Privacy policy

This policy explains what personal data Hyblance processes, why, for how long, and what your rights are. It is written in plain English. Where it refers to "we" or "Hyblance", it means the company named below. Where it refers to "you", it means the person reading it — an employee using Hyblance at work, an administrator who set it up, or a visitor to this website.

1. Who we are and how to reach us

Hyblance is operated by Hyblance, registered at Breda, company registration number 93940254, the Netherlands.

For anything about personal data, write to info@hyblance.com. For help using the product, write to support@hyblance.com.

2. Two roles: controller and processor

Hyblance processes personal data in two different capacities, and the difference decides who you should contact about it.

Hyblance as controller. For your account (name, e-mail address, password, sign-in method), for billing and contract data of the customer company, and for the technical data of this website, Hyblance decides what is processed and why. Hyblance is the controller, and this policy applies in full.

Hyblance as processor. For everything your company's employees enter into the product — schedule entries, tags, check-ins, room bookings, team membership, visibility rules — the customer company is the controller. It decides which tags exist, who may see whose schedule, and how long the data is kept. Hyblance processes this data only on the customer's instructions, under a Data Processing Agreement. If you are an employee with a question about how your employer uses Hyblance, ask your employer first; we will help them answer.

A Data Processing Agreement is available on request from info@hyblance.com.

3. What we process and why

3.1 Account data (Hyblance as controller)

• Your name and e-mail address — to create and secure your account, to sign you in, and to send you the transactional e-mails listed in section 6.
• Your password — stored only as a cryptographic hash by our authentication provider. We never see it.
• If you sign in with Google: your name, e-mail address and profile picture as Google provides them. We use them only to create and identify your account. Google sign-in is optional; e-mail and password work without it.
• Organisation membership — which company you belong to and which roles you hold in it, so the product can show you the right screens.

Legal basis: performance of the contract with you or your employer (Article 6(1)(b) GDPR).

3.2 Customer data (Hyblance as processor)

• Schedule data — for each person and calendar day, the tag chosen and, where the tag uses office capacity, the office. Also which version of the tag's rules applied at the time.
• Check-ins — that a person pressed "I'm here" at an office on a date.
• Room bookings — room, date, times, organiser, title, number of people, and whether the booking was checked into, released or cancelled.
• Structure — teams, membership with start and end dates, working patterns, roles, home office.
• Audit records — who changed whose schedule or visibility, and when. Kept so that every person can see changes made to their own data by someone else.

Legal basis: as processor we act on the customer's instructions. The customer is responsible for having a legal basis towards its employees, typically its legitimate interest in organising work and the office, or the employment contract.

Some tags may concern health or personal circumstances (for example a "Sick" tag). Hyblance is designed so that such tags carry no free-text notes at all, and so that their labels can be restricted to managers or HR. Whether such tags exist and who may see them is the customer's decision and responsibility.

3.3 Website and technical data (Hyblance as controller)

• Server logs — IP address, browser type, requested page, time, and any error, kept for security and to keep the service running.
• Colour-mode preference — stored in your browser so the site remembers light or dark.

Legal basis: our legitimate interest in running a secure and reliable service (Article 6(1)(f) GDPR).

3.4 Contact and support

When you write to us, we keep the correspondence for as long as needed to answer you and to handle any follow-up.

Legal basis: legitimate interest in answering you, or the contract where the question concerns it.

4. Sub-processors

We use the following third parties to run Hyblance. Each processes data only on our instructions and under a written agreement.

We will update this table when a provider changes and notify customers under the Data Processing Agreement.

5. Retention

• Account data: for as long as your account exists. When you delete your account, or your employer removes you, we delete the account within 30 days. Records that we must keep by law (invoices, for example) are kept for the legal period only.
• Customer data: for the life of the customer's subscription. When a subscription ends, the customer can ask for its data within 30 days; after 30 days we delete it. Backups are overwritten on a rolling schedule within a further 30 days.
• Server logs: 90 days.
• Correspondence: up to two years after the last message.

6. E-mail

Hyblance sends transactional e-mail only: a confirmation when you create an account, a link when you reset your password, and an invitation when an administrator adds you to a company. These are sent from no-reply@send.hyblance.com.

We send no notification e-mail of any kind — no reminders, no weekly digests, no capacity alerts — and no marketing e-mail to product users.

7. Cookies

Hyblance uses strictly necessary cookies only:

• a session cookie set by our authentication provider so that you stay signed in;
• a colour-mode preference so the site remembers light or dark;
• a redirect cookie that remembers the page you were trying to open when you were asked to sign in.

There is no advertising, no tracking across websites, and no analytics that identify people. Because these cookies are strictly necessary, no cookie banner is shown.

8. International transfers

Product data is stored in the European Union. Where a sub-processor is outside the EU (see section 4), transfers take place under the European Commission's standard contractual clauses, with additional safeguards where the law requires them. You can ask for a copy of the relevant clauses at info@hyblance.com.

9. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• rectify data that is wrong — you can change your own name in the product's settings;
• erase your data, where we have no legal reason to keep it;
• restrict or object to processing based on legitimate interest;
• receive your data in a portable format;
• withdraw consent at any time, where processing was based on consent (for example Google sign-in — you can switch to e-mail and password).

For account and website data, write to info@hyblance.com and we will answer within one month. For schedule and other customer data, your employer is the controller: ask them, and we will support them in answering. We may ask you to confirm your identity before acting on a request.

10. Complaints

If you believe we are processing your personal data unlawfully, we would like to hear it first at info@hyblance.com. You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the authority in the country where you live or work.

11. Security

We protect personal data with encryption in transit and at rest, row-level access control in the database so that one company can never read another's data, access limited to the people who need it, and logging of administrative actions. If a personal-data breach occurs that is likely to result in a risk to you, we will inform the affected customers without undue delay and the supervisory authority within 72 hours where the law requires it.

12. Changes to this policy

When this policy changes, we update the date at the top and, for changes that affect what we do with your data, tell customers by e-mail at least 30 days before the change takes effect. Earlier versions are available on request.