Last updated: October 2022
Privacy Notice – Kaltura
1. Introduction
This Privacy Notice is intended to describe the practices EY follows in relation to the Kaltura (“Tool”) with respect to the privacy of all individuals whose personal data is processed and stored in the Tool. This Privacy Notice should be read together with the ey.com Privacy Statement , and in case of any conflict with the ey.com Privacy Statement , the terms of this Privacy Notice will prevail. Please read this Privacy Notice carefully.
2. Who manages the Tool?
“EY” refers to one or more of the member firms of Ernst & Young Global Limited (“EYG”), each of which is a separate legal entity and can determine the purposes and means for data processing in its own right (i.e. act as a data controller or in a similar capacity).
The entity that is acting as data controller (or similar capacity) by providing this Tool on which your personal data will be processed and stored is:
· For the personal data of EY personnel: The data controller is the EY entity which employs you.
· For the personal data of third party personnel (including EY clients): The data controller is the EY local member firm with which the third party has a relationship.
You can find a list of local EY member firms and affiliates on the ey.com Privacy Statement : https://www.ey.com/en_gl/privacy-statement
The personal data in the Tool is shared by the above data controller with one or more member firms of EYG (see “Who can access your personal data” section 6 below).
The Tool is hosted externally by the vendor or its third-party hosting provider AWS in US-East (North Virginia / Ohio).
3. How does the Tool process personal data?
The purpose of the Kaltura platform is twofold. Firstly, to provide a scalable alternative webcasting product and secondly to provide a premium experience virtual event platform.
Kaltura is a Virtual Event technology platform that can deliver a range of use cases from webcasts to complex virtual events to both internal and external clients.
This is a virtual event platform to deliver internal and externally facing virtual & hybrid events. It consists of a webcast component to record, produce and broadcast live or pre-recorded content as part of an event as well as an attendee hub where participants can view the content being broadcast and interact with sessions. Finally, there is a video hub to access content post event / post broadcast. Supporting services are available throughout the delivery lifecycle of an event ranging from discrete specialist skills (e.g. content production) to fully managed events.
Your personal data processed in the Tool is used as follows:
As individuals are attending a virtual event, their data will be used for registration purposes to identify them during their participation throughout the event. Following the event, EY will maintain records of attendance and the individual’s participation in the event as well as monitoring on-going engagement with the content as it will be available on-demand. This reporting and the data used are for the purposes for measuring event & content performance. In a learning setting it can also be used to award CE or CPE credits.
For EY Employees - EY relies on the following basis to legitimize the processing of your personal data in the Tool:
Processing of your personal data is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. The specific legitimate interest(s) are:
· Learning and events registration and management
· Kaltura will be used for high-profile, EY flagship events that were typically in person. Users’ data will only be processed when they choose to register and attend an optional event. For internal EY events, users’ data will be used to track attendance at the event and issue CPE (continuing professional education) credits when applicable.
· For external, client-facing events this basic level of data collection is used to track attendance at a specific event for networking and business development purposes. Particularly in the context of the ongoing Covid pandemic, Kaltura will allow EY to continue to host such global flagship events in a secure and safe way.
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you based on the above legitimate interest(s).
For Client (External) Users
We process your personal data based on your consent. The provision of your personal data to EY is optional. However, if you do not provide all or part of your personal data, we may be unable to carry out the purposes for processing. You have the right to withdraw your consent at any time.
4. What type of personal data is processed in the Tool?
The Tool processes these personal data categories:
EY Employees data:
- Full Name
· Official email address
Optional data based on the event:
· Event recording (audio & visual)
- Education
- Address
- Job Title
· Photograph or image for personal profile
· Telephone number
- IP Address
- Gender
Client (External) data:
- Full Name
· Official email address
Optional data based on the event:
· Event recording (audio & visual)
- Education
- Address
· Employer Name
· Occupation/Job Title
· Photograph or image for personal profile
· Telephone number
- IP Address
- Gender
This data is sourced For EY employee from Active Directory, GHRDB or provided directly when employee registers directly through Kaltura tool.
Client/potential client data is sourced from Marketo (External) and CVENT (External). Clients, and potential clients attending an Intrado event will enter their registration information directly, if Kaltura is used for registration instead of Marketo or CVENT.
5. Sensitive personal data
Sensitive personal data reveals your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning sex life or sexual orientation.
EY does not intentionally collect any sensitive personal data from you via the Tool. The Tool’s intention is not to process such information.
6. Who can access your personal data?
Your personal data is accessed in the Tool by the following persons/teams:
|
USer Group |
LOCATION |
PURPOSE |
ACCESS |
AMOUNT
|
|
Group name |
Identify country |
The action that the group performs |
Identify whether access is read, update, add |
Provide the approx. number of users with access |
|
EY IT Product Managers |
Global |
Full access |
Read, Update, Add |
Less than 10 |
|
EY Event Managers |
Global |
Event specific access |
Read, Update, Add |
Less than 10 |
|
EY Webcast Producers |
Global |
Webcast specific access |
Read, Update, Add |
Less than 10 |
|
Kaltura event support inc producers |
Global |
Full Access |
Read, Update, Add |
Less than 10 |
|
Event Attendees |
Global |
Registration, engagement within sessions, engagement out of sessions |
Read, update, add their own data only |
Event based ~ |
The access rights detailed above involves transferring personal data in various jurisdictions (including jurisdictions outside the European Union) in which EY operates (EY office locations are listed at https://www.ey.com/en_gl/locations ). An overview of EY network entities providing services to external clients is accessible here (See Section 1 (About EY) - “View a list of EY member firms and affiliates”). EY will process your personal data in the Tool in accordance with applicable law and professional regulations in your jurisdiction. Transfers of personal data within the EY network are governed by EY’s Binding Corporate Rules .
We transfer or disclose the personal data we collect to third-party service providers (and their subsidiaries and affiliates) who are engaged by us to support our internal ancillary processes. For example, we engage service providers to provide, run and support our IT infrastructure (such as identity management, hosting, data analysis, back-up, security and cloud storage services) and for the storage and secure disposal of our hard copy files. It is our policy to only use third-party service providers that are bound to maintain appropriate levels of data protection, security and confidentiality, and that comply with any applicable legal requirements for transferring personal data outside the jurisdiction in which it was originally collected.
To the extent that personal data has been rendered anonymous in such a way that you or your device are no longer reasonably identifiable, such information will be treated as non-personal data and the terms of this Privacy Notice will not apply.
For data collected in the European Economic Area (EEA) or which relates to individuals in the EEA, EY requires an appropriate transfer mechanism as necessary to comply with applicable law. The transfer of personal data from the Tool to Kaltura Europe Ltd is governed by an agreement between EY and the service provider that includes standard data protection clauses adopted by the European Commission.
7. Data retention
Our policy is to retain personal data only for as long as it is needed for the purposes described in the section “How does the Tool process personal data?” Retention periods vary in different jurisdictions and are set in accordance with local regulatory and professional retention requirements.
In order to meet our professional and legal requirements, to establish, exercise or defend our legal rights and for archiving and historical purposes, we need to retain information for significant periods of time.
The policies and/or procedures for the retention of personal data in the Tool are:
The total retention period is defined and will be implemented in accordance with EY Records Retention Global Policy and the relevant Country Retention Schedule (CRS) .
Log Data will be retained in accordance with the EY IT Logging Policy .
After the end of the data retention period, your personal data will be deleted.
8. Security
EY protects the confidentiality and security of information it obtains in the course of its business. Access to such information is limited, and policies and procedures are in place that are designed to safeguard the information from loss, misuse and improper disclosure. Additional information regarding our approach to data protection and information security is available in our ey-protecting-your-data-2018.pdf brochure.
9. Controlling your personal data
10. Your rights in relation to your personal data
Depending on the applicable jurisdiction, you may have certain rights in relation to your personal data, including:
- To request details of the personal data EY processes about you and to access the personal data that EY processes about you
- To have your personal data corrected, for example, if it is incomplete or incorrect
- To restrict or object to the processing of personal data or request the erasure of your personal data
- To receive a copy of the personal data which you have provided to EY in a structured, commonly used and machine-readable format which you can re-use for your own purposes (known as “data portability”)
- Where you have provided consent to the processing of your personal data, the right to withdraw your consent.
- The right to complain to a data protection authority (see section “Complaints”)
If you have any questions about how EY processes your personal data or your rights related to your personal data, please send an e-mail to global.data.protection@ey.com .
11. Complaints
If you are concerned about an alleged breach of privacy law or any other regulation, contact EY’s Global Privacy Leader, Office of the General Counsel, 6 More London Place, London, SE1 2DA, United Kingdom or via email at global.data.protection@ey.com or via your usual EY representative. An EY Privacy Leader will investigate your complaint and provide information about how it will be handled and resolved.
If you are not satisfied with how EY resolved your complaint, you may have the right to complain to your country’s data protection authority. You may also have the right to refer the matter to a court of competent jurisdiction.
Certain EY member firms in countries outside the European Union (EU) and the UK have appointed representatives in the EU and the UK respectively to act on their behalf if, and when, they undertake data processing activities to which the EU General Data Protection Regulation (GDPR) and/or the UK General Data Protection Regulation (UK GDPR) applies. Further information and the contact details of these representatives are available below:
EU data protection representative | EY
UK Data protection representative (ey.com)
12. Contact us
If you have additional questions or concerns, contact your usual EY representative or email global.data.protection@ey.com .