-
Pseudonymised data
Employees are identified only by your internal ID. We do not process names, national ID numbers or contact details.
-
Data minimisation
Every data point we process has a documented purpose. We do not take in data the calculation does not require.
-
Pay data in the EU
The application and database run in Frankfurt (AWS eu-central-1), and backups are also kept in the EU.
-
Your data, under your control
Export is available at any time. When the contract ends, we delete the data, including backups.
What data we process and why
About your employees
| Required | Recommended | Not needed |
|---|---|---|
| Internal employee ID | Gender | First and last name |
| Job title | Variable pay | National ID number, date of birth |
| Base pay | Benefits | Address, email, phone |
| Working hours (FTE) | Pay validity dates | Bank account number |
| Start and leave dates | Performance ratings | |
| Currency | Health data, reasons for absence |
We receive data as an export from your HRIS or payroll system (XLSX or CSV). We do not require direct access to your systems. You decide the scope of any data beyond the required fields.
What each data point is used for
| Data | Purpose |
|---|---|
| Employee ID | Links pay to a role and allows changes to be tracked over time without knowing the employee’s identity. |
| Job title | Assignment to a pay grade and range. |
| Pay and FTE | Converts pay to full-time equivalent and compares it with the role’s range. |
| Gender | Gender pay gap analysis under the EU Pay Transparency Directive (EU) 2023/970. The analysis cannot be performed without it. Other outputs do not require it. |
| Variable pay and benefits | Total reward calculation, not just base pay. |
| Pay validity, start and leave dates | Reports as of a set date, excluding employees who had left by that date. |
About your company and app users
Company data: roles, areas, seniority levels, competencies, pay grades and ranges. This is not personal data, but we handle it as confidential information.
App users: for users from your organisation (usually HR and leadership), we process their name, work email and sign-in data for access control purposes. Only users you grant access to can access the data, and only their own organisation’s data. At paHRity, access is limited to a small number of designated staff, and only to the extent necessary for data processing and support.
Who is responsible for the data
For the pay and other employee data you pass to us for processing, you are the controller under GDPR and paHRity acts as the processor. We process the data only on your instructions and for the purpose of providing the service. We do not sell it or use it for our own purposes. We make it available to subprocessors only to the extent necessary to run the service.
The contract includes a data processing agreement. We will send you its full text and the current list of subprocessors on request.
Service operator: FlexiHR s.r.o., Company ID 22119582, registered office at Družstevní ochoz 1251/48, Nusle, 140 00 Prague 4, Czech Republic, registered in the Commercial Register maintained by the Municipal Court in Prague.
EU data residency
The application, the database and the backups are all in the EU. The application and database run in a data centre in Frankfurt (AWS eu-central-1, operated through Netlify). Encrypted backups are stored in Cloudflare R2 in the EU.
| Subprocessor | Purpose | Certification | Where |
|---|---|---|---|
| Netlify | Application and database hosting | ISO/IEC 27001 and 27018, SOC 2 Type II | EU (Frankfurt) |
| Cloudflare R2 | Encrypted database backups | ISO/IEC 27001 and 27018, SOC 2 Type II | EU |
| Clerk | User sign-in | SOC 2 Type II | USA |
Transfers outside the EU: employee data stays in the EU. Only app users’ names and work emails are transferred to the US, for authentication through Clerk. Clerk is certified under the EU–US Data Privacy Framework, and its data processing agreement includes Standard Contractual Clauses in case the framework is invalidated. Netlify and Cloudflare are headquartered in the US, and their data processing agreements rely on the same safeguards.
We inform you in advance of any intended addition or replacement of a subprocessor.
How we protect the data
- Encryption: all traffic is encrypted with TLS, and the database rejects unencrypted connections. Data at rest is encrypted at the infrastructure level.
- Authentication and authorisation: authentication is handled by Clerk. Multi-factor authentication (MFA) can be enforced for your organisation. Every API request is authorised server-side against a verified session token.
- Tenant isolation: each company has its own schema in the database. Data from different clients never shares tables.
- Small-group protection: the output flags any comparison with fewer than 5 women or 5 men as a re-identification risk, because an individual’s pay could be inferred from it. The same applies to responses to employees’ pay information requests.
- Audit trail: data changes made through the API are written to an audit log: who made the change, when, which record it affects, and its state before and after.
- Backups: the database can be restored to any point in time within the retention period (point-in-time recovery). In addition, an independent encrypted backup outside the main platform is created daily, with 14-day retention.
- Website security: Content Security Policy, HSTS and other HTTP security headers. A vulnerability reporting contact is published in security.txt.
- Artificial intelligence: we do not pass employee data to AI service providers or use it to train models.
Security incident: we notify you of any incident affecting your data without undue delay, usually within 48 hours of discovery. The notification includes a description of the incident, the categories of data affected and the measures taken. If the incident is notifiable under GDPR, as the controller you must report it to the supervisory authority, as a rule within 72 hours of becoming aware of it.
How long we keep the data
- During the contract: for the term of the contract, so changes can be tracked over time.
- After the contract ends: we export the data on request. We delete it from the app within 30 days and from backups no later than 14 days after that, once their retention expires.
- Any time on request: we delete selected data, or all of your organisation’s data, even during the contract.