Privacy policy
Last updated 18 October 2026
How Folkdesk collects, uses and protects personal data, and the choices you have.
1. Who we are
Folkdesk is provided by [Company legal name] Ltd (company number [company number]), registered at [registered office address] ("we", "us"). You can contact us about privacy at privacy@folkdesk.app.
2. Our role
Folkdesk handles two kinds of personal data, and our role differs for each:
- Customer data: the leave, allowance and employment information an organisation (our customer) puts into Folkdesk about its people. The organisation is the controller and we are its processor: we only use this data to provide the service, on the organisation's instructions and under our data processing terms. If you are an employee, contact your employer first about your data.
- Account and website data: details about people who sign up, administer an account or contact us. For this data we are the controller.
3. What we collect
| Data | Examples |
|---|---|
| Account details | Name, work email address, hashed password, email verification status. |
| Employment details | Job title, team, manager, start and end dates, working schedule, role in the organisation. |
| Leave records | Requests, dates, durations, leave types, notes, approval decisions, allowances and adjustments. |
| Usage and security data | Sign-in sessions, IP address, browser type, audit log entries of sensitive changes and error logs. |
| Communications | Messages you send us and the notification emails we send on your organisation's behalf. |
Some leave types (for example sickness) can reveal information about health, which is special category data. Organisations can mark leave types as confidential so that only authorised people see the reason. Organisations are responsible for having a lawful basis and condition for recording such data.
4. How we use it and our lawful bases
- To provide the service: creating accounts, processing requests and approvals, calculating balances and sending notifications (contract, and for customer data, our customer's instructions).
- To keep Folkdesk secure: authentication, rate limiting, fraud and abuse prevention and audit logging (legitimate interests).
- To support and improve the service: answering questions, fixing faults and understanding how features are used in aggregate (legitimate interests).
- To run our business: billing, accounting and meeting legal obligations (contract and legal obligation).
- Product updates: occasional emails about Folkdesk to account owners and admins. You can opt out at any time (legitimate interests or consent, as required by law).
We do not sell personal data and we do not use customer data for advertising.
5. Who we share it with
Within an organisation, people see data according to their role: employees see their own records, managers see the people who report to them, and admins and the owner see the whole organisation. Outside your organisation, we share data only with service providers that help us run Folkdesk, under contracts that require them to protect it:
| Provider | Purpose |
|---|---|
| Convex, Inc. | Application backend and database hosting. |
| Cloudflare, Inc. | Website hosting, content delivery, security and email delivery. |
We may also disclose data where required by law, or to a buyer or successor if our business is sold or reorganised, subject to this policy.
6. International transfers
Our providers may process data outside the UK, including in the United States. Where they do, we rely on the UK adequacy regulations (including the UK-US data bridge where the provider is certified) or the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.
7. How long we keep it
- Leave requests, allowance adjustments and audit logs are kept for the retention period your organisation chooses (1 to 25 years; 6 years by default), then deleted automatically.
- People who have been deactivated for longer than the retention period are anonymised.
- In-app notifications are deleted after one year.
- If an organisation is deleted, it can be restored for 30 days and is then permanently deleted.
- Account and billing records are kept for as long as you have an account and afterwards for as long as the law requires (typically 6 years for financial records).
8. Cookies and local storage
We use only cookies that are strictly necessary to sign you in and keep your session secure. We store your light or dark mode preference in your browser's local storage. We do not use advertising or third-party tracking cookies, so we don't ask for cookie consent. If this changes we will update this policy and ask first.
9. Security
Data is encrypted in transit, passwords are hashed, access is controlled by role, every organisation's data is isolated, and sensitive changes are recorded in an audit log. No system is perfectly secure, but we work to protect your data and will notify affected customers and the ICO of a personal data breach where the law requires.
10. Your rights
Under UK data protection law you can ask to access, correct or delete your personal data, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on consent you can withdraw it at any time. For customer data, we will pass your request to your organisation and help it respond. To make a request, email privacy@folkdesk.app.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to put things right first.
11. Children
Folkdesk is a workplace tool and is not intended for anyone under 16.
12. Changes
We will post any changes here and update the date above. If a change is significant we will tell account owners by email before it takes effect.