App privacy · TIMEOFF.GURU

1. Who is responsible for your data

Your employer uses the system to manage leave and absence. For the data in it, your employer is the controller. IBS Bulgaria, the company behind TIMEOFF.GURU, is the processor: it processes data only on your employer's instructions and under a data processing agreement (DPA).

For questions and requests about your personal data, contact your employer first, usually the HR department. We help your employer respond. You can also write to admin@timeoff.guru.

2. What data is processed

Data	Where it comes from	What for
Profile: name, work email, user ID, department, manager, working hours	Your employer	Sign-in, approval workflow, notifications
Phone number	Your employer, if it uses SMS notifications	SMS notifications
Leave and absence: balances, requests, dates, leave type, status, comments, substitutes	You, your colleagues and HR	Managing leave by your employer's rules
Attachments, such as sick notes	You, optionally	Documenting the absence. Only HR sees them
Work locations	You, if your employer uses them	Showing who works from where
Sign-in and activity: date and time of sign-in, audit log	Automatically	Security and traceability
Notification token of your device	Automatically, in the mobile app	Phone notifications

3. Notifications

The system sends notifications by email and, if your employer uses them, by SMS or as mobile app notifications. Your employer decides which notifications are sent and what they say.

4. Cookies and device storage

In the browser the system uses only strictly necessary cookies: to keep you signed in and to remember your language. They do not require consent.
In the mobile app your sign-in details are kept on the device so you do not have to enter your password every time.
We use no advertising cookies and do not track you across other sites and apps.

5. Who data is shared with

We do not sell data or share it with advertisers. People in your organization see data according to the roles your employer has set: your team, your manager, HR and administrators.

To run the service we use sub-processors, for example for hosting and for sending emails and SMS. When leave orders are signed with a qualified e-signature, signing data is processed with our partner Borica. The full list of sub-processors is part of the agreement with your employer and is available on request.

6. How long data is kept

While your employer uses the system, data is kept according to its rules, for example how many years of leave history to keep. When the subscription ends, the data is destroyed immediately, following set procedures.

If you leave the organization, your employer's administrator deactivates or deletes your profile.

7. Your rights

You have the right of access, correction, deletion, restriction, portability and objection. As your employer is the controller, requests go to them. If you write to us, we forward the request and help your employer respond.

You can also lodge a complaint with the Bulgarian Commission for Personal Data Protection or the supervisory authority in your country.

8. How we protect data

All traffic is encrypted. Each customer's data sits in a separate, protected instance, passwords are hashed one way, and every action is written to an audit log. Our information security management system is certified to ISO/IEC 27001 and ISO/IEC 27017. See the Trust Center for details.

9. Changes to this policy

When we change this policy, we update the date at the top of the page. For data that visitors leave on the timeoff.guru website, see the website privacy policy.