Privacy policy

We at absentify GmbH (hereinafter referred to as "we," "us," or "absentify") are committed to protecting your personal data and ensuring transparency in how we collect, process, and use it. This privacy policy applies to the use of our website https://absentify.com and our SaaS application absentify.

absentify GmbH Rotachstrasse 4, 8003 Zuerich, Schweiz

Phone: +49 251 9811573777 Email: support@absentify.com

Prighter Group GmbH Neustiftgasse 83/2A, 1070 Vienna, Austria

Contact: https://app.prighter.com/portal/absentify

Prighter Ltd 20 Primrose Street, London EC2A 2EW, United Kingdom

Contact: https://app.prighter.com/portal/absentify

absentify GmbH – Data Protection Officer

Email: privacy@absentify.com

EU Supervisory Authority: You may lodge a complaint with a supervisory authority in your EU member state, particularly in the member state of your habitual residence, place of work, or place of the alleged infringement.

UK Supervisory Authority: Information Commissioner's Office (ICO) Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom Website: https://ico.org.uk

absentify is fully compliant with the General Data Protection Regulation (EU) 2016/679 (GDPR). We process personal data lawfully, fairly, and transparently in accordance with Articles 5-11 GDPR.

absentify is also compliant with the UK General Data Protection Regulation (UK GDPR) as retained in UK law under the European Union (Withdrawal) Act 2018, read together with the Data Protection Act 2018. The UK GDPR applies to processing of personal data of individuals located in the United Kingdom.

As a Swiss company, we also comply with the Swiss Federal Act on Data Protection (FADP/DSG).

absentify serves organizations in multiple countries. References to the GDPR, UK GDPR and Swiss law apply where those laws govern the processing concerned. US federal and state laws and Canadian federal and provincial laws may impose different requirements. This policy does not represent a guarantee of compliance with every law worldwide. Customers must assess the requirements applicable to their use of absentify and their employee data.

We collect and process your data in the following ways:

• Registration and account setup information
• Forms, emails, and support messages
• Absence requests, leave reasons, and uploaded documents
• Profile information entered manually

When you use Microsoft login, we receive and sync the following basic profile data:

Data Element

Purpose

First Name

User identification and display

Last Name

User identification and display

Email Address

Account identification and communication

Profile Picture

User profile display

Business phone

User profile and optional Outlook automatic replies

Mobile phone

Stored with the Microsoft profile

Data Element

Purpose

Birthday (optional)

Birthday notifications and HR insights

Employment Start/End Dates

Anniversary notifications, tenure tracking, HR reporting

Custom Employee ID

Integration with HR systems

Public Holiday Calendar

Accurate leave calculations

Regional Preferences

Localized user experience

Data Element

Purpose

Absence Requests

Core absence management functionality

Leave Allowances

Quota management and balance tracking

Department Assignments

Organizational structure and access control

Approver/Representative Assignments

Approval workflows

Work Schedules

Accurate leave calculations

Uploaded Documents

Supporting documentation for leave requests

Data Element

Purpose

IP Address

Security, fraud prevention, and legal compliance

Browser Type and Version

Technical support and optimization

Operating System

Technical support and optimization

Time of Access

Security monitoring and analytics

Referring URLs

Marketing analytics

Data Element

Purpose

Microsoft OAuth Tokens

API access for optional integrations

Encrypted, automatic renewal

Magic Link Tokens

Passwordless authentication

15 minutes, single-use

Session Cookies

Session management

30 days, AES-256 encrypted

For its own account and contract administration and support activities where it determines the purposes and means of processing, absentify acts as controller. The legal bases below apply to those activities where the GDPR or UK GDPR applies. For customer workspace data, including employee data processed through AI assistance on the customer's behalf, the customer organization acts as controller and absentify acts as processor under the Data Processing Agreement. The customer determines the applicable legal basis and meets applicable privacy and employment law requirements. Where the GDPR or UK GDPR applies, this includes Article 6 and, for health or other special-category data, an applicable Article 9 condition. The service contract with absentify is not itself a legal basis for processing an employee's data. Default settings and acceptance of the service terms do not constitute employee consent. Customers remain responsible for informing employees and meeting applicable consultation or participation requirements.

Purpose

Legal Basis (EU GDPR)

Legal Basis (UK GDPR)

Providing access to the application

Art. 6(1)(b) – Performance of contract

Art. 6(1)(b) – Performance of contract

Ensuring functionality and security

Art. 6(1)(f) – Legitimate interest

Art. 6(1)(f) – Legitimate interest

AI assistance using customer workspace data

Customer instructions under the DPA; the customer determines the legal basis under applicable law, including Articles 6 and 9 GDPR / UK GDPR where applicable

Customer instructions under the DPA; the customer determines the legal basis under applicable law, including Articles 6 and 9 GDPR / UK GDPR where applicable

Support and customer service (including AI-assisted ticket handling)

Art. 6(1)(f) – Legitimate interest

Art. 6(1)(f) – Legitimate interest

Support-ticket signals for customer relationship management (for example upgrade or cancellation interest)

Art. 6(1)(f) – Legitimate interest

Art. 6(1)(f) – Legitimate interest

Newsletter and marketing (with consent)

Art. 6(1)(a) – Consent

Art. 6(1)(a) – Consent

Product analytics and improvements

Art. 6(1)(f) – Legitimate interest

Art. 6(1)(f) – Legitimate interest

Legal compliance and record-keeping

Art. 6(1)(c) – Legal obligation

Art. 6(1)(c) – Legal obligation

Legitimate Interest Assessment: Where we rely on legitimate interests, we have conducted balancing tests to ensure our interests do not override your fundamental rights and freedoms. You may request details of these assessments by contacting privacy@absentify.com.

Withdrawal of Consent: Where processing is based on consent, you may withdraw your consent at any time with effect for the future by contacting privacy@absentify.com or using the unsubscribe link in marketing communications.

We carefully select subprocessors who meet our security and data protection standards. All subprocessors operate under Data Processing Agreements (DPAs) in compliance with GDPR.

We engage the providers listed on our subprocessor page under the applicable data processing arrangements. The list describes service locations and purposes; provider security processing and international transfers are addressed in this policy and the DPA. The current list of approved subprocessors, including their locations and purposes, is available at:

https://absentify.com/subprocessors

We notify authorized customer contacts of changes to subprocessors in writing or text form, by email or an in-app notice, at least 30 days before the change takes effect. Publication of the subprocessor list alone is not notice to the customer. Customers may raise reasonable, documented data-protection objections within 14 days after notification, without limiting longer periods or other rights under the applicable DPA, an individual agreement or mandatory law.

Primary application hosting is in the European Union. The following locations describe the application database and logging services; AI processing is described separately in section 17:

Data Type

Primary Location

Backup Location

Customer Data

North Europe (Ireland)

EU paired region (geo-redundant)

Application Logs

North Europe (Ireland)

–

Audit Logs

North Europe (Ireland)

–

AI prompts / completions

Microsoft Azure AI services (see section 17)

–

The European Commission has adopted an adequacy decision for the United Kingdom, recognizing that the UK provides an adequate level of data protection. This adequacy decision was renewed on December 19, 2025 for a period of six years (until 2031). We monitor this status and will implement appropriate safeguards if necessary.

For any transfers to countries outside the EU/EEA/UK/Switzerland without an adequacy decision, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) as approved by the European Commission
• UK International Data Transfer Agreement (IDTA) or UK Addendum to EU SCCs where required
• Technical and organizational security measures
• Transfer Impact Assessments where required

You may request a copy of these safeguards at privacy@absentify.com.

You have the following rights regarding your personal data:

Right

Description

Reference

Right to Access

Obtain confirmation of processing and a copy of your data

Art. 15 GDPR

Right to Rectification

Correct inaccurate or incomplete data

Art. 16 GDPR

Right to Erasure

Request deletion of your data ("right to be forgotten")

Art. 17 GDPR

Right to Restriction

Restrict processing in certain circumstances

Art. 18 GDPR

Right to Data Portability

Receive your data in a structured, machine-readable format

Art. 20 GDPR

Right to Object

Object to processing based on legitimate interests

Art. 21 GDPR

Right to Withdraw Consent

Withdraw consent at any time

Art. 7(3) GDPR

Right Not to be Subject to Automated Decision-Making

Not be subject to decisions based solely on automated processing

Art. 22 GDPR

Right to Lodge a Complaint

File a complaint with a supervisory authority

Art. 77 GDPR

To exercise your rights, please contact us at:

• Email: privacy@absentify.com
• Phone: +49 251 9811573777

Where the GDPR or UK GDPR applies, we respond within one month of receipt; a further two months may be available where legally permitted due to complexity or the number of requests, with the required notification. Other requests are handled within the deadlines and procedures required by the applicable law.

We verify identity and authority where necessary and permitted by applicable law. Any refusal, limitation or fee is subject to that law. Under the GDPR or UK GDPR, a reasonable fee or refusal may apply to manifestly unfounded or excessive requests where the statutory conditions are met.

Where applicable US state privacy law, including California law, grants you rights, these may include access or knowledge, correction, deletion, portability, opt-out of sale, sharing or targeted advertising, limits on certain uses of sensitive information, and appeal of a denied request, subject to the relevant law and its exceptions. You may exercise applicable rights without unlawful discrimination. Contact privacy@absentify.com. For customer workspace data, contact your organization; absentify assists it under the DPA. For that data, absentify acts as a service provider or processor where applicable and does not sell it, share it for cross-context behavioral advertising, or use it for targeted advertising. This statement concerns customer workspace data; website cookies and analytics are addressed separately in section 9.

For Canadian customers, processing in the EU, Switzerland and other countries described in this policy takes place outside Canada. Information may be accessible to foreign courts, law enforcement or national security authorities under applicable law. The customer remains responsible for lawful authority, transparency and any required assessment before outsourcing, including a privacy impact assessment for transfers outside Quebec where applicable. Applicable federal or provincial law may provide access, correction, consent-related or complaint rights, subject to legal exceptions. Contact your organization for customer workspace data, or privacy@absentify.com for absentify's own processing and information about our cross-border practices. You may also contact the competent Canadian privacy authority.

We retain your data only as long as necessary to fulfill the purposes for which it was collected or to meet legal requirements.

Data Type

Retention Period

Notes

Customer Application Data

Until account deletion

Deleted immediately upon account deletion

Backup Data

Maximum 14 days

Geo-redundant backups, then permanently deleted

Financial Records

Managed by Paddle

Subject to Paddle's GDPR-compliant policies

Application Logs

30 days

Azure Log Analytics

Security Audit Logs

365 days

Immutable storage for compliance

Database Audit Logs

30 days

Azure Log Analytics

Key Vault Access Logs

365 days

Immutable storage

Email Communications

12 months

Unless part of legal/audit matter

AI conversations: Questions and answers in the product assistant are stored in absentify to provide conversation history. We retain them for the relevant service purposes, taking into account the customer's instructions, account deletion and applicable legal obligations. Disabling workspace data access does not erase existing history. Contact support@absentify.com for deletion requests; employees should contact their organization's administrator for requests relating to customer workspace data. Separate retention and security processing by Microsoft are governed by its applicable terms as described in section 17.

When data is no longer required, it is securely deleted using industry-standard data destruction methods that ensure the data is not recoverable.

Our website and application use cookies for the following purposes:

Category

Purpose

Legal Basis

Essential Cookies

Core functionality, security, session management

Art. 6(1)(f) – Legitimate interest

Analytics Cookies

Product improvement and usage analytics

Art. 6(1)(a) – Consent

Marketing Cookies

Personalized advertising (if applicable)

Art. 6(1)(a) – Consent

We use PostHog, Inc. (EU Cloud) for product and usage analytics. The configured cloud service location is Frankfurt am Main, Germany. Analytics may include information relating to users or accounts. Provider security processing and any international transfers are addressed in sections 5 and 6 and the applicable provider terms.

You can manage your cookie preferences through:

• Our cookie consent banner
• Your browser settings
• Our cookie settings page

Certification

Status

ISO 27001

Certified (Information Security Management System)

Microsoft 365 App Certification

Certified

Microsoft Azure Compliance

ISO 27001, ISO 27017, ISO 27018, SOC 1/2/3

We have implemented comprehensive security measures to protect your data:

Encryption:

• At Rest: AES-256 encryption for all databases, storage, and backups
• In Transit: TLS 1.2+ enforced on all connections, HTTPS-only with HSTS

Network Security:

• Private endpoints for all sensitive services (no public IP addresses)
• Web Application Firewall (WAF) with OWASP protection
• DDoS protection with rate limiting
• Dedicated Virtual Network with subnet segmentation

Access Control:

• Role-based access control (RBAC)
• Multi-factor authentication (MFA) for production access
• Principle of least privilege
• Regular access reviews
• Direct database access restricted to top management only

Monitoring:

• Microsoft Defender for Cloud for real-time threat detection
• Continuous security monitoring and alerting
• Immutable audit logs retained for 365 days

Incident Response:

• Documented security incident response procedure
• 72-hour breach notification to supervisory authorities (where required)
• Regular penetration testing and vulnerability assessments

For customers using absentify in a business context, we provide a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR / UK GDPR.

The DPA is available at: https://absentify.com/dpa

The DPA includes:

• Standard Contractual Clauses (SCCs) for international transfers
• Technical and Organizational Measures (TOMs)
• ISO 27001 certificate as an appendix
• List of subprocessors

absentify integrates with Microsoft 365 for authentication and optional features.

We follow the principle of minimal data access.

Permission

Purpose

email

View users' email addresses

openid

Sign users in

profile

View users' basic profile

User.Read

Sign in and read user profile

Each optional feature uses a separate Azure AD app registration to ensure minimal permission scope:

Feature

Permissions

What We Do

What We Do NOT Do

Calendar Sync

Calendars.ReadWrite

Create/update/delete absence events only

Read existing appointments

Out-of-Office

MailboxSettings.ReadWrite

Set automatic replies only

Access emails or mailbox content

Manager Sync

User.Read.All

Read manager relationships and the profile fields listed in section 3.2

Read other directory data such as salary or personnel files

Group Sync

Group.ReadWrite.All, Directory.Read.All

Read group memberships only

Access files, chats, or group content

Our Commitment:

• We only request permissions necessary for each feature
• We only read the specific data fields required
• We only store what is absolutely necessary
• We never modify your Microsoft tenant beyond the stated purpose

All payment processing is handled by Paddle.com Market Limited, acting as our Merchant of Record.

• absentify does not store payment card details, bank information, or billing addresses.
• We only store reference IDs to Paddle records.
• Paddle is PCI DSS compliant and GDPR compliant.

For billing inquiries: https://paddle.net Paddle Privacy Policy: https://www.paddle.com/legal/privacy

absentify is a business-to-business (B2B) service designed for organizational use. We do not knowingly collect personal data from children under 16 years of age. If you believe we have inadvertently collected such data, please contact us immediately at privacy@absentify.com.

We may update this privacy policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors.

• Material changes will be communicated via email to registered users and/or via notice in the application.
• The "Last updated" date at the top of this policy indicates when it was last revised.
• We encourage you to review this policy periodically.

For questions or concerns regarding data protection or this privacy policy, please contact:

Data Protection Officer absentify GmbH Rotachstrasse 4, 8003 Zuerich, Schweiz

• Email: privacy@absentify.com
• Phone: +49 251 9811573777
• General Support: support@absentify.com

absentify uses Microsoft Azure AI services for product assistance and, separately, support operations. The product assistant and its workspace data access are available across plans; other AI functions, such as translation, may depend on your plan. Configured Azure OpenAI deployments process model inference in the EU Data Zone. This describes model inference, rather than every processing operation of absentify or its providers. Microsoft processes data under the Microsoft DPA and applicable service terms. Under those terms, customer prompts and outputs are not used to train or improve foundation models. Security and abuse monitoring may involve retention and review by authorized personnel.

AI assistance is a standard part of absentify in the application and Microsoft Teams. AI access to workspace data is enabled by default for newly created workspaces. Existing workspaces retain their current setting. Administrators can turn workspace data access off or on at any time under Settings > Microsoft > Azure AI integration.

• When workspace data access is enabled and an AI function is used, absentify can retrieve relevant data within the user's application permissions and send it to Microsoft Azure AI services. Depending on the request, this may include member profiles, absence information, leave types, allowances, schedules, and company settings.
• Absence information and messages can contain health-related or other sensitive personal data. The customer determines whether and on what legal basis this processing is permitted under applicable law.
• Turning workspace data access off stops automatic retrieval of workspace data for the product assistant and prevents earlier conversation content containing automatically retrieved workspace data from being reused as AI context. General help chat remains available. Questions and any personal or company information users enter themselves are still sent to Microsoft Azure AI services.
• Questions and answers are stored in absentify as conversation history. Turning workspace data access off does not delete stored conversations. Retention and deletion are described in section 8.
• The assistant can perform actions expressly requested by a user, including creating, approving, declining, or cancelling absence requests, within that user's permissions. Requested changes are shown for user confirmation before execution. Outputs may be incomplete or inaccurate and must be checked. The assistant is not intended to make independent employment decisions; existing permissions and approval workflows apply.

Independently of the product's workspace data access setting, we may use Microsoft Azure AI services to classify and summarize support messages, identify routing and customer relationship signals (such as upgrade or cancellation interest), and help support staff prepare replies.

• This covers support messages and associated metadata, including information, screenshots, or documents you submit yourself.
• To resolve a support request, authorized support staff may select relevant ticket history, workspace and member data, and technical diagnostic information for AI assistance. The product's workspace data access setting does not govern this support processing.
• Suggested replies are reviewed by support staff before being sent. Customer relationship signals may be used in our customer relationship management processes.
• Where the GDPR or UK GDPR applies to our own support and customer relationship activities, we rely on Article 6(1)(f), our legitimate interest in efficient support and managing customer relationships. Customer workspace data processed on the customer's behalf is subject to the DPA and customer instructions. The customer remains responsible for any legal basis and additional conditions required under applicable law, including for employee health data.

Your rights are described in section 7. Provider and security details appear in our DPA and subprocessor list.

Customer relationship management may include account and usage metadata, upgrade or cancellation signals and relevant support previews. Those previews may contain customer-provided content. Processing is limited to the relevant support or customer relationship purpose and authorized access. Employee and workspace content processed on the customer's behalf remains subject to the DPA; its inclusion in a support or CRM system does not by itself change the parties' roles.