Data processing agreement (DPA)

The client acts as controller (Art. 4(7) GDPR) for the personal data of its employees and candidates; Egalis acts as processor (Art. 4(8)). Subject matter of the processing: providing the pay transparency compliance platform — import, calculations, job evaluation, reporting, information requests, remediation.

• Data subjects: the client’s employees and, in the recruitment module, its candidates.
• Categories of data: internal identifier (the payroll ID), sex, job title, occupation code (e.g. ISCO-08), department, hire date, working-time fraction, remuneration elements, leave events, pay changes; optionally the name (stored separately, encrypted); the contact email for information requests. No national identification numbers are processed and no special category of data enters the calculation data.
• Duration: for the term of the contract, plus the legal retention of reports required by the Directive and the applicable national law, unless the controller instructs otherwise.

• Processes the data only on the controller’s documented instructions (use of the application constitutes an instruction).
• Ensures the confidentiality of the persons authorised to process the data.
• Applies technical and organisational measures (Art. 32): EU-only hosting, pseudonymisation by design, encryption of nominal identities, role-based access control, an immutable audit log.
• Engages no new sub-processors without prior information to the controller (Annex 1), with a 15-day right to object.
• Supports the controller with data subjects’ requests and with impact assessments.
• Notifies the controller without undue delay, and within 72 hours at the latest, of any personal data breach it becomes aware of.
• On termination: returns the data (full export, structured format) and permanently deletes it, except for the audit log (legal evidence, without salary data) and legal retention obligations.
• Makes available the information necessary to demonstrate compliance and allows audits, with reasonable notice.

The data is processed and stored exclusively in the European Union. No transfers to third countries take place.

• Hetzner Online GmbH, Germany — hosting infrastructure.
• Transactional email: our own server, hosted in the EU — there is no third-party email provider.
• Stripe Payments Europe, Ltd., Ireland — card payment processing (billing data only; payroll data never reaches Stripe).

Egalis: ADDO VISION SOLUTIONS SRL, registered office: Bucharest, Șos. Berceni 96, Monaco Towers, A9.06, Romania, trade register no. J2013010973404, EUID ROONRC.J2013010973404, VAT RO32203240 (contact: office@addovision.ro). The client: the entity identified in the service contract. The DPA forms an integral part of the contract. See also the privacy policy.