Privacy policy

1. Who is responsible?

Finito is a product of Moof grafisch ontwerp Comm.V, Steenland 46, 8930 Rekkem, Belgium, company number BE 0833.354.120, hereinafter "Moof" or "we". Send privacy questions to hallo@finito.work.

2. Two roles: controller and processor

For the data of our own customers (anyone who creates an account, pays or contacts us) and for visitors to finito.work, we are the data controller. That's what this privacy policy covers.

The data a company keeps in Finito about its employees, such as hours, planning and absences, we process on behalf of that company. The company is then the controller and we are the processor. The arrangements for this are in the data processing agreement in our terms. If you're an employee with a question about your data in Finito, please contact your employer first. We'll help your employer answer it.

3. What data do we process?

• Account details: name, email address, language, role in the company and company name.
• Security: your password (only stored encrypted) and the data for two-step verification.
• Work data: recorded hours, timers, projects, tasks, comments and messages, planning, work arrangement, overtime and flexitime reviews, and payroll exports.
• Absences: leave, time off in lieu and sickness, with date and duration. Finito asks for no medical information: for sickness, only the absence is recorded. Colleagues just see "absent".
• Amounts: hourly rates and cost prices, if the company enters them. Only people with permission can see them.
• Log: who changed which hours or data and when, so the original entry stays visible.
• Billing and payment: company name, VAT number, address, billing address, plan, number of users and payment status. Payment details such as card or account numbers go straight to Mollie. We don't see them.
• Technical data: limited data needed to secure the service and track down errors, such as sign-in times.

4. Why do we process that data?

• To create and secure your account and your colleagues', and to deliver Finito. Legal basis: performance of the contract.
• To send emails that are part of the service, such as invitations, sign-in confirmations, notifications, budget alerts and the monthly export. Legal basis: performance of the contract.
• To handle payments and to issue and keep invoices. Legal basis: performance of the contract and legal obligations.
• To prevent abuse, secure the service and provide support. Legal basis: our legitimate interest.

We don't sell data, don't send advertising to our customers' employees and don't use your data to train AI models.

5. External service providers

We work with these service providers. They only get what they need for their task:

• Supabase: database and sign-in. The data sits on servers in Frankfurt, Germany.
• Cloudflare: hosting and security of the app and the domain.
• Brevo: sending emails, France.
• Mollie: payments, Netherlands.
• Hetzner and RunCloud: server and server management for the finito.work website.
• Google Fonts: the website's font.

Where data leaves the European Economic Area, as with Cloudflare or Google, this happens with the safeguards the GDPR requires, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

6. The website and cookies

On finito.work we use no advertising or tracking cookies and no third-party visitor statistics. The website loads a font from Google Fonts, which means Google receives your IP address. In the app itself we only use what's needed to keep you signed in.

7. How long do we keep data?

• As long as your account is active.
• Employees who leave are archived in Finito, not deleted. That way the employer can meet their legal retention obligation. The employer can ask us to delete archived employees' data.
• When an account ends, we delete the data within 30 days, except what we're legally required to keep, such as invoices.
• Backups are overwritten after 30 days at most.

8. Security

In the database, each company's data is walled off from every other company's. Administrators must use two-step verification. All connections are encrypted. Secret keys live only on the server, never in the app or the browser. Employees only see what fits their role.

9. Your rights

You can ask for access to, correction, transfer, restriction or deletion of your personal data, and object to certain processing. Email hallo@finito.work. We reply within a month. If it concerns data your employer keeps in Finito, we pass your request on to your employer.

If you're not happy with how we handle your data, you can file a complaint with the Data Protection Authority, Drukpersstraat 35, 1000 Brussels, www.gegevensbeschermingsautoriteit.be.

10. Changes

We update this policy when Finito or the services we use change. The current version is always on this page. Also read our terms and conditions.