Allshares Oy and Allshares AB (”Allshares” or “us”) respect your privacy and are committed to protecting your privacy and personal data.
We process your personal data for our purposes as joint controllers when you use the remuneration benchmarking service (”Pay Data Platform”) or your personal data is used in the said service, a SaaS-service we offer to our customers, typically your employer.
When acting as joint controllers, Allshares Oy and Allshares AB jointlydetermine the purposes and means of the processing of your personal data aswell as have access to the data. They also share responsibility for protectingyour data and ensuring your rights under data protection laws.
We may also process some personal data as separate controllers for each controller’s own purposes for which this notice shall not apply. For example, if you are a contact person of our customer, you can find more information on how we process your personal data in our customer privacy notice on www.allshares.com.
This privacy notice has been drafted in a layered format. By clicking the headlines below, you can move to the different parts of this notice.
CONTENTS
1. CONTROLLERS
2. COLLECTED PERSONAL DATA AND SOURCES
3. COOKIES
4. PROCESSING PURPOSES, LEGAL BASES, AND RETENTION TIMES FOR PROCESSED PERSONAL DATA
5. RECIPIENTS OF PERSONAL DATA
6. INTERNATIONAL TRANSFERS OF PERSONAL DATA
7. DATA SUBJECTS’ RIGHTS
8. CHANGES TO THIS PRIVACY NOTICE
1. CONTROLLERS
The controller for the personal data processing described herein is:AllsharesOyBusinessID 1882491-3 Aleksanterinkatu 13, 00100 Helsinki, FinlandAllshares ABBusinessID 556731-4546 Sveavägen15, våning 16, 111 57 Stockholm, Sweden
If you have any questions regarding this privacy notice, please contact us at: privacy@allshares.com.
2. COLLECTED PERSONAL DATA AND SOURCES
We only collect personal data from or about you that is essential and necessary for the purposes described in this privacy notice.
In this section, we will tell you which personal data we collect about you and how the collection takes place. In section 4 you will find a table in which we have detailed the purposes of collecting your personal data and the legal basis for the processing of personal data as well as the relevant retention times foreach personal data processing purpose.
We may collect, use, store and transfer different types of your personal data, which we have grouped in the following way:·Remuneration data means information about you and your remuneration we need for providing the Pay Data Platform, which will be collected from your employer or publicly available sources.
Wecollect the personal data from the following sources:· From your employer (please see below a description of how we ensure the confidentiality of such data).· From publicly available sources such as business information databases and websites of companies.
In order to ensure the confidentiality of the personal data sourced from your employer, the data in the Pay Data Platform is presented in an anonymous and statistical form so that the remuneration information cannot be connected to any individual and no individual can be identified from the data. Data aggregation and a minimum reporting threshold – set at seven (7) data points – are used to prevent the identification of any individual. The remuneration information displayed represents the middle range of the data collected, excluding the lowest 25% and the highest 25%. If there are less than seven (7) data points, no data is displayed. The compensation ranges are visible per component, including base salary, bonuses, equity, pensions, and benefits. Users can then refine their view using pre-set filters for company metrics such as revenue, market capitalization, total assets, and employee count, as well as by region and role. Selections are limited top redefined ranges, ensuring the user cannot modify the ranges. The Pay Data Platform does not permit users to alter the composition of this collective dataset by adding or removing companies.
3. COOKIES
We use essential cookies to ensure the proper functioning of the website. These cookies are necessary for the website to work and do not track you or collect your personal data for any other purposes. We do not use non-essential cookies.
4. PROCESSING PURPOSES, LEGAL BASES, AND RETENTION TIMES FOR PROCESSED PERSONAL DATA
We process your personal data only within the limits permitted by law. We usually process your personal data based on the following legal basis of processing:· The processing is necessary for the purposes of the legitimate interests according to Article 6(1)(f) of GDPR, pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms.
In the table below, we have described the personal data we are going to process together with the purposes for which we are going to process this data as well as our legal bases for such processing and the retention times for different sets of data.
- Processed personal data
- Processing purposes
- Legal basis for processing (GDPR Art. 6)
- Retention time for personal data
- Remuneration data, such as company name, companymetrics and job title, years of relevant work experience/starting year ofemployment, salary, earning opportunity from short-term and long-term incentiveplans and paid out incentives as well as other remuneration components, placeof business, age, and gender.
- Providing the remuneration benchmarking service forcustomers which have purchased a subscription to the Pay Data Platform.
- Legitimate interest GDPR Art. 6(1)(f)
- Five (5) years
We may retain your personal data longer than stated above, if it is necessary to fulfil the obligations set by law or to prepare, present or defend against legal claims or to resolve disagreements. After we no longer have any purposes to retain your data, it is deleted or anonymized.
To the extent that the processing of personal data is based on our legitimate interest, we have carried out a legitimate interest balance test. The purpose of the balance test is to ensure that our legitimate interest is properly balanced with your interests or fundamental rights or freedom. If you want to get more information about the balance tests we have performed, you can contact us by email at privacy@allshares.com.
5. RECIPIENTS OF PERSONAL DATA
We may share your personal data with third party recipients in the following situations:·
- When it is necessary for the purposes listed in section 4.
- If required by law, we may disclose your personal data to public authorities
- Your information may be shared with a person or entity that acquires all or most of our company, shares, or assets, or with which we are in the process of merging
- We may also disclose your information when we believe in good faith that its disclosure is necessary to exercise our rights or defend against a legal claim, to ensure your or others' safety, to investigate fraud, or to respond to a government request.
We also share personal data with trusted third-party service providers. These service providers process personal data on our behalf and based on our instructions to offer us their services. Such service providers include, for example:
- Koalitix Technology B.V.
- Microsoft Ireland Operations Limited
The third-party service providers have access to or the ability to process your personal data to provide their services to us. These third parties may not use your information for purposes other than those related to the services they provide. We have entered into data processing agreements with all above-mentioned third parties.
Your personal data may also be disclosed between the two controllers mentioned in section 1 acting as joint controllers. Both controllers process your personal data only for the purposes of and in accordance with this notice.
6. INTERNATIONAL TRANSFERS OF PERSONAL DATA
Your personal data might be transferred outside of the European Union (“EU”) and/or the European Economic Area (”EEA”) by us or our service providers. When this happens, we are committed to ensure the adequate level of your personal data protection by adhering to the obligations laid down in the GDPR.
As a rule, we protect international personal data transfer by using standard contractual clauses (link to English version), approved by the European Commission on 4 June 2021, with all of our service providers processing data outside of the EEA. If necessary, we also engage additional safeguards to protect your data in accordance with prevailing market practice.
For more information on the international transfer of your personal data and our service providers located outside of the EEA, please contact us at: privacy@allshares.com.
7. DATA SUBJECTS’ RIGHTS
You have multiple different rights related to your personal data. Below, you can find a summary of all your rights and possible limitations that apply to them.
-Right to request information on personal data processing. You have the right to receive transparent information on the personal data we process about you.
- Right to request access to your personal data. You have the right to obtain a copy of any personal data we hold about you.
- Right to request correction of your personal data. You have the right to ask us to correct information about you that is incomplete or incorrect.
- Right to request deletion of your data. You have the right to ask us to delete your personal data when there is no longer a suitable basis for processing the data.
- Right to object to the processing of your data when the processing basis is our (or a thirdparty's) legitimate interest and you have a reason related to your personalspecial situation to object to the data processing. On top of that, you alwayshave the right to object to the processing of your data for direct marketingpurposes.
- Right to request the restriction of the processing of your data. You can ask us to stop processing your data, for example, until you verify the correctness of the data or the legal basis for processing.
- Right to request the transfer of your data from one system to another when the processing of personaldata is based on consent or agreement.
- If the processing is based only on your consent, you have the right to withdraw thatconsent at any time. However, the withdrawal of consent does not affect thelegality of the processing of personal data that was carried before thewithdrawal was made.
You can use the above-mentioned rights by sending an email to privacy@allshares.com or by letter to the address mentioned at the start of this notice.
Some of these rights only apply with particular legal basis of processing. To find out which rights apply in which situations, you can visit the Finnish DPA’s website here (link in English).
You also have right to notify the Finnish and/or Swedish DPA, if you are unsatisfied with how we process your personal data. For Finland, such notification can be made here (link in English) and for Sweden here (link in English).
8. CHANGES TO THIS PRIVACY NOTICE
This Privacy Notice has been updated on 7 May 2025. We update this privacy notice on a regular basis. You can always find the latest version on the Pay Data Platform.