Controller and processor roles
Customer organisations control the employee data they add to LeaveManager. LeaveManager acts as processor for workspace, employee, leave, sickness, approval, and audit records entered into the service.
GDPR compliance
LeaveManager helps UK SMEs handle leave, sickness, and employee records with clear data roles, secure cloud storage, practical retention controls, and transparent security measures.
A practical overview for teams reviewing LeaveManager before inviting employees.
Customer organisations control the employee data they add to LeaveManager. LeaveManager acts as processor for workspace, employee, leave, sickness, approval, and audit records entered into the service.
LeaveManager is designed around practical leave management, so the service asks for the employee, organisation, and absence information needed to run approvals, balances, reports, and notifications.
Production application delivery runs through Cloudflare, with workspace records stored in managed PostgreSQL infrastructure and database connections requiring SSL.
The platform uses encrypted traffic, hashed passwords, role-based access controls, audit history, protected secrets, and restricted operational access.
Data storage
LeaveManager stores customer workspace data for as long as the account is active and needed to provide leave management. After closure, workspace data is normally kept for up to 30 days for export or recovery, then deleted or anonymised unless a longer period is required for legal, accounting, security, or dispute-resolution reasons.
Security measures
Employee absence records are sensitive operational data. LeaveManager uses layered safeguards across access, authentication, hosting, payment handling, and operational monitoring to reduce risk and support GDPR accountability.
TLS encryption for application traffic and SSL-required database connections.
Password hashing, server-side session protection, and optional OAuth sign-in through supported identity providers.
Role-based permissions for owners, admins, managers, and employees.
Audit logs for important workspace actions and leave-management changes.
Stripe-hosted checkout and card handling, so LeaveManager does not store card numbers.
Sub-processor transparency for hosting, database, payments, email, analytics, and support tooling.
Data rights
Workspace owners can manage users and employee records inside LeaveManager. For GDPR rights requests involving employee records, LeaveManager supports the customer organisation as controller. For account, billing, sales, or support data controlled by LeaveManager, requests can be sent directly to us.
Access and export support
Correction and deletion support
DPA available on request