EU Mandatory Disclosure Regime (MDR) Tool - Privacy Notice

1. Introduction

This Privacy Notice is intended to describe the practices ....................... follows in relation to the EU Mandatory Disclosure Regime (MDR) Tool (“Tool”) with respect to the privacy of all individuals whose personal data is processed and stored in the Tool.

2. Who manages the tool?

3. Why do we need your information?

The Tool is designed to facilitate our compliance with the EU Mandatory Disclosure Regime (“MDR”), which requires tax intermediaries and taxpayers to disclose certain types of cross-border (EU-to-EU or EU-to-third country) tax planning arrangements. The Tool is designed to facilitate this reporting process through automation, enabling EY Tax engagement teams to:
• Assess and Determine if a reporting obligation exists; and
• If a reporting obligation does exist, log the assessment and produce a preliminary disclosure statement that includes the reportable information using the national tax authority template.
Your personal data processed in the Tool is used as follows:
• To determine (by way of logic tree) whether a disclosure obligation exists; and
• Data may also be processed in the system in order to be input into the required form for disclosure to the national tax authority.
We rely on the following basis to legitimize the processing of your personal data in the Tool:
• Client Personal Data: Processing is necessary for compliance with a legal obligation to which the data controller is subject.
• Our personnel data: Processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. The specific legitimate interest pursued is complying with regulatory and legal obligations.

4. What type of personal data is processed in the Tool?

The Tool processes these personal data categories: 
• ..................., Employees, and Contractors (current and former). This includes full name, (first and last), email address, and Entity.
• Clients, former clients, and other intermediaries, relevant taxpayers (including, for example, counter-parties to an arrangement) as well as associated enterprises to any taxpayer affected by the arrangement. This includes full name, (first and last), date and place of birth (in the case of an individual), residence for tax purposes, Taxpayer Identification Number (TIN), the persons who are associated enterprises to the intermediary or taxpayer (where appropriate), identification of the Member State of the relevant taxpayer(s) and any other Member States which are likely to be concerned by the reportable cross-border arrangement, and the identification of any person in the other Member States (if any) likely to be affected by the reportable cross-border arrangement or series of such arrangements indicating to which Member States the affected intermediaries or taxpayers are linked.
This data is sourced from:
•...................., Employees, and Contractors (current and former):Users may be authenticated through Single Sign-on (SSO) using Active Directory (AD). Email addresses of key members of the team may also be sourced from AD via the email system.
• Clients, former clients, and other intermediaries, relevant taxpayers, and associated enterprises: ............................................................................

5. Sensitive Personal Data

Sensitive personal data reveals your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or data concerning sex life or sexual orientation.

EY does not intentionally collect any sensitive personal data from you via the Tool. The Tool’s intention is not to process such information.

6. Who can access your information?

Your personal data is accessed in the Tool by the following persons/teams:

The access rights detailed above involves transferring personal data in various jurisdictions (including jurisdictions outside the European Union).

7. Data retention

The policies and/or procedures for the retention of personal data in the Tool are:

......................

8. Security

Our organisation is committed to making sure your personal data is secure. To prevent unauthorized access or disclosure,We have technical and organizational measures to safeguard and secure your personal data.

9. Controlling your personal data

We will not transfer your personal data to third parties (other than any external parties referred to in section 6 above) unless we have your permission or are required by law to do so. 
You are legally entitled to request details of the personal data about you.
To confirm whether your personal data is processed in the Tool or to access your personal data in the Tool, contact your usual representative or email your request to ..............................

10. Rectification, erasure, restriction of processing or data portability

You can confirm your personal data is accurate and current. You can request rectification, erasure, restriction of processing or a readily portable copy of your personal data by contacting your usualre presentative or by sending an e-mail to ............................

11. Complaints

If you are concerned about an alleged breach of privacy law or any other regulation, contact .... Global Privacy Officer,.....................
If you are not satisfied with how we resolved your complaint, you have the right to complain to your country’s data protection authority. You can also refer the matter to a court of competent jurisdiction. 

12. Contact us

If you have additional questions or concerns, contact your usual representative or email ..............................