Privacy Policy

Just Parity ApS is the data controller for the processing of personal data relating to visitors to justparity.com, contact persons at our customers, and platform users (HR staff and managers).

For the pay and HR data that customers upload to the platform, Just Parity ApS acts as a data processor. In these cases, the data controller is the customer's organisation, and requests concerning employee data should be directed there.

Data Protection Officer (DPO): Just Parity ApS has not currently appointed a DPO, as the scope of our processing does not presently trigger the obligation under Article 37 GDPR. Questions concerning data protection should be directed to contact@justparity.com.

We process personal data for the following purposes:

• delivery of the Justparity compliance platform
• customer support and communication
• invoicing and accounting
• operation, maintenance and improvement of the service
• marketing (only with consent)
• compliance with legal requirements
• sending proposals in B2B relationships, including measuring whether the recipient has opened the email (read receipt via a 1x1 pixel image)

We process the following categories of personal data:

• Contact details: name, email, phone number, company, job title
• Usage data: log data, IP address, browser information, device information
• Customer data (as data processor): pay and HR data uploaded to the platform by customers

Pay data and special categories. Pay data is processed as ordinary personal data (Article 6). However, the processing may include data falling within the special categories (Article 9):

• trade union membership, which may appear indirectly in imported payroll datasets (Article 9(2)(b))

Gender is the very criterion of the pay gap analysis. It does not appear in the list in Article 9(1), which is exhaustive, and is therefore ordinary personal data, processed under Article 6(1)(c) to meet the pay mapping duty in the customer's own national law and in EU Directive 2023/970. We nevertheless surround it with the same reinforced safeguards as Article 9 data.

National identification numbers may be received transiently from connected payroll systems (for example Intect) and used solely to derive gender for the pay gap analysis, from the digit that encodes it. The number is not stored in Justparity's database (only gender and date of birth are stored). The data controller is responsible for the legal basis for the transfer.

These data are stored in separate tables with additional safeguards and strict access control.

We process personal data on the following legal bases:

• Performance of a contract (Article 6(1)(b)): to deliver our services and fulfil the agreement
• Legal obligation (Article 6(1)(c)): accounting, bookkeeping, tax reporting and compliance with EU Directive 2023/970
• Legitimate interest (Article 6(1)(f)): operations, security, prevention of misuse, product improvement, and measuring whether a recipient has opened a B2B proposal we have sent (read receipt). We have assessed that the recipient's expectation of this measurement is reasonable in the context of an ongoing business dialogue, and that the intrusion is minimal (we record the time of opening, IP address and browser type). You may object to this processing at any time by contacting us at contact@justparity.com.
• Consent (Article 6(1)(a)): marketing, newsletters and non-essential cookies

Gender (Article 6(1)(c)): the processing of gender data for pay gap analysis is carried out as part of compliance with employment law obligations: the pay mapping duty in the data controller's own national law, and the EU Pay Transparency Directive where it is in force. Gender is not among the categories listed exhaustively in Article 9(1) and is therefore ordinary personal data.

Special categories (Article 9(2)(b)): the processing of trade union membership, where it appears indirectly in payroll datasets, is carried out as part of compliance with the employment law obligations in force where the data controller is established.

National identification numbers: not processed as Article 9 data. A national identification number may be received transiently from a payroll system and used solely to derive gender, from the digit that encodes it. The number is not stored. The data controller is responsible for the legal basis for any transfer.

We may share personal data with:

Sub-processors:

Public authorities: where required by law.

Transfers to third countries outside the EU/EEA only take place where appropriate safeguards are in place, typically the EU Standard Contractual Clauses (SCCs) pursuant to Article 46(2)(c) GDPR. Where a sub-processor's parent company has potential access from the United States, SCCs have been entered into.

Consent-based marketing tools: Google Analytics and Google Ads (statistics and ad measurement), Meta Pixel (Meta Platforms Ireland Ltd., ad measurement) and LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company, ad measurement) are used only with your consent and are not sub-processors of the platform's personal data. Data may be transferred to the USA on the basis of the EU-US Data Privacy Framework and standard contractual clauses (SCCs). The individual cookies, their purposes and their durations are set out in our cookie policy, where you can also change or withdraw your consent.

Rate limiting: Protection against overload takes place in the platform's own memory and involves no external provider.

We retain personal data for as long as necessary for the purposes for which it was collected:

• Customer data in the platform: deleted no later than 30 days after termination of the agreement
• Contact details: 3 years after the end of the customer relationship, corresponding to the limitation period for contractual claims (Section 3 of the Danish Limitation Act)
• Accounting data: 5 years (Section 12 of the Danish Bookkeeping Act)
• Proposals and proposal audit data: 5 years from the end of the financial year to which the material relates, pursuant to Section 12(1) of the Danish Bookkeeping Act. Pseudonymised after this period (PII fields are replaced with a hash; the identifier and event timestamp are retained for audit purposes).
• Marketing data: until consent is withdrawn
• Log data: 90 days
• Read receipts on B2B proposals: time of opening, IP address and browser type are stored together with the proposal (5 years) pursuant to the Danish Bookkeeping Act and pseudonymised thereafter

As a data subject, you have the following rights under Chapter III of the GDPR:

• right of access (Article 15)
• right to rectification (Article 16)
• right to erasure, "the right to be forgotten" (Article 17)
• right to restriction of processing (Article 18)
• right to notification regarding rectification or erasure (Article 19)
• right to data portability (Article 20)
• right to object (Article 21)
• right not to be subject to automated decision-making (Article 22)
• right to withdraw consent (Article 7(3)). Withdrawal does not affect the lawfulness of processing carried out on the basis of the consent before it was withdrawn

For data in respect of which Justparity is a data processor (employee data uploaded to the platform), requests must be directed to the data controller, i.e. the organisation that uploaded the data. For other data (contact details, user data), rights may be exercised by contacting contact@justparity.com. We respond to requests without undue delay and no later than one month after receipt. Where the request is complex, the deadline may be extended by up to two months, in which case you will be informed within the first month.

We have implemented appropriate technical and organisational measures to protect personal data, including:

• encryption of data in transit (TLS 1.3) and at rest (AES-256)
• role-based access control (RBAC) and multi-factor authentication
• logging and monitoring of access to personal data
• ongoing vulnerability scanning and security updates
• backup, recovery and incident response procedures
• confidentiality undertakings and periodic security training for staff

Detailed security measures are set out in our data processing agreement (/data-processing-agreement).

You may lodge a complaint with the supervisory authority in the EU or EEA country where you live, where you work, or where you believe the infringement took place (Article 77 GDPR). That authority is normally the fastest route, because it works in your own language.

Just Parity ApS is established in Denmark, so the Danish Data Protection Agency is our lead supervisory authority under Article 56. Your own authority will take the case up with it through the cooperation procedure, and you can also write to it directly:

The first part of this section concerns personal data we did not obtain from you. It applies to contact persons at companies we are considering approaching as prospective customers, whom we may never have spoken to. The data is held in our internal sales system, not in the platform.

Where the data comes from (Article 14(2)(f)): the companies' own publicly available web pages, where employees are listed by name, job title and work contact details. The extraction is automated. The companies themselves we find in the Danish Central Business Register (CVR); CVR is not the source of the data about individual people.

Categories of data: name, job title, work email address, work telephone number and employer. We do not collect special categories of personal data under Article 9, and no national identification numbers, for this purpose.

Purposes and legal basis: to assess whether the company might benefit from our product, and to be able to approach the right employee. The legal basis is Article 6(1)(f), our legitimate interest in marketing a service to other businesses. We have balanced that interest against the interests of the individual, and the data is confined to the professional role.

No automated decision-making: we take no decisions about an individual based solely on automated processing, and we do not profile people. Any prioritisation we carry out concerns the company.

Recipients: none beyond the processors that operate our own systems, see section 5. The data is not sold and is not disclosed to third parties for marketing.

How long we keep it: a contact is deleted no later than 12 months after the data was collected, if there has been no contact between us and the person or the company during that period. Where there has been contact, the periods in section 6 apply.

Your rights, and in particular the right to object: you have the right of access (Article 15), rectification (Article 16), erasure (Article 17) and restriction (Article 18). Because the processing rests on a legitimate interest, you also have the right to object under Article 21. Where you object to processing for direct marketing, we will stop. No reason is required, and no particular wording. Write to contact@justparity.com and we will delete the data about you.

Why you are reading this rather than having been notified: Article 14(5)(b) allows a controller to refrain from notifying each individual where doing so would involve a disproportionate effort, and requires in return that the information be made publicly available. That is what this page does. We have chosen not to approach people who never asked to hear from us, precisely so as not to turn a duty to inform into an approach.

Contact persons at prospective partners

We write to providers of payroll and HR systems so that we can fetch data from their systems on our customers' behalf. The first email goes only to a shared address that the provider has published itself, never to a named person. We only obtain data about you when you or a colleague replies or forwards our email.

Purpose: to gain access to the provider's API, partner programme or test environment, and to conduct the dialogue about an integration.

Categories of data: name, work email address, job title or role, employer, a work telephone number if you give it to us, and our correspondence with you, including whether you have replied or said no thanks.

Where the data comes from: the shared address is on the provider's own publicly available website (Article 14(2)(f)). Everything else comes from you or your colleagues when you write to us. If you reply to our email yourself, we obtain the data from you, and Article 13 applies. If a colleague forwards our email to you or names you in a reply, we obtain it from that colleague and not from you, and Article 14 applies.

You are under no obligation to reply: replying to us or giving us any data is neither a statutory nor a contractual requirement, and there are no consequences for you if you do not (Article 13(2)(e)).

Legal basis: Article 6(1)(f), our legitimate interest in being able to fetch our customers' own payroll and HR data from the systems they use. That interest outweighs yours because we only process data about your professional role, only write to an address the provider has published itself, and because you can opt out at any time.

Recipients: none beyond the processors that operate our own systems, see section 5.

How long we keep it: 12 months after the most recent correspondence, if we do not enter into a partnership. If we do, we keep the contact details for as long as it lasts and for 3 years afterwards, the same period as for contact details in section 6. If you say no thanks, we keep only the shared address we wrote to and the date, so that we do not write to that address again.

Your right to object (Article 21): you may object at any time. Reply "no thanks" to our email, or write to integrations@justparity.com or contact@justparity.com. We will then stop the processing, not write again, and delete the data about you, except the shared address and the date. You also have the right of access, rectification, erasure and restriction (Articles 15 to 18).

Why you received an email: here we write to you directly, so the exemption in Article 14(5)(b) does not apply. Every email from us links to this page, so you have the information no later than the first email you receive from us (Articles 13(1) and 14(3)(b)).

If you are not satisfied with how we handle your data, you may complain to a supervisory authority, see section 9.

We reserve the right to update this privacy policy. In the event of material changes, data subjects will be informed by email or upon logging in to the platform. The latest version is always available on this page.