GDPR
Last updated: 8 July 2026
If you become a client of Equal Pay Monitor, you supply us with pay data on your employees for analysis. This page explains how we handle that under the General Data Protection Regulation (GDPR).
1. Our role: processor, not controller
For the pay data you supply, we act as a processor under Article 28 GDPR. Your organisation remains the data controller. We process the data only on your instructions, as set out in a data processing agreement per engagement.
2. Purpose limitation
Pay data we receive is used only for the purpose you supplied it for: the pay gap analysis and resulting report. This aligns with Article 10f of the Dutch pay transparency implementation act, which limits use of this data to the purpose of equal pay. We do not use this data for any other purpose, and do not sell it to third parties.
3. Storage location
Pay data you supply is stored within the European Economic Area (EEA).
4. Retention
We retain pay data no longer than necessary to complete the analysis and deliver the report. Raw source data is deleted after the engagement is completed, unless you ask us to retain it longer (for example for a follow-up measurement). Exact terms are set per engagement.
5. Who has access
Only Equal Pay Monitor / The Inclusion Studio staff directly involved in your analysis have access to your pay data.
6. Sub-processors
For the website and general operations we use Vercel Inc. (hosting) and Web3Forms (contact form). Any sub-processors used for the actual pay data analysis are explicitly named in the data processing agreement per engagement.
7. Data processing agreement
A data processing agreement (DPA) is available and is entered into as standard before you supply us with pay data. Contact info@equalpaymonitor.nl to request one.
8. Security
We take appropriate technical and organisational measures (GDPR Article 32), including encrypted data transfer and role-based access restrictions.
9. Data subject rights
Requests from your employees about their own data (access, erasure, etc.) go through you as the data controller. We support you within the terms of the data processing agreement.