1. Purpose of this notice
This notice explains how ClockIt processes personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). It supplements our Privacy Policy.
2. Roles under POPIA
- Your organisation (the customer) is typically the responsible party for employee personal information you load into ClockIt for timekeeping (names, codes, attendance, photos, location).
- ClockIt acts as an operator when we process that employee information on your documented instructions to provide the service.
- For admin account data, billing contacts, and website visitors, ClockIt is typically the responsible party.
3. Categories of information
We process the categories listed in the Privacy Policy, including special operational records such as selfie photos required at clock-in and clock-out and location data where geo-fencing is used.
4. Lawful processing
Processing is necessary to:
- Conclude and perform the subscription / trial agreement
- Pursue legitimate interests in running a secure timekeeping platform
- Comply with legal obligations (for example tax or regulatory requests where applicable)
Employers must ensure they have an appropriate POPIA basis and workplace notices for collecting employee photos and location for attendance.
5. Operator commitments
When acting as operator for customer employee data, we:
- Process information only to provide ClockIt features you use
- Apply reasonable technical and organisational security measures
- Limit access to personnel and processors who need it
- Assist with reasonable data-subject requests routed through you
- Notify you of security compromises affecting your data where required
6. Security safeguards (Condition 7)
Measures include HTTPS, credential hashing, access controls, and hosting protections. Customers should manage admin access carefully and deactivate leavers promptly.
7. Data subject rights
Under POPIA, data subjects may have rights to:
- Be told what information is held and how it is used
- Access their personal information
- Request correction or deletion
- Object to certain processing
- Lodge a complaint with the Information Regulator
Employees should usually contact their employer first (the responsible party). Admins and website users may contact ClockIt at the address below.
8. Cross-border transfers
Where operators or infrastructure are outside South Africa, transfers are handled in line with POPIA section 72 and our Privacy Policy.
9. Direct marketing
We send transactional service emails related to your account. Marketing emails (if any) will include an unsubscribe option and comply with POPIA rules on electronic direct marketing.
10. Information Officer
For POPIA queries related to ClockIt as responsible party:
Email: noreply@clock-it.co.za
Web: https://clock-it.co.za
You may also contact the Information Regulator (South Africa):
- Website: inforegulator.org.za
- Email: enquiries@inforegulator.org.za
11. Updates
We may update this notice when our processing practices change. The “Last updated” date will be revised accordingly.