Data Processing Addendum

Last updated: October 8, 2026

This addendum applies to every customer of LeaveCalc for Employers by using the service. If your procurement needs a signed copy, email contact@leavecalc.com and we return a signed PDF.

Plain-language summary

  • Your organisation decides what happens to your people's data. LeaveCalc processes it for you and only follows your instructions.
  • The live data is on a dedicated server in Manassas, Virginia, USA, rented from netcup GmbH. Stripe, Resend and Cloudflare each receive a part of it for one job, as listed in clause 8. We give 30 days notice before adding a sub-processor. Google, Microsoft and Slack are not: Google or Microsoft receives data only when your own users sign in or sign up with their account or an owner connects a Google or Outlook calendar, and Slack only when an owner connects your own Slack workspace.
  • If we learn of a breach affecting your data, we tell the account owner by email without undue delay, with what we know.
  • Documents such as doctor's notes, if you ask for them, are stored encrypted, can be opened only by the people you allow, and are deleted after the time you choose.
  • You can export your data at any time, have the account deleted, and audit us by written questionnaire.
  • For customers in the EU and the UK, the transfer to Canada and the USA is covered by the EU Standard Contractual Clauses, and for the UK by the ICO Addendum, both incorporated by reference. We do not rely on the Canadian adequacy decision.

1. Parties and roles

This Data Processing Addendum ("DPA") is between the customer that holds a LeaveCalc for Employers account (the "Customer") and LeaveCalc, a sole proprietorship in Manitoba, Canada ("LeaveCalc", "we").

For the personal data in the account, the Customer is the controller (under the GDPR and the UK GDPR) or the business (under the CCPA). LeaveCalc is the processor or the service provider.

2. Subject matter, duration, nature and purpose

  • Subject matter: the leave and absence records of the Customer's workforce.
  • Duration: for the term of the account, plus the deletion period in clause 11.
  • Nature: hosting and storing the records, computing balances, sending notifications and reminders, and producing reports and exports.
  • Purpose: providing LeaveCalc for Employers to the Customer, and no other purpose.

3. Types of personal data

Employee names, work email addresses, departments, hire dates, work schedules, leave requests and balances, FMLA case dates and a leave reason category only, optional pay rates, optional licences and certifications with expiry dates, attendance points, who each person reports to, and notes the Customer enters. If the Customer asks for documents on time off requests, the files its people attach (PDF, JPG, PNG or HEIC), with their file names, sizes and the dates they were added. If the Customer connects an HR system, the names, work email addresses, departments, job titles, dates, reporting lines and hours read from it. For account users: email addresses and hashed passwords, the IP address and browser of sign-ins, and for a user who turns on two-step sign-in an encrypted authenticator secret and hashed recovery codes. For a user who signs in or signs up with Google: the verified email address, the name and the account identifier that Google returns, and the domain of a Google Workspace account. For a user who signs in or signs up with Microsoft: the email address, the name and the tenant and account identifiers that Microsoft returns, and the domain of a work or school account when Microsoft confirms it. For a user who signs in with SAML single sign-on: the email address that the Customer's identity provider sends and, if it sends one, a name, which is used only to create a viewer account; the response itself is not kept, only a hash of the assertion identifier so that it cannot be used twice. If the Customer connects the Slack app: the Slack workspace name and identifier, and for each person found in Slack the Slack user identifier, a keyed hash of the email address that Slack confirms, and the identifier of the direct message. Support messages sent to us.

Sensitive data. Some leave types, such as sick leave or FMLA leave, may reveal health-related information by their nature; the Customer decides whether to use them. The Customer should not type diagnoses or other medical details into notes and reasons. The documents are the one place where health data can be held on purpose: a doctor's note or a medical certification that a person attaches is health data, a special category of personal data (GDPR Article 9). The Customer decides which leave types ask for a document, who may open the documents and how long they are kept, and is responsible for having a lawful basis to hold them. Clause 7 and the security overview describe how the files are protected.

4. Categories of data subjects

The Customer's employees and contractors, the Customer's account users, and approvers.

5. Instructions

LeaveCalc processes the personal data only on the Customer's documented instructions. The instructions are the settings the Customer chooses in the service, the calls it makes to the API, and written requests sent to contact@leavecalc.com. If an instruction seems to us to break the law, we tell the Customer.

6. Confidentiality

One person operates LeaveCalc. That person accesses the personal data only to operate, support and secure the service, and keeps it confidential. We never sell the data, never use it for advertising and never use it to train AI models.

7. Security measures

LeaveCalc keeps the measures described in the security overview, which forms Annex II. In short:

  • All live data on a dedicated server in Manassas, Virginia, USA, rented from netcup GmbH; the service is served over HTTPS (TLS 1.2 and 1.3).
  • Passwords hashed with scrypt; session, sign-in, reset, approval, invitation and API tokens stored only as hashes; the secrets behind two-step sign-in and connected HR systems stored encrypted.
  • Two-step sign-in with an authenticator app for every user who turns it on, which an owner can require for owners and managers; Sign in with Google or Microsoft, and on the Business and Enterprise plans SAML 2.0 single sign-on through the Customer's own identity provider, which an owner can require for the whole company.
  • Rate limits on sign-in, the public request form and the API; a custom header required on state-changing calls.
  • Owner, manager and viewer roles; managers can be limited to one department and, if the owner chooses, to seeing only that department and their own team; pay rates visible only to owners and managers without a department limit; every record scoped to one company.
  • An audit trail of every insert, update and delete made through the app, with secret values redacted, which owners read in the activity log and can export, kept for 7 years by default.
  • Documents attached to requests (such as doctor's notes) are stored encrypted, file by file, outside the folder the web server serves. Only the person, the owners and the managers an owner allows can open them, and never a manager limited to one department for sick, FMLA and other protected leave. Every listing, download and deletion is written to the activity log. They are deleted automatically after the time the Customer chooses (3 years by default). Files are checked by their content, and there is no virus scanning.
  • Nightly backups, with 14 copies kept on the same server, each checked with an integrity check. The database copies are not encrypted (the documents in them are, file by file) and there is no off-site copy yet. Limited retention of technical logs.

8. Sub-processors

The Customer gives a general authorisation for LeaveCalc to use these sub-processors:

Sub-processors authorised under this DPA
NameJobWhat it receives
netcup GmbHHosting the serverEverything stored in LeaveCalc. netcup is a company in Germany; the server is in its location in Manassas, Virginia, USA.
StripePaymentsCard details, entered on Stripe's own pages. LeaveCalc sees only the email, plan, amount, country, card brand and last four digits.
ResendSends the service's emails: digests, reminders and account emailsThe recipient address and the email content, which includes names, dates and leave types in notifications.
CloudflareDelivers mail addressed to contact@leavecalc.com (email routing)The mail you send to us.

LeaveCalc has a written contract with each sub-processor with the same data protection obligations as this DPA. Before a new sub-processor processes personal data, we email the account owner at least 30 days in advance. The Customer may object, and if the objection cannot be resolved, the Customer may terminate the account.

Recipients and services that the Customer chooses itself, such as a Slack or Teams channel, webhook endpoints, API clients, an AI assistant connected with an API token, the identity provider set up for SAML single sign-on or a connected HR system, are the Customer's own and not sub-processors of LeaveCalc. The Slack app is live and sends only to the Slack workspace that the Customer connects. Slack receives names, dates, quantities and balances, and the leave type (sick, FMLA and protected leave read Away in lists and in the daily post); an approver also sees the note the person typed. The Microsoft Teams app is not switched on.

Google is not a sub-processor. Google receives data only when an account user chooses to sign in or sign up with their own Google account, or when an owner chooses to connect their own Google account so that approved time off appears in a calendar there. These are the Customer's own choices, made with the Customer's own accounts, and the Customer can stop them at any time by disconnecting. What Google receives: for sign-in, none of the Customer's records, only the fact that the user signed in to LeaveCalc (Google tells LeaveCalc the verified email address and name). For the calendar, one all-day event for each approved request in a calendar that LeaveCalc creates in the owner's Google account, with the employee's name or initials, the type of leave and the dates, as far as the owner's privacy setting for that connection allows. Sick leave and FMLA leave are never named by type, and no balance, note or reason is sent. LeaveCalc asks Google for the calendar.app.created permission only, so it cannot read or change any other calendar. The Customer is responsible for who the calendar is shared with in Google.

Microsoft is not a sub-processor. Microsoft receives data only when an account user chooses to sign in or sign up with their own Microsoft account (work, school or personal), or when an owner chooses to connect their own Outlook or Microsoft 365 account so that approved time off appears in a calendar there. These are the Customer's own choices, made with the Customer's own accounts, and the Customer can stop them at any time by disconnecting. What Microsoft receives: for sign-in, none of the Customer's records, only the fact that the user signed in to LeaveCalc (Microsoft tells LeaveCalc the email address and name, and LeaveCalc trusts the address only when Microsoft confirms the domain owner). For the calendar, one all-day event for each approved request in a calendar that LeaveCalc creates in the owner's Microsoft account, with the employee's name or initials, the type of leave and the dates, as far as the owner's privacy setting for that connection allows. Sick leave and FMLA leave are never named by type, and no balance, note or reason is sent. LeaveCalc asks Microsoft for the Calendars.ReadWrite permission, which Microsoft has no narrower version of; LeaveCalc creates one calendar and makes calls to that calendar only. The Customer is responsible for who the calendar is shared with in Outlook. The Microsoft app has no verified publisher yet, so an organisation's IT administrator may have to approve it.

9. Assistance

The Customer answers requests from data subjects, mostly in the app, where the records are kept. Where the Customer needs our help, we give it within 10 business days. We also help with data protection impact assessments and questions from regulators, as far as is reasonable.

10. Breach notification

If we become aware of a breach affecting the Customer's personal data, we notify the account owner by email without undue delay, with what we know, so the Customer can meet its own notification duties. We send updates as we learn more.

11. Deletion and return

The Customer can export its data at any time: Reports > Exports > Download backup gives a JSON file of the account, and the payroll and report exports produce CSV files. On request from the account owner, we delete the account within 30 days and confirm the deletion in writing. Copies in the backups leave them as the backups rotate: the 14 copies on the server within 14 days. There are no other copies.

Documents attached to requests are deleted automatically when the retention time the Customer chose is over (3 years after the request ended unless the Customer chooses 1 or 7 years, or to keep them), or earlier when the Customer deletes them in the app. An owner can also erase every document of one person, and an owner can download all the files as one ZIP file. When the account is deleted, its documents are deleted with it. The backup copies hold them too until they are replaced, within 14 days.

US FMLA record keeping asks employers to keep records for 3 years (29 CFR 825.500). A Customer may choose to keep its records frozen on the Free plan instead of asking for deletion.

12. Audits

We answer a written security questionnaire within 15 business days, once a year or after an incident. On-site audits are not offered, because the server is at a hosting provider. On request we share the hosting provider's own documentation, as far as we have it.

13. International transfers

Where the data is. LeaveCalc is a sole proprietorship in Manitoba, Canada. The person who runs it administers the service from Canada. The data is stored on a server in Manassas, Virginia, USA, rented from netcup GmbH, a company in Germany. For a Customer in the European Economic Area (EEA) or the United Kingdom, the data therefore leaves that area for Canada and for the USA.

Adequacy is not relied on. The European Commission has recognised Canada as adequate (Decision 2002/2/EC), but only for recipients subject to the Canadian PIPEDA, and a decision on Canada does not cover a further transfer to a sub-processor in the USA. LeaveCalc does not rely on it. The Standard Contractual Clauses below cover the whole chain. LeaveCalc is not certified under the EU-US Data Privacy Framework: only a US company under FTC or Department of Transportation jurisdiction can self-certify, and LeaveCalc is Canadian.

EU Standard Contractual Clauses. For a Customer subject to the GDPR, the Customer and LeaveCalc enter into the Standard Contractual Clauses of Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), which are incorporated into this DPA by reference. The Customer is the data exporter and LeaveCalc is the data importer. The choices in the Clauses are:

  • Clause 7 (docking clause): not used.
  • Clause 8.1 (instructions): clause 5 of this DPA. Clause 8.6 (security): clause 7 and the security overview. Clause 8.8 (onward transfers): only to the sub-processors in clause 8, which are bound as Clause 9(b) requires.
  • Clause 9(a) (sub-processors): option 2, general written authorisation, with 30 days notice of changes as in clause 8.
  • Clause 11(a) (redress): the optional independent dispute resolution language is not used.
  • Clause 13 (supervision): the supervisory authority is the one the Clause names for the data exporter.
  • Clause 17: option 2, the law of the EU member state in which the data exporter is established, or the law of Ireland where that law does not allow third-party beneficiary rights. Clause 18(b): the courts of that member state, or of Ireland.
  • Annex I (the parties, the description of the transfer): clauses 1 to 4 of this DPA, with the Customer as exporter and LeaveCalc as importer, and the contact in clause 17. Annex II (security measures): the security overview. Annex III (sub-processors): clause 8.

Local laws and public authorities. LeaveCalc has no reason to believe that the laws and practices of Canada and the USA that apply to it stop it from meeting the Clauses (Clause 14). If it receives a request from a public authority for the Customer's data, it follows Clause 15: it tells the Customer unless the law forbids it, and challenges a request where there are grounds to do so.

United Kingdom. For a Customer subject to the UK GDPR, the ICO International Data Transfer Addendum to the EU Standard Contractual Clauses applies. Its tables are completed with the information in this clause and in clauses 1 to 4, 7 and 8, and the Clauses above are the Addendum EU SCCs it incorporates.

Canada. Under PIPEDA, an organisation that transfers personal data to another for processing stays accountable for it and must use a contract to give comparable protection. This DPA is that contract between the Customer and LeaveCalc, and LeaveCalc does the same with its sub-processors.

14. US state privacy laws

Where the CCPA, as amended by the CPRA, applies, LeaveCalc acts as a service provider and:

  • processes the personal data only for the specified business purpose in clause 2;
  • does not sell or share it;
  • does not retain, use or disclose it outside the direct business relationship with the Customer, or for any other purpose;
  • does not combine it with other personal data, except as the regulations allow;
  • gives it the same level of protection the CCPA requires of the Customer;
  • tells the Customer if it can no longer meet these duties;
  • accepts that the Customer may take reasonable steps to stop and fix unauthorised use;
  • cooperates with the Customer in answering consumer requests.

See Cal. Civ. Code 1798.100(d) and 1798.140(ag), and Cal. Code Regs. tit. 11, section 7051.

15. Liability and order of precedence

This DPA forms part of the Terms. The liability cap in the Terms applies to this DPA. Where the Standard Contractual Clauses conflict with this DPA or the Terms, the Clauses prevail for the data they cover.

16. Governing law

As in the Terms: the laws of the Province of Manitoba and the federal laws of Canada that apply there, and the courts of Manitoba. The Standard Contractual Clauses are governed as set out in clause 13.

17. Contact

Questions about this DPA, and requests for a signed copy: contact@leavecalc.com.

Sources

California Civil Code 1798.100(d) and 1798.140(ag) (service provider terms).

Need a signed copy?

Email us with your organisation's name and we return a signed PDF of this addendum.

contact@leavecalc.com