Last updated: date
1. Who we are
Vacaydiary Limited (“Vacaydiary”, “we”, “us”) provides HR software to businesses. We are registered in England and Wales, company number 17322035, at The Conductor, 8 Westfield Avenue, London E20 1NW. ICO registration number: add.
You can contact us about privacy at privacy@vacaydiary.com.
2. Two different roles
When we are the controller. We decide how your personal data is used when you visit our website, contact us, sign up for a trial, pay us, or ask for support. This policy covers that data.
When we are a processor. A business using Vacaydiary controls the employee data it puts into the app. We process that data on its behalf under our data processing agreement.
If your employer uses Vacaydiary, its privacy notice explains how it uses your data. Contact your employer first with questions. We will help it respond.
3. What we collect and why
| What | Examples | Why we use it | Legal basis |
|---|---|---|---|
| Contact details you give us | Name, work email, company name, company size, your message | To reply to you and arrange demos | Legitimate interests |
| Account details | Name, work email, job title, password (stored scrambled), sign-in with Google or Microsoft if you choose it | To create and secure your account | Contract |
| Company details | Company name, country, time zone, working week, departments | To set up your workspace | Contract |
| Billing details | Billing contact, company name, number of people, plan, invoices | To charge for the service. Card details are collected and held by Stripe, not by us | Contract and legal obligation (tax records) |
| Support requests | Your report, any files you attach, a screenshot of the page you were on, the page address | To fix problems and answer questions | Legitimate interests |
| Service emails | Emails we send you, and whether they bounced | To deliver account and service messages | Contract |
| Technical and usage data | Errors, device and browser type, pages used in the app, click and scroll positions | To find and fix errors and keep the service secure | Legitimate interests |
| Session recordings (only if switched on) | A recording of how the app was used, with all text, typing and images hidden, and a choice to decline | To understand and fix problems. Off unless a workspace switches it on | Consent |
| Website analytics and cookies | See section 4 | To understand how the website is used | Consent, where required |
We do not sell personal data, and we do not use it for advertising profiles.
4. Cookies
Our website and app use cookies and similar technologies. Some are needed to make them work, such as keeping you signed in and protecting payments. Others, such as analytics, are only used if you agree. Our cookie policy lists them and explains how to change your choice.
5. Who we share data with
We use a small number of suppliers to run Vacaydiary. Each one only gets what it needs.
| Supplier | What they do | Where |
|---|---|---|
| Contabo. Ask the developer to confirm | Hosts the server that runs Vacaydiary, including the database, files, e-signing and email | UK. Ask the developer to confirm the region |
| Stripe | Takes payments and stores card details | UK, EU and US, confirm |
| PostHog | Error tracking, and session recordings where a workspace switches them on | EU |
| Google or Microsoft | Only if you choose to sign in with them | Their own locations |
| Cloudflare. Ask the developer if it is used | Network and security services | Global |
| Backup storage provider. Ask the developer which one | Encrypted offsite backup copies | confirm |
We may also share data if the law requires it, to protect our rights, or with a buyer if our business is sold (in which case this policy would continue to apply).
If you connect an AI assistant to your workspace, the data it reads goes to the AI provider you chose, under your own agreement with them.
6. International transfers
Some suppliers may process data outside the UK. Where they do, we rely on UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Confirm per supplier.
7. How long we keep data
| Data | How long |
|---|---|
| Enquiries from people who don’t become customers | 12 months after our last contact |
| Account and workspace data | For as long as you are a customer, then 90 days so you can export it, unless you ask us to delete it sooner |
| Billing records | Six years, for tax and accounting |
| Support requests | 2 years |
| Technical and error data | 12 months |
8. How we protect data
Each company’s data is kept separate in our database, and access depends on people’s roles. Changes are recorded in an audit log, and backups are encrypted. Read more on our security page.
9. Your rights
You have the right to:
- ask for a copy of your personal data
- ask us to correct it
- ask us to delete it
- ask us to restrict how we use it, or object to it
- ask us to move it to another provider
- withdraw consent at any time, where we rely on consent
To make a request, email privacy@vacaydiary.com. We will reply within one month. If you are an employee of one of our customers, please contact your employer, who controls your HR data.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We’d appreciate the chance to put things right first.
10. Changes to this policy
When we change how we use personal data, we’ll update this policy and the date at the top. We’ll email customers about significant changes.