Privacy Policy
This Privacy Policy explains how Oraston BV ("Oraston", "we") processes personal data through Preference Planner, a shift-scheduling application used by your employer. Preference Planner is provided to your employer (the "Controller"), who determines how your data is used; Oraston acts as a data processor on their behalf, under a separate Data Processing Agreement with your employer.
1. Who we are
Oraston BV
Company registration number (KBO/BCE): BE1008332321
Data protection contact: dpo@oraston.be
2. What data we collect
Depending on how your employer uses Preference Planner, we may process the following data about you:
- Name and title
- Email address
- Role, specialisation, and start date
- Assigned shifts and schedule history
- Shift preferences (desiderata)
- Vacation and leave requests
- Overtime records
- Shift swap requests
- Login and authentication data (e.g. timestamps; passwords are stored as secure hashes, never in plain text)
If you choose to connect your personal Outlook or Google calendar, your assigned shifts are synchronised to that calendar. This is optional and only happens if you actively enable it. See section 3 for details.
Preference Planner does not collect patient data or special categories of personal data (such as health data) about employees.
3. Calendar synchronisation (Google Calendar and Outlook)
From your user settings you can choose to connect a Google or Microsoft Outlook calendar so that your assigned shifts automatically appear in it. Connecting a calendar is entirely optional and the rest of Preference Planner works without it.
Google user data we access
When you connect Google Calendar, we request a single permission: https://www.googleapis.com/auth/calendar.app.created. This permission only allows Preference Planner to create and manage calendars that Preference Planner itself created. We use it to:
- create one secondary calendar named "Preference Planner" in your Google account;
- add, update, and remove events in that calendar, one for each shift you are assigned (shift name, start time, and end time).
We cannot read, modify, or delete your other calendars or any events you created yourself, and we do not read your Google profile, contacts, email, or any other Google data.
How we store and protect Google user data
We store only the OAuth access and refresh tokens issued by Google, the identifier of the "Preference Planner" calendar, and the identifiers of the events we created in it. These are stored in our database in the EU (see section 6), are only used by our servers to keep your shifts in sync, and are never exposed to other users or your employer.
How we use and share Google user data
Google user data is used exclusively to show your assigned shifts in your own Google Calendar. We do not sell it, use it for advertising, use it to train artificial intelligence or machine learning models, or share it with any third party. No person at Oraston reads this data, except where you explicitly ask us to for support, where necessary for security purposes, or where required by law.
Preference Planner's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Microsoft Outlook
When you connect Outlook, we request the Calendars.ReadWrite and offline_access permissions from Microsoft. We use them only to create, update, and remove events for your assigned shifts in your Outlook calendar, and we store only the OAuth tokens and the identifiers of the events we created.
Disconnecting and deletion
You can disconnect your calendar at any time from your user settings in Preference Planner. When you do, we remove the synchronised shifts from your calendar (for Google, we delete the "Preference Planner" calendar we created) and permanently delete the stored tokens. You can also revoke access directly from your Google account permissions or your Microsoft account app access page. To request deletion of any remaining calendar-related data, contact dpo@oraston.be.
4. Why we process your data
Your data is processed to provide the scheduling service on behalf of your employer, including generating schedules, taking your preferences into account, processing leave and overtime requests, enabling shift swaps, and — if you enable it — synchronising your shifts to your calendar. The legal basis for this processing is determined by your employer, typically as necessary for the performance of your employment contract and your employer's legitimate interest in operating an efficient schedule. Calendar synchronisation is based on your own choice to enable it.
5. Who we share your data with
We use a small number of service providers (sub-processors) to operate Preference Planner:
- Hetzner Online GmbH (Falkenstein, Germany) — hosts the application and its database
- Appliku — manages deployment of the application infrastructure
- Maileroo — delivers transactional emails, such as login links and reminders
- Microsoft Corporation — only if you personally connect your Outlook calendar, to synchronise your assigned shifts
- Google LLC — only if you personally connect your Google calendar, to synchronise your assigned shifts
We do not sell your data, and we do not share it with any party other than those listed above and your employer.
6. Where your data is stored
Your data is hosted on servers located in Falkenstein, Germany, within the European Union. Shifts you choose to synchronise to Google Calendar or Outlook are additionally stored by Google or Microsoft in your own account, under their respective privacy policies.
7. How long we keep your data
Your data remains linked to your employer's account, including after you leave your employer, so that historical schedules and records remain available for legitimate record-keeping, reporting, and legal compliance purposes (for example, payroll or labour law obligations). You or your employer can request that your directly identifying data (name and email address) be removed or anonymised, while the underlying schedule records are kept in anonymised form.
Calendar tokens are kept only for as long as your calendar is connected and are deleted as soon as you disconnect it.
If your employer stops using Preference Planner entirely, all personal data associated with their account is deleted within 30 days, unless a longer period is required by law.
8. Your rights
Under the GDPR, you have the right to access, correct, or request deletion of your personal data, to restrict or object to certain processing, and to receive a copy of your data in a portable format. Because your employer is the data controller, we recommend directing these requests to your employer in the first instance. You may also contact us directly at dpo@oraston.be, and we will either assist you or forward your request to your employer.
9. How we protect your data
We apply appropriate technical and organisational measures to protect your data, including encrypted connections (TLS/HTTPS), secure password hashing, role-based access control within the application, logical separation of each employer's data, and hosting with a provider holding ISO 27001 certification.
10. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated to your employer, who is responsible for informing you as appropriate. The date at the top of this page shows when it was last updated.
11. Contact
For any questions about this Privacy Policy or how your data is processed, please contact us at dpo@oraston.be.