GDPR Compliance

The GDPR is the foundation of how we process personal data. Justparity is built with privacy by design, and we follow the principles of the Regulation in everything from architecture to day-to-day operations.

Privacy by design. Data protection is built in from the start. Our architecture is designed to minimise risk and protect personal data.

Data minimisation. We only collect the data necessary to deliver the service. Nothing more, nothing less.

Purpose limitation. Data is used only for the purposes for which it was collected. We never sell data to third parties.

Right to erasure. Data subjects have the right to have their personal data erased. We have processes in place to handle this efficiently.

Data portability. Data subjects can obtain a copy of their data in a structured, machine-readable format. Export is available directly in the platform.

Access control. Strict role-based access ensures that only authorised individuals can view personal data.

Below is an overview of the types of personal data we process in connection with pay transparency compliance.

User data

• Name and email of system users
• Role and permissions in the system
• Login history and activity log

Legal basis: Performance of a contract (Article 6(1)(b)).

Employee data

• Name and employee number
• Job title, department, manager
• Date of employment

Legal basis: Legal obligation (Article 6(1)(c)), where the customer as data controller is under a statutory duty to map pay. Which law creates that duty depends on where the customer is established: the national law implementing Directive (EU) 2023/970 where it is in force, and otherwise the equal pay legislation the country already has. For Just Parity ApS, established in Denmark, that law is the Danish Equal Pay Act.

Pay data and special categories

Pay data is processed as ordinary personal data (Article 6). However, the processing may include data falling within the special categories (Article 9):

• Trade union membership (may appear indirectly in payroll datasets)

Gender is the very criterion of the pay gap analysis. It does not appear in the list in Article 9(1), which is exhaustive, and is therefore ordinary personal data, processed under Article 6(1)(c) to meet the pay mapping duty in the customer's own national law and in Directive (EU) 2023/970. We nevertheless surround it with the same reinforced safeguards as Article 9 data.

Legal basis for Article 9 data: Article 9(2)(b), obligations in the field of employment law. That provision takes its content from Union or Member State law, so the operative rule is the one in force where the customer is established. For Just Parity ApS it is Sections 7(2) and 12 of the Danish Data Protection Act.

National identification numbers are not processed as Article 9 data. A payroll system may pass us a national identification number, such as a Danish CPR number or a Norwegian fødselsnummer, and it is used solely to derive gender. The number is not stored.

Gender and date of birth are stored in separate tables with additional safeguards. National identification numbers are not stored, but may be received transiently to derive gender.

We respect and facilitate all rights under the GDPR. We respond without undue delay and at the latest within one month of receiving the request (Article 12(3)). Where the request is complex, that deadline may be extended by up to two months, and you are told within the first month.

• Right of access (Article 15). Data subjects may request a copy of their personal data.
• Right to rectification (Article 16). Data subjects may have inaccurate personal data corrected.
• Right to erasure (Article 17). Data subjects may request the deletion of their data, unless legal requirements prevent this.
• Right to data portability (Article 20). Data subjects may receive their data in a machine-readable format.
• Right to restriction (Article 18). Data subjects may request the restriction of processing in certain situations.
• Right to object (Article 21). Data subjects may object to processing based on legitimate interest.
• Right to withdraw consent. Where processing is based on consent, it may be withdrawn at any time.

• Privacy Policy, how we process personal data on justparity.com and in the platform.
• Data Processing Agreement (DPA), standard contractual clauses pursuant to Article 28.
• Cookie Policy, which cookies we set and how to manage them.
• Terms and Conditions, terms governing the use of the platform.

Do you have questions about how we process personal data, or would you like to exercise your rights? Fill in the form below.