Privacy Policy

Calbarry (“Calbarry”, “we”, “us”) operates a software-as-a-service platform for EU Pay Transparency Directive (2023/970) compliance. The legal entity operating the service is identified in the signed agreement with each customer.

For questions about this policy, the processing of your personal data, or to exercise your rights, contact us at /contact.

This policy describes how we handle personal data we collect directly — in particular, data about visitors to our website, prospects who contact us, and the authorised users of customer organisations.

When we process personal data on behalf of a customer organisation — for example, the salary and employee records uploaded to compute a pay-equity report — we act as a processor. That processing is governed by the Data Processing Agreement (DPA) signed between Calbarry and the customer, not by this policy.

From website visitors

• Standard request metadata: IP address, user agent, request timestamp, referrer. Used for security monitoring and to generate aggregate, non-identifying traffic statistics.
• A request-id stamped on every server-side log line. Not derived from personal data; used only for correlating logs during debugging.
• Only if you accept analytics cookies on our public pages (the home page, Methodology, Security, Contact, and these legal pages): usage data collected by Google Analytics — pages viewed, approximate location, device and browser details, and an online identifier stored in a cookie. See Cookies and similar technologies.

From people who contact us

• Name, work email address, company name.
• The free-text message you submit and the headcount bucket you select.
• Submissions are stored in our application database in the European Union and forwarded to a founder inbox, so that an enquiry is not lost if the notification email fails to arrive.

From authorised users of customer organisations

• Email address and display name (used for sign-in and audit).
• Authentication factors you choose to enrol: a time-based one-time-password (TOTP) secret stored encrypted, and / or one or more passkey credentials (public key only — the private key never leaves your device).
• Session identifiers and timestamps, IP address of each session, and a record of security-relevant events (sign-in, MFA enrolment, password reset, recovery-code use).

• Performance of a contract (Art. 6(1)(b)) — providing the service to authenticated users of customer organisations.
• Legitimate interests (Art. 6(1)(f)) — responding to inbound enquiries, securing the service against abuse, keeping immutable audit logs to meet our customers’ compliance obligations. Our legitimate interests are balanced against your fundamental rights; the assessment is documented internally and available on request.
• Legal obligation (Art. 6(1)(c)) — record-keeping requirements applicable to us as a data processor and as an employer / contractor of our own personnel.
• Consent (Art. 6(1)(a)) — website analytics on our public pages, only after you accept analytics cookies. You can withdraw consent at any time through “Cookie settings” in the page footer; withdrawal does not affect processing carried out before it.

Apart from website analytics, we do not rely on consent for the processing described above. We do not engage in profiling or automated decision-making with legal effects on individuals.

• To provide, secure, and improve the service.
• To respond to enquiries and provide customer support.
• To maintain an append-only audit trail of security and administrative events, available to authorised admins of the relevant organisation under Article 7 of the EU Directive 2023/970.
• To detect and prevent abuse, fraud, and security incidents.
• To comply with applicable law and respond to lawful requests.
• With your consent, to understand in aggregate how visitors use our public website.

We do not sell personal data. We do not use personal data for behavioural advertising or marketing enrichment.

Production data is stored and processed exclusively within the European Union. We do not transfer personal data outside the EEA for production processing. Limited operational metadata (such as aggregated, non-identifying error reports) may be processed by security and observability tooling located in the EU; the full sub-processor list is provided as an appendix to the DPA.

Website analytics is the one exception. Google Analytics and Google Tag Manager are provided by Google Ireland Limited, and data they collect may be transferred to Google LLC in the United States, which is certified under the EU–US Data Privacy Framework. It concerns visitors to our public pages, and no customer data is sent to Google. One limitation: if, in the same browser tab, you move from the application to one of our public pages and then use the browser’s Back button, the addresses and titles of application pages you return to in that tab may also be reported to Google Analytics. Those addresses contain random identifiers, never names or other personal details.

If we ever need to engage a non-EEA sub-processor in the future, we will rely on the EU Commission’s Standard Contractual Clauses (Decision 2021/914) and notify affected customers in advance with a right to object.

• Account and authentication data — kept while the user account is active and for up to 90 days after deactivation, after which it is deleted or anonymised.
• Audit events — retained for seven (7) years in line with the long-tail evidentiary needs of compliance customers. Audit events are append-only and cannot be modified by us or the customer.
• Contact-form submissions — kept in our database and in the recipient inbox as a record of the enquiry and of any contract that follows from it. We do not delete them on a fixed schedule; you can ask us to erase yours at any time, and we will.
• Website analytics — event-level data is retained in Google Analytics for two (2) months and then deleted by Google; only aggregated reports remain.
• Backups — encrypted, EU-resident, and rotated on a documented schedule. Personal data deleted from the primary store is removed from backups within the next backup cycle.

You may, free of charge, exercise the following rights:

• Access — request a copy of your personal data.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your data, subject to the legal grounds we may have for retaining it (e.g. audit log, contractual records).
• Restriction — ask us to pause processing while a dispute is resolved.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Lodge a complaint with your local Data Protection Authority. A list is maintained by the European Data Protection Board at edpb.europa.eu.

Where you are an authorised user of a customer organisation, requests under these rights should generally be directed to your employer (the controller) first. We will support our customers in responding within statutory timelines.

We implement technical and organisational measures appropriate to the risk, including encryption of sensitive fields at rest, multi-factor authentication for all roles, role-based access control, an append-only audit trail, and EU-only data residency. A more detailed description of our security controls is on the Security page.

Strictly necessary. The application uses a session cookie set by our authentication system. Across the site we also store your language preference and, on our public pages, your analytics choice (calbarry_consent, kept for six months). These do not require consent.

Analytics — public pages only, with consent. If you accept analytics cookies, Google Analytics (loaded through Google Tag Manager) sets _ga and _ga_<measurement-id> cookies that distinguish visits; they expire after up to two years. If you decline, no analytics cookies are set, but Google’s tags may still send Google a cookieless signal that a page was viewed, without an identifier, which Google uses in aggregate. You can change your choice at any time through “Cookie settings” in the page footer; withdrawing deletes the analytics cookies.

We do not set marketing or advertising cookies.

The service is intended for use by business customers and their authorised personnel. We do not knowingly collect personal data from children.

We may update this policy as our practices evolve, the law changes, or to clarify wording. Material changes will be communicated to active customers via email at least thirty (30) days before they take effect.

For any privacy-related question or to exercise the rights described above, contact us at /contact.