a controller, please email UK_privacy_information_management@pwc.com

Right of access

You have the right to receive a copy of your personal data held by a data controller and obtain certain other information about how and why the data controller processes your personal data (similar to the information provided in this privacy statement).

Right to rectification

You have the right to request for your personal data to be amended or rectified where it is inaccurate (for example, if you change your name or address) and to have incomplete personal data completed.

The right to erasure / right to be forgotten

You have the right to obtain deletion of your personal data in the following cases:

• the personal data are no longer necessary in relation to the purposes for which they were collected and processed;
• the lawful basis for processing is consent, you withdraw consent and we have no other lawful basis for the processing;
• the lawful basis for processing is that the processing is necessary for a legitimate interest, you object to such processing and the controller or third party does not have overriding legitimate grounds;
• you object to our processing for direct marketing purposes;
• your personal data have been unlawfully processed; and
• your personal data must be erased to comply with a legal obligation to which we are subject.

The right to restrict processing

You have the right to restrict our processing of your personal data in the following cases:

• for a period enabling the controller to verify the accuracy of the personal data where you have contested the accuracy of the personal data
• your personal data have been unlawfully processed and you request restriction of processing instead of deletion;
• the personal data are no longer necessary in relation to the purposes for which they were collected and processed but the personal data are required by you to establish, exercise or defend legal claims; and
• for a period enabling the controller to verify whether the legitimate grounds relied on override your interests (where you have objected to processing based on it being necessary for the pursuit of a legitimate interest identified by the controller).

The right to object to processing

You have the right to object to processing of your personal data in the following cases:

• the lawful basis for processing is that the processing is necessary for a legitimate interest; and
• processing for direct marketing purposes.