Data Processing Agreement
Our Article 28 GDPR processor terms, published in full. Most vendors in this space make you sign an NDA and sit through a call before showing you this. Read it first, then decide whether to talk to us.
1. Role of the parties
This agreement applies where Parmetra processes personal data on behalf of a customer. The customer is the controller and Parmetra is the processor within the meaning of Art. 4 GDPR. It forms part of, and is governed by, the Terms of Service. Where the customer is itself a processor for a third party, Parmetra acts as sub-processor and the same terms apply.
2. Subject matter, duration, nature and purpose
Parmetra processes personal data to provide gender pay-gap analysis, job valuation, pay-range transparency and worker information-request handling under Directive (EU) 2023/970. Processing lasts for the term of the subscription and the deletion periods that follow it.
3. Categories of data subject and personal data
Data subjects: the customer's employees, workers and job applicants, and the customer's own administrative users. Personal data: names, work email addresses, salary and complementary pay, working time and FTE ratio, job category and valuation scores, gender, employment start and end dates, salary history, and pay-information requests and their responses.
4. Processing on documented instructions
Parmetra processes personal data only on the customer's documented instructions, including as to international transfers, unless required otherwise by Union or member-state law, in which case Parmetra informs the customer before processing, unless that law prohibits it. The Terms of Service, this agreement and the customer's use of the product's features constitute the complete documented instructions.
5. Confidentiality
Parmetra ensures that persons authorised to process personal data are bound by an appropriate obligation of confidentiality and that access is limited to those who need it to provide the service.
6. Security measures (Art. 32)
Encryption in transit and at rest; per-organisation scoping enforced on every query; server-side role separation; AES-256-GCM sealing of third-party credentials; an immutable audit log of changes to employee data, reports and assessments; automated stripping of personal data from error-monitoring events; and screen-recording disabled on production. Measures are reviewed as the service changes and may be updated provided the level of protection is not reduced.
7. Sub-processors
The customer gives general written authorisation to the sub-processors described in the privacy policy, which identifies each by function. Parmetra maintains an itemised list naming the legal entity behind each function, and provides it to the customer in full and free of charge on request through our contact form; that named list forms part of this agreement's documentation and is what the authorisation in this section attaches to. Parmetra gives at least 30 days' notice before adding or replacing a sub-processor. The customer may object on reasonable data-protection grounds; if the objection cannot be resolved, the customer may terminate the affected part of the service without penalty. Each sub-processor is bound by data-protection obligations equivalent to these, and Parmetra remains fully liable for its sub-processors' performance.
| Provider | Purpose | Location | Transfer basis |
|---|---|---|---|
| Database hosting | Primary application database: all workforce and organisation records | Frankfurt, Germany (EU) | N/A: data remains in the EEA |
| Application hosting and content delivery | Runs the application and serves it to your browser | Frankfurt region (EU); provider established in the United States | EU Standard Contractual Clauses |
| Authentication provider | Sign-in, user accounts and organisation membership | United States | EU-U.S. Data Privacy Framework |
| Payment processor | Subscription billing, payment processing and EU VAT determination | Ireland (EU), with onward processing in the United States | EU Standard Contractual Clauses / EU-U.S. Data Privacy Framework |
| Error and performance monitoring | Diagnosing faults in the running application | Germany (EU): the provider's EU-region ingest endpoint | N/A: data remains in the EEA |
| Transactional email delivery | Sending account, reminder and information-request notifications | EU sending region; provider account data and message metadata in the United States | EU Standard Contractual Clauses |
| AI drafting assistance (optional) | Drafts a suggested score for each job-evaluation criterion from a position title. Active only where an organisation has switched the optional assist on; every score is decided by a person. | United States | EU Standard Contractual Clauses / EU-U.S. Data Privacy Framework |
8. Assistance with data subject rights
Taking into account the nature of the processing, Parmetra assists the customer by appropriate technical and organisational measures in fulfilling requests to exercise data subject rights. Where a data subject contacts Parmetra directly, Parmetra forwards the request to the customer without undue delay and does not respond substantively itself.
9. Assistance with Arts. 32-36
Parmetra assists the customer in ensuring compliance with the security, breach-notification and data-protection-impact-assessment obligations in Arts. 32 to 36, taking into account the nature of processing and the information available to it. Breach notification to the customer is made without undue delay after Parmetra becomes aware.
10. Deletion or return
On termination the customer may export its data through the product. Parmetra deletes or returns workforce data within 30 days of termination and purges residual backup copies within a further 90 days, save where Union or member-state law requires longer storage.
11. Audits and information
Parmetra makes available the information necessary to demonstrate compliance with Art. 28 and allows for and contributes to audits, including inspections, conducted by the customer or an auditor it mandates. Audits are limited to once in any twelve-month period unless a breach or a supervisory authority requires otherwise, are arranged with reasonable notice, and are subject to confidentiality.
12. International transfers
Workforce data is stored in the European Union. Where a sub-processor is established outside the EEA, transfers rely on the EU Standard Contractual Clauses or an adequacy decision as stated in the sub-processor table, together with any supplementary measures required by the transfer-impact assessment. The named entity relied on for each transfer is given in the itemised list available on request through our contact form.
13. Order of precedence
In the event of conflict, this agreement prevails over the Terms of Service in respect of the processing of personal data. The English text is the authoritative version.
This document is published in English, which is the authoritative version. Translations may be provided for convenience; in the event of any discrepancy, the English text prevails.
Need this countersigned, or running a vendor security review? Get in touch through our contact form. The categories of data and the rights behind these terms are described in the Privacy Policy.