PrivacyPolicy

Zenchronity provides a leave management platform for organisations and Zenchronity Calendar, an appointment scheduling product (together, the “Service”). This Privacy Policy explains what personal data we process when you visit our website, contact us, buy or use the Service, or book an appointment through Zenchronity Calendar, why we process it, and what rights you have.

“Zenchronity”, “we” and “us” mean the legal entity that provides the Service, as named on our invoices. For any question about this policy or your data, write to privacy@zenchronity.com.

Data protection law distinguishes between the controller, who decides why and how personal data is used, and the processor, who handles it on the controller's behalf.

• We are the controller for the data we use for our own purposes: our website, our relationship with customers, billing, support and the security of the Service. This policy covers that data.
• We are a processor for the data organisations put into the Service, such as their employees' profiles and leave, and for the details people give when they book with a host on Zenchronity Calendar. The organisation or host is the controller of that data, and we process it only on their instructions, under our Data Processing Agreement.

If you use Zenchronity because your employer does, your employer's privacy notice explains how your data is used, and your employer is the right place for questions and requests about it. We will help your employer answer them.

Information you give us

• When you contact us: your name, email address, optional phone number and your message.
• When you buy or set up the Service: the name and email address of your organisation's administrators, your organisation's details and billing information.
• When you ask for support: the content of your request and our correspondence.

Information collected automatically

• Technical data: IP address, browser and device type, and the time of access, when you use our website or the Service.
• Usage statistics: on our website only, and only if you accept analytics in the cookie bar: pages visited, referring websites, device type and page load times, collected through Cloudflare Web Analytics without cookies and without identifying you, and seen by us only as aggregated statistics. The legal basis is your consent, which you can withdraw at any time in "Cookie settings".
• Sign-in and security records: sign-ins, failed sign-ins and changes made in the Service.
• Cookies and similar storage: only those needed for the Service to work or to remember your choices. See our Cookie Policy.

Information from others

• Our payment processor confirms your payment and the email address used for it. Card details stay with the payment processor and never reach us.
• Sign-in providers such as Microsoft or Google confirm your identity when you choose to sign in with them.
• Your employer may add your details to the Service directly or by connecting its company directory.

We use personal data only for the purposes below, each with a legal basis under the GDPR:

We do not use personal data to make decisions about anyone that are based solely on automated processing and have legal or similarly significant effects.

Booking an appointment

When you book with a host, we collect your name and email address, your time zone, a phone number and notes if you give them, and the answers to any questions the host asks, and send you a code to confirm your email address. The host decides what to ask and is responsible for how your details are used; we process them on the host's behalf. These details are encrypted at rest and deleted 730 days after the appointment.

To protect hosts from abuse, we also record the IP address a booking comes from and the actions taken on each booking, based on our legitimate interest in keeping the Calendar reliable. The IP address is removed from the booking after a few days, and the record of actions is kept for up to 12 months.

Host accounts

Hosts sign in with Google or with a Zenchronity account. With Google sign-in we receive the host's name, email address, Google account id and profile picture, which we use only to create and identify their account.

Zoom

A host may connect their own Zoom account. We use it only to create a meeting for an appointment, move it when the appointment is rescheduled and delete it when it is cancelled, and we read the connected account's id and email address once, to know whose connection it is. We do not access recordings, participants, chat, webinars or account settings, and we store no meeting content.

Google Calendar and Google Meet

A host may connect their own Google account. We request:

• calendar.app.created, which lets us create one calendar of our own in the host's account and manage only what we put in it. We cannot see, change or delete anything in the host's other calendars.
• calendar.freebusy, which tells us when the host is busy, without any event titles, attendees, locations or descriptions.
• the basic openid and email scopes, to identify which Google account was connected.

We use this access for one purpose only: to keep appointments and their Google Meet links in the host's calendar, and to avoid offering a time at which the host is already busy.

Zenchronity's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to serve advertising, we do not sell it, we do not transfer it to others except as needed to provide this feature or where required by law, and we allow no human to read it except with the host's explicit permission, for security purposes, or to comply with applicable law.

Disconnecting

The credentials for a connected account are stored encrypted. Disconnecting it in Settings revokes our access and deletes them.

When someone uses the Zen AI Assistant, their messages are sent to our AI model provider to generate a reply, with the names and email addresses of colleagues replaced by aliases first. The provider does not use this data to train its models. Organisations can turn the assistant off. See how Zen AI works.

We share personal data only with:

• Service providers who help us run the Service, such as hosting, email delivery, network protection, web analytics, icon delivery and our AI model provider. They may use the data only to provide their services to us. The providers that process our customers' data are listed in Annex IV of our Data Processing Agreement.
• Our payment processor, which processes payments as an independent controller under its own privacy policy.
• Services you connect, such as Slack, Microsoft, Google or Zoom, which receive the data the integration needs when an organisation or host connects them.
• Professional advisers, such as lawyers and accountants, bound by confidentiality.
• Authorities, where the law requires it or to protect our rights.
• A successor, if all or part of our business is merged, sold or reorganised, in which case this policy continues to apply to your data.

We never sell personal data and never share it for advertising.

Our servers are in the European Union. Some of our providers, including our network protection and AI model providers, may process data in other countries, such as the United States. When that happens, the transfer is protected by an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework, or by the Commission's standard contractual clauses. You can ask us for more information about these safeguards.

We keep personal data only as long as we need it for the purposes above, and then delete or anonymise it:

• Contact and sales enquiries: Up to 24 months after our last exchange, unless they lead to a contract.
• Customer account and contract records: For the duration of the contract, then as long as needed to establish or defend legal claims.
• Invoices and accounting records: For the period required by accounting and tax law.
• Security and sign-in records: As long as needed to protect the Service, and deleted automatically after that.
• Data organisations put into the Service: For the duration of their contract, and deleted within 30 days after it ends.
• Zenchronity Calendar appointments: 730 days after the appointment.

Copies in backups are deleted as the backups are overwritten.

We use technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls, separation of each customer's data and regular backups. Our Security page describes them. No system is completely secure, but if a breach affects your data, we will inform you or your organisation as the law requires.

Under the GDPR, you have the right to:

• access the personal data we hold about you and receive a copy;
• rectification of inaccurate or incomplete data;
• erasure of your data, where there is no reason for us to keep it;
• restriction of processing, for example while you contest its accuracy;
• object to processing based on our legitimate interests;
• portability, receiving data you gave us in a common machine-readable format;
• withdraw consent at any time, where we rely on it, without affecting earlier processing.

To exercise them, write to privacy@zenchronity.com. We may ask you to confirm your identity first. We answer within one month; for complex or numerous requests this may be extended by two further months, and we will tell you if it is. Requests that are manifestly unfounded or excessive may be refused or charged for, as the law allows. Requests about data your employer or a host put into the Service are passed on to them.

You also have the right to complain to a supervisory authority: in Romania, the National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro), or the authority of the EU country where you live or work. We would appreciate the chance to address your concern first.

The Service is intended for businesses and their staff. It is not directed at children under 16, and we do not knowingly collect their data. If we learn that we have, we will delete it.

We may update this policy from time to time. The current version is always at zenchronity.com/privacy, with its effective date at the top, and we will tell customers about material changes by email or in the Service.

For any question or request about your personal data, write to privacy@zenchronity.com.