Privacy Policy

How TIMEmSYSTEM ApS handles personal data in the mTime product, including data from connected Google accounts.

Who we are and how to contact us

mTime is provided by TIMEmSYSTEM ApS (CVR 32 78 38 99), Gærtorvet 3, 1799 København V, Denmark, a company in the Visma Group.

For questions about this policy, or to exercise any of the rights described below, write to sikkerhed@timemsystem.com or use Visma’s privacy request form.

What this policy covers

This policy covers the mTime product: the web application at mtime.app, the mobile and kiosk apps, the API, and this Knowledge Center. It explains what personal data mTime processes, why and on what legal basis, who else is involved, and what your choices are — including dedicated sections on Google Calendar data for employees who connect their Google account, and on the AI features built into mTime.

The marketing website timemsystem.com has its own cookie and privacy notice.

Controller and processor

mTime is used by companies to manage their employees’ working time. For the employee data a company enters and processes in its own mTime workspace — names, employment terms, registered hours, time off, approvals — the company is the data controller and TIMEmSYSTEM ApS is the data processor, acting on the company’s instructions under the data processing agreement that is part of the customer contract. The company decides what is recorded and on what legal basis. If you are an employee and have a question about how your employer uses mTime, your employer is the right first contact.

TIMEmSYSTEM ApS is itself the data controller for the account you sign in with, for the security and operation of the service, for support requests you send us, and for visits to this Knowledge Center. Section Why we process your data sets out the legal basis for each of those.

Personal data mTime processes

• Account data — your name and email address, how you sign in (password, passkey, or a sign-in provider), your language and display preferences, and which workspaces you belong to.
• Employment and time data — employment terms, work time policies, registered hours and activities, time off requests, approvals, and notes you write.
• Integration data — data exchanged with systems your employer has connected (payroll, HR, identity providers), and, if you choose to connect one, your Google Calendar (see below).
• Technical data — server logs with IP address, browser and timestamps, kept for security and troubleshooting.
• Support data — what you send us when you report a problem or give feedback from inside mTime: your message, your email address and workspace, the page you were on, any screenshot you choose to attach, the transcript of your conversation with the assistant, and, for bug reports, an anonymised export of the workspace data you selected.

Where it comes from. Account data and support data come from you. Most employment and time data is entered by your employer, or by you as part of your work, and reaches mTime either directly or through an HR or payroll system your employer has connected — not from any public source. Google Calendar data comes from your own Google account, and only if you connect it.

mTime does not profile you, does not make automated decisions with legal or similarly significant effects about you, does not use your data for advertising, and does not sell it.

Why we process your data

Where your employer is the controller, the legal basis is your employer’s to determine, and their own privacy information applies. Where TIMEmSYSTEM ApS is the controller, this is what we process and why:

Where we rely on legitimate interests, you have the right to object — see Your rights. Providing account data is necessary to use mTime; everything else above is optional, and declining it costs you only the feature concerned.

Cookies and local storage

mTime sets only cookies that are strictly necessary to make the product work. There are no advertising, analytics or profiling cookies, and no consent banner, because there is nothing to consent to.

All three are HttpOnly and Secure, so they are sent only over HTTPS and cannot be read by scripts. Our legal basis is our legitimate interest in providing a working product, GDPR art. 6(1)(f).

Your preferences — language, sidebar state, notification choices — are stored in your browser’s own local storage, not in a cookie, and never sent to us.

mTime loads nothing from third-party domains, with one exception: the API reference at /api/docs loads its documentation viewer from unpkg.com. This Knowledge Center loads no third-party resources at all, and its search runs entirely in your browser against an index served from this site.

Google Calendar data

An employee can connect their own Google Calendar to mTime so that two things work: filling in a timesheet from meetings that have already taken place, and marking their calendar as busy when time off is approved.

Connecting is your own choice. An administrator turns the integration on for the workspace, but that changes nothing for anyone until each employee connects their own Google account from Security › Connected accounts. Nobody can connect an account on someone else’s behalf, and mTime has no workspace-wide access to calendars.

What mTime asks for. One calendar permission, https://www.googleapis.com/auth/calendar.events, plus the basic profile permissions (openid, email, profile) that let mTime show which Google account is connected. That calendar permission is the narrowest one that covers both features: a read-only permission could not write the out-of-office block, and a permission limited to calendars mTime created could not read your meetings, which other people made on your own calendar.

How mTime uses it.

• Filling in a timesheet. mTime shows meetings that have already finished so you can turn them into time entries. It reads only the date range on screen, and skips all-day entries, events marked free, invitations you declined, cancelled events and out-of-office entries. It asks Google for one attendee only — your own entry — so guest lists are never sent to mTime.
• Checking a time off request. When you request time off, mTime shows which upcoming meetings in that period would clash. Same exclusions; nothing is written.
• Out-of-office blocks. When your time off is approved, mTime puts an “Out of office” event on your own calendar, and removes or moves it if the time off is cancelled or its dates change. It never touches events it did not create. When you connect, and when you open the Security page, mTime checks whether time off already approved for the next twelve months is blocked on your calendar; that check reads out-of-office entries only.

What mTime keeps. Meeting titles, times, locations and guests are never stored — they are read from Google each time they are shown. What is stored is the encrypted access and refresh tokens, the connected account’s email address, the permissions you granted, and the id and dates of each out-of-office block, both those mTime created and any it found already there (flagged so it never touches them).

Taking access away. Either disconnect in Security › Connected accounts, or remove mTime under Third-party apps & services in your Google account. Either one stops all reading and writing, and mTime deletes the stored tokens and the connection. Out-of-office blocks already on your calendar stay there — mTime no longer has permission to remove them, so delete them in Google Calendar if you want them gone.

Limited use. mTime’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, mTime does not sell this data, does not use it for advertising or retargeting, does not use it to train or feed any AI feature, does not transfer it to third parties except as needed to provide the two features above, and does not allow people to read it — except with your explicit permission, where necessary for security purposes such as investigating abuse, or where required by law.

Sign-in providers and other integrations

If you sign in to mTime with Google, Microsoft, Visma Connect or Apple, mTime reads your name and email address from that provider to identify you, and stores your email address and the provider’s account identifier — nothing else. Signing in with a provider does not give mTime access to your calendar or any other data held there.

Payroll, HR and identity integrations (for example Dataløn, Intega Løn, Statens HR, Visma Organisation Master, Microsoft Entra ID and SCIM provisioning) are turned on and configured by your employer. Data exchanged through them is processed on your employer’s instructions under the data processing agreement.

AI features

mTime includes an assistant that answers questions about using mTime, helps you find things, and lets you report problems in your own words. Using it is optional: if you do not open it, nothing about you is sent to any AI model.

Where it runs. The assistant’s language, voice-transcription and help-search models run on Scaleway’s inference service in Paris, France — the same provider and region that hosts the rest of mTime. No other AI provider is involved: nothing is sent to OpenAI, Anthropic, Google or any other AI company.

What is sent to the models. Only what is needed to answer you: the messages you type and the earlier turns of the same conversation; the page you are on and the fields shown on it; your voice recording, if you use voice input, which is transcribed and then handled like typed text; your language; and, when the assistant looks something up for you, the data the answer needs — for example your working-day calendar and public holidays, or your own time off balances. When you report a problem, the assistant drafts the report from your conversation, and translates it into English if it is going to our internal issue tracker.

What is not done. TIMEmSYSTEM does not use your data or your conversations to train models, and Scaleway processes them only as our processor, to return an answer. The assistant cannot read your Google Calendar — calendar data is never sent to any AI model. It cannot change your data either: it prepares an action and shows it to you, and nothing happens until you confirm it.

Who we share data with

mTime is hosted in the European Union. We share personal data only with the providers below, and only for the purpose stated. Each is bound by a data processing agreement.

Reports sent by our own staff are handled in our internal issue tracker, provided by Linear Orbit, Inc. (USA).

As part of the Visma Group, we may share personal data with other Visma companies where that is necessary to operate and support the service.

Public authorities, including the police, may request access to personal data. We disclose data only where there is a court order or another valid legal obligation to do so.

We do not send push notifications containing personal data. mTime does not sell personal data and does not share it with advertising networks.

Where data is processed

All application data, including the encrypted Google tokens, is stored and processed in Scaleway’s Paris (fr-par) region in the European Union. Where a recipient above operates outside the EU/EEA — Google, when you choose to connect an account, and our internal issue tracker — transfers rely on the safeguards of Chapter V of the GDPR, such as the EU–US Data Privacy Framework or standard contractual clauses.

Retention and deletion

How long mTime keeps workspace data, and how it is deleted when a workspace is closed, is set out in the Data Deletion Policy. The table under Why we process your data gives the retention period for the data we hold as controller. In addition, Google Calendar tokens are deleted as soon as you disconnect, and server logs are kept for at most 31 days.

Security

All traffic to mTime is encrypted in transit (TLS). Data is encrypted at rest, and credentials such as Google tokens are additionally encrypted by the application with keys held in a separate secrets manager. Sign-in supports passkeys, and session cookies are HttpOnly and Secure. TIMEmSYSTEM ApS operates an information-security programme with independent ISAE 3000 assurance.

Your rights

Under the GDPR you have the right to access your personal data, to rectify it, to erase it, to restrict or object to its processing — including processing we base on legitimate interests — and to data portability.

For data your employer processes in mTime, contact your employer, who as controller answers such requests; we assist them. For account, security and support data, write to sikkerhed@timemsystem.com or use Visma’s privacy request form.

You can also complain to the Danish Data Protection Agency, Datatilsynet, or to the supervisory authority in your own country.

Changes to this policy

We encourage you to review this policy from time to time. When it changes in a way that materially affects how we handle your personal data, we announce it under Updates and revise the date below. The current version is always the one published on this page.

This policy is maintained by the mTime team and was last updated on September 15, 2026.