Privacy policy

1.Hosting and technical delivery

External hosting

This website is hosted externally. The personal data collected in this context is stored on the provider's servers. This may include, in particular, IP addresses, contact requests, metadata and communication data, contract data, contact details, names and website access data.

External hosting is carried out for the purpose of fulfilling contracts with our potential and existing customers (Art. 6(1)(b) GDPR) and in the interest of a secure, fast and efficient provision of our online services by a professional provider (Art. 6(1)(f) GDPR).

The provider processes your data only to the extent necessary to fulfil its service obligations and follows our instructions regarding this data.

Provider (Microsoft Azure)

Public landing website

Our public landing website is hosted using Microsoft Azure Static Web Apps. We use Azure DNS for domain name resolution and Azure Front Door for secure and reliable delivery of content and redirection between our domains.

Azure Front Door and Azure Static Web Apps operate through a globally distributed network. On each request, Microsoft processes technical connection and request data, including IP addresses, requested URLs and request times. This data may also be processed outside the EU/EEA, subject to the safeguards described below.

Data processing agreement and international transfers

Processing by Microsoft on our behalf is governed by the Microsoft Products and Services Data Protection Addendum (DPA). Where personal data is transferred outside the EU/EEA, the applicable transfer safeguards are those specified in that agreement, including the European Commission's standard contractual clauses where applicable.

Further information is available in the Microsoft Data Protection Addendum and the Microsoft Privacy Statement at privacy.microsoft.com/en-gb/privacystatement.

2.General information and mandatory disclosures

Data protection

We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.

Please note that data transmission over the internet — for example when communicating by e-mail — can have security gaps. Complete protection of data against access by third parties is not possible.

Notice on the controller

The controller for data processing on this website is:

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

Storage period

Unless a more specific storage period is stated within this privacy policy, your personal data will remain with us until the purpose for processing it no longer applies. If you assert a justified request for erasure or withdraw your consent, your data will be deleted unless there are other legally permissible grounds for storing it — such as retention periods under tax or commercial law. In the latter case, deletion takes place once those grounds cease to apply.

Legal bases for data processing

Where you have consented to data processing, we process your personal data on the basis of Art. 6 (1) (a) GDPR, or Art. 9 (2) (a) GDPR where special categories of data pursuant to Art. 9 (1) GDPR are processed. If you have consented to the storage of cookies or to access to information on your device, processing additionally takes place on the basis of § 25 (1) TDDDG. Consent may be withdrawn at any time.

If your data is required for the performance of a contract or for pre-contractual measures, we process it on the basis of Art. 6 (1) (b) GDPR. If it is required to fulfil a legal obligation, on the basis of Art. 6 (1) (c) GDPR. Processing may furthermore take place on the basis of our legitimate interest pursuant to Art. 6 (1) (f) GDPR. The following sections provide information on the legal basis relevant in each individual case.

Recipients of personal data

In the course of our business activities we work with external parties. This sometimes requires the transfer of personal data. We only pass on personal data where this is necessary for the performance of a contract, where we are legally obliged to do so, where there is a legitimate interest pursuant to Art. 6 (1) (f) GDPR, or where another legal basis permits the transfer. Where processors are used, data is transferred exclusively on the basis of a valid data processing agreement.

Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You may withdraw consent already given at any time. The lawfulness of the data processing carried out until the withdrawal remains unaffected.

Right to object (Art. 21 GDPR)

Right to lodge a complaint with the supervisory authority

In the event of breaches of the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. This right exists without prejudice to any other administrative or judicial remedy.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done insofar as it is technically feasible.

Information, correction and erasure

Within the framework of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the data processing, and, where applicable, a right to correction or erasure of this data. You may contact us at any time in this regard.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. This right applies in the following cases:

• If you dispute the accuracy of the data we hold about you, we usually need time to verify this. For the duration of the review, you have the right to request restriction.
• If the processing of your data was or is unlawful, you may request restriction instead of erasure.
• If we no longer need your data but you require it to exercise, defend or establish legal claims, you may request restriction instead of erasure.
• If you have lodged an objection pursuant to Art. 21 (1) GDPR, a balance must be struck between your interests and ours. As long as it has not been determined whose interests prevail, you have the right to request restriction.

If you have restricted processing, this data may — apart from being stored — only be processed with your consent, or for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest.

SSL / TLS encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the browser address line changing from “http://” to “https://” and by the lock symbol in your browser bar. When encryption is active, the data you transmit to us cannot be read by third parties.

Objection to advertising e-mails

We hereby object to the use of contact data published as part of our legal notice obligations for the purpose of sending advertising and information material that has not been expressly requested. We expressly reserve the right to take legal action in the event of the unsolicited sending of advertising information.

3.Data collection on this website

Server log files

When you visit our website, Azure Front Door (see Section 1) automatically logs the following information transmitted by your browser:

• IP address
• date and time of the request
• requested URL, HTTP method and status code
• referrer URL
• browser type, browser version and operating system (user agent)
• amount of data transferred

This data is not merged with other data sources. Collection takes place on the basis of Art. 6 (1) (f) GDPR. We have a legitimate interest in the technically error-free and secure provision of our website and in detecting and defending against attacks; the server log files must be recorded for this purpose.

The logs are stored in our Azure environment and automatically deleted after 30 days.

Cookies

Our web pages use so-called cookies. Cookies are small data packets and do no harm to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are deleted automatically at the end of your visit. Persistent cookies remain stored until you delete them yourself or until your web browser deletes them automatically.

Cookies that are required to carry out the electronic communication process, to provide functions you have requested, or to optimise the website (necessary cookies) are stored on the basis of Art. 6 (1) (f) GDPR, unless another legal basis is specified. Where consent has been requested, processing takes place exclusively on the basis of that consent (Art. 6 (1) (a) GDPR and § 25 (1) TDDDG); consent may be withdrawn at any time.

You can set your browser to inform you about the setting of cookies, to allow cookies only in individual cases, to exclude their acceptance in general, and to activate the automatic deletion of cookies when the browser is closed. Disabling cookies may limit the functionality of this website.

Contact form

If you send us enquiries via the contact form, your details from the enquiry form, including the contact data you provide there, will be stored by us for the purpose of processing the enquiry and in case of follow-up questions. We do not pass on this data without your consent.

Processing takes place on the basis of Art. 6 (1) (b) GDPR where your enquiry is related to the performance of a contract or is necessary for pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6 (1) (f) GDPR).

The data you enter remains with us until you ask us to delete it or the purpose for storing the data no longer applies, for example once we have finished handling your enquiry. Mandatory statutory provisions, in particular retention periods, remain unaffected.

Enquiry by e-mail or telephone

If you contact us by e-mail or telephone, your enquiry including all personal data arising from it will be stored and processed by us for the purpose of handling your request. We do not pass on this data without your consent. The legal bases and storage period correspond to the details given for the contact form.

"Pay Insights" newsletter

When you subscribe to our newsletter, we process your email address and the language you choose for the guide (German or English). We send the newsletter once a month. It contains expert articles on HR analytics and the EU Pay Transparency Directive. When you subscribe, you also receive the Pay Transparency Readiness Guide.

Subscription uses a double opt-in procedure. After you sign up, you receive an email asking you to confirm your subscription. Only then do we send you the newsletter. To document your consent, we store the time of sign-up and confirmation and your IP address at those times.

The legal basis is your consent (Art. 6(1)(a) GDPR). You may withdraw your consent at any time, in particular via the unsubscribe link in every newsletter email. The lawfulness of processing carried out before withdrawal remains unaffected.

We manage and send the newsletter ourselves through an internal administration area of our platform. Your subscription data is stored in our Azure infrastructure in the Germany West Central region (Germany); it is not shared with any external newsletter provider. The emails are delivered via Azure Communication Services, a service of Microsoft Ireland Operations Limited that stores its data in Germany. The data processing agreement and the safeguards for international transfers described in Section 1 apply.

We analyse whether a newsletter has been opened. For this purpose, each newsletter email contains a small tracking pixel that is retrieved from our server in Microsoft Azure when the email is opened. This involves processing the time of opening, your IP address and technical information about your email client. The analysis is carried out internally only and serves to improve our content. It is covered by your consent; withdrawing your consent also ends the measurement. If you disable image loading in your email client, no measurement takes place. The newsletter does not load any other content from third-party servers.

After you unsubscribe, we delete your email address from the mailing list. We retain proof of your consent for up to three years after unsubscribing in order to defend against legal claims (Art. 6(1)(f) GDPR). Your address may also be kept on a suppression list so that we do not contact you again.

4.Pay Transparency Assistant platform

The processing of personal data when using the Pay Transparency Assistant platform, in particular the personnel and remuneration data uploaded by customers, is not covered by this privacy policy. It is governed by the data processing agreement with the respective customer and the associated documents, which we make available to customers and prospective customers on request.

5.Website analytics and fonts

Website analytics with Umami

We use the analytics service Umami Cloud to understand how our website is used. The provider is Umami Software, Inc., 28 Geary St, Suite 650 #243, San Francisco, CA, USA. The analytics data is stored on Umami servers in the EU.

We have concluded a data processing agreement with Umami pursuant to Art. 28 GDPR. As Umami is based in the USA, access from the USA cannot be ruled out. Any transfer to third countries is based on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

Umami does not set cookies and does not track you across other websites. It records the pages visited, the referring page (referrer), browser, operating system, device type and country of origin. Visits are counted using an anonymous session identifier; anyone who switches device or browser appears as a new visitor. Your IP address is used only to determine the country and is not stored.

The legal basis is our legitimate interest in analysing and improving our website (Art. 6(1)(f) GDPR). The stored analytics data does not allow conclusions to be drawn about you as a person. It is retained for the duration of our contract with Umami; after the contract ends, Umami deletes it in accordance with the data processing agreement.

You can object to this data collection by disabling JavaScript in your browser or by using a tracking blocker. Further information about Umami is available at umami.is/docs.

Fonts

The fonts used on this website are served from our own server. No connection to Google or any other font provider is established when you visit the website.

6.Social media

Our social media profiles

We maintain publicly accessible profiles on social networks. This privacy policy applies to the following profiles:

• LinkedIn (company page): linkedin.com/company/fedeja-people-analytics
• LinkedIn: linkedin.com/in/julia-f-7b5b86b0
• XING: xing.com/profile/Julia_Fiodarava

If you are logged into your social media account and visit our presence, the operator of the portal may associate that visit with your user account. Under certain circumstances your personal data may also be collected if you are not logged in or do not have an account — for example via cookies or by recording your IP address. With the help of this data, the operators can create user profiles and display interest-based advertising.

The legal basis is Art. 6 (1) (f) GDPR. The analysis processes initiated by the networks may be based on different legal bases, which must be stated by the respective operators.

When you visit one of our social media profiles, we are jointly responsible with the platform operator for the data processing operations triggered in the process. In principle, you can assert your rights to information, correction, erasure, restriction of processing, data portability and complaint both against us and against the platform operator. We would point out that, despite this joint responsibility, we do not have full influence over the platforms' data processing operations.

LinkedIn

We have a profile on LinkedIn. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. For details on how your personal data is handled, please refer to LinkedIn's privacy policy at linkedin.com/legal/privacy-policy. If you wish to deactivate LinkedIn advertising cookies, please use this link.

XING

We have a profile on XING. The provider is New Work SE, Am Strandkai 1, 20457 Hamburg, Germany. For details on how your personal data is handled, please refer to XING's privacy policy at privacy.xing.com/de/datenschutzerklaerung.