Privacy Policy
Version 1.14 · Effective 4 November 2026
Exsens AB ("Exsens", "we", "us") provides Timeplan — a cloud-based service for workforce scheduling, time reporting and payroll data. This privacy policy explains how we process personal data when we act as a data controller, meaning when you interact with us directly.
When we process personal data inside Timeplan, we do so as a data processor on behalf of our customer. The customer is then the controller and determines the purposes. That processing is governed by our Data Processing Agreement. If you are employed by one of our customers, please contact your employer about your data in the system.
Data controller
Exsens AB, company registration no. 556706-5288Fürstenbergsgatan 4, SE-416 64 Gothenburg, SwedenE-mail: privacy@timeplan.se
Data protection enquiries and rights requests are handled by privacy@timeplan.se.
When we process personal data
We act as a controller when you order Timeplan or enter into an agreement with us, receive login credentials, are registered as a customer contact, attend our training sessions, contact our support by e-mail, chat, form or phone, visit our website, or use our help centre and receive product and service updates.
Categories of personal data
Contact and customer data — name, role, company name, phone number, e-mail address, and information about the customer relationship such as agreements, orders, invoicing and case history.
User data — Timeplan login credentials and logs relating to use of support and the help centre.
Communication and service data — support tickets, training participation, e-mail correspondence, chat and form submissions.
Website data — technical information such as IP address, browser and device, cookie identifiers, and statistical and behavioural data from our website. See our cookiepolicy for the full list.
Purposes, legal bases and retention
| Purpose
|
Data
|
Legal basis
|
Retention
|
| Customer relationship and contract administration
|
Contact and company details
|
Contract, Art. 6(1)(b)
|
Contract term + 7 years (Swedish Bookkeeping Act)
|
| Invoicing and accounting
|
Contact details, invoicing data
|
Legal obligation, Art. 6(1)(c)
|
7 years
|
| Handling support tickets
|
Name, e-mail, logs, ticket information
|
Legitimate interest, Art. 6(1)(f)
|
24 months after the ticket is closed
|
| Service updates and product news to customers
|
Name, e-mail, customer role
|
Legitimate interest, Art. 6(1)(f)
|
For the duration of the customer relationship
|
| Training administration
|
Name, company, course participation
|
Contract, Art. 6(1)(b)
|
12 months after the training is completed
|
| Marketing to non-customers
|
Name, e-mail, company
|
Consent, Art. 6(1)(a)
|
Until consent is withdrawn
|
| Essential website functions
|
Technical cookies, IP address
|
Legitimate interest, Art. 6(1)(f)
|
As set out in our cookie policy
|
| Analytics, behavioural measurement and marketing on the website
|
IP address, device data, cookie ID, page interactions, session recording
|
Consent, Art. 6(1)(a)
|
As set out in our cookie policy
|
We rely on legitimate interest where we have assessed that our interest in managing the customer relationship, providing support and keeping customers informed about the service outweighs the data subject's interest in the data not being processed. You can always object to such processing.
Recipients
We never sell personal data and do not disclose it to third parties without a legal basis. The following providers process personal data on our behalf in this role:
| Provider
|
Purpose
|
Location
|
Transfer safeguard
|
| Microsoft Ireland Operations Ltd
|
Hosting, e-mail and internal IT
|
Ireland (EU)
|
No third-country transfer
|
| HubSpot, Inc.
|
CRM, marketing, support, chat
|
Germany (EU), some processing in the US
|
DPF + SCC
|
| Twilio Inc. (SendGrid)
|
E-mail notifications
|
USA
|
DPF + SCC
|
| Webflow, Inc.
|
Website publishing and hosting
|
USA
|
DPF + SCC
|
| PostHog Inc.
|
Web analytics and session recording on the website
|
Frankfurt, Germany (EU). Support and administration may take place from the US.
|
DPF + SCC
|
| Google Ireland Ltd
|
Tag management and ad measurement
|
EU, some processing in the US
|
DPF + SCC
|
| Cloudflare, Inc.
|
Bot protection on forms (Turnstile)
|
Global network
|
DPF + SCC
|
| Vimeo.com, Inc.
|
Video guides and training material
|
USA
|
DPF + SCC
|
| Stripe Payments Europe, Ltd
|
Subscription billing and card payments
|
Ireland (EU). Some processing may take place at Stripe, Inc. in the US.
|
DPF + SCC
|
| Fortnox AB
|
Finance system, invoicing and accounting
|
Sweden. Fortnox in turn uses sub-processors that may process data outside the EU/EEA.
|
No third-country transfer at Fortnox; SCC for their sub-processors
|
| Accounting firm and authorised auditor
|
Ongoing bookkeeping and statutory audit
|
Sweden
|
No third-country transfer
|
Our accounting firm and authorised auditor have their own statutory obligations and act as independent controllers in that respect, not as our processors.
If you would like to know exactly which recipients process your personal data, we will provide this on request to privacy@timeplan.se.
Providers that process personal data inside Timeplan are listed separately in Appendix 3 to our Data Processing Agreement.
Transfers outside the EU/EEA
Some providers are established in the United States. Such transfers rely on the EU–U.S. Data Privacy Framework for certified providers, the European Commission's Standard Contractual Clauses (Decision 2021/914), and supplementary technical and organisational safeguards including encryption, access restriction and data minimisation.
Your rights
You have the right to request access to your data, rectification of inaccurate data, erasure, restriction of processing, to object to processing based on legitimate interests, to withdraw consent, and to data portability. Requests go to privacy@timeplan.se. We respond within one month. You may also lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se.
Security
We apply technical and organisational measures to protect personal data, including encryption of all traffic (TLS/HTTPS), hosting in Microsoft Azure North Europe, role-based access control, logging of administrator actions, regular security updates and a documented incident response process. These are described in detail in Appendix 2 to our Data Processing Agreement.
Changes and contact
We may update this policy. The current version and date are always shown at the top of this page. Material changes are communicated to our customers. Questions: privacy@timeplan.se