Privacy policy
1 Who processes your data
This policy covers two situations:
- the planifast.com website, for which PLANIFAST SARL is the controller;
- the Planifast application, in which PLANIFAST SARL processes its customers' employee data on their behalf, as processor. Each employer customer is the controller.
2 Data collected on the website
The demo request form collects:
- the company name;
- the contact's first and last name;
- the work email address;
- on the Demo page, and only if you provide them, the number of employees and the modules you are interested in.
This data is only used to answer your request and present Planifast to you. Legal basis: pre-contractual steps taken at your request (article 6.1.b GDPR). It is never sold or passed on to third parties for marketing.
The form is handled by Formspree (United States), which forwards requests by email. The website is hosted by Vercel, which keeps technical connection logs (IP address, requested page) for service security.
The website sets no analytics or advertising cookies and loads no third-party resources when displayed: the font is hosted on the site itself.
3 Data processed in the application
Depending on the modules switched on by the employer, the application processes in particular: identity and work contact details, contract data, absences and leave, attendance and hours, expense claims and receipts, reviews, HR documents, and, for the Onboarding and offboarding module, personal information (address, bank account, family situation, emergency contact, residence permit) visible only to HR and the employee concerned.
Employees exercise their rights with their employer, whom PLANIFAST SARL assists in answering.
4 Subprocessors and transfers
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | Data in Paris (France), US company |
| Vercel | Hosting of the application and website | Processing in Paris (France), US company |
| Anthropic | Reading expense receipts | United States |
| Resend | Sending notification emails | United States |
| Google Firebase | Mobile notifications (iOS and Android) | United States |
| Formspree | Website demo form | United States |
Transfers of data outside the European Union are covered by these providers' data processing agreements, based on the standard contractual clauses adopted by the European Commission (decision 2021/914). Bank details read during onboarding are processed on the employee's device: the image is not sent to any provider.
5 Retention periods
- Demo requests: 3 years from the last contact.
- Application data: for the term of the contract, then 30 days to allow export, before deletion, subject to periods specific to certain documents (for example 10 years after exit for the employee file, 10 years for payslips, 3 years after exit for the residence permit, 30 days for diplomas and fitness certificates), applied by automatic deletion.
6 Your rights
You have the right of access, rectification, erasure, restriction, portability and objection. Write to contact@planifast.com: I answer within one month.
You can also lodge a complaint with the data protection authority of your country:
- Luxembourg : National Commission for Data Protection (CNPD), cnpd.public.lu
- Belgium : Data Protection Authority (APD/GBA), autoriteprotectiondonnees.be
- France : CNIL, cnil.fr
7 Security
Traffic is encrypted with TLS 1.3, data is hosted in Paris and isolated per organisation, access is limited by each user's role and two-factor authentication is available. Document views and exports are logged.
8 Contact
For any question about your data: contact@planifast.com