GDPR Compliance
Under the European Union General Data Protection Regulation (GDPR) 2016/679, your personal data is protected. This page summarizes your rights and how to exercise them on the CADENSA platform.
1. Your Rights Under GDPR
The GDPR grants you the following rights regarding your personal data:
📄 Right to Access (GDPR Article 15)
You can request a copy of the personal data we hold about you.
How: Profile → Settings → Privacy → Export Data (JSON or CSV format).
✏️ Right to Rectification (GDPR Article 16)
You can request correction of inaccurate or incomplete data.
How: Profile → Edit, or contact us:
🗑️ Right to Erasure (GDPR Article 17)
You can request deletion of your personal data ("right to be forgotten").
How: Settings → Delete Account. Note: All data is removed from Cadensa systems. VAT invoices remain with external providers (e.g. Billingo).
⏸️ Right to Restriction (GDPR Article 18)
You can request restriction of processing under certain conditions.
How: Settings → Privacy → GDPR Rights → “Request Data Processing Restriction” — from the interface, stating a reason. You can also request it by email:
📦 Right to Data Portability (GDPR Article 20)
You can request your data in a machine-readable format.
Format: JSON or CSV (Profile → Export Data)
🛑 Right to Object (GDPR Article 21)
You can object to data processing (e.g., direct marketing).
How: Settings → Privacy → GDPR Rights → “Object” — separately against direct marketing, profiling, and processing based on legitimate interests. For marketing, the unsubscribe link in the emails is enough. By email:
↩️ Right to Withdraw Consent (GDPR Article 7)
You can withdraw consent at any time (e.g., cookies, marketing).
How: Cookie Settings (footer), or Settings → Privacy
⚖️ Right to Lodge a Complaint (GDPR Article 77)
You can file a complaint with a supervisory authority if you believe your data protection rights have been violated.
Hungarian supervisory authority:
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9-11.
Postal address: 1363 Budapest, Pf. 9.
Email: ugyfelszolgalat@naih.hu
Web: https://naih.hu
2. Data Retention Periods
Detailed information about data retention periods is available in our Privacy Policy:
- User accounts: Retained until user-initiated deletion
- Time entries and other workspace content: as instructed by the customer acting as controller — they set the retention period under the employment rules that apply to them. Default: deletion when the account ends. When you delete your account, the link between you and your entries is severed immediately.
- Billing records: Removed from Cadensa systems on account deletion; VAT invoices remain with external providers
- Audit logs: 30 days (FREE), 90 days (PRO), 1 year (ENTERPRISE); security events for 1 year on every plan
- Marketing consent: until withdrawn
For more details: Privacy Policy
3. Data Export Guide
Under the right to data portability, you can export all your personal data in JSON or CSV format:
- Sign in to your CADENSA account
- Navigate to Settings → Privacy
- Click "Export Data" button
- Choose the format (JSON or CSV) and the file with all your personal data is downloaded
- • Profile information
- • Time entries
- • Projects and tasks
- • Settings and preferences
- • Billing history
4. Account Deletion (Right to be Forgotten)
Under GDPR Article 17, you can request deletion of your account and personal data:
Deletion Process:
- Settings → Delete Account
- Confirm deletion intent (irreversible)
- 7-day grace period: you can export your data or cancel the deletion
- All personal data will be deleted (except legal obligations)
⚠️ Important Notes:
- Billing records: Removed from Cadensa systems. VAT invoices remain with external providers (e.g. Billingo) — their retention obligations apply.
- Audit logs: Depending on plan: 30 days / 90 days / 1 year; security events 1 year (anonymized)
- Backups: Deleted from the live system immediately. Backups expire on a rotating schedule (daily: 30 days, weekly: 6 months, monthly: 2 years), so data disappears from backups within 2 years at the latest — if a restore ever happens, the deletion is re-applied.
5. Third-Party Data Processors
CADENSA uses the following GDPR-compliant third-party processors. The complete, canonical list — with contracting entity, storage location and transfer basis — lives on the Sub-processors page; in case of any discrepancy that page prevails.
OVH Hosting Limited
Managed database service (MongoDB) — storage of all operational data (Data center: Gravelines, France, EU / Contracting entity: Dublin, Ireland, EU)
DPA: OVH Data Protection Agreement (IE)Mollie B.V.
Payment processing, subscription management (Netherlands, EU — Amsterdam)
DPA: Automatic upon registration (GDPR Art. 28 — EU-based processor)
Wasabi Technologies, LLC
Object storage (eu-central-2 / Frankfurt, EU) with three separate buckets. (1) Encrypted database backups: rotating retention (daily 30 days, weekly 6 months, monthly 2 years) with no Object Lock — so erasure requests remain executable. (2) Invoice PDF archive: WORM Object Lock in COMPLIANCE mode, 8-year immutable retention per §169 of the Hungarian Accounting Act. (3) Profile pictures: a publicly readable bucket so the image can render in the interface — uploading one is optional and it can be deleted at any time. The buckets never mix.
DPA: wasabi.com/legal/data-processing-addendumBillingo Technologies Zrt.
Electronic invoicing + NAV Online Számla 3.0 reporting (Hungary, EU). Data transferred: customer name, billing address, tax/EU VAT number, email, invoice line items.
DPA: billingo.hu/adatvedelemPlausible Analytics OÜ
Cookie-free website analytics (Estonia, EU) — no personal data collected, no consent required
DPA: Not required (not personal data under GDPR)
Google LLC (Google Calendar)
Optional Google Calendar integration (USA) — user-initiated only, with explicit consent (Article 6(1)(a)); the transfer relies on the Article 45 adequacy decision (EU–US Data Privacy Framework). Google acts as an independent controller here, not as Cadensa’s processor.
DPA: cloud.google.com/terms/data-processing-addendum6. Contact and Questions
If you have questions about your GDPR rights or wish to exercise any of them:
Privacy Contact:
- Email:
- Response time: Within 30 days
- Service Provider: Axeri Labs Bt.
- Address: 2120 Dunakeszi, Brassói utca 7., Hungary
Related Documents:
Language of this document
This document is authored in English and Hungarian. On other language interfaces the English text is shown. In case of any discrepancy between the two versions, the English text prevails — except where the contracting party is a consumer resident in Hungary, in which case the Hungarian version applies. If you spot a discrepancy between the versions, please tell us at legal@cadensa.io and we will fix it.