Privacy and Cookie Notice

1. Who we are and our role

EasyTurni is operated by [LEGAL NAME / COMPANY NAME], with registered address at [REGISTERED ADDRESS] (“EasyTurni”, “we”, “us”).

You can contact us regarding privacy or data protection matters at [REAL CONTACT EMAIL OR CONTACT METHOD].

EasyTurni may process personal data in different roles depending on the context.

When we process data necessary to operate EasyTurni itself, such as customer account administration, authentication, security, technical logs, support, service communications and consent-based analytics, [LEGAL NAME] acts as data controller.

When a company, association or other organization uses EasyTurni to manage its workforce or members, that organization generally determines why workforce information is processed. For data such as employee or worker roles, locations, availability, leave, shifts, assignments, swap requests, scheduling rules and compensation parameters, the organization generally acts as the data controller and EasyTurni acts as a data processor, processing that information on the organization's instructions and under the applicable data processing agreement.

If you use EasyTurni through your employer or another organization, questions or requests concerning information entered into that organization's workspace should normally be directed to that organization. EasyTurni will assist the organization where required.

2. Personal data we process

Depending on how you use EasyTurni, we may process the following information.

Account and profile information may include your name, email address, user identifier, organization, role, account status, invitation status and authentication information.

Organization and scheduling information may include workplaces or locations, roles, availability, holidays or leave, scheduled shifts, assignments, shift changes, swap requests, scheduling rules, calendar settings and other information necessary to organize work.

Compensation and administrative information may include hourly rates, compensation parameters or other employment-related values entered by an organization for scheduling or labor-cost calculations.

EasyTurni is not intended to be used as a repository for medical records or other special categories of personal data. Users and organizations should avoid entering health information, religious beliefs, political opinions, trade-union information or other sensitive information into free-text fields unless there is a specific lawful reason to do so.

Technical and security information may include IP addresses, login and authentication events, session identifiers, browser and device information, language preferences, application logs, timestamps and security events.

Communication information may include transactional emails, invitations, scheduling notifications, support requests and other service-related communications.

Analytics information, where you have consented to analytics, may include pseudonymous identifiers and information about how EasyTurni is used, such as pages or features accessed, interactions, browser or device information and session information.

Some personal data may be provided directly by you. Other data may be provided by the organization that invited you to EasyTurni, for example your email address, role, workplace or employment-related settings.

3. Why we process personal data

Where EasyTurni acts as data controller, personal data may be processed to create and manage accounts, authenticate users, provide the service, manage subscriptions or customer relationships and send operational communications where processing is necessary to provide the requested service or perform a contract.

We may process technical logs, authentication events and security information where necessary for our legitimate interests in protecting EasyTurni, preventing abuse or fraud, troubleshooting errors and maintaining the reliability and security of the service.

Where processing is required to comply with applicable tax, accounting, judicial or regulatory requirements, we process the relevant information to comply with our legal obligations.

Optional analytics or other non-essential tracking technologies are used on the basis of your consent. Consent can be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

Where EasyTurni acts as a data processor for an organization, the organization determines the applicable lawful basis for the processing of its workforce data. EasyTurni processes that information only to provide the service and in accordance with the organization's documented instructions, except where otherwise required by law.

4. Is providing personal data mandatory?

Information required to create an account, authenticate, join an organization or use core scheduling features is necessary to provide those parts of the service. If required information is not provided, some EasyTurni features may not be available.

Analytics and other optional tracking are not required to use the core EasyTurni service.

5. Who can access personal data

Personal data may be accessible to authorized users within your organization where necessary for scheduling and workforce-management purposes. For example, an organization owner or manager may need access to availability, assignments, shift information or compensation settings.

We also use selected service providers to operate EasyTurni. These may include:

Supabase, for database, authentication and related backend infrastructure;

PostHog, for optional product analytics where analytics consent has been given;

Resend, where used for transactional email delivery;

and hosting, infrastructure, monitoring, security and technical service providers required to operate the platform.

These providers process personal data only for the purposes necessary to provide their respective services and are subject to appropriate contractual and data-protection obligations where required.

We may also disclose information where necessary to comply with law, respond to lawful requests from authorities, establish or defend legal claims, or protect EasyTurni, its users or third parties.

We do not sell workforce personal data to third parties or use information entered by organizations for third-party advertising.

6. International data transfers

Some of the service providers used by EasyTurni may process information in countries outside the European Economic Area.

Where personal data is transferred outside the EEA, EasyTurni uses an appropriate transfer mechanism where required by the GDPR, such as an adequacy decision adopted by the European Commission, Standard Contractual Clauses or other legally recognized safeguards.

The location in which certain data is processed may also depend on the infrastructure region selected for a particular service.

7. How long we keep personal data

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and in accordance with contractual, security and legal requirements.

Account and customer-administration information is generally retained for the duration of the account or customer relationship and may be retained for a limited period afterwards where necessary to manage requests, disputes, fraud prevention or legal claims.

Workforce and scheduling information processed on behalf of an organization is retained according to the organization's instructions, the applicable customer agreement and the EasyTurni data processing agreement. When the customer relationship ends or data is deleted, the information is deleted or returned in accordance with those arrangements, subject to limited backup retention and legal requirements.

Technical and security logs are normally retained for up to 12 months, unless a longer period is necessary to investigate a security incident, misuse or legal claim.

Support and operational communication records may normally be retained for up to 24 months after the relevant request or customer relationship ends, where needed for support history or legal purposes.

Backup copies may remain for a limited period after deletion until they are automatically overwritten in accordance with our backup cycle.

Analytics information is retained according to the retention configuration of our analytics service and only for as long as reasonably necessary for product analytics and improvement.

Where applicable law requires information to be retained for a longer period, we may retain only the information required for that legal purpose.

8. Cookies and similar technologies

EasyTurni uses cookies and browser-storage technologies such as local storage where necessary to operate the service.

Essential technologies

Essential storage may be used for authentication, maintaining a user session, security, language preferences, selected organization or calendar settings and remembering your cookie preferences.

Depending on the authentication configuration, EasyTurni or Supabase may store authentication information in browser local storage or in cookies.

These technologies are necessary to provide functionality expressly requested by the user and do not require consent for their strictly necessary purposes.

Analytics

EasyTurni uses PostHog to understand how the platform is used and to improve features and usability.

Where PostHog is configured to use analytics cookies, local storage or similar persistent identifiers, analytics tracking is disabled until you provide consent.

If you reject analytics, EasyTurni's core functionality remains available.

PostHog may use first-party cookies or browser storage to maintain pseudonymous identifiers and session information depending on the configuration used by EasyTurni.

Your cookie choice

Your cookie preference may be stored using a strictly necessary technical identifier so that EasyTurni remembers your choice.

If you reject optional tracking, we will not repeatedly ask you to reconsider your decision before the applicable consent period has elapsed, unless the tracking technologies or purposes materially change, we can no longer determine your previous choice, or you clear the relevant browser storage.

You can change or withdraw your choice at any time using the “Cookie settings” control available on the EasyTurni website or application.

Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

9. Your data-protection rights

Subject to the conditions provided by applicable law, you may have the right to request access to your personal data, correction of inaccurate data, deletion, restriction of processing and data portability, as well as the right to object to certain processing.

Where processing is based on consent, you have the right to withdraw that consent at any time.

Where EasyTurni processes information as data controller, requests can be submitted using the contact details provided in Section 1.

Where EasyTurni processes workforce information on behalf of your employer or another organization, you should normally exercise your rights through that organization. EasyTurni will assist the organization in responding where required.

You also have the right to lodge a complaint with the competent supervisory authority. In Italy, this is the Garante per la protezione dei dati personali.

10. Automated scheduling

EasyTurni may provide automated tools, recommendations or scheduling assistance to help organizations prepare or manage work schedules.

Unless expressly stated otherwise for a particular feature, EasyTurni does not independently make decisions producing legal or similarly significant effects on workers solely by automated means. The organization using EasyTurni remains responsible for its workforce-management and scheduling decisions.

11. Security

We use reasonable technical and organizational measures designed to protect personal data against unauthorized access, alteration, loss, misuse or disclosure.

These measures may include authentication controls, role- and organization-based access restrictions, encrypted communications, infrastructure security measures, logging and data-minimization practices.

Authentication credentials are handled through our authentication infrastructure and EasyTurni does not need access to users' plaintext passwords.

No online service can guarantee absolute security, and our security measures are reviewed and updated as the service evolves.

12. Children and minors

EasyTurni is a workforce-management and organizational service and is not directed to children.

Where an organization lawfully employs or otherwise manages a minor who is permitted to use EasyTurni, that organization is responsible for ensuring that the processing is lawful and that any notices, permissions or safeguards required by applicable law are in place.

13. Changes to this Notice

We may update this Privacy and Cookie Notice where EasyTurni's features, service providers, data-processing practices or legal obligations change.

Where a change materially affects how personal data is processed, we will provide an appropriate notice and, where required, request a new consent.