TimeLeaf is built to help you meet your obligations as a data controller: employees can download their own data, and admins can erase a former employee's personal details while keeping the employment records you are required to hold.
Roles under GDPR
Your company is the data controller. You decide what employee data to collect and why, and you are responsible for telling employees about their rights.
TimeLeaf is the data processor. We process data only on your instructions, to run the service, under a Data Processing Agreement (DPA).
Data Processing Agreement
A DPA is included in our Terms of Service for all paid plans. If your legal team needs a separately signed DPA, contact [email protected]. You can also review our standard DPA at timeleaf.io/dpa.
What data TimeLeaf stores
- Names, email addresses, phone numbers and job details
- Personal details you choose to record: date of birth, home address, emergency contacts, photo
- Tax and bank details, encrypted with a key unique to your workspace
- Leave requests (type, dates, status, notes) and any sick notes or other files attached to them
- Leave balances and accrual history
- Clock-in and clock-out records and timesheets, including the location of a clock-in where your workspace records it
- Shift schedules and assignments, and job-site check-ins with their location and photos
- Contracts and signed contract documents
- Overtime and time bank balances
- Manager relationships and team structure
- Sign-in times and IP addresses, for security
Individual rights
| Right | How to fulfil it |
|---|---|
| Access | Each employee can download all their own data as a JSON file by opening https://<your-workspace>.timeleaf.io/api/gdpr/export while signed in. There is no button for it in the app, and an admin can't download it for someone else. If their access has ended, email [email protected]. |
| Rectification | Edit the employee's profile from People › Employees & Teams. |
| Erasure | See Erase a former employee's personal details below. |
| Portability | The same JSON file as Access. |
| Restriction | Furlough or Lay Off the employee on People › Employees & Teams and choose Immediately to turn off their sign-in straight away. Someone still clocked in stays signed in only until they clock out. Their records are kept, and Restore brings them back (it needs a free plan seat). |
Erase a former employee's personal details
Erasure is for people who have left. It removes their personal details and keeps the work records the employer must keep by law (GDPR Article 17(3)(b)).
Remove them from your directory first
If you use Directory Sync, remove the person from Microsoft Entra ID or Google Workspace first. Otherwise the next sync adds them back as a new employee.
Offboard them
On People › Employees & Teams, Furlough or Lay Off the person. Once their access has ended they move to the Archived view. See Offboarding & Archived.
Erase their personal details
Switch to Archived and click Erase on the person's row, or tick several people and click Erase personal details. The confirmation lists what is erased and what is kept. Confirm to erase.
Erasure can't be undone. An erased person stays in the Archived view marked Erased and can never be restored.
Erased:
- Email address and phone numbers, home address, emergency contacts
- Date of birth, gender, marital status, nationality and photo
- Bank and tax details
- Sign-in: password, SSO link, sessions and tokens
- Sick-note files, and the free text they typed on leave requests, site check-ins and time entries
- Notifications, calendar sync, shift qualifications, training records, working-time opt-outs and work restrictions
Any leave request of theirs still waiting for a decision is cancelled, so approvers are no longer asked about it.
Kept, still under their name:
- Name, employee number, job title, team and employment dates
- Employment contracts, with their attachments and signed copies
- Position and pay history
- Timesheets, their approvals and the hours on them
- Leave requests (dates, type, status and hours), their approvals, leave balances and the record of balance adjustments
- Banked overtime and every payout
- The invoice lines that bill their work
- Roster shifts, site visits (with their location and photos) and on-call records
Records other people made, such as an approval they gave or an audit entry they caused, are not changed. Their email becomes an internal placeholder so the address is free to invite someone new.
Data retention
Leave records, timesheets, contracts and other work data are kept for the life of your subscription. There is no automatic purge for them and no retention settings page.
Some system data is cleared automatically:
| Data | Kept for |
|---|---|
| Audit log entries | 12 months (records of leave-balance adjustments are kept as long as the balance) |
| Completed or failed background jobs | 30 days |
| Read notifications | 90 days |
| Unread notifications | 180 days |
| Expired password-reset tokens | 7 days |
When your subscription ends, we keep your data for 30 days so you can export it. Then our team deletes it; backups expire within 14 more days, and the logs we host within 30 days.