Privacy policy

1. Controller

The controller for website visitors and account holders is Teamly360, Bulver 1, Belgrade. For any privacy question, write to support@teamly360.com.

2. When we are a processor

We process the data a company enters about its employees (time off, balances, birthdays, contact details) on that company's behalf. For that data the company is the controller and we are its processor; please direct requests about it to your employer.

3. What data we process

• Account data: name, email, password hash (never the readable password), language, two-factor settings.
• Company data: name, country, language, time zone and logo.
• Data a company enters about employees: time-off requests, balances, date of birth, phone number or Telegram account if the user links them for notifications.
• Contact form: name, email, company and your message.
• Payment data: Paddle sends us the name, email, country and subscription status; we never see or store card details.
• Technical data: IP address, browser details and system logs, for security and troubleshooting.

4. Purposes and legal bases

• Providing the service and managing accounts — performance of a contract (Art. 6(1)(b) GDPR).
• Security and preventing abuse and bots (rate limits, Cloudflare Turnstile) — legitimate interest (Art. 6(1)(f)).
• Answering contact form messages — steps prior to a contract or legitimate interest (Art. 6(1)(b) and (f)).
• Keeping accounts and meeting legal duties — legal obligation (Art. 6(1)(c)).

5. Who else processes data

We share data only with trusted providers that process it on our instructions or as independent controllers:

• Hetzner Online GmbH — servers and database in the European Union.
• Mailgun Technologies, Inc. — sending notifications and confirmation emails.
• Paddle.com Market Ltd (United Kingdom) — merchant of record: payments, VAT and invoices; an independent controller for payment data.
• Cloudflare, Inc. (USA) — Turnstile, bot protection for forms; processes your IP address and technical browser data.
• Viber and Telegram — only if a user links their account for notifications.

6. Transfers outside the EU

Where a provider processes data outside the European Economic Area (such as Cloudflare in the USA), the transfer relies on an adequacy decision (EU–US Data Privacy Framework) or on the European Commission's standard contractual clauses.

7. How long we keep data

• Account and company data — while the company uses the service; after an account is closed the company is archived for 30 days and then permanently deleted.
• Logs of sent emails — 90 days; email contents — 7 days; notifications — 180 days.
• Contact form messages — up to 24 months, unless they lead to a contract.
• Invoices and data required by tax and accounting law — as long as that law requires.

8. Your rights

You have the right to access, rectify and erase your data, to restrict its processing and to data portability, and to object to processing based on legitimate interest. Send your request to support@teamly360.com; we reply within 30 days.

You can lodge a complaint with the Serbian Commissioner for Information of Public Importance and Personal Data Protection (www.poverenik.rs) or with the supervisory authority of the EU country where you live or work.

9. Security

Data travels encrypted (HTTPS), passwords are stored only as hashes, and only authorised people can access data. Two-factor sign-in protects accounts further.

10. Cookies

We only use essential cookies. See the cookie notice for details.

11. Changes

We announce material changes to this policy on the website and, to account holders, by email.