Deutsche Version

Back to overview

LeaveFlow: Privacy and GDPR

This page describes what LeaveFlow stores, for how long and how former employees are anonymized. It is not legal advice.

LeaveFlow runs on your own infrastructure. There is no vendor service that data is sent to. Outbound connections only result from features you set up yourself (see below).

Retention period

You set the retention period under Admin → Organisation → Company settings in the field "GDPR retention period (months)". The default is 36 months, 1 to 360 months are allowed. The period starts with the employee's exit date.

Anonymization

Anonymization is strictly manual. There is no daily scheduler for it and no advance warning before the due date.

1. Open Admin → System → GDPR Anonymization (/admin/anonymization).
2. The section "Due for anonymization" lists all former employees whose exit date plus retention period has been reached, with "Due since".
3. Click Anonymize and confirm in the dialog with Anonymize now. The action cannot be undone.

Completed cases appear in the section "Already anonymized". LeaveFlow refuses to anonymize before the period has elapsed and for active employees.

Anonymization changes only the employee record and the linked user account. Employee number, join and exit dates, leave requests, leave balances and absence data are kept for statistics. Notifications that were already sent and the reasons in decision histories are not cleaned up separately.

The interface offers no function to delete employees or users completely. If you must remove the complete record, you have to do it in the database.

Employee exit

Under Admin → Organisation → Employees, Exit employee... starts the exit dialog: you set the exit date and choose the "Remaining leave policy" (leave payout, mandatory consumption before exit, or paid release from work). If the date is today or in the past, the user account is deactivated immediately, for a future date the job exit-deactivation-check does it. LeaveFlow shows the remaining balance and a note about the chosen policy. The policy is information for you: LeaveFlow books neither a payout nor a release from work.

You set the default policy in the company settings. The option "Paid release from work (Freistellung)" can only be selected there if an absence type named Freistellung exists.

What data LeaveFlow stores

Health-related data

Absence types with the property "Counts toward the 6-week illness threshold" (called "Krankheit" in the demo data) can represent illness. Note where this is visible:

• The team calendar shows all signed-in users approved and recorded absences with name and absence type, including illness. Every user can switch the team in the filter.
• The Slack command /team-abwesend lists, for every user with a linked Slack account, all approved and recorded absences of the company that are active today, with name and absence type, including recorded illness. The list is limited to 25 entries.
• The personal iCal feed contains the user's own approved and recorded absences. The team feed contains approved absences only, recorded illness is not part of it.
• The admins' statistics dashboard names the currently absent employees.
• When someone reaches 42 consecutive calendar days, LeaveFlow notifies the team lead, otherwise the deputy, otherwise all admins, with name, employee number and period.

The team calendar offers no restriction of visibility by role or department. Take that into account in your privacy assessment.

Statistics and anonymity

The statistics dashboard hides departments with fewer than 3 active employees in the charts (anonymity threshold). The PDF export carries the note "anonymisierte Auswertung".

Access protection

External connections

The pages load their scripts and stylesheets from your own instance, there are no embedded trackers or third-party fonts. Outbound connections only occur in these cases:

• When setting a password through a reset link, LeaveFlow checks the password against a list of known data breaches (Have I Been Pwned service, only a hash prefix is transmitted).
• Slack: names, absence types and periods of requests go to the Slack API when you enable the integration.
• Microsoft Teams: the same applies to the webhook URL you enter.
• Google and Microsoft Entra ID: sign-in runs through the providers' servers.
• LDAP and SMTP: connections to the servers you configure.

Exports