Data processing agreement (DPA)

The client acts as controller (Art. 4(7) GDPR) for the personal data of its employees and candidates; Egalis acts as processor (Art. 4(8)). Subject matter of the processing: providing the pay transparency compliance platform — import, calculations, job evaluation, reporting, information requests, remediation.

• Data subjects: the client’s employees and, in the recruitment module, its candidates.
• Categories of data: internal identifier (the payroll ID), sex, job title, occupation code (e.g. ISCO-08), department, hire date, working-time fraction, remuneration elements, leave events, pay changes; optionally the name (stored separately, encrypted); the contact email for information requests. No national identification numbers are processed and no special category of data enters the calculation data.
• Duration: for the term of the contract, plus the legal retention of reports required by the Directive and the applicable national law, unless the controller instructs otherwise.

• Processes the data only on the controller’s documented instructions (use of the application constitutes an instruction).
• Ensures the confidentiality of the persons authorised to process the data.
• Applies technical and organisational measures (Art. 32): EU-only hosting, pseudonymisation by design, encryption of nominal identities, role-based access control, an immutable audit log.
• Engages no new sub-processors without prior information to the controller (Annex 1), with a 15-day right to object.
• Supports the controller with data subjects’ requests and with impact assessments.
• Notifies the controller without undue delay, and within 72 hours at the latest, of any personal data breach it becomes aware of.
• On termination: returns the data (full export, structured format) and permanently deletes it, except for the audit log (legal evidence, without salary data) and legal retention obligations.
• Makes available the information necessary to demonstrate compliance and allows audits, with reasonable notice.

The data is processed and stored exclusively in the European Union. No transfers to third countries take place.

The client authorisesEgalis to compute, from the data processed on its behalf, irreversibly anonymised statistical aggregates and to use them, including publicly, for pay-related market statistics (for example the „pay gap barometer”). The computation is carried out as a processor, on the basis of this documented instruction; the result, being anonymous (GDPR Recital 26), is no longer personal data. To the extent this step were qualified as Egalis’s own purpose, the legal basis is legitimate interest (Art. 6(1)(f)) and the balancing test is made available on request.

• Off by default. Aggregation only takes place after the client switches it on explicitly in the application; the activation and its withdrawal are recorded in the audit log, with author and timestamp.
• Publication thresholds.No published figure comes from a cell with fewer than 5 employees or fewer than 5 companies, nor from a cell where a single company contributes more than 40 % of the observations. Figures are published rounded, without extremes.
• Never published or shared.Individual data, the client’s identity, named comparisons between companies, or non-aggregated data sets to third parties. The aggregates are not sold as a data product.
• Withdrawal. The client may switch it off at any time, with effect on future editions; editions already published, being anonymous, cannot be withdrawn.
• Informing employees. The client, as controller, includes the mention in its own privacy notice; Egalis provides a model paragraph.

• Hetzner Online GmbH, Germany — hosting infrastructure.
• Transactional email: our own server, hosted in the EU — there is no third-party email provider.
• Stripe Payments Europe, Ltd., Ireland — card payment processing (billing data only; payroll data never reaches Stripe).

Egalis: ADDO VISION SOLUTIONS SRL, registered office: Bucharest, Șos. Berceni 96, Monaco Towers, A9.06, Romania, trade register no. J2013010973404, EUID ROONRC.J2013010973404, VAT RO32203240 (contact: office@addovision.ro). The client: the entity identified in the service contract. The DPA forms an integral part of the contract. See also the privacy policy.