Last updated: 12th October 2026
Monkaru ("we", "us", or "our") respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, disclose, and safeguard your information when you use our employee shift scheduling application.
This policy complies with the General Data Protection Regulation (GDPR) and other applicable data protection laws.
Our role as processor: Where you, as a customer (e.g. a hospital or department), enter and manage personal data of your employees in Monkaru, Monkaru acts solely as a processor under Art. 28 GDPR, and you remain the controller for that data. Processing is governed by a Data Processing Agreement, which we make available to our customers. For details, see our Data Processing Agreement.
Information about sick leave and special protection groups may be health data within the meaning of Art. 9 GDPR. We treat it with corresponding care: by default, employees and viewers cannot see other people's sick leave, and the organization decides who may see it.
We process your personal data based on the following legal grounds:
We use the collected information for the following purposes:
We may share your information in the following circumstances:
We use the following service providers to operate the Service:
The complete list with purpose and location is in Section 6 of the Data Processing Agreement.
We do not sell your personal data to third parties.
We retain your data for the following periods:
| Data Type | Retention Period | Legal Basis |
|---|---|---|
| Active account data | Duration of your account | Contract (Art. 6(1)(b) GDPR) |
| An organization's data after the end of the contract (employees, schedules, actual times, absences, settings) | Retained until the organization instructs deletion; no automatic deletion | Processing on behalf of the organization (Art. 28 GDPR); the organization's statutory retention obligations |
| Deleted items (employees, shifts, rooms, staffing slots, schedule entries, absences) | Kept for 30 days, then permanently deleted by the next weekly purge | Legitimate interest (Art. 6(1)(f) GDPR): accidental deletion recovery |
| Activity logs | Accessible in the app for 90 days, then archived; up to 2 years in total from the entry, then permanently deleted | Legitimate interest (Art. 6(1)(f) GDPR): traceability of changes and security |
| Change history of actual times | No fixed period, for as long as the organization keeps its data in Monkaru | Processing on behalf of the organization (Art. 28 GDPR): makes its working-time records traceable |
| Audit logs (security events) | 2 years, then permanently deleted | Legal obligation and legitimate interest |
| GDPR data requests | 5 years after completion | Legal documentation requirement |
Deleted data is only hidden at first and kept for 30 days. During this time, owners and admins can restore deleted employees, shifts, rooms and staffing slots from the trash of the respective page. Deleted schedule entries and absences cannot be restored from a trash. After 30 days, a weekly automated purge deletes the data permanently and irreversibly.
When an organization's contract ends, its data is not deleted automatically. The organization may resume using the Service later, and many records are subject to statutory retention obligations (e.g. for working-time records and payroll records). Owners of the organization can still download a full data export of the organization (JSON) under Settings › General. The data is deleted on the documented instruction of the organization as controller, for example a request to support, taking its statutory retention obligations into account. Section 11 of the Data Processing Agreement sets out the details.
Activity logs are accessible in the application for 90 days. They are then automatically moved to an archive that is not accessible through the application interface, and permanently deleted two years after the entry. Changes to actual times are the exception: they are kept for as long as the organization keeps its data in Monkaru, because they make the organization's working-time records traceable.
Important: As a user of our service, you are responsible for ensuring compliance with applicable labor law requirements, including any data retention obligations. We provide the retention mechanisms described above, but the Controller remains responsible for determining appropriate retention periods for their specific legal context.
You have the following rights regarding your personal data:
You have the right to request deletion of your personal data (GDPR Article 17). We distinguish two kinds of data:
Note: The 30-day recovery window applies to deletions inside the application, for example when an admin removes an employee or a shift. Deleting your account is separate from this and takes effect immediately.
To exercise these rights, please contact us using the information provided below or use the Data Rights Management page.
We use cookies and similar technologies to enhance your experience:
When you sign in with two-factor authentication (2FA), you may opt in to "Remember this device for 30 days". If you check this option, we set a security cookie (mfa_trusted_device) that allows you to skip the 2FA code entry on subsequent sign-ins from the same browser.
The cookie notice (profile menu › Cookie settings) lists all cookies. Because apart from the trusted device cookie we only set technically necessary cookies, it offers no further settings. You can delete cookies at any time via your browser settings.
We implement appropriate technical and organizational measures to protect your data:
The database holding all scheduling, absence and employee data is located in Germany (Frankfurt); the data is processed primarily in the EU. Where individual data is processed outside the EU, this is safeguarded by Standard Contractual Clauses (SCCs) or the EU-US Data Privacy Framework.
Database provider: The contracting party for database and authentication is Supabase Pte. Ltd. (Singapore). Supabase is contractually obliged to store the data in Frankfurt and to process it primarily there. Access is limited to authorized personnel bound by confidentiality; all access is logged. Where access takes place from a third country, e.g. for operations and support, it is safeguarded by Standard Contractual Clauses (SCCs) under Commission Implementing Decision (EU) 2021/914.
Payment processing: Hospitals and departments are normally billed by invoice (e-invoicing, SEPA credit transfer). In that case no data is transferred to Stripe. Stripe, Inc. (United States) is used only if an organization chooses online payment through Stripe (e.g. credit card). Only then is billing metadata (email address, customer ID, subscription status) processed by Stripe for payment and subscription management. In no case is scheduling, absence or employee data shared with Stripe.
The transfer to Stripe is protected by the following safeguards:
In the event of a data breach, the following applies depending on the kind of data:
In both cases we take appropriate measures to remedy the breach and limit its consequences.
We may update this privacy policy from time to time. We will notify you of any material changes by:
We use Rybbit, a privacy-focused, cookieless analytics tool hosted in the EU (Germany), to understand how our website is used and to improve our services. Rybbit does not use cookies and does not track individual users across sessions. Your IP address is processed only briefly on a page view to determine the country, and is not stored. Analytics operate under our legitimate interest (Art. 6(1)(f) GDPR) without requiring your consent, because no cookies are set and no user profiles are built.
We use Google Search Console to monitor indexing and site health. Search Console does not set cookies for visitors and provides aggregated reporting to us as site owners.
If you have any questions about this privacy policy or our data practices, please contact us:
Controller
Monkaru, owner Manuel Istratoaie
Vorgartenstraße 223A/2/58, 1020 Vienna, Austria
Email: support@monkaru.com
You also have the right to lodge a complaint with the competent data protection authority if you believe we have not complied with applicable data protection laws.
If you submit or manage personal data of employees or company representatives in the Service (such as names, email addresses, identifiers, shift preferences, availability, and related HR data), you, as the data controller, confirm that you have obtained all permissions, consents, or other lawful bases required by applicable law, collective agreements, and internal company policies to provide such data to us and to have it processed for the purposes described in this Privacy Policy.
We act as your data processor and rely on your representations regarding authorization and legal basis. You remain solely responsible for compliance as controller, including honoring any local-law or policy restrictions applicable to your organization.