1. Who we are
ClockIt (“we”, “us”, “our”) provides a QR-based employee time-tracking service at clock-it.co.za. This Privacy Policy explains how we collect, use, store, and share personal information when you use our website, admin dashboard, and clock-in experience.
For POPIA roles and data-subject rights, also read our POPIA Notice.
2. Information we collect
Depending on how you use ClockIt, we may process:
- Account information — business name, admin name, email address, phone, address, password hashes, API keys.
- Employee information — names, employee codes, optional emails, PIN hashes, profile tokens, active/inactive status.
- Attendance records — clock-in and clock-out times, site, IP address, GPS coordinates (where captured), geo-verification status, and a required selfie photo for each clock event.
- Site information — site names, addresses, geo-fence coordinates and radius.
- Billing information — subscription status, payment references, amounts, and card authorisation tokens processed via our payment provider (Paystack). We do not store full card numbers on our servers.
- Technical data — device/browser information, logs, and security events needed to run and protect the service.
3. Why we process information
- To provide time tracking, reporting, exports, and admin tools you request.
- To verify attendance using PIN, location (where enabled), and photo evidence.
- To bill for active employees and manage subscriptions, renewals, and cancellations.
- To send service emails (welcome, password reset, billing, invitations).
- To secure the platform, prevent abuse, and meet legal obligations.
4. Photos and location
Clock-in and clock-out require a selfie photo. Photos are stored securely and linked to the attendance event so employers can review who punched. Where a site has a geo-fence, location may be checked against that fence. Location and photo data are sensitive operational records — treat access accordingly within your organisation.
5. Sharing
We share personal information only as needed to operate ClockIt, including:
- Payment processors (e.g. Paystack) for billing.
- Email delivery providers for transactional mail.
- Hosting / infrastructure providers that store or transmit data under contract.
- Your authorised admins, who can view employee and attendance data for your business.
We do not sell personal information.
6. Retention
We keep account and attendance data for as long as your organisation uses ClockIt and for a reasonable period afterwards for reporting, disputes, billing, and legal requirements. You may request deletion of an account subject to legal retention needs. Photos and clock events are retained with attendance history unless deleted as part of an account closure request.
7. Security
We use industry-standard safeguards such as encrypted connections (HTTPS), hashed passwords/PINs, access controls, and server hardening. No method of transmission or storage is 100% secure; please use strong admin passwords and limit who can access your dashboard.
8. Cross-border transfers
Some processors or infrastructure may store or process data outside South Africa. Where that happens, we take steps consistent with POPIA section 72 (for example contractual protections or comparable safeguards).
9. Your choices and rights
Admins can update business and employee details in the dashboard. Individuals may request access, correction, or deletion of their personal information via their employer (the customer) or by contacting us. See the POPIA Notice for data-subject rights.
10. Children
ClockIt is intended for workplace use by employers and their adult workers. It is not directed at children.
11. Changes
We may update this policy from time to time. The “Last updated” date at the top will change when we do. Continued use of ClockIt after an update means you accept the revised policy.
12. Contact
Privacy questions: noreply@clock-it.co.za
Website: https://clock-it.co.za