Vathom GmbH ("Vathom", "we", "us", or "our") is committed to protecting personal data and respecting individual privacy.
This Privacy Policy explains how we collect, use, store, and protect personal information when you visit www.vathom.de, contact us, or use our compensation intelligence platform.
We process personal data in accordance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and other applicable data protection laws.
Privacy Policy
Introduction
The controller responsible for processing personal data through this website is Vathom GmbH, located at Schwanthalerstr. 166, 81476 Munich, Germany.
We can be contacted at contact@vathom.de.
Where Vathom processes employee compensation data on behalf of business customers, the customer generally acts as the data controller, while Vathom acts as a data processor under Article 28 GDPR. The respective responsibilities are governed by contractual agreements and applicable data protection legislation.
We can be contacted at contact@vathom.de.
Where Vathom processes employee compensation data on behalf of business customers, the customer generally acts as the data controller, while Vathom acts as a data processor under Article 28 GDPR. The respective responsibilities are governed by contractual agreements and applicable data protection legislation.
Controller
Depending on how you interact with our website and services, we may collect and process different categories of personal data.
When you visit our website, we may process technical information such as IP addresses, browser and device details, access times, and server logs necessary for website operation and security.
When you contact us or request a demonstration, we may collect your name, business contact details, company information, and the contents of your enquiry.
When you use our platform, we may process account information, authentication details, user permissions, and activity records. Our business customers may also provide employee information, job classifications, salary records, compensation structures, and related workforce data.
We limit the collection and processing of personal information to what is necessary for specified, legitimate purposes.
When you visit our website, we may process technical information such as IP addresses, browser and device details, access times, and server logs necessary for website operation and security.
When you contact us or request a demonstration, we may collect your name, business contact details, company information, and the contents of your enquiry.
When you use our platform, we may process account information, authentication details, user permissions, and activity records. Our business customers may also provide employee information, job classifications, salary records, compensation structures, and related workforce data.
We limit the collection and processing of personal information to what is necessary for specified, legitimate purposes.
Collection
We process personal data to operate and secure our website, respond to enquiries, provide our services, manage customer relationships, and fulfil applicable legal obligations.
Website operation and security are generally based on our legitimate interests under Article 6(1)(f) GDPR. Processing enquiries and providing contracted services may be based on Article 6(1)(b) GDPR where necessary for a contract with the individual concerned, or Article 6(1)(f) GDPR where we have a legitimate business interest.
Processing required to fulfil statutory obligations is based on Article 6(1)(c) GDPR. Where consent is legally required, including for certain analytics and marketing activities, we rely on Article 6(1)(a) GDPR.
Where Vathom acts as a data processor on behalf of business customers, personal data is processed according to their documented instructions and the applicable data processing agreement.
Website operation and security are generally based on our legitimate interests under Article 6(1)(f) GDPR. Processing enquiries and providing contracted services may be based on Article 6(1)(b) GDPR where necessary for a contract with the individual concerned, or Article 6(1)(f) GDPR where we have a legitimate business interest.
Processing required to fulfil statutory obligations is based on Article 6(1)(c) GDPR. Where consent is legally required, including for certain analytics and marketing activities, we rely on Article 6(1)(a) GDPR.
Where Vathom acts as a data processor on behalf of business customers, personal data is processed according to their documented instructions and the applicable data processing agreement.
Basis
Vathom provides software for pay transparency, compensation analysis, regulatory reporting, and related workforce management activities.
Employee and compensation information submitted by business customers is processed for the purposes defined in the relevant customer agreements and in accordance with documented instructions.
Vathom does not sell employee compensation data or use customer-provided employee information to train general-purpose AI models without appropriate contractual authorisation and a valid legal basis.
Business customers remain responsible for establishing the legal basis for processing their employees' personal data and providing any required privacy notices. Vathom supports customers in fulfilling their data protection obligations within the scope of its contractual responsibilities.
Employee and compensation information submitted by business customers is processed for the purposes defined in the relevant customer agreements and in accordance with documented instructions.
Vathom does not sell employee compensation data or use customer-provided employee information to train general-purpose AI models without appropriate contractual authorisation and a valid legal basis.
Business customers remain responsible for establishing the legal basis for processing their employees' personal data and providing any required privacy notices. Vathom supports customers in fulfilling their data protection obligations within the scope of its contractual responsibilities.
Data
Our website may use cookies and similar technologies to maintain functionality, support security, and analyse website usage.
Technologies that are strictly necessary for operating the website may be used without consent where legally permitted. Non-essential analytics, advertising, and tracking technologies are only activated after obtaining consent where required by applicable law.
Where consent-based technologies are used, visitors can change or withdraw their consent through the available cookie settings. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
Technologies that are strictly necessary for operating the website may be used without consent where legally permitted. Non-essential analytics, advertising, and tracking technologies are only activated after obtaining consent where required by applicable law.
Where consent-based technologies are used, visitors can change or withdraw their consent through the available cookie settings. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
Analytics
We may share personal data with authorised service providers that support our business operations. These may include website hosting providers, cloud infrastructure services, communication platforms, customer relationship management software, technical support providers, and security service providers.
Personal information may also be shared with professional advisers or competent public authorities where required by law.
Where third parties process personal data on our behalf, we establish appropriate contractual arrangements, including data processing agreements where required by Article 28 GDPR. Such providers are required to maintain suitable confidentiality and security measures.
Vathom does not sell personal data to third parties.
Personal information may also be shared with professional advisers or competent public authorities where required by law.
Where third parties process personal data on our behalf, we establish appropriate contractual arrangements, including data processing agreements where required by Article 28 GDPR. Such providers are required to maintain suitable confidentiality and security measures.
Vathom does not sell personal data to third parties.
Sharing
Where personal data is transferred outside the European Economic Area, Vathom applies safeguards required by the GDPR.
Depending on the recipient and destination, these safeguards may include adequacy decisions issued by the European Commission, Standard Contractual Clauses, and supplementary technical or organisational measures where necessary.
Further information about applicable international transfers and the relevant safeguards may be requested using the contact details provided in this Privacy Policy.
Depending on the recipient and destination, these safeguards may include adequacy decisions issued by the European Commission, Standard Contractual Clauses, and supplementary technical or organisational measures where necessary.
Further information about applicable international transfers and the relevant safeguards may be requested using the contact details provided in this Privacy Policy.
Transfers
Vathom implements appropriate technical and organisational measures designed to protect personal data from unauthorised access, accidental loss, alteration, destruction, or disclosure.
These measures may include encryption, access restrictions, authentication procedures, activity logging, security monitoring, and controlled data retention and deletion processes.
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, satisfy applicable legal retention requirements, or establish, exercise, or defend legal claims.
Where we process employee and compensation information on behalf of customers, the relevant contractual agreements govern retention, return, and deletion procedures, subject to applicable legal requirements.
These measures may include encryption, access restrictions, authentication procedures, activity logging, security monitoring, and controlled data retention and deletion processes.
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, satisfy applicable legal retention requirements, or establish, exercise, or defend legal claims.
Where we process employee and compensation information on behalf of customers, the relevant contractual agreements govern retention, return, and deletion procedures, subject to applicable legal requirements.
Security
Under the GDPR, individuals have various rights concerning the processing of their personal information.
Depending on the circumstances, these include the right to access personal data, request correction of inaccurate information, request erasure, restrict processing, and receive eligible information in a portable format.
Individuals may also object to processing based on legitimate interests and withdraw previously granted consent at any time. Withdrawal does not affect the lawfulness of processing conducted before the withdrawal.
Individuals also have the right to lodge a complaint with a competent data protection supervisory authority.
Requests concerning personal information controlled by Vathom may be submitted to contact@vathom.de. Where the relevant information is controlled by a business customer, requests should generally be directed to that customer. Vathom will provide reasonable assistance as required by applicable law and contractual arrangements.
Depending on the circumstances, these include the right to access personal data, request correction of inaccurate information, request erasure, restrict processing, and receive eligible information in a portable format.
Individuals may also object to processing based on legitimate interests and withdraw previously granted consent at any time. Withdrawal does not affect the lawfulness of processing conducted before the withdrawal.
Individuals also have the right to lodge a complaint with a competent data protection supervisory authority.
Requests concerning personal information controlled by Vathom may be submitted to contact@vathom.de. Where the relevant information is controlled by a business customer, requests should generally be directed to that customer. Vathom will provide reasonable assistance as required by applicable law and contractual arrangements.
Rights
Vathom's platform may use artificial intelligence and automated analytical tools to support compensation analysis, identify potential pay disparities, and assist organisations with workforce-related decisions.
These capabilities are intended to support informed human decision-making. Where automated individual decision-making falls within the scope of Article 22 GDPR, the relevant processing must comply with applicable legal requirements and safeguards.
Vathom is committed to responsible AI governance, appropriate human oversight, and the protection of personal data throughout the operation of its platform.
These capabilities are intended to support informed human decision-making. Where automated individual decision-making falls within the scope of Article 22 GDPR, the relevant processing must comply with applicable legal requirements and safeguards.
Vathom is committed to responsible AI governance, appropriate human oversight, and the protection of personal data throughout the operation of its platform.
Decisions
We may update this Privacy Policy periodically to reflect changes in legislation, our business operations, or the way personal information is processed.
Any revised version will be published on our website, together with an updated revision date. Where required by applicable law, we will provide additional notice of material changes.
For questions about this Privacy Policy or the processing of personal data, please contact Vathom GmbH at contact@vathom.de.
Any revised version will be published on our website, together with an updated revision date. Where required by applicable law, we will provide additional notice of material changes.
For questions about this Privacy Policy or the processing of personal data, please contact Vathom GmbH at contact@vathom.de.
Changes
Unlock the Power of Compensation Intelligence
Book a Demo
Vathom
© 2026 Vathom