Recipients of the data

In order to fulfil the processing purposes listed below, data is also transferred to third parties. This may also include the transfer of personal data to European and non-European countries and the storage of data outside the EU or the European Economic Area (EEA).

Recipients bound by instructions

We share your data with service providers bound by instructions, both within the PwC network and with other third parties, such as IT service providers, who support us in our activities, e.g. as part of the administration and maintenance of the application and the related systems and/or for other internal or administrative purposes.

PwC is a member of the global PwC network, which consists of the individual legally independent PwC firms. In the course of our activities, we use other German or foreign PwC network companies as network-internal IT service providers bound by instructions who provide services for the operation, maintenance and upkeep of the IT systems and applications used by the PwC network companies. This is in particular PwC IT Services Ltd. based in the United Kingdom (UK).

If we pass on data to service providers bound by instructions, we do not require a separate legal basis for this.

Further information on the cloud service providers used by PwC can be found at the following link: www.pwc.de/externe-dienstleister

Independent recipients

In addition, we share your data in individual cases both within the PwC network and with other third parties who use your data under their own responsibility. Other third parties are, for example, authorities, courts or other bodies, if we are required by law or by official or court order of an EU member state to disclose personal data to these bodies. These bodies also use the data under their own responsibility.

Insofar as you have explicitly consented, Art. 6 para. 1 lit. a) GDPR is the legal basis for the data transfer. If there is a legal obligation to disclose the data, the legal basis for the data transfer is Art. 6 para. 1 lit. c) GDPR. If the disclosure is necessary for the fulfilment of a contractual or pre-contractual measure with you as a natural person, Art. 6 para. 1 lit. b) GDPR is the legal basis. Otherwise, the transfer is based on our legitimate interests and the legal basis is Art. 6 para. 1 lit. f) GDPR; we and the other companies of the PwC network have an interest in designing our work processes efficiently and dividing business processes within the PwC network.

Data transfer to recipients in third countries outside the EU/EEA

Insofar as any of the above-mentioned data transfers are made to a recipient outside the European Economic Area, an appropriate level of data protection for the international transfer is ensured by means of suitable security measures.

For data transfers within the PwC network, the PwC network companies have, among other things, concluded an internal data protection agreement which provides for compliance with the EU standard contractual clauses of the EU Commission within the meaning of Art. 46 para. 2 lit. c) GDPR for the transfer of personal data from EU/EEA states to PwC network companies outside the EU/EEA.

If you have any questions about such data protection agreements based on the EU standard contractual clauses or if you would like more information about additional security mechanisms and measures for data transfers to third countries, please feel free to contact our data protection officer, e.g. at DE_Datenschutz@pwc.com.