1. Data controller
The data controller is:
Ing. Michal Bajer
Company ID (IČO): 75476274
Contact email: [email protected]
2. Scope of processed data
Within the Service, we process the following data:
- Registration data: name, email address, company name.
- Service usage data: logins, work allocations, projects, time-off records, capacities.
- Financial data: user hourly rates, project hourly rates, and company fixed costs (entered by administrators for profitability reporting).
- Change logs: records of changes to allocations and time-off entries (who changed what and when).
- Technical data: IP address, browser type, access time, and last activity timestamp (to ensure security and proper functioning of the Service).
3. Purpose and legal basis of processing
We process personal data based on the following legal grounds under GDPR Art. 6:
- Performance of a contract (Art. 6(1)(b)) — to provide the Service and manage user accounts.
- Legitimate interest (Art. 6(1)(f)) — to ensure security and prevent misuse.
- Consent (Art. 6(1)(a)) — for sending commercial communications (if the user gives consent).
4. Data retention
We retain personal data for the duration of the user account and subsequently for the period necessary to fulfill legal obligations (particularly tax and accounting), but no longer than 3 years after account deletion.
5. Data sharing with third parties
We do not share your personal data with third parties for marketing purposes. Data may only be shared with:
- Hosting service providers (servers in the EU).
- PostHog — analytics tool hosted on EU servers (Frankfurt, Germany). Processing mode depends on user consent via the cookie banner (see section 6).
- Sentry — application error monitoring tool. Processes technical error information without users’ personal data.
- Public authorities based on legal requirements.
6. Cookies
The Service uses technical (essential) cookies to ensure proper functioning of the application, in particular to maintain user sessions and protect against CSRF attacks. These cookies are necessary for the operation of the Service and cannot be declined.
For analytics, we use PostHog (EU servers — Frankfurt, Germany). On the first visit, a cookie banner offers Accept all (full analytics including session recordings and heatmaps) or Essential only (PostHog runs in cookieless mode — anonymous aggregate page-views only, no recordings). Consent can be withdrawn at any time by removing the wrksched_cookie_consent entry from your browser’s local storage. The Service does not use third-party marketing cookies.
7. Data subject rights
As a data subject, you have the right to:
- Access your personal data (Art. 15 GDPR).
- Rectification of inaccurate data (Art. 16 GDPR).
- Erasure of personal data (“right to be forgotten”, Art. 17 GDPR).
- Restriction of processing (Art. 18 GDPR).
- Data portability (Art. 20 GDPR).
- Object to processing based on legitimate interest (Art. 21 GDPR).
- Withdraw consent at any time without affecting the lawfulness of prior processing (Art. 7(3) GDPR).
- Lodge a complaint with the Office for Personal Data Protection (www.uoou.cz).
To exercise your rights, contact us at [email protected].
8. Data security
We protect your data using encrypted transmission (HTTPS/TLS), secured servers in the EU, and regular security updates. Access to personal data is restricted to authorized personnel only.
9. Contact
For questions regarding personal data protection, please contact us:
Ing. Michal Bajer
Email: [email protected]