1. Who we are
flexiday is operated by Daniel Hrynusiw OSVČ(“we”, “us”, “the controller”), a sole trader established in the Czech Republic, with a registered address at Bořetická 4133/6, 615 00 Brno-Židenice, Czech Republic. We are the data controller for the personal data described in this policy.
For any privacy question or to exercise your rights, contact us at support@flexi-day.com. We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR.
2. Scope
This policy applies to the flexiday web application and related services (the “Service”), a tool that helps teams request, approve and track time off. It does not cover third-party websites we may link to.
3. What data we collect
Data you provide
- Account data — your name, email address and password (stored only as a salted hash; we never see your plain-text password).
- Team & organisation data — groups you create or join, roles, and invitations.
- Time-off data — leave requests you submit, including dates, leave type (e.g. vacation, sick, home office), status, and any note you add.
- Support communications — the content of emails you send us.
Data we collect automatically
- Technical data — IP address, browser and device type, and timestamps, collected in server logs for security and reliability.
- Session data — an authentication cookie / local-storage token that keeps you signed in (see section 9).
4. Why we use your data and our legal bases
| Purpose | Legal basis (Art. 6(1) GDPR) |
|---|---|
| Create and manage your account and authenticate you | Performance of a contract (b) |
| Provide the time-off calendar, requests and approvals to your team | Performance of a contract (b) |
| Send transactional emails (e.g. email verification, notifications) | Performance of a contract (b) / legitimate interests (f) |
| Keep the Service secure and prevent abuse | Legitimate interests (f) |
| Comply with legal obligations and respond to lawful requests | Legal obligation (c) |
5. Who we share it with
We do not sell your personal data. Within the Service, your time-off and profile information is visible to members of your team and groups, as needed to coordinate coverage. We rely on the following processors, who act on our instructions under data-processing agreements:
| Processor | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS) | Application hosting and database storage | EU (Frankfurt, Germany) |
| Amazon SES (AWS) | Sending transactional emails | EU (Frankfurt, Germany) |
We may also disclose data where required by law, to enforce our Terms, or to protect the rights, safety and security of our users.
6. International transfers
Your data is hosted within the European Union (Amazon Web Services (AWS), eu-central-1 region (Frankfurt, Germany)). Where any transfer outside the European Economic Area occurs, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
7. How long we keep it
We keep your personal data for as long as your account is active. If you delete your account or ask us to erase your data, we remove it from our live systems and delete it from backups within a reasonable period, unless we are legally required to keep it longer. Server logs are retained for a limited period for security purposes.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected (rectification);
- have your data erased (“right to be forgotten”);
- restrict or object to certain processing;
- receive your data in a portable, machine-readable format;
- withdraw consent at any time, where processing is based on consent.
To exercise any of these rights, email support@flexi-day.com. You also have the right to lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic (https://www.uoou.cz).
9. Cookies and local storage
We use only strictly necessary cookies and browser local storage to keep you signed in and to operate the Service. We do not use third-party advertising or cross-site tracking cookies.
10. Children
The Service is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, please contact us so we can remove it.
11. Security
We take appropriate technical and organisational measures to protect your data. For details, see our Security page.
12. Changes to this policy
We may update this policy from time to time. We will change the “last updated” date above and, for material changes, provide a more prominent notice.
13. Contact
Daniel Hrynusiw OSVČ
Bořetická 4133/6, 615 00 Brno-Židenice, Czech Republic
support@flexi-day.com