Privacy Statement

Introduction

The PwC network and each of the individual PwC firms are strongly committed to protecting personal data.

This Privacy Statement describes why and how we collect and use personal data and provides information about individuals’ rights. It applies to personal data provided to us, both by individuals themselves or by others. We may use personal data provided to us for any of the purposes described in this Privacy Statement or as otherwise stated at the point of collection. Please note that this Privacy Statement serves as a general overview and data subjects might receive further specific information about their rights and the use of their data at the point of collection.

In this Privacy Statement, ‘PwC’, ‘we’ or ‘us’ refers to PricewaterhouseCoopers AG, which is a separate legal entity of the PwC network.
PricewaterhouseCoopers GmbH, Vaduz, Liechtenstein is a wholly owned subsidiary of PricewaterhouseCoopers AG and generally adheres to the same data protection and privacy principles as set forth in this Privacy Statement. Please find specific data protection terms for PricewaterhouseCoopers GmbH under the following link: PwC Liechtenstein Privacy Statement. For further information about the structure of the PwC network, visit www.pwc.com/structure.

Personal data are any information relating to an identified or identifiable natural person (data subject). PwC processes personal data for numerous purposes, and the means of collection, lawful basis of processing, use, disclosure and retention periods may differ for each of these purposes.

Data controller and contact information

The data controller responsible for the processing of your personal data as described in this Privacy Statement is PricewaterhouseCoopers AG (CHE-106.839.438). You will be informed in case of a different data controller deciding about the processing of your data.

We have appointed a Data Protection Officer. If you have any questions about this Privacy Statement or about how and why we process personal data, please contact our Data Protection Officer at:

Data Protection Officer
PricewaterhouseCoopers AG
Birchstrasse 160
8050 Zurich

Email: ch_swiss_data_privacy@pwc.ch
Phone: +41 (0) 58 792 00 00

Our Processing Activities

In the following sections, we take a detailed look at the data subject groups from which we process personal data. Please note that other data subjects from whom we might process personal data (e.g. partners and staff, suppliers), will be informed separately about the processing of their data.

Clients and individuals associated with our clients

Relevant personal data and their source

We only process personal data as necessary for providing our services resp. for agreed purposes. Generally, we collect such personal data from our clients or from a third party acting on the instructions of the relevant client. In such case, we ask our clients to provide associated data subjects (e.g. employees, suppliers, customers or other associated individuals) with the necessary information regarding the processing. Our clients may use relevant sections of this Privacy Statement or refer data subjects to this Privacy Statement if they consider it appropriate to do so.

We provide a diverse range of professional services (click here for information on our services). Some of our services require us to process personal data in order to provide advice and deliverables. Given the diversity of the services that we provide to clients, we process many categories of personal data, including:

  • contact details;
  • business activities;
  • information about management and employees;
  • payroll and other financial- and tax-related data;
  • information about internal processes and procedures;
  • data contained in corporate IT systems such as SAP;
  • bank, salary and payment data;
  • information about investments and other financial interests; or
  • in case of individual clients family-related information.

For certain services (e.g. payroll and immigration services, specific advisory mandates) or with the data subject’s consent, we may also process special categories of personal data such as information about religious beliefs, physical or mental health, sexual life or sexual orientation, excerpts from the debt register or criminal records.

Purposes of processing personal data

  • Initiating and fulfilling contracts

    PwC processes personal data to carry out pre-contractual measures (such as preparing an offer or creating a contract) and to provide the contractually agreed services, including the administering the business relationship and billing of the the services.
  • Complying with any requirement of law, regulation or requirements of a professional body of which we are a member

    As with any provider of professional services, we are subject to legal, regulatory and professional obligations. In particular, we need to collect and keep certain records to demonstrate that our services are provided in compliance with those obligations and those records may contain personal data.
  • Security, quality and risk management activities

    To safeguard our own legitimate interests, we have security measures in place to protect our and our clients’ information (including personal data), which involve detecting, investigating and resolving security threats. Personal data may be processed as part of the security monitoring that we undertake; for example, automated scans to identify harmful emails.

    In addition, we monitor the services provided to clients for quality purposes, which may involve processing personal data stored in the relevant client file.

    Finally, we have policies and procedures in place to manage risks in relation to client engagements. We process personal data as part of our client engagement and acceptance procedures during which we especially carry out searches using publicly available sources (e.g. the internet and sanctions lists) or third-party data to identify heightened risks and/or issues that would prevent us from working with a particular client.
  • Developing our business and services and providing our clients with information about us and our range of services

    We are continually looking for ways to help our clients and improve our business and services. Where agreed with our clients, we may use information that we receive in the course of providing professional services for other lawful purposes, including analysis to better understand a particular issue, industry or sector, to provide insights to our clients, to improve our business, service delivery and offerings and to develop new PwC technologies and offerings. We might also use contact details to obtain client feedback to improve and develop our business and our services.
  • Marketing and contact management purposes

    In line with applicable law, PwC also uses contact data (for example, name, email address, phone number, postal address) to provide the client with information on other PwC offers, services or events we believe to be of interest to our clients. For this purpose, we transfer the contact data into the customer relationship management (CRM) systems.

    There is a legitimate interest in informing PwC's clients about offers and events of our own in order to establish and maintain a long-term relationship.

    If PwC has received contact data within the framework of a business event held by PwC or others, within the framework of a business appointment (e.g. by exchanging business cards), within the framework of a survey or within the framework of an order, we also use the contact data (in particular, name, address, email address) to maintain our business contacts.

    PwC has a legitimate interest in maintaining contacts established in the course of business transactions beyond the initial contact and in using them to establish a business relationship and to remain in contact with those affected for this purpose.

Data retention

We retain the personal data processed for as long as is considered necessary for the purpose for which it was collected and described above (including as required by applicable laws or regulations).

In the absence of specific legal, regulatory or contractual requirements, our baseline retention period for records and other documentary evidence created in the provision of services is 10 years.

Profiling and automated decision-making

If no information to the contrary is provided, we do generally not perform profiling or undertake any automated decision-making when processing personal data provided by our corporate clients.

Visitors to our website

Relevant personal data and their source

We process limited personal data of visitors of our websites such as:

  • Contact details including name and email address;
  • Business related information including job title, job level and company name;
  • Order information and customer’s credit card information in case you order something via our website; or
  • Content of (email) correspondence between website visitors and us..

This data is collected directly from the website visitors and generally on a voluntary basis. An exception is the provision of credit card details in case a purchase is made via our website.

Purposes of processing personal data

When a website visitor provides personal data to us, we use them in connection with the purposes stated below or as obvious from the context of collection.

  • Initiating and fulfilling a contract

    We process your data to provide you with information material you requested or to invite you to events resp. conferences you registered for. Although most publications are provided as downloads, website visitors may also have the opportunity to purchase PwC publications online. In such case, we process the order information and your credit card information, where applicable, in order to facilitate shipment and payment of the publication.
  • Use of the website and communication

    Furthermore, your personal data is processed in order for you to benefit from all capabilities of our website resp. services provided via the website, including registration for webinars and events, subscriptions to updates or newsletters, participation in surveys, quizzes or polls, requests for further information or for reference materials.

    If we have collected consent to the respective tracking cookies we may leverage a visitor’s interactions with the website to display content recommended specific to his or her interests.

    Website visitors are also able to send us emails or contact us via specific forms on our website. Their messages will contain the name and email address, as well as any additional information the user may wish to include in the message.
  • Security, quality and risk management

    We process your personal data for administering and managing our website, including monitoring and enforcing compliance with the terms and conditions for the use of our website, confirming and authenticating identity and preventing unauthorized access to restricted areas, premium content or other services limited to registered users.

    As policy, visitors are not required to register to gain access to the areas of PwC websites. In certain cases, as a visitor’s PwC website experience expands, we may require in the future that a visitor register in order to obtain a user ID and password for authentication and secure access to a transaction or to certain confidential business or proprietary information services on premium websites.
  • Website analytics

    In order to assess the usage of our website and improve the user experience we aggregate data.
  • Marketing purposes

    Unless we are asked not to, we may also use your data to contact you with information about PwC’s business, services and events, and other information that may be of interest to you. Should visitors subsequently choose to unsubscribe from mailing lists or revoke their registration, we provide instructions on the related webpage or in our communication to the individual, or the individual may contact us by email. Users may visit the Preference Centre to adjust their interests, subscriptions and their consent to marketing communications.

Cookies and log files

Cookies may be used on some pages of our site. Cookies are small text files placed on your hard drive that assist us in providing a more customised website experience. For example, a cookie can be used to store registration information in an area of the site so that a user does not need to re-enter it on subsequent visits to that area. It is PwC’s policy to use cookies to make navigation of our websites easier for visitors and to facilitate efficient registration procedures. Site statistics are compiled by third parties and therefore your IP address will be passed to third parties for statistical reporting only.

Our website uses cookies for a variety of purposes detailed on the cookies information page. Visitors to the website get prompted to accept or reject these cookies upon their first visit. There are options to set preferences for analytics, personalisation and advertisting cookies.

If you are concerned about cookies, most browsers permit individuals to decline them. In most cases, a visitor may refuse a cookie and still be able to navigate our websites; however, other functionality on the site may be impaired. After ending a visit to our site, users can delete the cookie from their systems if they so wish.

Understand that no effective legal remedies are available under such access. Therefore, the transfer of your data to the USA and the use of cookies which involve such a transfer is based on your consent only. This consent can be withdrawn at any time by clicking on the “Cookie Settings” in the bottom area of the website.

Data retention

We retain the personal data processed for as long as is considered necessary for the purpose for which it was collected and described above (including as required by applicable laws or regulations).

Contact information about visitors (such as information generated though registration for access to areas on the site) shall be kept as long as the information is required to service the contact request or until a user requests that we delete that information. Mailing list information, discussion posts and emails are kept for only the period of time considered reasonable to facilitate the visitor’s requests.

Profiling and automated decision-making

In case a user has accepted personalisation cookies, we might use automated technology to display personalised content such as reading recommendations, event invitations or other relevant content related to a user’s browsing behavior. Users can opt out at any time by declining these cookies.

Recruitment applicants

When applying for a job, applicants should refer to the details provided on why and how personal data are collected and processed. If you should enter in an employment relationship with us, contractual agreements will regulate our use of your personal data. For more details about how we handle recruitment data, please visit our separate Privacy Statement and terms of use for the relevant tools.

Suppliers (including subcontractors and individuals associated with our suppliers and subcontractors)

We collect and process personal data about our suppliers (including subcontractors and individuals associated with our suppliers and subcontractors) in order to manage the relationship, contract, to receive services from our suppliers and, where relevant, to provide professional services to our clients. We commonly process contact details, e.g. name, job title, work telephone numbers, work email addresses, other contact details.

Purposes of processing personal data

  • Receiving services: We process personal data in relation to our suppliers and their staff as necessary to receive the services.
  • Providing professional services to clients: Where a supplier is supporting us to deliver professional services to our clients, we process personal data about the individuals involved in providing the services in order to administer and manage our relationship with the supplier and the relevant individuals and to provide such services to our clients.
  • Administering, managing and developing our businesses and services
  • Security, quality and risk management activities: We have security measures in place to protect our and our clients’ information (including personal data), which involve detecting, investigating and resolving security threats. Personal data may be processed as part of the security monitoring that we undertake; for example, automated scans to identify harmful emails. We have policies and procedures in place to monitor the quality of our services and manage risks in relation to our suppliers. We collect and hold personal data as part of our supplier contracting procedures. We monitor the services provided for quality purposes, which may involve processing personal data.
  • Providing information about us and our range of services: Unless we are asked not to, we use business contact details to provide information that we think will be of interest about us and our services.
  • Complying with any requirement of law, regulation or a professional body of which we are a member: As a professional services provider, we are subject to legal, regulatory and professional obligations. We need to collect personal data or to keep certain records to demonstrate that our services are provided in compliance with those obligations and those records may contain personal data.

Data retention

We retain personal data processed by us for as long as necessary for the purpose for which it was collected (including as required by applicable law or regulation). Personal data may be held for longer periods where extended retention periods are required by law or regulation and in order to establish, exercise or defend our legal rights.

Others

Individuals who use our applications

We provide external users access to various applications managed by us. Such applications generally include their own Privacy Statements explaining why and how personal data are collected and processed by those applications

Children

PwC understands the importance of protecting children’s privacy, especially in an online environment. Our website is not intentionally designed for or directed at children 16 years of age or younger. It is PwC’s practice never knowingly to collect or maintain information about anyone under the age of 16.

Participants of events, fairs or the like

PwC organizes or helps organize events and takes part in fairs (e.g. at universities or the like) or other social gatherings. We may use various applications to manage event registration processes, which applications will contain their own privacy notices explaining why and how personal data is collected and processed by these applications. Please refer to the privacy notices available on those applications.

Should you register via our website for such an event please see above in section covering website visitors. As part of the event management, we may process event-related data (but only to the extent required for a specific event), such as dietary restrictions, special requirements, travel information. We do not intentionally collect sensitive personal data unless you provide us with such data.

Participants of such events can interact with our employees and provide their personal data (such as information on business cards or by registering for talent pools, newsletter, games or the like). We will use this data to fulfill the purpose your data has been collected for or to get in touch with you with information about us or our services which could be of interest to you. You can at all times request us to stop our communication in accordance with your privacy rights described below.

Third parties

We shall only share personal data with third parties when and as far as we are legally permitted to do so. When we share data with third parties, we protect the data and comply with our data protection, confidentiality and security standards by means of e.g. security mechanisms, contractual and organizational arrangements.

The transfer of personal data may be possible to:

  • Other PwC member firms - For details of our member firm locations, please click here.

    We may share personal data with and store it on servers of other PwC member firms where necessary for administrative, quality control or risk management purposes and to provide professional services to our clients (e.g. when providing services involving advice from PwC member firms in different territories). Our business contacts are visible to and used by PwC users from other PwC member firms to learn more about a contact, a client or an opportunity in which they have an interest.

    In addition, PwC uses Service Delivery Centres (SDC), which operate within the PwC network to support several PwC firms in the administrative organisation and processing of client orders and mandates. This includes, for example, the preparation and review of invoices, layout and design, editing, translation services and other services relating to client orders and mandates.

    The PwC member firms have concluded an internal data protection agreement that provides for the transfer of personal data from EU/EEA countries and Switzerland to PwC network firms in other territories in compliance with the applicable legal requirements (e.g. the applicable EU standard contract clauses of the EU Commission as approved by the Swiss Federal Information and Data Protection Commissioner available here, or legally accepted set of rules to ensure data protection). If you would like more information about further security measures for the transfer of personal data to third countries, please feel free to contact our data protection officer.
  • Third parties that provide applications or IT services to us

    We and the PwC network use third parties to support us in providing our services and to help provide, run and manage our IT systems in Switzerland and abroad. For those purposes your personal data might be shared with resp. accessed by such third-party service providers. For data transfers in connection with cookies we use please see there.
  • Third parties that otherwise assist us

    Your personal data might also be shared with other third-party service provides such as suppliers and business partners supporting us in providing goods, services or information but also in supporting and making our business development activities more effective.
  • We may also share your personal data with auditors and other professional advisers as necessary.
  • Your personal data is also shared with law enforcement or other government and regulatory agencies or other third parties as required by, and in accordance with, applicable laws or regulations.
  • Occasionally, we may receive requests from third parties with authority to obtain disclosure of personal data, such as to check that we are complying with applicable laws and regulations, to investigate an alleged crime or to establish, exercise or defend legal rights. We shall only fulfil requests for access to personal data where we are permitted to do so in accordance with applicable laws or regulations.

The data are not further shared within the PwC network for secondary or unrelated purposes or shared with a third party other than as described in this Privacy Statement or otherwise disclosed at the point of collection. If there is an instance where such information may be shared, the visitor shall be asked for permission beforehand.

Third party links

In several places, pwc.ch may link to other websites that do not operate under the privacy practices of pwc.ch. If visitors follow links to other websites, PwC’s privacy practices no longer apply. We encourage visitors to review each site’s Privacy Statement before disclosing any personally identifiable information.

Individual’s rights

PwC makes every practical effort to avoid excessive or irrelevant collection of data. If you believe that we have collected excessive information, we encourage you to contact us to raise any concerns.

  • Access to personal data

    You have a right of access to personal data held by us as a data controller. This right may be exercised by emailing us. We aim to respond to any requests for information promptly and, in any event, within the legally required time limit.
  • Amendment of personal data

    To update personal data submitted to us, you may email us or, where appropriate, contact us via the relevant website registration page or by amending the personal details held on relevant applications with which you registered.

    When PwC retains personally identifiable information, PwC assumes responsibility for keeping an accurate record of the information once the data subject has submitted and verified the data. PwC does not assume responsibility for verifying the ongoing accuracy of the content of personal data. When feasible in practice, if PwC is informed that any personal data collected are no longer accurate, PwC shall make appropriate corrections based on the updated information provided by the data subject.

    When requested and legally permitted, PwC shall delete identifying information from current operational systems.
  • Withdrawal of consent

    Where we process personal data based on consent alone, individuals have a right to withdraw consent at any time. To withdraw consent to our processing of your personal data please email us or, to stop receiving an email from a PwC marketing list, please click on the ‘unsubscribe’ link in the email you received from us.
  • Erasure/deletion of personal data

    You have the right to request that PwC deletes your personal data if there is no legal or regulatory requirement for PwC to keep your data (such as retention obligations). To request the deletion of your personal data, please send an email ideally together with an identification document and the reasons why you wish us to delete the data.
  • Right to lodge a complaint with a supervisory authority

    You have the right of appeal to a data protection supervisory authority if you believe that the processing of your personal data violates applicable data protection law.

    For Switzerland this is Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Tel.: +41 (0)58 462 43 95 (https://www.edoeb.admin.ch/edoeb/en/home.html).
  • Other data subject rights

    As well as the rights referred to above, individuals may have other rights in relation to the personal data we hold, such as the right to restrict or object to our processing of personal data and the right to data portability. If you wish to exercise these rights, please send an email.

Security

Information Security is a high priority for the PricewaterhouseCoopers network. PwC member firms are accountable to their people, clients, suppliers and other stakeholders to protect information that is entrusted to them. The PwC Information Security Policy (ISP) outlines the minimum security requirements with which every member firm must comply.

The PwC ISP has been developed to safeguard the confidentiality, integrity and availability of the information and technology assets used by the PwC member firms. The PwC ISP is aligned with the industry standard ISO/IEC 27002:2013 Information technology – Security techniques – Code of practice for information security controls.

Modifications to this Privacy Statement

PwC reserves the right to modify or amend this Privacy Statement at any time by publishing an updated version here. The current version of the statement shall be accessible on this website. This Privacy Statement was last updated on 06 November 2023.