Privacy Notice

Filax is provided by [company legal name], a company registered in [country of registration] under number [registration number], whose registered office is at [registered office address].

When we handle personal data for our own purposes, as described under “What this notice covers”, we are the controller: we decide why and how that data is used. You can reach us about it at hello@filax.io.

We have not appointed a data protection officer. Questions about personal data are answered by the people who run Filax, at that address.

We handle personal data in two different roles.

• Data in the Service. If your employer uses Filax, your employer is the controller of your personal data in the Service and we act as its processor. That means we hold and use that data only to provide the Service, on your employer’s instructions, under a contract that requires us to protect it. Your employer decides what goes into the Service and who in the organisation can see it, and its own privacy notice to you applies as well.
• Data we handle for ourselves. We are the controller of the personal data of people who contact us or visit filax.io, and of the people who look after an organisation’s account with us: the details we need to answer questions, arrange a trial, send invoices and keep the Service secure.

This notice describes both, so that everyone whose data is in Filax can see what happens to it. For how your employer uses your data in the Service, and to exercise your rights over it, please contact your employer first.

In the Service, for the organisations that use it:

• Staff details: your name, email address, phone number, job role, the departments you work in, your contract type and hours, your start and end dates, your annual leave entitlement, the expiry dates of certificates your employer records, and your language and notification settings.
• Account details: your role in the Service, such as manager, department admin or staff member, who invited you and when, and the information needed to sign you in and keep you signed in.
• Rotas and requests: the shifts you are given, the days you would prefer or cannot work, shift swaps and offers to cover shifts, leave and sickness absences with their dates and status, and the notes and reasons written with any of them.
• Messages: the notifications the Service shows you, and a record of each email and text message it sends you: what it was about, the address or number it went to, and whether it was sent.
• Records of changes: who changed a rota, a shift, a request or a setting, when, and what it was before and after.

For ourselves:

• When you contact us: your name, your email address or telephone number, the organisation you work for, what you write to us, and — when you ask us to call you back — the best time to call.
• For an organisation’s account: the names and contact details of the people who look after it, and the information needed to invoice it.
• When you visit filax.io: the technical information your browser sends with every request, such as your IP address and browser type, which our hosting provider uses to deliver the pages and protect them from abuse.

Giving us your own details is not required by any law, and you are free not to. But we need them for what they are for: without an email address we cannot answer you, and without the details of the people who look after an organisation’s account we cannot set it up or invoice it.

The Service is built for staffing. It is not built to hold patient information or clinical records.

Data in the Service. We use it only to provide the Service to your employer: to plan, check and publish rotas; to handle leave, sickness absences, swaps and offers to cover shifts; to send notifications by email and, where they are switched on, by text message; to keep a record of changes; and to keep the Service secure and working. Your employer decides the legal basis for this. It will usually be that the processing is necessary for your employment contract, for your employer’s legal obligations, such as keeping records of working time, or for your employer’s legitimate interest in running its rotas well.

Data we handle for ourselves. We use it:

• to answer your questions, and to arrange a trial or a call you ask for: our legitimate interest in responding to the people who contact us (Article 6(1)(f) GDPR);
• to set up and manage an organisation’s account, and to invoice it: our contract with that organisation, and our legal obligations, such as keeping accounting records (Article 6(1)(b) and (c) GDPR);
• to keep the Service and our website secure, and to prevent and investigate misuse: our legitimate interest, and yours, in a service that is safe to use (Article 6(1)(f) GDPR);
• to tell the people who look after an account about changes to the Service or to our terms: our contract with their organisation (Article 6(1)(b) GDPR); and
• to comply with the law, and to establish, exercise or defend legal claims: our legal obligations and our legitimate interests (Article 6(1)(c) and (f) GDPR).

We do not sell personal data, and we do not use it for advertising.

A record that someone is off sick is health data, which the GDPR treats as a special category of personal data and protects more strictly.

When you report that you are sick, or a manager records a sick call for you, the Service keeps the dates of the absence, the fact that it is sickness, whether it has been approved, and any note or reason written with it. It does not ask for a diagnosis, and notes should not include one: it is not needed to plan a rota.

Managers and admins in your organisation can see the absence in the Service, and those who can approve it are told when it is waiting, by email and, where it is switched on, by text message. You are told when it is approved or declined. Other staff cannot see why you are absent: when your shift is offered to colleagues to cover, they are not told the reason.

Your employer is the controller of this data and must have a lawful condition for processing it, which will usually be its obligations and rights in the field of employment law. We process it only as your employer’s processor, to provide the Service, and never for any purpose of our own.

• Your employer: the managers and admins who run the Service add your name, contact details, job role, departments and contract details, and invite you to sign in.
• You: when you use the Service, for example to give your availability, ask for leave, report that you are sick, offer or accept a swap, or change your notification settings.
• Your managers and colleagues: the shifts you are given, the decisions on your requests and the reasons for them, the swaps and cover offered to you, and sick calls recorded for you.
• The Service itself: the records of changes, the messages it sends, and the information needed to sign you in.
• People who contact us: the information they choose to send us.

Inside your organisation. The Service shows each person only what their role allows. Staff see their own details, requests and notifications, the published rota, and the name, job role and phone number of colleagues in their departments. Managers and admins see the organisation’s staff, rotas and requests. Each organisation’s data is kept apart from every other’s: no other customer can see it.

Our service providers. We use these providers to run Filax. Each acts only on our instructions, under its own data processing terms, which hold it to what the GDPR requires of a processor.

• Supabase: the database that stores the Service’s data, and the system that signs people in.
• Vercel: hosts the website and the Service, and runs the scheduled tasks that send notifications.
• Resend: sends the Service’s emails, including sign-in codes, invitations and notifications, and brings us the call-back requests made on filax.io.
• Twilio: sends text messages, for organisations that have text messages switched on.
• Namecheap: forwards the emails you send to hello@filax.io into our own mailbox.

Others, only where needed. Our professional advisers, such as lawyers and accountants, who are bound by confidentiality; public authorities, courts and regulators, where the law requires it; and, if our business is sold or reorganised, the buyer, who must protect the data as this notice describes.

Filax runs on Supabase and Vercel, and sends its email through Resend. All three are companies based in the United States, and personal data in the Service may be processed both in the European Economic Area and in the United States.

Some of our providers are companies based in the United States, and may access or process personal data there, for example to give support. Whenever personal data is transferred outside the European Economic Area, we make sure it is protected as the GDPR requires: by an adequacy decision of the European Commission, such as the EU–US Data Privacy Framework for providers certified under it, or by the European Commission’s standard contractual clauses. You can ask us at hello@filax.io for a copy of the safeguards that apply.

• Data in the Service is kept for as long as your employer uses Filax, unless your employer asks us to delete it sooner. When someone leaves and their employer deactivates their account, they can no longer use the Service, but their past shifts and requests stay part of the employer’s records. The record of changes — who changed a rota, a shift or a request, and when — is kept for as long as your employer uses Filax: it is what shows who published or changed a rota that people worked to.
• The record of messages sent to you — what an email or text was about, where it went and whether it was sent — is kept for as long as your employer uses Filax.
• When an organisation stops using Filax, it can ask for a copy of its data for 30 days. We then delete the data as our Terms of Service describe: from the Service within 30 days, and from backups as they are overwritten in the normal course. Afterwards we keep only our own record of what we did for the organisation, such as approving it, taking its notice, sending its copy and deleting it, which names the organisation and nobody who worked there.
• Messages you send us, and the call-back requests made on filax.io, are kept for 12 months after our conversation ends, unless they become part of an agreement with your organisation.
• Account and invoicing records are kept for as long as tax and accounting law requires us to keep them.
• Technical logs are kept by our hosting provider on its own schedule, which we do not extend, and are deleted when it ends.

We use technical and organisational measures suited to the sensitivity of the data, including:

• access rules enforced by the database itself, which keep each organisation’s data apart and let each person see only what their role allows;
• sign-in without passwords: we email a one-time code or link, so there is no password to guess or steal;
• signing a person out on every device when their employer deactivates their account;
• encryption of data as it travels between your device and the Service;
• a record of who changed what, and when; and
• access at Filax only for the people who need it to run and support the Service, who are bound by confidentiality.

No system is completely secure. If a personal data breach affects data in the Service, we will tell your employer without undue delay. If it affects data we handle for ourselves, we will tell the supervisory authority, and you where the law requires.

Under the GDPR, you have the right to:

• access the personal data held about you, and get a copy of it;
• have it corrected if it is inaccurate or incomplete;
• have it erased, for example when it is no longer needed for the purpose it was collected for;
• restrict how it is used, for example while its accuracy is being checked;
• data portability: receive the data you provided in a structured, commonly used and machine-readable format, and have it sent to another organisation;
• object to its use where that use is based on legitimate interests; and
• withdraw your consent at any time, where the use is based on consent.

These rights have conditions and exceptions, so not every right applies in every case.

For data in the Service, please make your request to your employer, which is the controller. If you send it to us, we will pass it on to your employer and help it respond. For data we handle for ourselves, write to us at hello@filax.io. We will reply within one month, and tell you if we need longer, as the law allows for complex requests. We may ask you to confirm your identity first.

You also have the right to complain to a data protection supervisory authority. In Cyprus, that is the Commissioner for Personal Data Protection (dataprotection.gov.cy). You can also complain in the EU country where you live or work. We would welcome the chance to deal with your concern first.

We use no cookies for analytics or advertising, and nothing on filax.io tracks you. Opening a page, signed in or not, sets no cookies at all. The one thing every visitor’s browser is asked to store is a copy of our offline page (filax-shell-v1, in its cache), so that the site can say plainly when there is no connection. It holds that one page: no rota, and nothing about you.

When you sign in, your browser also stores what the Service needs to work:

• Sign-in cookies (sb-…-auth-token): keep you signed in, for up to 400 days unless you sign out. A related cookie is used only while you complete a sign-in link.
• Your preferences (filax-prefs-v1, in your browser’s local storage): your language, how compact the rota looks, and the department you last opened.

These are strictly necessary to provide the site and the Service you use, so they do not need your consent. You can delete them in your browser’s settings; if you delete the sign-in cookies, you will be signed out.

The Service helps people decide: it checks rotas against the rules your employer sets up, warns when a rota breaks one, and works out who is eligible to be offered a shift that needs cover. It does not make decisions about you based solely on automated processing that have legal effects on you or affect you in a similarly significant way. People at your employer publish every rota, and decide every leave request, sick call and swap.

Filax is a service for organisations and the people who work for them. It is not meant for children, and we do not knowingly collect personal data about children.

We may update this notice from time to time, for example when we add a feature or change a provider. The date at the top of this page shows when it last changed. If a change materially affects how we handle personal data, we will tell the organisations that use Filax before it takes effect, and, where it affects data we handle for ourselves, we will tell the people concerned directly where we can.

For questions about this notice or your personal data, or to exercise your rights over data we handle for ourselves, email us at hello@filax.io, or write to [company legal name], [registered office address]. For data in the Service, you can also contact your employer directly.