Privacy Policy

1. Who we are

Offdays is operated by Ing. Jiří Psota, Company ID (IČO) 76072266, registered at Zborovská 1200/6, 150 00 Prague 5 – Smíchov, Czech Republic (the “operator,” “we”). For data protection matters, write to hello@offdays.cz.

2. Our role

Depending on the data, we are either a processor or a controller.

• As a processor we process everything the customer, meaning the organization using Offdays, enters into the service: users and their details, absences, vacation entitlements, approvals and settings. The customer is the controller of this data. The processing is governed by the Data Processing Addendum, which is part of the Terms of Service. If you are an employee or contractor of a customer and want to exercise your rights, contact your employer or client. If you send the request to us, we pass it on to them.
• As a controller we process only the data described in Section 3: accounts and sign-in, billing, communication with customers, operational and security logs, and traffic on the www.offdays.cz website.

3. Data we are responsible for as a controller

3.1 Accounts and sign-in

When you sign in with Google Workspace, we receive your name, email, profile photo and Google account identifier. We use them to verify that it is you and to manage your account. Legal basis: performance of the contract with the customer and our legitimate interest in secure sign-in (Article 6(1)(b) and (f) GDPR). We keep them while the account exists and delete them together with the customer's data under the Data Processing Addendum.

3.2 Billing

For paid subscriptions we process the billing contact's name and email, the company name and address, tax ID and payment history. Payments are handled by Stripe; we never see or store card numbers. Legal basis: performance of the contract and legal accounting and tax obligations (Article 6(1)(b) and (c) GDPR). We keep accounting records for as long as the law requires (usually 10 years).

3.3 Communication with customers

When you write to us, we process your name, email and the content of your message so we can reply. Legal basis: performance of the contract and legitimate interest (Article 6(1)(b) and (f) GDPR). We keep correspondence for the duration of the cooperation and at most 3 years after it ends.

3.4 Operational and security logs

The service writes technical records, such as IP addresses and times of requests, errors and recipient addresses of sent emails. They are used to run the service, fix errors and prevent abuse. Legal basis: legitimate interest in secure operation (Article 6(1)(f) GDPR). Logs are kept in Google Cloud Logging and deleted when its retention period ends.

3.5 The www.offdays.cz website

On the website we use Google Analytics to measure traffic, but only if you consent in the cookie banner. Legal basis: consent (Article 6(1)(a) GDPR). You can withdraw consent at any time with the “Cookie settings” link in the website footer. The website remembers your language and color theme choice in your browser.

4. Cookies in the app

The app at app.offdays.cz uses only strictly necessary cookies and browser storage: the sign-in session (valid for 30 days), language and color theme. We use no analytics or advertising cookies in the app.

5. Who we share data with

We do not sell data. We share it only with providers who help us run the service. Sub-processors of customer data and providers for which we are the controller (Stripe, Google Analytics) are listed on the Sub-processors page. We may also disclose data to authorities where the law requires it.

6. Where data is stored

The app and database run on Google Cloud in region europe-west1 in Belgium. Data leaves the EU only with providers that say so in the sub-processor list, and always with a safeguard under Chapter V GDPR (the EU-US Data Privacy Framework or standard contractual clauses).

7. Security

Sign-in works only with a Google Workspace work account; Offdays stores no passwords. Data is encrypted in transit and at rest, and each organization has its own separate space. The measures are described in detail in Annex 2 of the Data Processing Addendum.

8. Your rights

For data we are responsible for as a controller, you have the right of access, rectification, erasure, restriction of processing, data portability and the right to object to processing based on legitimate interest. You can withdraw consent to analytics at any time. Write to hello@offdays.cz; we reply within one month.

You also have the right to lodge a complaint with the Czech Office for Personal Data Protection (uoou.gov.cz) or the supervisory authority in your country.

For data your employer or client entered into the service, contact them (see Section 2).

9. Children

The service is meant for businesses and their staff, not for children.

10. Changes to this policy

We may update this policy. The current version is always on this page with the date of the last change.

11. Contact

Controller: Ing. Jiří Psota, Company ID (IČO) 76072266, registered at Zborovská 1200/6, 150 00 Prague 5 – Smíchov, Czech Republic
Email: hello@offdays.cz
Website: www.offdays.cz