Privacy Notice

Controller and processor

Plana is provided by Kasvu SK Oy (Business ID 3143367-7, Diakonissantie 7 B 1, 02940 Espoo).

Plana involves two roles:

• When your company manages its employees' shifts, working hours and pay data in Plana, your company is the controller of that data, and Kasvu SK Oy processes it in accordance with the data processing agreement concluded with you (processor).
• Kasvu SK Oy is the controller of user accounts, subscriptions, payments and usage data of this website.

What data we process

• User account: email, name and sign-in details (the password is stored only in irreversible form in the authentication service).
• Company and locations: name, opening hours, scheduling settings.
• Employee data: name, contact details (phone, email), employment details, contracted hours, pay and tax card details.
• Shifts and working hours: rosters, clock-in and clock-out times and corrections, clocking device identifier.
• Absences: only the type of absence, no diagnosis. Sick leave certificates are stored separately and can be seen only by the employee themselves and by the owner and manager.
• Phone push token (for shift notifications).
• Subscription and payments: plan and billing details. Card details are processed by Stripe; we do not see them.

Purpose and legal basis of processing

• Providing the Plana service (shift scheduling, working hours, payroll calculation, notifications): performance of the customer contract (Article 6(1)(b) of the EU General Data Protection Regulation).
• Supporting the employer's statutory record-keeping obligations for working time, annual leave and pay: the employer's legal obligation (point (c)).
• Security of the service, prevention of misuse and troubleshooting: legitimate interest (point (f)).
• We do not carry out profiling for marketing purposes, we do not sell data and we do not use it for advertising.

Processors and data location

• Supabase: database, sign-in and files. Data is stored in the EU (Stockholm, Sweden).
• UpCloud (UpCloud Oy, Finland): website server. The server is located in the EU (Stockholm, Sweden).
• Netlify: backup server for the website, used only during service disruptions.
• Resend: email (invitations, rosters), sending region EU (Ireland).
• Stripe: subscription payments.
• Expo, Google (Firebase Cloud Messaging) and Apple: delivery of notifications to the employee's phone; only the push token and the content of the notification.
• Cloudflare: domain name service.
• Sentry (Functional Software, Inc.): error reports and service availability monitoring. Data is stored in the EU (Frankfurt, Germany); personal data and sign-in credentials are removed from error reports before sending. Transfers to the United States rely on the Data Privacy Framework or standard contractual clauses.
• Auto-schedule calculations are performed on Talous SK's own server, not by third parties.

Transfers outside the EU

The database and files are located in the EU. Some of the service providers listed above are based in the United States; for their processing, transfers are based on the standard contractual clauses approved by the European Commission or on the EU-U.S. Data Privacy Framework.

Retention periods

• Rosters, working time records, annual leave records and consents to shift changes: 3 years from the end of the employment (the limitation period for claims under the Working Hours Act is 2 years from the end of the employment, plus a one-year safety margin), after which the data is anonymized automatically: the figures are kept, the person is not.
• Sick leave certificates: until the end of the year following the year in which the absence ended, after which they are deleted automatically.
• Tax card details: deleted when the employee's data is anonymized.
• Accounting records are retained in accordance with the Accounting Act by the party responsible for the bookkeeping.
• User account: until the account is deleted.

Rights of the data subject

You have the right to access your data, to request its rectification or erasure, to restrict processing, to object to processing and to receive your data in a commonly used format.

If you are an employee, please direct requests concerning shifts and working hours to your employer (the controller); we assist the employer in handling them.

If you consider that the processing of your data infringes the law, you may lodge a complaint with the Office of the Data Protection Ombudsman.

You can delete your Plana user account yourself: in the app (Me → Delete account) or on the Account deletion page. Deletion permanently removes your sign-in details. Your employer retains shift and working time data for the period stated under Retention periods.

Deleting your Plana account

Data security

• All data traffic is encrypted.
• Each company's data is isolated from the others, and each user sees only the data their role permits; these rules are enforced at the database level.
• Changes to working hours, approvals and access rights are logged.

Cookies

We use only cookies that are strictly necessary for the website to function (sign-in, language and your cookie choices). We do not use analytics or advertising cookies. The full list is on the Cookies page.

Contact details

Questions and requests concerning data protection: Kasvu SK Oy, info@planavuorolista.fi.

Updates to this notice

We update this notice when the service or the legislation changes, and we mark the date at the top of the page. We will notify customers of material changes in advance.