Privacy Policy

This Policy describes how Proplanum processes personal data in connection with the Website, the Proplanum Service, the Proplanum Application and the Mobile Application, and in business contacts. It fulfills the information obligations under Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter the “GDPR”).

§ 1. Definitions

For the purposes of the Policy, the following terms have the meanings set out below:

1. Proplanum Application: software made available by the Service Provider for planning and settling work in an enterprise, comprising in particular: work schedule management, recording and documenting working time (including by means of mobile devices and a kiosk), handling electronic leave requests, task management, internal communication for employees, and forecasting and planning staffing needs;
2. Mobile Application: the version of the Proplanum Application for smartphones and tablets, including in kiosk mode for recording working time;
3. Proplanum Service: the platform available at https://app.proplanum.com, providing access to the Proplanum Application;
4. Website: the Service Provider's website available at https://www.proplanum.com;
5. Terms of Service: the terms and conditions for the provision of services by electronic means in connection with the use of the Proplanum Application;
6. Agreement: the agreement for the provision of services by electronic means concluded between the Service Provider and the Service Recipient on the basis of the Terms of Service or a separate agreement;
7. Data Processing Agreement: the agreement on the entrustment of personal data processing concluded between the Service Provider and the Service Recipient;
8. Service Provider, Proplanum: Proplanum spółka z ograniczoną odpowiedzialnością (a limited liability company) with its registered office in Siedlce, ul. Sokołowska 34, 08-110 Siedlce, Poland, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court Lublin-Wschód in Lublin with its seat in Świdnik, 6th Commercial Division of the National Court Register, under KRS number 0001078697, NIP (tax ID) 8212688991, REGON 527344533;
9. Service Recipient: an entrepreneur using the Proplanum Application under the Agreement, in particular as the employer of the persons whose data it enters into the Proplanum Application;
10. User: a person to whom the Service Recipient has granted access to the Proplanum Application, in particular an employee, a manager or an account administrator.

§ 2. Controller and Data Protection Officer

1. The controller of personal data within the scope described in § 3(1) is the Service Provider. Contact: info@proplanum.com, ul. Sokołowska 34, 08-110 Siedlce, Poland.
2. The Service Provider has appointed a Data Protection Officer, who can be contacted on all matters concerning the processing of personal data and the exercise of related rights: iod@proplanum.com, or in writing at the address of the Service Provider's registered office, marked “Data Protection Officer”.

§ 3. The Two Roles of the Service Provider

1. The Service Provider is the controller of the personal data of:
   1. persons visiting the Website and the Proplanum Service;
   2. persons contacting the Service Provider through the form, chat, e-mail or telephone, and persons taking part in online meetings;
   3. persons submitting a registration request, persons representing the Service Recipient and persons designated by it as contact persons, to the extent of the conclusion and performance of the Agreement and billing;
   4. contact persons at companies to which the Service Provider addresses a business proposal (§ 5(3));
   5. Users, to the extent of technical data on the use of the Proplanum Application and the Mobile Application, processed for security, bug fixing and service development.
2. Data of the Service Recipient's employees and contractors entered into the Proplanum Application (in particular schedules, working time, absences, leave, tasks and communication) is processed by the Service Provider on behalf of the Service Recipient, which is its controller, on the basis of the Data Processing Agreement (Article 28 GDPR). The purposes and legal bases of that processing are determined by the Service Recipient as the employer. On matters concerning this data, the User should contact their employer; a request addressed to the Service Provider will be forwarded to the Service Recipient without delay.

§ 4. Purposes, Legal Bases and Retention Periods

The Service Provider, as controller, processes personal data for the following purposes:

1. Registration and performance of the Agreement: reviewing the registration request, concluding and performing the Agreement, maintaining the Service Recipient's account, technical support and communication concerning the Agreement. Legal basis: Article 6(1)(b) GDPR and, with regard to persons representing the Service Recipient and contact persons, Article 6(1)(f) GDPR (legitimate interest in maintaining contact concerning the Agreement). Period: the term of the Agreement and, after its termination, until the limitation period for claims expires; data from a registration request that was not accepted, 12 months from its submission.
2. Billing: issuing invoices and fulfilling tax and accounting obligations. Legal basis: Article 6(1)(c) GDPR. Period: as required by law, as a rule 5 years from the end of the calendar year in which the tax payment deadline expired.
3. Security and business continuity: protecting the Proplanum Application, the Proplanum Service and the Website, detecting abuse, fixing bugs, keeping event logs and backups. Legal basis: Article 6(1)(f) GDPR. Period: event logs and backups for the period resulting from their configured retention and rotation cycle, no longer than necessary to ensure security and restore data.
4. Responding to inquiries: handling forms, chat, correspondence, telephone calls and online meetings. Legal basis: Article 6(1)(f) GDPR. Period: until the matter is closed and, where no cooperation follows, 12 months from the last contact.
5. Business contact with companies: addressing to contact persons at companies a business proposal related to the activities of those companies and conducting further correspondence. Legal basis: Article 6(1)(f) GDPR (legitimate interest in direct marketing of the Service Provider's own services). Period: until an objection is raised and, absent an objection, no longer than 24 months from the last contact. After an objection is raised, the Service Provider retains only the e-mail address on a suppression list so as not to send further messages.
6. Analytics and advertising: measuring traffic on the Website and in the Proplanum Service and the effectiveness of advertising. Where consent to advertising cookies has been given, after the contact form on the Website is submitted the browser calculates a one-way hash (SHA-256) of the e-mail address and telephone number entered in the form, and the Service Provider transfers this hash to Google Ireland Limited (Google Ads) to establish whether the request followed a click on an advertisement (enhanced conversions); on the same basis and only for requests for which this consent was given, the Service Provider may transfer to Google Ads a hash (SHA-256) of the e-mail address from the register of requests together with information on the further course of the request (a meeting held, a pilot or conclusion of a contract). The e-mail address and telephone number are not transferred in plain form. Legal basis: consent (Article 6(1)(a) GDPR) given in the consent bar; consent may be withdrawn at any time through the “Cookie settings” link (§ 12(6)). Period: until consent is withdrawn or the cookies expire (§ 12).
7. Measuring registrations and advertising effectiveness: establishing how registrations in the Proplanum Service proceed and which advertisements lead to them. When a registration request is accepted or rejected and at the first sign-in to the company account (account activation), the Service Provider transfers to Google Ireland Limited (Google Analytics) an event for each registration with the request identifier and, after acceptance, also the organization identifier, together with the Google Analytics browser identifier and the outcome of the request (acceptance, or rejection with the reason for rejection). Where the request follows a click on an advertisement, when the request is accepted and when the company account is activated, the Service Provider additionally transfers to Google Ireland Limited (Google Ads) and to Microsoft Ireland Operations Limited (Microsoft Advertising) the ad click identifier (gclid, gbraid, wbraid or msclkid), the time and value of the conversion (set according to the size of the company and adjusted after 14 days according to the number of active employee accounts), the request identifier and the number of employees stated in the request. The click identifier comes from the address from which the user went to the Proplanum Service or, if the address does not contain it, from advertising cookies stored on the Website after consent has been given (§ 12(5)). As part of the measurement described in this paragraph, no first name, surname, e-mail address, telephone number or company name is passed to Google or Microsoft. Legal basis: Article 6(1)(f) GDPR (legitimate interest in measuring the effectiveness of the Service Provider's own advertising and registration process); cookies are stored on and read from the user's device only with the consent referred to in Article 399 of the Polish Electronic Communications Law of 12 July 2024. Period: conversion data is transferred to Google Ads and Microsoft Advertising within 90 days of the ad click and kept in the Proplanum Service for as long as the request data (paragraph 1). The data subject may object (§ 11(1)(f)).
8. Statistics and crash reports of the Mobile Application: improving the stability and development of the Mobile Application. Legal basis: Article 6(1)(f) GDPR. Period: in accordance with the settings of the Firebase tool, no longer than 14 months.
9. Establishing, exercising and defending claims: Legal basis: Article 6(1)(f) GDPR. Period: until the limitation period for claims expires.
10. Providing data is voluntary. Without the data necessary for registration and performance of the Agreement, it is not possible to create an account or use the Proplanum Application, and without contact data it is not possible to respond to an inquiry.

§ 5. Sources of Data

1. The Service Provider obtains data directly from the data subjects at registration, in forms, in correspondence and during the use of the Proplanum Application, the Proplanum Service and the Website.
2. The Service Provider receives the data of Users, persons representing the Service Recipient and contact persons from the Service Recipient.
3. The data of contact persons at companies to which the Service Provider addresses a business proposal comes from publicly available sources: the National Court Register, the Central Registration and Information on Business (CEIDG), company websites, public professional profiles and job advertisements, as well as from tools for finding and verifying business contact data. This is exclusively business data: first name, last name, position or function held, company name, business e-mail address and business telephone number.
4. A person who has received a message with a business proposal from the Service Provider and does not wish to receive further messages may object at any time by replying to the message or by writing to info@proplanum.com. The Service Provider does not send that person any further messages and deletes their data, except for the e-mail address kept on the suppression list.

§ 6. Recipients of Data

1. The Service Provider discloses personal data only to the extent necessary to provide its services. Service providers process the data on the Service Provider's instructions under data processing agreements, while the payment operator, providers of advertising systems as regards measuring advertising effectiveness, advisors and public authorities act as separate controllers. The recipients of data are:
   1. Microsoft Ireland Operations Limited (Ireland), Microsoft Azure: hosting of the Proplanum Application, the Proplanum Service, databases, files, backups and event logs in data centers within the European Economic Area;
   2. Microsoft Ireland Operations Limited (Ireland), Microsoft 365 and Microsoft Teams: e-mail, documents and online meetings;
   3. IT-SOLVE Damian Sitek, Wiktor Sobczyk s.c., ul. Rumiankowa 5, 42-280 Częstochowa, Poland: development, maintenance and technical support of the Proplanum Application; access to the system only for the duration of the work, through named accounts with multi-factor authentication and to the extent necessary for that work;
   4. Twilio Ireland Limited (Ireland), SendGrid, and LINK Mobility Poland sp. z o.o. (SMSAPI): sending e-mail and SMS messages from the Proplanum Application and the Proplanum Service, including account and billing messages and messages from the Service Provider. SendGrid receives the recipient's e-mail address, first and last name and the content and attachments of the message: for a schedule change the dates, hours and positions of the shifts and the first and last name of the person who published the schedule; for a processed request the request type, submission date, status and the rejection reason entered by the manager; for account activation, password reset and sign-in a one-time code or an activation link; for billing the invoice number and amount. SMSAPI receives the recipient's telephone number and the SMS content. Each User can switch off schedule and request notifications in their account settings; messages about the account, billing and the removal of published shifts are always sent. These providers have no access to the Proplanum Application database or to any other data of the Service Recipient. SendGrid processes messages on servers in the United States (§ 7(2));
   5. Google Ireland Limited (Ireland), Firebase: only in the Mobile Application: delivery of push notifications (device identifier and notification content: for a chat message the sender's first and last name and the message text, for other events a short description that may contain an employee's first and last name, dates, the name of a task or a document), crash reports (device identifier, technical data, the request path and the server response code; the content of requests and the data entered in the Mobile Application are not sent) and launch statistics without a User identifier; in kiosk mode only crash reports. The User can switch off push notifications in the phone settings (§ 8(2));
   6. Apple Distribution International Limited (Ireland), Apple Push Notification service: delivery of the push notifications referred to in point 5 to iOS devices;
   7. Crisp IM SAS (France): chat on the Website, in the Proplanum Service and in the Mobile Application;
   8. Stripe Payments Europe Limited (Ireland): card payment processing;
   9. wFirma sp. z o.o.: issuing invoices;
   10. Webflow, Inc. (United States): hosting of the Website and its forms;
   11. Cloudflare, Inc. (United States): protection of the Website, the Proplanum Service and the Proplanum Application against attacks (web application firewall, DDoS protection) and routing of traffic to them; processes data in transit, without caching it, and connection logs with the IP address and technical data; does not store the databases or files of the Proplanum Application;
   12. Google Ireland Limited (Ireland): Google Analytics, Google Tag Manager, Google Ads, Google Maps, reCAPTCHA and Google Sheets (register of form submissions); analytics and advertising tools on the Website only after consent has been given, including the hash of the e-mail address and telephone number from the contact form as described in § 4(6), and data on registrations in the Proplanum Service as described in § 4(7);
   13. Microsoft Ireland Operations Limited (Ireland), Microsoft Advertising: measurement and advertising in the Bing search engine; on the Website only after consent has been given, and conversion data from registration in the Proplanum Service as described in § 4(7);
   14. providers of tools for finding, verifying and managing business contact data (Apollo.io, Hunter.io, Snov.io, Bouncer): to the extent of business contact with companies;
   15. accounting firm, law firm and advisors: to the extent necessary to provide their services;
   16. public authorities: where the obligation to disclose data arises from the law.
2. The list of sub-processors of data entrusted by Service Recipients constitutes an appendix to the Data Processing Agreement. The Service Provider informs Service Recipients of any intended change to it at least 14 days in advance.
3. If the Service Recipient enables an integration of the Proplanum Application with an external system (in particular an HR and payroll system, the ZUS platform, a calendar, or the API), data is transferred to the provider of that system on the Service Recipient's instructions and at its responsibility.

§ 7. Transfers of Data Outside the European Economic Area

1. The Proplanum Application, its databases, files, backups and event logs are stored within the European Economic Area.
2. Some of the recipients listed in § 6(1) (Google, Microsoft, Apple, Stripe, Webflow, Cloudflare, Twilio and the providers of contact data tools) may also process data in the United States. In such cases, the transfer takes place on the basis of the European Commission's adequacy decision (EU-US Data Privacy Framework), where the recipient is covered by it, and otherwise on the basis of the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR).
3. A copy of the safeguards can be obtained by contacting the Data Protection Officer.

§ 8. Mobile Application and Kiosk

1. The device location is collected only at the moment of recording the start or end of work, where the Service Recipient has enabled verification of the place of recording and the User has granted the Mobile Application the location permission. The Mobile Application does not track location continuously.
2. Push notifications require a device identifier. They are delivered by Google (Firebase) and Apple (§ 6(1), points 5 and 6). The User can disable them in the phone settings.
3. The Mobile Application can be unlocked using the device's biometrics (fingerprint, facial recognition). The verification is performed by the phone's operating system, and biometric data is not transferred to the Service Provider.
4. In Poland, the function of recording working time by fingerprint on the kiosk is disabled. The Service Provider does not process Users' biometric data in Poland.

§ 9. Data Security

1. The Service Provider applies technical and organizational measures appropriate to the risk, in particular: hosting in Microsoft Azure within the European Economic Area, encryption of data in transit and at rest, multi-factor authentication for all persons with access to the infrastructure and the administration panel, restriction and logging of access to data, daily backups, and periodic penetration tests.
2. Access to data is granted only to persons authorized by the Service Provider, bound by confidentiality, to the extent necessary to perform their tasks.
3. In the event of a personal data breach, the Service Provider proceeds in accordance with Articles 33 and 34 GDPR and, with regard to entrusted data, notifies the Service Recipient without delay.

§ 10. Profiling and Automated Decisions

1. The Service Provider does not make decisions concerning the persons whose data it processes that are based solely on automated processing and that produce legal effects concerning them or similarly significantly affect them.
2. Automatic scheduling in the Proplanum Application prepares a proposal, and the Service Recipient decides whether to accept it. The selection of companies to which the Service Provider addresses a business proposal is based on data about the company (industry, size, location), not on an assessment of individuals.

§ 11. Rights of Data Subjects

1. The data subject has the right:
   1. to access their data and obtain a copy of it;
   2. to rectification of their data;
   3. to erasure of their data;
   4. to restriction of processing;
   5. to portability of data processed on the basis of consent or the Agreement;
   6. to object to processing based on legitimate interest, on grounds relating to their particular situation;
   7. to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal;
   8. to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa, Poland).
2. An objection to the processing of data for direct marketing purposes may be raised at any time, without giving reasons. Once raised, the data is no longer processed for that purpose.
3. Requests may be sent to info@proplanum.com or to the Data Protection Officer (§ 2(2)). The Service Provider responds without undue delay and no later than within one month.
4. With regard to data processed on behalf of the Service Recipient (§ 3(2)), the rights are exercised through the Service Recipient as controller, and the Service Provider assists it in this on the terms set out in the Data Processing Agreement.

§ 12. Cookies and Similar Technologies

1. The Website and the Proplanum Service use cookies and similar technologies, that is, information stored on the user's device and read on subsequent visits.
2. Necessary: maintaining the session and sign-in, security, including protection against automated traffic (Cloudflare), protection of forms (reCAPTCHA), remembering the choices made in the consent bar. Used without consent, as they are necessary to provide the service.
3. Functional: chat (Crisp). Used after consent has been given.
4. Analytics: Google Analytics and Google Tag Manager and, in the Mobile Application, Firebase statistics (§ 4(8)). On the Website and in the Proplanum Service, used after consent has been given.
5. Advertising: Google Ads and Microsoft Advertising, including conversion measurement. Used after consent has been given. Once this consent has been given, the hash of the e-mail address and telephone number from the contact form is also passed to Google Ads (enhanced conversions, § 4(6)). Advertising cookies are stored in the proplanum.com domain, so the Proplanum Service also reads them at registration; the transfer of conversion data from registration is described in § 4(7).
6. Consent is given in the consent bar displayed on the first visit. It can be changed or withdrawn at any time through the “Cookie settings” link in the footer of the Website and the Proplanum Service. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
7. Session cookies are deleted when the browser is closed, and persistent cookies are stored for the period specified in their parameters, no longer than 2 years. Cookies can also be deleted in the browser settings.

§ 13. Changes to the Policy

1. The Service Provider updates the Policy in the event of changes in the law, the services, the recipients of data or the manner of processing. The current version is available on the Website and in the Proplanum Service.
2. The Service Provider informs Service Recipients of material changes by electronic means.
3. The Policy in this wording (version of 26 October 2026) applies from the date of its publication on the Website.

This document is a translation of the Polish original. In the event of any discrepancy, the Polish version prevails.