УК EN

Privacy Policy

Effective date: April 26, 2026 • App: Day Off

1. General

Day Off is a corporate (enterprise) mobile app for tracking employee absences (vacation, sick leave, time off). The app is distributed exclusively among employees of client companies that have entered into a relevant agreement with the app operator. Self-registration is not available: accounts are created by the company's HR administrator.

2. Data Controller and Processor

Data Controller — the user's employer, who determines the purpose and scope of processing their employee's personal data within the employment relationship.
Data Processor — Brander, which provides Day Off as a SaaS service and processes data exclusively on the controller's instructions.
Processor contact: dayoffbrander@branderstudio.com

3. Data We Collect

Day Off stores the following personal data in Cloud Firestore (Google):

Category	Fields	Source
Employee profile	email, full name, position, department, employment start date, role	Provisioned by administrator (HR) via Google Sheets or admin panel
Absence requests	request type (vacation / sick leave / quota increase), dates, hours, comment, status, approval history	Created by the user in the app
Balance	remaining vacation and sick leave hours, accrual and deduction history	Calculated by the server based on requests and company policy
Technical identifiers	Firebase Auth UID, FCM device push token	Created on first login

The app does not collect: geolocation, contacts, photos, microphone, advertising identifiers, browsing history, or cross-app tracking data.

4. Processing Purposes

Tracking and approving employee absence requests.
Calculating and managing vacation and sick leave balances.
Sending push notifications and email notifications about request status, reminders, and company settings updates.
Generating reports for management (Excel, Google Sheets) within the current company.
Ensuring access security (authentication).

Legal basis: performance of the employment contract between the user and their employer, and the employer's legitimate interest in tracking working time (Art. 6(1)(b) and (f) GDPR).

5. Third-Party Transfers

Data is shared only with technical providers necessary for the service:

Google LLC (Firebase) — Authentication, Cloud Firestore, Cloud Functions, Cloud Messaging (FCM). Data is stored on Google servers in the region configured for the Firebase project.
Google LLC (Gmail SMTP) — for sending service email notifications.
Apple Inc. / Google LLC — as platform operators for push notification delivery (APNs / FCM).

Data is not shared with advertising networks, behavioral tracking analytics systems, data brokers, or other third parties for commercial purposes.

6. Data Retention

Data is retained for the duration of the employment contract between the user and the controller company, as well as for periods required by local law for retaining HR records. After the employment relationship ends, the account is deactivated or deleted by the company administrator.

7. Data Subject Rights

Under GDPR, the user has the right to:

access their personal data;
request correction of inaccurate data;
request deletion (right to be forgotten);
restrict processing;
receive data in machine-readable format (right to portability);
file a complaint with a supervisory authority.

Exercising rights: since accounts are created and managed by the company's HR administrator, to exercise any of the above rights, please contact your employer's HR department first. In cases where a technical action is required from the processor, your employer will contact us at dayoffbrander@branderstudio.com.

Account deletion. Day Off is an enterprise app with employer-provisioned accounts (App Store Review Guideline 5.1.1(v), Google Play Workforce policy). Self-deletion through the app is not available. To delete your account, contact your company's HR administrator — they will initiate the deletion. Requests are processed within a reasonable timeframe, generally within 30 days.

8. Security

All network connections are secured with TLS 1.2+.
Access to Firestore is governed by Security Rules that verify authorization and user role for each request.
Authentication via Firebase Auth (email + password).
Processor staff access to Firestore is limited and logged.

9. Children

Day Off is intended exclusively for adult employees of client companies and is not intended for persons under 16 years old (EU) / 13 years old (US). The app does not knowingly collect personal data from children.

10. Changes to This Policy

This policy may be updated periodically. The effective date is shown at the beginning of the document. Users will be notified of significant changes by email and/or push notification in the app.

11. Contact

For privacy questions, write to: dayoffbrander@branderstudio.com