Privacy Statement

Our Commitment

We are committed to protecting the privacy and security of information about you (“data”) when you visit our application GTA in connection with your services pursuant to your Agreement dated 01 Apr 2026 with EY or other communication/documentation of similar nature. This privacy statement explains how EY collects, uses, and shares data. While processing data for GTA / or any other person (“Data Subject”), we comply with applicable privacy laws, including:

• Clearly stating the purposes for which we process personal data, as detailed in this privacy statement.
• Limiting our collection of personal data to only what is necessary for legitimate purposes.
• Requesting Data Subjects’ explicit consent before processing their personal data when required.
• Implementing appropriate security measures to protect personal data and requiring the same from third parties that process personal data on our behalf.
• Respecting the right to access, correct, or delete personal data upon request, as permitted by law.

Questions or requests about the data we hold: gdpr.india@in.ey.com.

1. Purpose, Data, and Retention Period

1.1. Contact – Through Phone, Mail, E-mail or Webforms

For this purpose, we use the following data (which may include, but are not limited to):

• Name
• Designation
• Mobile Number
• Official Email Address
• Address
• User Photo

1.2. Retention Period

We keep personal data no longer than necessary for the purpose(s) for which it was first collected, considering the purpose(s) of processing, relevant legal requirements, and/or as provided under the Agreement. To meet professional and legal requirements, to establish, exercise or defend legal rights, and for archiving and historical purposes, we may retain information for significant periods of time. Log Data will be retained in accordance with the EY IT Logging Policy. After the end of the data retention period, your personal data will be deleted.

EY does not intentionally collect any sensitive personal data from you via the Tool. The Tool’s intention is not to process such information. Please do not enter any unnecessary personal information or any sensitive personal data (including government identifiers such as tax file numbers or social security numbers, financial or health data), client confidential information, audit secrets, state secrets, commercial secrets, or text/images of anything that would violate professional secrecy or confidentiality rules or that would be considered abusive/irrelevant.

2. Sharing with Other Parties

The above-mentioned data is shared for the purposes of, or in connection with, one or more of the following reasons and associated purposes:

• Identification and access authorization
• Making contact and providing requested information following business meetings
• Provision of information and of requested services (e.g., newsletters)
• Monitoring, property protection, security checks
• Administration and general conduct of business
• Contacting in case of emergencies, fire drills, or evacuations

3. Security

We are dedicated to the protection of personal data. We implement reasonable security measures to prevent misuse, unlawful processing, destruction, damage, and unauthorized access to personal data.

The access rights detailed above involve transferring personal data in various jurisdictions (including jurisdictions outside the European Union) in which EY operates (EY office locations are listed at www.ey.com/ourlocations). An overview of how EY collects and uses personal data is available at Privacy statement | EY – India. EY will process your personal data in the App in accordance with applicable law and professional regulations in your jurisdiction. Transfers of personal data within the EY network are governed by EY’s Binding Corporate Rules. Further information about EY’s security measures and processing of personal data is available at www.ey.com/privacy.

For data collected in the European Economic Area (EEA) or which relates to individuals in the EEA, EY requires an appropriate transfer mechanism as necessary to comply with applicable law. The transfer of personal data from the Tool is governed by an agreement between EY and the service provider that includes standard data protection model clauses adopted by the European Commission. Accordingly, unless otherwise specified in the Agreement, when processing Personal Data subject to the General Data Protection Regulation (GDPR) or other applicable data protection law, we have agreed appropriate data processing protocols in the Agreement, applicable Statement of Work dated 01 Apr 2026 and DPA dated 01 Apr 2026 for processing of your data.

We transfer or disclose the personal data we collect to third-party service providers (and their subsidiaries and affiliates) engaged by us to support internal ancillary processes (e.g., identity management, hosting, data analysis, backup, security, and cloud storage services) and for the storage and secure disposal of hard copy files. It is our policy to only use third-party service providers that maintain appropriate levels of data protection, security and confidentiality, and that comply with any applicable legal requirements for transferring personal data outside the jurisdiction in which it was originally collected.

To the extent that personal data has been rendered anonymous in such a way that you or your device are no longer reasonably identifiable, such information will be treated as non-personal data and the terms of this Privacy Notice will not apply.

EY protects the confidentiality and security of information it obtains in the course of its business. Access to such information is limited, and policies and procedures are in place to safeguard the information from loss, misuse and improper disclosure. Additional information regarding our approach to data protection and information security is available in our brochure ey-protecting-your-data-brochure-v2.pdf.

4. Amendments to this Privacy Statement

We reserve the right to make amendments to this privacy statement. We recommend that you regularly consult this privacy statement to stay informed of any changes. Additionally, we will endeavour to actively inform you of any amendments, wherever possible.

5. Accessing and Modifying Your Data

If you have any questions or wish to know which personal data we hold about you, please contact us. If it does not conflict with any applicable laws, you are entitled to the following:

• Knowledge of why your personal data is needed, what will happen to it, and the duration of its retention.
• Copies of your personal data upon request, subject to a possible small fee for this service.
• Correction of any information you believe is inaccurate, as well as completion of information you consider incomplete.
• Erasure of your personal data under certain conditions.
• Restriction of the processing of your personal data under certain conditions.
• Notification of any rectification, erasure of personal data, or restriction of processing under certain circumstances.
• Objection to our processing of your personal data under certain conditions.
• Transfer of the data we have collected to another organization, or directly to you, under certain conditions.
• Discontinuation of contact by us for marketing purposes at any time.
• Lodging a complaint with the relevant authority.
• Avoidance of decisions based solely on automated processing.
• Notification in the event of a personal data breach, subject to certain conditions.

Please clearly identify yourself when making a request to ensure we do not modify or delete the data of the wrong person.

6. Children

Our website is not designed to attract children, and it is not our intent to collect personal data from children under the age of consent in their country of residence.

7. Submitting a Complaint

If you are not satisfied with the way we handle a complaint about the processing of your personal data, you have the right to submit a complaint to the relevant authority.

8. Data Protection Officer

For questions or requests about this privacy statement or to contact the Data Protection Officer, email global.data.protection@ey.com / gdpr.india@in.ey.com.

9. Contact Details

Firm name: Ernst & Young Services Private Limited

Noida

Delhi

Gurgaon

Website: https://www.ey.com/en_in

Email: gdpr.india@in.ey.com