Last updated: August 2026
When you use PlanningMe to plan your staff, you are the controller of your employees' data and we are your processor. Article 28 GDPR requires that relationship to be governed by a written agreement. This page sets out what our standard Data Processing Agreement covers, who our sub-processors are, and how we tell you when they change.
Our standard DPA covers the eight elements Article 28(3) requires: we process only on your documented instructions; everyone with access is bound by confidentiality; we apply the technical and organisational measures of Article 32; we engage sub-processors only under the terms below; we assist you in responding to data subject requests; we assist you with breach notification, impact assessments and prior consultation; at the end of the contract we delete or return the data at your choice; and we make available the information needed to demonstrate compliance and allow for audits.
Subject matter: staff planning — shifts, absences, working calendars and the accounts needed to access them. Duration: the term of your subscription. Categories of data subject: your employees and administrators. Categories of data: identity and contact details, employment data, absence records, planning records, and technical access logs. No special-category data is required by the service; free-text fields, such as the reason for an absence, may contain it if your administrators enter it there.
We engage the following sub-processors, each under a data processing agreement that imposes obligations equivalent to ours. All primary processing takes place in Switzerland or the European Economic Area.
| Sub-processor | Purpose | Location |
|---|---|---|
| Microsoft Azure | Hosting, database and file storage | Switzerland / EEA |
| Microsoft Application Insights | Service telemetry: errors and availability | Switzerland / EEA |
| Microsoft Exchange Online | Transactional email: access codes and notifications | Switzerland / EEA |
We notify you by email at least 30 days before adding or replacing a sub-processor. During that period you may object on reasonable data protection grounds; if we cannot resolve the objection, you may terminate the affected part of the service without penalty.
Write to privacy@planningme.ch and we will send you the DPA for signature. If your organisation has its own template, send it and we will review it.