Back to Legal

Security & GDPR

Effective date

monoplan handles schedules, employee data, hours, team chat and reports with data protection, access control and transparency built into the platform.

What data can be processed?

monoplan is not intended for sensitive information or data that is unnecessary for employee scheduling, operations and team communication.

  • Employee name
  • Email and contact information
  • Role and department
  • Shift schedules and working hours
  • Clock-in/out and time tracking
  • Absence, changes and shift swaps
  • Team chat and important messages
  • Payroll reports and hours
  • Locations and access control
  • Report and export data

The customer’s responsibilities

The customer is responsible for correct use, working-time rules, payroll rules, employment law, internal agreements and its own GDPR obligations.

  • Only create data that is necessary
  • Give users the right access
  • Remove access when employees leave
  • Avoid sensitive information in the chat
  • Inform employees about how the platform is used
  • Comply with rules for working hours, payroll, employment conditions and GDPR

Security in day-to-day scheduling

GDPR becomes practical when employees join, leave, change roles or request access to their data.

An employee leaves

Access to the schedule, team chat and relevant channels is removed when the employee is no longer employed.

A manager changes role

Access should follow responsibility so employees, managers and administrators do not see the same data.

Data must be exported

The business may need to find, export or delete relevant employee data following a specific request.

The customer is the data controller. monoplan is a data processor.

When a business uses monoplan, the business—the employer—is the data controller for employee data. The customer decides what information is entered, which employees are created, who gets access and how data is used in operations.

monoplan does not own the customer’s employee data. monoplan processes data on behalf of the customer and according to the customer’s instructions to provide the platform, support, operations and security.

The data processing agreement and specific subprocessors are described alongside the customer agreement, so responsibilities, purposes and safeguards are clear before data is processed.

monoplan supports structure, access and oversight, but the customer remains responsible for its own processing of personal data and compliance with applicable rules.

Employee requests for data

If an employee requests access to, correction, deletion or a copy of their information, the request should normally be directed to the employer.

As a rule, monoplan cannot disclose employee data directly to employees because monoplan is not the data controller for customer data.

monoplan can help the customer find, export, correct or delete relevant data according to the customer’s instructions.

Access and agreements in practice

Access control

Employees, managers and administrators must not have the same access.

Dynamic channels

Chat channels can follow role, department, location or shift.

Data processing agreement

The agreement and any subprocessors are included in the customer agreement before data is processed.