Controller and processor roles
Customer organisations control the employee data they add to LeaveApprove. LeaveApprove acts as processor for workspace, employee, leave, sickness, approval, and audit records entered into the service.
GDPR compliance
LeaveApprove helps UK SMEs handle leave, sickness, and employee records with clear data roles, secure cloud storage, practical retention controls, and transparent security measures.
A practical overview for teams reviewing LeaveApprove before inviting employees.
Customer organisations control the employee data they add to LeaveApprove. LeaveApprove acts as processor for workspace, employee, leave, sickness, approval, and audit records entered into the service.
LeaveApprove is designed around practical leave management, so the service asks for the employee, organisation, and absence information needed to run approvals, balances, reports, and notifications.
Production application delivery runs through Cloudflare, with workspace records stored in managed PostgreSQL infrastructure and database connections requiring SSL.
The platform uses encrypted traffic, hashed passwords, role-based access controls, audit history, protected secrets, and restricted operational access.
Data storage
LeaveApprove stores customer workspace data for as long as the account is active and needed to provide leave management. After closure, workspace data is normally kept for up to 30 days for export or recovery, then deleted or anonymised unless a longer period is required for legal, accounting, security, or dispute-resolution reasons.
Security measures
Employee absence records are sensitive operational data. LeaveApprove uses layered safeguards across access, authentication, hosting, payment handling, and operational monitoring to reduce risk and support GDPR accountability.
TLS encryption for application traffic and SSL-required database connections.
Password hashing, server-side session protection, and optional OAuth sign-in through supported identity providers.
Role-based permissions for owners, admins, managers, and employees.
Audit logs for important workspace actions and leave-management changes.
Stripe-hosted checkout and card handling, so LeaveApprove does not store card numbers.
Sub-processor transparency for hosting, database, payments, email, analytics, and support tooling.
Data rights
Workspace owners can manage users and employee records inside LeaveApprove. For GDPR rights requests involving employee records, LeaveApprove supports the customer organisation as controller. For account, billing, sales, or support data controlled by LeaveApprove, requests can be sent directly to us.
Access and export support
Correction and deletion support
DPA available on request