GooseLeave1. Scope and who is responsible for what
This Policy applies to GooseLeave websites, company workspaces, employee accounts, support interactions, billing administration and related service communications.
For workplace leave records, the organization that creates the workspace generally decides which employees are invited, which policies and balances are entered, what permissions are enabled and how the information is used for its workplace purposes. GooseLeave processes that information to provide the service. For GooseLeave account security, service operation, billing, support and our own legal obligations, GooseLeave may determine the purposes for which the relevant information is handled.
Different Canadian privacy laws may apply depending on the organization, province, type of information and circumstances. Where applicable law gives you greater rights than this Policy describes, those rights continue to apply.
2. Personal information we may collect or process
Account and identity information
Name, email address, password-derived authentication credentials, preferred language, timezone, profile photo and account status.
Organization and employment-related information
Organization membership, workplace role, manager/reporting relationships, leave types, entitlements, accrual rules, opening or corrected balances, planned and taken leave, approvals, work calendars, company holidays, leave history and information entered into optional notes.
Billing information
Subscription plan, billing status, customer and subscription identifiers, invoice or transaction metadata, billing address and tax-related information supplied through our payment flow. Payment-card numbers and card security codes are handled by our payment processor and are not stored directly by GooseLeave.
Support and communications
Messages you send us, support correspondence, feedback, troubleshooting information and records reasonably needed to resolve a request.
Technical and security information
Session identifiers, request timestamps, device/browser information made available by standard web requests, logs needed to operate or secure the service, and IP addresses where needed for security, abuse prevention, troubleshooting or legal compliance.
3. Where information comes from
- Directly from you when you create or update an account, profile, workspace or support request.
- From your organization, owner, administrator or manager when they invite you or maintain workplace records.
- From your use of GooseLeave when the service records actions necessary to provide leave calculations, history, permissions and security.
- From service providers involved in billing, email delivery, hosting or other operational functions.
4. Why we use information
- Create and operate private organization workspaces and authenticate authorized users.
- Calculate balances, accruals, forecasts, working days and leave availability from the rules configured by the organization.
- Support invitations, leave planning, approvals, team calendars, reporting, history and administrative controls.
- Provide support, respond to requests and troubleshoot service problems.
- Send service, security, account and billing communications.
- Operate trials, subscriptions, invoices, taxes and payment workflows.
- Detect, investigate and prevent misuse, fraud, unauthorized access and security incidents.
- Maintain, improve and debug GooseLeave in ways reasonably necessary to provide a reliable service.
- Comply with applicable law, lawful process and enforceable requests.
We do not sell workplace personal information to advertisers and we do not use authenticated workplace data to build advertising profiles.
5. Workplace records, sensitive information and organization access
Organization owners and administrators can access workplace information according to their role and the permissions configured in GooseLeave. Managers may receive access to information about direct reports where the organization enables those features. Coworker visibility is intentionally limited by configured team-calendar rules.
GooseLeave is not designed to store detailed medical records, diagnoses, treatment information, government identification numbers, payment-card numbers or other unnecessary highly sensitive information in leave notes. Organizations and users should avoid entering information that is not reasonably required for leave administration.
If an organization enters inaccurate employment information, the organization may need to correct the authoritative workplace record. GooseLeave can assist with account- or service-level privacy requests, but we may direct workplace-record requests to the relevant organization when it is the appropriate party to make that decision.
6. Service providers and disclosures
We may provide information to service providers that help us operate GooseLeave, such as infrastructure/network providers, email-delivery providers, payment processors, security providers and professional advisers. They receive only the information reasonably needed for their function and are expected to protect it.
We may also disclose information when reasonably necessary to comply with applicable law, court orders or lawful government requests; protect the rights, safety and security of GooseLeave, our users or others; investigate fraud or abuse; or support a corporate reorganization, financing, acquisition or sale where appropriate protections are applied.
We do not disclose workplace personal information to data brokers or advertisers for their independent advertising use.
7. Processing outside Canada
Some service providers may process or store information outside Canada. When information is processed in another country, it may be subject to the laws and lawful access requirements of that jurisdiction. GooseLeave remains responsible for using service providers appropriate to the role they perform and for taking reasonable steps to protect information under our control.
For questions about our service-provider practices or the handling of information outside Canada, contact our Privacy Lead using the details below.
9. Email and other communications
We may send transactional or service communications relating to account access, invitations, security, leave workflows, billing, support or changes that materially affect the service. These messages are part of operating GooseLeave.
If GooseLeave sends marketing or other commercial electronic messages where consent or an unsubscribe mechanism is required, we will manage those messages separately and provide the required identification and opt-out controls.
10. Security safeguards
We use safeguards designed for the sensitivity and role of the information we handle, including authenticated private workspaces, role-based authorization, access restrictions, secure credential handling, transport security, operational backups and security testing. Access is limited according to product roles and operational need.
No internet service can guarantee absolute security. Users are responsible for protecting their passwords, devices and email accounts, signing out of shared devices, and notifying us promptly if they suspect unauthorized access.
11. Privacy and security incidents
We investigate suspected unauthorized access, loss or disclosure of personal information and take steps appropriate to the circumstances. Where applicable law requires notification to affected individuals, privacy regulators or other parties, we will make the required notifications.
Organizations should promptly tell us about suspected incidents involving their GooseLeave workspace so we can investigate and coordinate appropriate action.
12. Retention, backups and deletion
We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including providing an active workspace, preserving legitimate workplace history, maintaining security and billing records, meeting legal obligations, resolving disputes and enforcing agreements.
When information is deleted from the active service, residual copies may remain temporarily in backups, logs or disaster-recovery systems until those copies are overwritten in the ordinary course, or longer where law requires preservation. Information may also be retained where necessary to prevent fraud, document a transaction or defend legal claims.
Workspace owners may contact support regarding workspace closure. Requests involving employee records may require coordination with the organization responsible for those records.
13. Access, correction, questions and complaints
Depending on applicable law and context, you may have rights to ask whether we hold personal information about you, request access to it, ask for corrections, withdraw consent where consent is the applicable basis, or challenge our compliance with privacy obligations.
Many account details can be updated directly in GooseLeave. For employment-related records, contacting your organization may be the fastest route because it controls the underlying workplace policy or record.
We may need to verify identity before completing an access or correction request. We may also decline or limit a request where permitted or required by law, and will explain the basis where appropriate.
14. Children
GooseLeave is a workplace service intended for people authorized to participate in an organization workspace. It is not directed to children and should not be used to create accounts for children except where a lawful workplace context and appropriate authority exist.
15. Changes to this Policy
We may update this Policy as GooseLeave, our providers or applicable requirements change. We will update the effective date and, where a change is material, provide additional notice through the service, email or another appropriate channel.
16. Privacy contact
Privacy Lead — GooseLeave
Edmonton, Alberta, Canada
[email protected]
Use the subject line Privacy Request so we can route the request appropriately.
For workplace records, your employer or organization administrator may be the party responsible for correcting the underlying employment record. GooseLeave will still help route service-level privacy questions appropriately.