Privacy policy

Corporate clients (and individuals associated with our corporate clients)

We only collect the personal data necessary for agreed purposes and we ask our clients to share personal data with us only if it is necessary for those purposes. Where we need to process personal data to provide professional services, we ask our clients to provide the data subjects with the necessary information regarding its use. Our clients may use relevant sections of this Privacy Statement or refer data subjects to this privacy statement if they consider it appropriate to do so.

Given the diversity of the services that we provide to clients, we process many categories of personal data, including:

• contact details;

• business activities;

• information about management and employees;

• payroll and other financial- and tax-related details;

• internal processes and procedures;

• data contained in corporate IT systems such as SAP; and

• information about investments and other financial interests.

For payroll and immigration services, and with the individual’s consent, we may also process special categories of personal data. Examples of special categories include religious beliefs, physical or mental health, sexual life or sexual orientation, excerpts from the debt register and criminal records. In such cases, the person concerned is informed about the purpose of data processing and asked for his/her consent individually.

Generally, we collect personal data from our clients or from a third party acting on the instructions of the relevant client. The data are treated as highly confidential within PwC Strategy&.

Purposes of processing personal data

• Initiating and fulfilling contracts
  PwC Strategy& processes personal data to carry out pre-contractual measures (such as preparing an offer, conducting internal pre-contractual risk and compliance checks or creating a contract) and to provide the contractually agreed services, including the administrative execution and billing of the order. In this context, the contact data are processed in particular, such as name, address, telephone number and email address.
  

• No automated decision-making is undertaken
  On the basis of a contract with our client, PwC Strategy& is subject to an obligation to provide the service for which it is commissioned. In order to be able to provide this service, it is necessary to process the data of the contact persons and persons with responsibility at the client. This constitutes a legitimate interest of PwC Strategy& in the processing of these data. Accordingly, the same applies when preparing a proposal for the provision of services.
  

• Administering, managing and developing our businesses and services
  PwC Strategy& is legally obliged to keep records properly and to document its mandates and orders extensively. These files and the documentation must also be kept and stored after completion of an order or mandate for retention periods specified by law. In addition, PwC Strategy& is subject to further statutory documentation and storage obligations, which are based, among other things, on tax, accounting or commercial and corporate law requirements for companies.
  The documents to be recorded, the results of the work and the associated client-related correspondence also contain personal data, so that these are also part of file management and archiving.
  The record keeping, documentation and archiving of client documents at PwC Strategy& is performed electronically in the IT systems and, in some cases, in the form of paper files.
  With its file management, documentation and archiving, PwC Strategy& fulfils the legal obligations of professional law, tax law and commercial and corporate law, among others.
  We are continually looking for ways to help our clients and improve our business and services. Where agreed with our clients, we may use information that we receive in the course of providing professional services for other lawful purposes, including analysis to better understand a particular issue, industry or sector, to provide insights to our clients, to improve our business, service delivery and offerings and to develop new PwC Strategy& technologies and offerings.
  

• Security, quality and risk management activities
  We have security measures in place to protect our and our clients’ information (including personal data), which involve detecting, investigating and resolving security threats. Personal data may be processed as part of the security monitoring that we undertake; for example, automated scans to identify harmful emails. We monitor the services provided to clients for quality purposes, which may involve processing personal data stored in the relevant client file. We have policies and procedures in place to monitor the quality of our services and manage risks in relation to client engagements. We collect and hold personal data as part of our client engagement and acceptance procedures. As part of those procedures, we carry out searches using publicly available sources (e.g. the internet and sanctions lists) to identify politically exposed persons and individuals and organisations involving heightened risk. Such searches are used to check that there are no issues that would prevent us from working with a particular client (such as sanctions, criminal convictions –including in respect of company directors – or conduct or other reputational issues).
  

• Providing our clients with information about us and our range of services
  PwC Strategy& also uses contact data (in particular, name, address, email address) to obtain client feedback or to provide the client with information on other PwC Strategy& offers, services or events.
  There is a legitimate economic interest in informing PwC Strategy&'s clients about offers and events of our own in order to establish and maintain a long-term relationship.
  

• Complying with any requirement of law, regulation or a professional body of which we are a member
  As with any provider of professional services, we are subject to legal, regulatory and professional obligations. We need to collect and keep certain records to demonstrate that our services are provided in compliance with those obligations and those records may contain personal data.
  

• Management of business contacts
  If PwC Strategy& has received contact data within the framework of a business event held by PwC Strategy& or others, within the framework of a business appointment (e.g. by exchanging business cards) or within the framework of an order, we also use these contact data (in particular, name, address, email address) to maintain our business contacts. For this purpose, we transfer the contact data into the customer relationship management (CRM) systems.

PwC Strategy& has a legitimate economic interest in maintaining contacts established in the course of business transactions beyond the initial contact and in using them to establish a business relationship and to remain in contact with those affected for this purpose.

Data retention

We retain the personal data processed by us for as long as is considered necessary for the purpose for which it was collected (including as required by applicable laws or regulations).

In the absence of specific legal, regulatory or contractual requirements, our baseline retention period for records and other documentary evidence created in the provision of services is 10 years.

Private clients

If a natural person is a client of PwC Strategy& (Private Client), other personal data are processed within the scope of order processing, insofar as this is required for the provision of the service agreed with the client. For this purpose, we shall process, in particular, bank data and payment data, as well as further information on personal, professional and financial circumstances, where applicable, insofar as these play a role in the fulfilment of the order by PwC Strategy& and the client provides us with this information in accordance with the order concluded with PwC Strategy&.

The processing of such personal data by PwC Strategy& is necessary for the fulfilment of the contract concluded between the client and PwC Strategy&.

Given the diversity of the services that we provide to personal clients, we process many categories of personal data, including:

• contact details;
• business activities;
• family information;
• income and other financial related details; and
• investments and other financial interests.

For payroll and immigration services, and with the individual’s consent, we may also process special categories of personal data. Examples of special categories include religious beliefs, physical or mental health, sexual life or sexual orientation, excerpts from the debt register and criminal records. In such cases, the person concerned is informed about the purpose of data processing and asked for his/her consent individually.

Generally, we collect personal data from our clients or from a third party acting on the instructions of the relevant client. The data are treated as highly confidential within PwC Strategy&.

Purposes of processing personal data

We only collect the personal data necessary for agreed purposes and we ask our private clients to share personal data with us only if it is necessary for those purposes. Where we need to process personal data to provide professional services, we ask our Private Clients to provide the data subjects with the necessary information regarding its use.

Providing professional services
We provide a diverse range of professional services. Some of our services require us to process personal data in order to provide advice and deliverables. For example, we need to use personal data to provide individual tax advice, immigration services or pension advice.

• Administering, managing and developing our businesses and services
  We process personal data in order to run and develop our business, including:
  • managing our relationships with clients;
  • developing our businesses and services (such as identifying client needs and making improvements in service delivery);
  • maintaining and using IT systems;
  • hosting or facilitating the hosting of events; and
  • administering and managing our website, systems and application

We are continually looking for ways to help our clients and improve our business and services. Where agreed with our clients, we may use information that we receive in the course of providing professional services for other lawful purposes, including analysis to better understand a particular issue, industry or sector, to provide insights to our clients, to improve our business, service delivery and offerings and to develop new PwC Strategy& technologies and offerings. To the extent that the information we receive in the course of providing professional services contains personal data, we shall de-identify the data prior to using the information for these purposes.

• Security, quality and risk management activities
  We have security measures in place to protect our and our clients’ information (including personal data), which involve detecting, investigating and resolving security threats. Personal data may be processed as part of the security monitoring that we undertake; for example, automated scans to identify harmful emails. We monitor the services provided to clients for quality purposes, which may involve processing personal data stored in the relevant client file. We have policies and procedures in place to monitor the quality of our services and manage risks in relation to client engagements. We collect and hold personal data as part of our client engagement and acceptance procedures. As part of those procedures, we carry out searches using publicly available sources (e.g. the internet and sanctions lists) to identify politically exposed persons and individuals and organisations involving heightened risk. Such searches are used to check that there are no issues that would prevent us from working with a particular client (such as sanctions, criminal convictions –including in respect of company directors – or conduct or other reputational issues)
• Providing our clients with information about us and our range of services
  With or without consent, in accordance with applicable law, we use client contact details to provide clients information that we believe to be of interest about us and our services; for example, industry updates and insights, other services that may be relevant and invitations to events.
• Complying with any requirement of law, regulation or a professional body of which we are a member
  As with any provider of professional services, we are subject to legal, regulatory and professional obligations. We need to collect and keep certain records to demonstrate that our services are provided in compliance with those obligations and those records may contain personal data.

Data retention

We retain the personal data processed by us for as long as is considered necessary for the purpose for which it was collected (including as required by applicable laws or regulations).

In the absence of specific legal, regulatory or contractual requirements, our baseline retention period for records and other documentary evidence created in the provision of services is 10 years.

Individuals who use our applications

We provide external users access to various applications managed by us. Such applications shall include their own privacy statement explaining why and how personal data are collected and processed by those applications, or in the absence of a particular privacy statement refer to this present privacy statement. We encourage individuals using our applications to refer to the privacy statement issued on those applications.

Others who get in touch with us

We collect personal data (such as name, contact details and contents of the communication) when an individual gets in touch with us with a question, request for information, complaint, comment or feedback. In these cases, the individual is in control of the personal data shared with us and we shall only use the data for the purpose of responding to the communication.

Recruitment applicants

When applying online for a position at PwC Strategy& via the PwC Strategy& careers website, applicants should refer to the information provided when applying for a job for details on why and how personal data are collected and processed. If you should enter in an employment relationship with us, contractual agreements will regulate our use of your personal data. For more details about our recruitment processes, please visit our careers page.