Privacy statement

This privacy statement was last updated on 12 June 2026

Introduction 

Your privacy is important to us, and this privacy statement explains what personal data we collect about you and how we use that personal data. It applies to personal data about you which you provide to us, which we receive from third parties (such as your employer), and which we collect from publicly available sources. It also provides details about the rights you have, as well as how to exercise those rights.

In this privacy statement, “PwC”, “us”, and “we” refer to the PwC network and/or one or more of its member firms that process your personal data. Each member firm in the PwC network is a separate legal entity. The data controllers of your personal data are one or more of the firms with which you interact - whether in connection with receiving professional services, a contractual relationship, a supplier arrangement, an event or a marketing activity. You can find details of the member firms here, the countries and regions in which they operate here, and information about the structure of our network here.

Where two or more member firms determine together how your personal data is collected and used, they are jointly responsible for ensuring your personal data is handled properly and have entered into an arrangement that allocates responsibilities in compliance with applicable data protection laws.

We define any information about you or that identifies you as “personal data”. Throughout this document, terms such as handling, collecting, or storing your personal data are collectively referred to as “processing”. When referring to “you”, this could mean you as an individual client, as a representative of a client or supplier organisation, as a visitor to one of our websites, or as another type of data subject described in the ‘How do we use your personal data?’ section below.  

What is our lawful basis for processing your personal data?

We process your personal data only when we have a valid lawful basis to do so, in compliance with applicable data protection laws. We carefully assess the purpose and necessity of processing to ensure that your rights are always respected. The lawful bases we rely on include:

• Performance of a contract: processing is necessary to fulfil our contractual obligations with you, or to take steps at your request before entering into a contract.
• Compliance with a legal obligation: processing is necessary to comply with applicable legal obligations.
• Legitimate interests: processing is necessary for our legitimate interests or those of third parties, such as operating and managing our business, improving our products and services, maintaining security, and protecting our rights, provided that such interests do not override your fundamental rights and freedoms.
• Consent: processing based on your consent for specific purposes.

Some of the personal data we collect, store and use is considered more sensitive (e.g. personal data about health, political beliefs, religious beliefs, or biometric data). We will only process this special category personal data when permitted by law or with your consent.

The lawful basis we rely on may differ depending on your location and the applicable data protection laws. If you have any questions about the lawful basis that applies to you, please contact us using the details below.

What happens if you do not provide personal data?

If we need to process your personal data to fulfil our legal obligations or execute a contract with you, and you do not provide the necessary information, we may be unable to enter into the contract or carry out your instruction. We will inform you if this situation arises.

Transfers to other countries

Your personal data may be transferred to and stored outside the country where you are located. This includes transfers to countries outside the European Economic Area (“EEA”) and to regions that may not have established laws that provide adequate protection for personal data. When your personal data is collected within the EEA, transfers outside the EEA will only be:

• to a recipient in a country which provides an adequate level of protection for your personal data; or
• under an agreement meeting EU requirements for transferring personal data to processors or controllers outside the EEA, such as standard contractual clauses approved by the European Commission.

Security

We follow internationally recognised standards for technology and operational security to safeguard personal data against loss, misuse, alteration and destruction. The data centres we use are aligned with ISO 27001 security standards or equivalent industry-recognised security frameworks, and only authorised personnel have access to personal data, all of whom are bound to maintaining confidentiality. We have established a comprehensive framework of policies and procedures addressing data protection, confidentiality and security, and we continuously review and enhance our security measures to ensure your data remains secure. 

How to contact us

Should you have any questions on how we process personal data, want to exercise your rights or have a complaint, please submit a request using the form linked here.

You may also contact us at the following postal address:

PricewaterhouseCoopers LLP
One Embankment Place
London
WC2N 6RH
UK  

Consent

By providing personal data to us, you acknowledge you have read this privacy statement and, to the extent your consent is necessary and valid under applicable law, you consent to the collection, use and disclosure of such personal data by the PwC network and any third party recipients in accordance with this privacy statement.