Privacy notice

Service: LeavePilot Data controller: MAXYMIZE BUSINESS di Romano Maximilian Giurastante, VAT no. 02747200695 Contact: support@leavepilot.app

This notice describes how LeavePilot processes the personal data of website visitors and users of the absence management platform, under Regulation (EU) 2016/679 and Italian legislative decree 196/2003.

The Italian version prevails / La versione italiana fa fede.

---

1. Data controller

Data controller: MAXYMIZE BUSINESS di Romano Maximilian Giurastante, VAT no. 02747200695. Contact: support@leavepilot.app.

2. Data processed

Registration and profile data: name, work email address, role, department, language, time zone, and where provided a profile picture and date of birth.

Platform usage data: requests for holidays, hourly leave, remote working and sick leave, with their statuses, dates and notes; any medical certificates uploaded by the employee, which are special categories of data under article 9 of the Regulation, encrypted and accessible only to the persons authorised by the employer.

Technical data: access logs, IP address, session identifiers, and the data needed for security purposes such as failed login attempts and account lockouts.

Cookie consent register on the public website: categories authorised or refused, date of the choice, IP address and browser, kept in a dedicated database in the European Union as evidence of consent under article 7 of the Regulation.

3. Purposes and legal bases

Provision of the service and performance of the contract (article 6(1)(b)); compliance with legal obligations, including employment law obligations, of the customer employer (point (c)); platform security and abuse prevention, on the basis of legitimate interest (point (f)); service communications by email (point (b)).

Health-related data, such as medical certificates, is processed on behalf of the employer in the context of employment law obligations, under article 9(2)(b) of the Regulation.

Where LeavePilot processes employee data on behalf of the customer company it acts as a processor under article 28 of the Regulation; the customer company remains the controller. The relationship is governed by the data processing agreement.

4. Processing by artificial intelligence

The descriptive commentary that appears at the end of reports is produced by a language model that receives aggregate figures only: counts, averages, distributions by band and departmental aggregates. It receives no names, identifiers or email addresses, no rows relating to an individual employee and no individual values. Departments of fewer than three people are not transmitted as a separate entry.

How it works, its limits and its exclusions are described in the instructions for use. The model provider is named in the list of sub-processors.

5. Retention

Data is kept for the duration of the contract and for up to 30 days after the account is deleted, unless a legal obligation requires longer retention. Technical logs are kept for limited periods, proportionate to the security purposes they serve.

6. Recipients and transfers

Data is processed on infrastructure with servers in the European Union for hosting and database purposes, and is disclosed only to suppliers appointed as processors under article 28. The up-to-date list is published on the sub-processors page. We do not sell personal data to third parties.

Any transfers outside the European Economic Area take place only to recipients that guarantee adequate safeguards, by way of standard contractual clauses or an adequacy decision, as indicated on that same page.

7. Rights of data subjects

You may exercise at any time the rights set out in articles 15 to 22 of the Regulation: access, rectification, erasure, restriction, portability and objection, by writing to support@leavepilot.app. Where the processing concerns data managed by your employer, we may forward the request to the controller.

You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

8. Security

We apply appropriate technical and organisational measures: encryption of sensitive data, authentication with signed tokens, role-based access control, a log of administrative operations, and account lockout after failed attempts. The measures applied to processing carried out on behalf of customer companies are described in Annex B of the data processing agreement.

---

For any question about this notice, write to support@leavepilot.app. Substantial changes will be announced through the platform.