Privacy policy

1.Hosting

External hosting

This website and the Pay Transparency Assistant platform are hosted externally; both run in the cloud infrastructure of the same provider. The personal data collected in this context is stored on its servers. This may include, in particular, IP addresses, contact requests, meta and communication data, contract data, contact details, names and website accesses.

External hosting takes place for the purpose of fulfilling our contracts with potential and existing customers (Art. 6 (1) (b) GDPR) and in the interest of secure, fast and efficient provision of our online offering by a professional provider (Art. 6 (1) (f) GDPR). Where consent has been requested, processing takes place exclusively on the basis of Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. Consent may be withdrawn at any time.

The respective provider processes your data only to the extent necessary to fulfil its performance obligations and follows our instructions with regard to this data.

Website and platform (Microsoft Azure)

The website is provided as a static web application in the Azure infrastructure. The application itself — dashboard, interfaces, database, analysis and reporting components as well as the uploaded files — runs in the Azure region Germany West Central (Germany). This is also where the personnel and remuneration data of our customers processed during use is stored and analysed; backups are kept in the same region.

The static content of the website contains no personnel or remuneration data. For access from Germany, it is delivered via locations within the European Union. Where processing takes place outside the EU in individual cases, it is based on the Microsoft Data Protection Addendum including the standard contractual clauses contained therein.

The basis for the commissioned processing is the Microsoft Data Protection Addendum as part of the Product Terms. Further information can be found in the provider's privacy policy at privacy.microsoft.com/de-de/privacystatement.

Domain management and redirection

The domain pay-transparency-assistant.eu is registered with GoDaddy.com, LLC, 2155 E GoDaddy Way, Tempe, AZ 85284, USA. If you call up the domain without a subdomain, you are redirected to this website; in doing so, the registrar processes the technical connection data including your IP address. As this is a provider based in the USA, a transfer to a third country may take place; such transfers are based on the European Commission's standard contractual clauses pursuant to Art. 46 (2) (c) GDPR. Further information can be found in the provider's privacy policy at godaddy.com/de-de/legal/agreements/privacy-policy.

Commissioned processing

Data processing agreements pursuant to Art. 28 GDPR are in place with the providers named above. These ensure that the providers process personal data only in accordance with our instructions and in compliance with the GDPR.

2.General information and mandatory disclosures

Data protection

We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.

Please note that data transmission over the internet — for example when communicating by e-mail — can have security gaps. Complete protection of data against access by third parties is not possible.

Notice on the controller

The controller for data processing on this website is:

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

Storage period

Unless a more specific storage period is stated within this privacy policy, your personal data will remain with us until the purpose for processing it no longer applies. If you assert a justified request for erasure or withdraw your consent, your data will be deleted unless there are other legally permissible grounds for storing it — such as retention periods under tax or commercial law. In the latter case, deletion takes place once those grounds cease to apply.

Legal bases for data processing

Where you have consented to data processing, we process your personal data on the basis of Art. 6 (1) (a) GDPR, or Art. 9 (2) (a) GDPR where special categories of data pursuant to Art. 9 (1) GDPR are processed. If you have consented to the storage of cookies or to access to information on your device, processing additionally takes place on the basis of § 25 (1) TDDDG. Consent may be withdrawn at any time.

If your data is required for the performance of a contract or for pre-contractual measures, we process it on the basis of Art. 6 (1) (b) GDPR. If it is required to fulfil a legal obligation, on the basis of Art. 6 (1) (c) GDPR. Processing may furthermore take place on the basis of our legitimate interest pursuant to Art. 6 (1) (f) GDPR. The following sections provide information on the legal basis relevant in each individual case.

Recipients of personal data

In the course of our business activities we work with external parties. This sometimes requires the transfer of personal data. We only pass on personal data where this is necessary for the performance of a contract, where we are legally obliged to do so, where there is a legitimate interest pursuant to Art. 6 (1) (f) GDPR, or where another legal basis permits the transfer. Where processors are used, data is transferred exclusively on the basis of a valid data processing agreement.

Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You may withdraw consent already given at any time. The lawfulness of the data processing carried out until the withdrawal remains unaffected.

Right to object (Art. 21 GDPR)

Right to lodge a complaint with the supervisory authority

In the event of breaches of the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. This right exists without prejudice to any other administrative or judicial remedy.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done insofar as it is technically feasible.

Information, correction and erasure

Within the framework of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the data processing, and, where applicable, a right to correction or erasure of this data. You may contact us at any time in this regard.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. This right applies in the following cases:

• If you dispute the accuracy of the data we hold about you, we usually need time to verify this. For the duration of the review, you have the right to request restriction.
• If the processing of your data was or is unlawful, you may request restriction instead of erasure.
• If we no longer need your data but you require it to exercise, defend or establish legal claims, you may request restriction instead of erasure.
• If you have lodged an objection pursuant to Art. 21 (1) GDPR, a balance must be struck between your interests and ours. As long as it has not been determined whose interests prevail, you have the right to request restriction.

If you have restricted processing, this data may — apart from being stored — only be processed with your consent, or for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest.

SSL / TLS encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the browser address line changing from “http://” to “https://” and by the lock symbol in your browser bar. When encryption is active, the data you transmit to us cannot be read by third parties.

Objection to advertising e-mails

We hereby object to the use of contact data published as part of our legal notice obligations for the purpose of sending advertising and information material that has not been expressly requested. We expressly reserve the right to take legal action in the event of the unsolicited sending of advertising information.

3.Data collection on this website

Server log files

The provider of these pages automatically collects and stores information in server log files, which your browser automatically transmits to us:

• browser type and browser version
• operating system used
• referrer URL
• host name of the accessing computer
• time of the server request
• IP address

This data is not merged with other data sources. Collection takes place on the basis of Art. 6 (1) (f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of its website; the server log files must be recorded for this purpose.

Cookies

Our web pages use so-called cookies. Cookies are small data packets and do no harm to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are deleted automatically at the end of your visit. Persistent cookies remain stored until you delete them yourself or until your web browser deletes them automatically.

Cookies that are required to carry out the electronic communication process, to provide functions you have requested, or to optimise the website (necessary cookies) are stored on the basis of Art. 6 (1) (f) GDPR, unless another legal basis is specified. Where consent has been requested, processing takes place exclusively on the basis of that consent (Art. 6 (1) (a) GDPR and § 25 (1) TDDDG); consent may be withdrawn at any time.

You can set your browser to inform you about the setting of cookies, to allow cookies only in individual cases, to exclude their acceptance in general, and to activate the automatic deletion of cookies when the browser is closed. Disabling cookies may limit the functionality of this website.

Contact form

If you send us enquiries via the contact form, your details from the enquiry form, including the contact data you provide there, will be stored by us for the purpose of processing the enquiry and in case of follow-up questions. We do not pass on this data without your consent.

Processing takes place on the basis of Art. 6 (1) (b) GDPR where your enquiry is related to the performance of a contract or is necessary for pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6 (1) (f) GDPR) or on your consent (Art. 6 (1) (a) GDPR) where this has been requested.

The data you enter remains with us until you ask us to delete it, withdraw your consent, or the purpose for storing the data no longer applies. Mandatory statutory provisions, in particular retention periods, remain unaffected.

Enquiry by e-mail or telephone

If you contact us by e-mail or telephone, your enquiry including all personal data arising from it will be stored and processed by us for the purpose of handling your request. We do not pass on this data without your consent. The legal bases and storage period correspond to the details given for the contact form.

4.Use of the platform

User account and sign-in

A user account is required in order to use the Pay Transparency Assistant. For this purpose we process the data provided during registration (in particular name, business e-mail address, company, role) as well as log data about sign-ins and accesses. The legal basis is Art. 6 (1) (b) GDPR (performance of a contract) and Art. 6 (1) (f) GDPR for logging for security and evidentiary purposes.

Processing of uploaded HR data

In order to produce pay analyses and pay gap reports, we process the personnel and remuneration data uploaded by you as a customer. With regard to this data we act exclusively as a processor within the meaning of Art. 28 GDPR; your company, as the commissioning party, remains the controller in the data protection sense.

The basis for the processing is a data processing agreement that governs the purpose, scope, binding instructions, technical and organisational measures, sub-processing relationships and deletion periods. No processing for our own purposes takes place.

The specific details on storage location, retention and deletion periods, the sub-processors used and the procedure for returning and deleting data after the end of the contract are set out in the data processing agreement and the associated concept documents (security, deletion and authorisation concepts). We make these documents available to customers and prospective customers on request.

Technical and organisational measures

We protect the processed data through encryption in transit and at rest, role-based access controls, tenant separation, logging of data accesses, and regularly reviewed backup and recovery procedures. Further information can be found on our IT security and compliance page.

5.Plugins and tools

Google reCAPTCHA

We use “Google reCAPTCHA” on this website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA is used to check whether data entered on this website is entered by a human or by an automated program. To do so, reCAPTCHA analyses the behaviour of website visitors on the basis of various characteristics. This analysis begins automatically as soon as the visitor enters the website.

For the analysis, reCAPTCHA evaluates various pieces of information, including the IP address, the time spent on the website and mouse movements made by the user. The data collected is transmitted to Google. The analyses run entirely in the background; website visitors are not informed that an analysis is taking place.

Storage and analysis take place on the basis of Art. 6 (1) (f) GDPR. The website operator has a legitimate interest in protecting its web offerings against abusive automated spying and against SPAM. Where corresponding consent has been requested, processing takes place exclusively on the basis of Art. 6 (1) (a) GDPR and § 25 (1) TDDDG; consent may be withdrawn at any time. As a transfer to the USA cannot be ruled out, such transfers are additionally based on the European Commission's standard contractual clauses pursuant to Art. 46 (2) (c) GDPR.

Further information can be found in Google's privacy provisions at policies.google.com/privacy and at policies.google.com/terms.

Google Fonts

This site uses so-called Google Fonts, provided by Google, for the uniform display of typefaces. When you call up a page, your browser loads the required fonts into its cache in order to display texts and typefaces correctly. To do this, your browser must establish a connection to Google's servers. This means Google becomes aware that this website was accessed via your IP address.

Use takes place on the basis of Art. 6 (1) (f) GDPR; we have a legitimate interest in the uniform presentation of typography. Where consent has been requested, processing takes place exclusively on the basis of Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. Further information can be found at developers.google.com/fonts/faq and in Google's privacy policy at policies.google.com/privacy.

6.Social media

Our social media profiles

We maintain publicly accessible profiles on social networks in order to ensure a comprehensive presence on the internet. This privacy policy applies to the following profiles: profile URLs.

If you are logged into your social media account and visit our presence, the operator of the portal may associate that visit with your user account. Under certain circumstances your personal data may also be collected if you are not logged in or do not have an account — for example via cookies or by recording your IP address. With the help of this data, the operators can create user profiles and display interest-based advertising.

The legal basis is Art. 6 (1) (f) GDPR. The analysis processes initiated by the networks may be based on different legal bases, which must be stated by the respective operators.

When you visit one of our social media profiles, we are jointly responsible with the platform operator for the data processing operations triggered in the process. In principle, you can assert your rights to information, correction, erasure, restriction of processing, data portability and complaint both against us and against the platform operator. We would point out that, despite this joint responsibility, we do not have full influence over the platforms' data processing operations.

LinkedIn

We have a profile on LinkedIn. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. For details on how your personal data is handled, please refer to LinkedIn's privacy policy at linkedin.com/legal/privacy-policy. If you wish to deactivate LinkedIn advertising cookies, please use this link.

XING

We have a profile on XING. The provider is New Work SE, Am Strandkai 1, 20457 Hamburg, Germany. For details on how your personal data is handled, please refer to XING's privacy policy at privacy.xing.com/de/datenschutzerklaerung.