Privacy notice

Service: LeavePilot Data controller: MAXYMIZE BUSINESS DI GIURASTANTE ROMANO MAXIMILIAN, Via Delle Valli 57, 66010 Canosa Sannita (CH), Italy, tax code and VAT no. IT02747200695, REA no. CH-420087 Contact: support@leavepilot.app Certified email (PEC): maximilian.giurastante@legalmail.it

This notice describes how LeavePilot processes the personal data of website visitors and users of the absence management platform, under Regulation (EU) 2016/679 and Italian legislative decree 196/2003.

The Italian version prevails / La versione italiana fa fede.

---

1. Data controller

Data controller: MAXYMIZE BUSINESS DI GIURASTANTE ROMANO MAXIMILIAN, a sole proprietorship with registered office at Via Delle Valli 57, 66010 Canosa Sannita (CH), Italy, tax code and VAT no. IT02747200695, entered in the Italian administrative and economic register under no. REA CH-420087.

Contact: support@leavepilot.app. For formal communications: maximilian.giurastante@legalmail.it.

2. Data processed

Registration and profile data: name, work email address, role, department, language, time zone, and where provided a profile picture and date of birth.

Platform usage data: requests for holidays, hourly leave, remote working and sick leave, with their statuses, dates and notes; any medical certificates uploaded by the employee, which are special categories of data under article 9 of the Regulation, encrypted and accessible only to the persons authorised by the employer. For these certificates the platform acts as an intermediary between employee and employer: it conveys the file until the employer downloads it, and does not archive it as the place where personnel documents are retained, which remains the employer's own task, outside the platform. The retention period is set out in section 6.

Technical data: access logs, IP address, session identifiers, and the data needed for security purposes such as failed login attempts and account lockouts.

Contract acceptance data: organisation identifier and name, identifier, email address and name of the person who accepts, date and time, originating IP address, browser used, event type and, for each accepted text, document type, version identifier and cryptographic fingerprint; where the Terms of Service are among the accepted documents, also the specific approval of the onerous clauses. This is recorded in accordance with article 3 of the Terms of Service.

Billing data, for paid plans only: identification and tax details of the customer organisation, amounts and accounting records.

Cookie consent register on the public website: categories authorised or refused, date of the choice, IP address and browser, kept in a dedicated database, hosted by Neon in the European Union, as evidence of consent under article 7 of the Regulation.

Technical events on how the platform is running: these are described in section 5, which also sets out their limits and how to object.

Minors. The service is intended for organisations and for their employees and collaborators of legal age. It is not intended to be used by minors.

Providing the data. Name, email address and password are necessary to create an account: without them registration cannot be completed. Date of birth is necessary to complete the profile at the end of registration: without it the profile remains incomplete and access to the platform keeps being redirected to onboarding. Type, start date and end date are necessary for every absence request: without them the request cannot be created; for sick leave requests you must also indicate how the medical certificate will be provided, straight away or at a later time. The other data described in this section, such as the profile picture and notes on the request, are optional and their absence does not prevent use of the platform.

3. Purposes and legal bases

Provision of the service and performance of the contract (article 6(1)(b)); compliance with legal obligations, including employment law obligations, of the customer employer (point (c)); platform security and abuse prevention, on the basis of legitimate interest (point (f)); service communications by email (point (b)).

Civil and tax obligations to retain accounting records and billing documents are met on the basis of point (c).

For the processing based on legitimate interest, namely the platform security described in section 9 and the technical events described in section 5, a written balancing test between the controller's interest and the rights of data subjects was carried out before the processing began. The legitimate interest assessments are available on request, by writing to support@leavepilot.app.

Health-related data, such as medical certificates, is processed on behalf of the employer in the context of employment law obligations, under article 9(2)(b) of the Regulation.

Where LeavePilot processes employee data on behalf of the customer company it acts as a processor under article 28 of the Regulation; the customer company remains the controller. The relationship is governed by the data processing agreement.

4. Processing by artificial intelligence

The descriptive commentary that appears at the end of reports is produced by a language model that receives aggregate figures only: counts, averages, distributions by band and departmental aggregates. It receives no names, identifiers or email addresses, no rows relating to an individual employee and no individual values. Departments of fewer than three people are not transmitted as a separate entry.

How it works, its limits and its exclusions are described in the instructions for use. The model provider is named in the list of sub-processors.

5. Technical events on how the platform is running

The platform collects technical events about its own operation: pages opened, actions taken, errors, response times. A module removes names, email addresses and absence details before sending; what remains are pseudonymised technical identifiers of user, organisation and session. This data is pseudonymised, not anonymous: it remains personal data, which is the reason this section exists. The following are not collected: the content of absence requests, sick notes, notes, addresses and contact details.

Collection follows two distinct regimes, not depending on whether you are an employee or a visitor to the site, but on whether the page you are using writes something to your device or not.

On the informational pages of the public site, those reachable without an account, where the cookie banner appears, such as the home page, the legal pages, the security and trust page, and the pages through which a new organisation signs up for the service, collection writes a cookie and some storage entries to your device: for that reason it starts only after consent to the "Measurement" category, without consent it does not start at all, and if you withdraw consent, collection stops and whatever had already been written is removed as well, cookies and storage entries included.

On all other pages, collection runs without writing anything to your device: it leaves no cookies and no storage entries, and its memory ends with the browser session. This includes the whole authenticated area, where consent requested in the workplace would not be freely given anyway, but also the public pages for sign-in, individual user registration, password recovery and reset, email address verification and workspace access, which anyone can visit and not only those who are already an employee of a customer organisation. On these pages consent is not required, because there is nothing on your device to write or to withdraw.

This processing is not carried out on behalf of your employer: its purposes and means are determined by the controller named in section 1, which acts here as an independent controller, on the basis of its legitimate interest in keeping the service running and secure (article 6(1)(f) of the Regulation). The provider that collects the events, PostHog Inc., operates on a European instance and is named in Annex D of the data processing agreement; it does not appear in the list of sub-processors in section 7, because for this processing LeavePilot does not act as processor on behalf of your organisation but, as just explained, as an independent controller: the complete list of who receives data about you therefore follows from reading this section together with section 7. The provider is based in the United States: any transfer to the United States is based on the European Union standard contractual clauses module 2, signed between the parties, and on the provider's adherence to the EU-U.S. Data Privacy Framework with certification extended to data relating to the employment relationship as well. The legitimate interest assessment is available on request.

You may object at any time by writing to support@leavepilot.app. Irrespective of your own objection, the organisation you work for may ask for collection to be switched off for all of its users.

6. Retention

Data	Retention	Where it is set out
Data entered in the platform: profile, absence requests	Duration of the contract. On termination, which is not the same as deleting one's own personal account, data remains exportable for 30 days; after that period the provider proceeds according to the customer organisation's choice or, absent a choice, deletes it after further notice	Terms of Service, article 6(7); data processing agreement, article 10
Medical certificates uploaded by the employee	12 months from upload, then automatically deleted, file and record together. Within that period they remain downloadable by the customer organisation. This is not a legal obligation but a minimisation choice: the platform is an intermediary, not the personnel archive, and retention of the document beyond this period is the employer's own responsibility, under its own obligations, outside the platform	Data processing agreement, Annex B
Register of acceptances of the contractual documents	Duration of the relationship and the subsequent limitation period	Data processing agreement, article 15.4; Terms of Service, article 3(2)
Register of the generations of the model-produced commentary	24 months from generation	Data processing agreement, Annex B
Register of administrative operations	Duration of the contract, then deleted together with the organisation's database	Data processing agreement, Annex B
Access logs, IP address, session identifiers, failed login attempts and account lockouts	12 months from the record being created, a period considered adequate for a security log. The IP-based lockout expires on its own within 30 minutes, independently of this period	Legitimate interest assessment for platform security, available on request
Technical logs of the infrastructure providers	According to the providers' own policies: at least 24 hours, up to 7 days on some plans. The controller does not extend them; IP address and browser may nonetheless appear, for security purposes, in the register in the row above, which the controller keeps itself	Data processing agreement, Annex B
Billing data and accounting records	10 years	Articles 2220 and 2946 of the Italian Civil Code
Cookie consent register of the public website	For as long as needed to evidence the consent given	Article 7 of the Regulation; Cookie Policy

Generated reports are not retained: the document is produced when it is requested and delivered to whoever requested it, without the service keeping a copy. The technical events described in section 5 are kept for as long as needed for the diagnostic and security purposes they are collected for.

Legal obligations requiring longer retention prevail over the periods in the table, for as long as and to the extent that they apply.

7. Recipients and transfers

Each organisation's database is hosted in the European Union, in the Frankfurt region. The application, the functions that process requests and the storage of sick notes are hosted with a United States provider, on a distribution network with a global presence. Service emails, when you do not use a mail provider configured by your organisation, are sent through a United States provider that receives the recipient's name and email address and the content of the communication. The descriptive commentary on reports referred to in section 4 is processed by a United States provider, which receives only the aggregate data described in that section. Data is disclosed only to suppliers appointed as processors under article 28. The up-to-date list, with the function and place of processing of each provider, is published on the sub-processors page; the provider that collects the technical events on how the platform is running does not appear in that list for the reason set out in section 5, which also gives you the information on its transfer. We do not sell personal data to third parties.

Transfers outside the European Economic Area take place to recipients that guarantee adequate safeguards. For the data processed on behalf of customer companies the basis is the European Union standard contractual clauses: none of the providers may receive that data under the EU-U.S. Data Privacy Framework adequacy decision, because their certifications cover only data that is not related to the employment relationship. The verification is documented in Annex C of the data processing agreement, from which you can obtain a copy of the standard contractual clauses by writing to support@leavepilot.app.

8. Rights of data subjects

You may exercise at any time the rights set out in articles 15 to 22 of the Regulation: access, rectification, erasure, restriction, portability and objection, by writing to support@leavepilot.app. Where the processing concerns data managed by your employer, we may forward the request to the controller.

For processing based on legitimate interest, the right to object may be exercised at any time, at the same address. For technical events, section 5 applies. As regards the monitoring of login attempts on your account, an objection seeking to suspend it entirely cannot as a rule be granted, because it would leave the account without the protection that mechanism provides, to your detriment and to that of other users sharing the same originating network; an objection concerning a lockout episode that is already closed, with no related proceedings under way, is instead assessed case by case and may lead to the early deletion of that single entry.

You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it); if you reside in another European Union member state, you may instead contact the supervisory authority of your state of residence.

9. Security

We apply appropriate technical and organisational measures: encryption of sensitive data, authentication with signed tokens, role-based access control, a log of administrative operations, and account lockout after failed attempts. The measures applied to processing carried out on behalf of customer companies are described in Annex B of the data processing agreement.

10. Changes affecting the controller

In the event of a sale or transfer of the business or of the service, data may be transferred to the incoming party, which will assume the same obligations. Data subjects and customer organisations will be informed before the transfer takes effect.

---

For any question about this notice, write to support@leavepilot.app. Substantial changes will be announced through the platform. Previous versions remain published at their own address.