Privacy statement

UpPlan is a product of LAP Solutions, established in the Netherlands. In this statement 'we' means LAP Solutions and 'UpPlan' means the website and the application.

A business that uses UpPlan (the customer) puts its own staff's data into UpPlan. For that data the customer is the controller within the meaning of the GDPR, and we are the processor: we process it only on the customer's instructions, to provide the service.

For a limited set of data we are the controller ourselves: the account details of whoever logs in, the data needed for invoicing, and the data of visitors to this website.

Are you an employee of a business that uses UpPlan and do you have a question about your data? Then go to your employer first. They decide which data is in UpPlan and can view, correct and delete it.

Depending on how the customer uses UpPlan, this is:

• Account details: name, email address, language preference and whether two-step verification is on. Passwords are handled by our log-in service and are not readable to us. If you log in with Google, we receive only your name and email address from Google.
• Organization details: name, address, contact details, industry, time zone, opening hours and settings.
• Staff data the customer enters: name, email address, phone number (optional), date of birth (optional, for the Working Hours Act check and the break rules), roles, contract hours, leave hours per year and hourly rate.
• Rota data: shifts, availability, swap requests, leave requests and sick reports, including the category given and any comment.
• Hours and pay: clock-in and clock-out times, breaks, approved hours, hourly rate per person or per role, surcharges and, in hospitality, the division of tips.
• Location check when clocking in: if the customer switches on the GPS check, the phone's position at the moment of clocking in is compared with the business's location. The phone's coordinates are not stored.
• Files for the optional AI import: a staff list or old rotas a manager uploads are sent once to our AI supplier to be read and not kept afterwards. Only what the manager confirms after checking is stored.
• Payment details: the customer enters those at Stripe. We receive only what is needed for administration, such as the subscription status, the invoices and the email address for invoices.
• Log: which user made which change to the rota or the staff, and when.
• Technical data: data needed to provide the service securely, such as session cookies and server logs at our hosting provider, and anonymous visitor statistics of the website without cookies.
• Address suggestions: when you type your business's address, what you type goes from your browser to a public address service (PDOK for the Netherlands, Photon elsewhere) to complete it. No other data goes with it.

We use data only for the following:

• Providing UpPlan to the customer: performance of the contract, and for staff data the customer's instructions.
• Invoicing and administration: performance of the contract and legal obligations, such as the tax retention duty.
• Security, preventing abuse and the audit log: our legitimate interest and the customer's.
• Service emails such as invitations, notifications, reminders and messages about the subscription: performance of the contract.

We don't sell data, don't use it for advertising and don't share it with anyone other than the suppliers below. We make no automated decisions with legal effects about people: Auto-fill proposes a rota based on fixed rules, the manager decides and publishes. The AI import only reads a file a manager chooses themselves and proposes a table the manager checks; staff data is not used to train an AI model.

To provide UpPlan we use the suppliers in the table below. Agreements on the processing of personal data are in place with each of them.

The database is in the United Kingdom, and some of our suppliers are established in the United States. Data may therefore be processed outside the European Economic Area. That happens only on the basis of an instrument the GDPR provides for it, such as an adequacy decision of the European Commission or the standard contractual clauses the supplier uses.

We keep the customer's data for as long as the account exists. The customer can change or delete staff, shifts and other data themselves at any time.

An organization created without completing the payment details is deleted after four days, after email reminders. If the customer asks us to close the organization, we delete its data within 30 days, unless the law requires us to keep something longer. We keep invoices and the related administration for 7 years because of the tax retention duty.

UpPlan uses functional cookies only: to keep you logged in and to remember your language. Your preference for a light or dark appearance is kept only in your own browser. For visitor statistics we use our hosting provider's cookieless analytics, without personal data. We use no advertising or tracking cookies and load no third-party scripts. That is why you don't see a cookie banner either.

Under the GDPR you have the right to access, correct and delete your data, to restrict processing, to data portability and to object to processing.

If it concerns data your employer put into UpPlan, address your request to your employer; we help the customer comply with it. If it concerns data we are responsible for ourselves, contact us.

You always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Which technical and organizational measures we have taken is on the security page.

If we change this statement, we put the new version on this page with a new date. For major changes we let customers know.