1. Data Controller
The controller of your personal data within the meaning of the General Data Protection Regulation (GDPR) is:
CloudKon Damian Czaja
Email: support@zrobgrafik.pl
2. What Data We Process
Within the Service, we process the following categories of data:
- Schedule data: schedule names, dates, shift types, staffing requirements
- Employee data: first and last names of employees entered by the schedule creator
- Preferences: availability and shift preferences submitted by employees
- Analytics data: IP address, browser type, pages visited — collected via PostHog (self-hosted at a.zrobgrafik.pl)
3. Purpose and Legal Basis for Processing
We process personal data for the following purposes:
| Purpose | Legal Basis |
|---|
| Providing the shift scheduling service | Art. 6(1)(f) GDPR — legitimate interest |
| Analytics and Service improvement (PostHog) | Art. 6(1)(f) GDPR — legitimate interest |
| Ensuring security and stability of the Service | Art. 6(1)(f) GDPR — legitimate interest |
4. Data Recipients
Personal data is not shared with third parties, except:
- PostHog (self-hosted at a.zrobgrafik.pl) — analytics tool; data remains on servers controlled by the Controller
- Hosting service providers necessary for the operation of the Service
- Public authorities — only on the basis of applicable law
5. Transfers Outside the EEA
Personal data is processed and stored on servers located within the European Economic Area (EEA). We do not transfer personal data outside the EEA.
6. Data Retention Period
- Schedule and employee data — stored for the duration of the schedule's existence in the Service. Inactive schedules may be deleted after a reasonable period of inactivity.
- Analytics data (PostHog) — stored for up to 13 months, after which it is automatically deleted.
- You may request data deletion at any time by contacting the Controller.
7. Your Rights (GDPR)
You have the following rights:
- Right of access — you have the right to obtain information about what data we process about you.
- Right to rectification — you have the right to request correction of inaccurate data.
- Right to erasure („right to be forgotten") — you have the right to request deletion of your data.
- Right to restriction of processing — you have the right to request restriction of processing your data.
- Right to data portability — you have the right to receive your data in a structured, commonly used format.
- Right to object — you have the right to object to the processing of your data based on legitimate interest.
- Right to withdraw consent — if processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing prior to withdrawal.
- Right to lodge a complaint — you have the right to lodge a complaint with a supervisory authority.
To exercise your rights, contact us: support@zrobgrafik.pl.
8. Cookies and Analytics
The Service uses the PostHog analytics tool (self-hosted) to analyze traffic and usage. PostHog may use cookies and similar technologies to:
- Record pages visited in the Service
- Collect anonymous device and browser data
- Analyze usage patterns
The PostHog installation is fully controlled by the Controller — data is not shared with third-party companies.
9. Data Security
We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or destruction, including:
- Encrypted data transmission (HTTPS/TLS)
- Restricted system access for authorized personnel only
- Regular software updates
10. URL-Based Schedule Access
Schedules in the Service are accessible via unique, unguessable URLs. This means:
- Anyone with a schedule URL has access to its contents, including employee names.
- Schedule creators should treat URLs as access credentials and not share them with unauthorized persons.
- The Controller is not liable for unauthorized access resulting from Users sharing URLs.
11. Data Protection Officer (DPO)
Due to the size and nature of our operations, the Controller has not appointed a Data Protection Officer. For all matters related to personal data protection, please contact: support@zrobgrafik.pl.
12. Supervisory Authority
You have the right to lodge a complaint regarding personal data processing with the supervisory authority:
President of the Personal Data Protection Office (PUODO)
ul. Stawki 2, 00-193 Warszawa, Poland
https://uodo.gov.pl/en
13. Changes to Privacy Policy
The Controller reserves the right to update this Privacy Policy. Changes will be communicated by updating the „Last updated" date on this page.
14. Contact
For matters related to personal data protection, please contact:
CloudKon Damian Czaja
Email: support@zrobgrafik.pl