1. Who is responsible for your information?
Annual Leaf operates this service. We are the controller of the account, security and service-administration information we use for our own purposes.
Your employer or the organisation that provides your workspace is normally the controller of employee records, leave requests, allowances and approval information entered into Annual Leaf. We process that information on its instructions. Questions about those records should usually go to your organisation first.
Annual Leafhello@annualleaf.com2. Information we collect
We may collect your name, work email address, job title, team, work location and timezone; account credentials and security records; holiday allowances, leave dates, notes and approval history; notification choices; and technical records needed to keep the service secure and reliable.
If your organisation enables Microsoft 365 calendar integration, we also process the calendar identifiers, account details and event information needed to preview, import and synchronise leave. We do not ask you to provide special-category information in leave notes.
3. How and why we use it
- Provide accounts, workspaces, holiday calculations, approvals, notifications and calendar synchronisation.
- Authenticate users, prevent misuse, investigate faults and protect the service.
- Maintain audit records and meet legal obligations.
- Improve the service using operational information that is aggregated or minimised where practical.
Our lawful bases for information we control are performance of our contract, our legitimate interests in providing and securing Annual Leaf, and compliance with legal obligations. Where your organisation controls the information, it decides the appropriate lawful basis.
4. Who receives information
Information is visible to authorised people in your organisation according to their role. We may also use hosting, database, email-delivery and IT support providers acting under contract. Microsoft receives or supplies information when your organisation enables its calendar integration. We disclose information where required by law or as part of a properly managed business transfer.
5. International transfers
Our suppliers may process information outside the UK. Where required, we use an adequacy decision or appropriate contractual safeguards. Contact us for information about safeguards relevant to your workspace.
6. How long we keep it
We retain information while the workspace is active and for a limited period afterwards where needed for account closure, security, backup recovery, disputes or legal obligations. Your organisation controls retention of its employee and leave records. Security and audit records may be kept for longer where necessary to protect the service and establish legal claims.
7. Your rights
Depending on the circumstances, you may have rights to access, correct, erase or restrict your information, receive a portable copy, and object to processing based on legitimate interests. Some rights are limited where information must be retained or another lawful basis applies.
Your right to object: you can object to processing based on legitimate interests. We will stop unless we have compelling legitimate grounds or need the information for legal claims.
Contact your organisation about employee and leave records, or contact us about information Annual Leaf controls. You may also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint.
8. Security and cookies
We use access controls, password hashing, encrypted connections, private database access and audit records designed to protect information. No internet service can guarantee absolute security.
Annual Leaf uses a strictly necessary session cookie to keep you signed in and protect access to your workspace. We do not currently use advertising or cross-site tracking cookies.
9. Changes to this notice
We may update this notice as the service or law changes. We will publish the new effective date and give additional notice where a change materially affects how information is used.