Privacy Policy

Who does what

Two organisations are involved in your data, and they have different responsibilities.

• Your employer is the controller. They decide which verification checks to switch on, who inside the company can see your records, how long records are kept, and what the records are used for. They are also responsible for telling you about that processing and for having a lawful basis for it.
• TimeGate is the processor. We run the platform, store the data, and act on the instructions your employer gives through the product. We do not decide what to collect about you.
• Where we handle data about our own customers and prospects, for example a work email address given to us for a demo, we are the controller for that limited set.

Data we collect

The platform holds the following categories. Most of it is supplied by your employer or generated when you use the app, not collected from you directly.

• Identity and employment data: first and last name, employee number, login ID, work email, phone number, job title, department, category, home branch, reporting line, hire date and employment status.
• Attendance records: check-in and check-out events with both the time reported by the phone and the time the server received it, the shift the punch belongs to, the branch, whether the punch was made offline and queued, and any corrections, notes or review flags attached to a day.
• Location data: latitude, longitude and accuracy, recorded at the moment of a punch, and only when your employer has enabled geofence verification.
• Network data: the SSID and BSSID of the Wi-Fi network the device is joined to at the moment of a punch, and whether it matched a network your employer registered for that branch. Only collected when Wi-Fi verification is enabled. We do not read traffic on that network.
• Device data: platform, device model, operating system version, app version, a hashed device fingerprint, and a push notification token. Devices can be bound to an employee so that punches from an unrecognised device are flagged.
• Technical data attached to a punch or a dashboard action: IP address, user agent, and the app session the action belonged to.
• Leave and absence data: requests, dates, leave type, balances, the approval trail through line manager and HR, and any documents attached to a request.
• Disciplinary data: warnings recorded against an employee for lateness, absence, misconduct or other reasons, where your employer uses that feature.
• Payroll data: compensation figures, pay components, pay periods, payslips, and bank details where your employer runs payroll through TimeGate. Bank account numbers and SWIFT or routing values are encrypted at rest with a key held outside the database.
• Authentication data: a password hash and salt for dashboard users, an optional multi-factor secret, hashed one-time codes used for mobile sign-in, and hashed refresh tokens. Passwords and one-time codes are never stored in a recoverable form.
• Audit data: a log of actions taken in the dashboard, including who acted, in what role, what changed before and after, the IP address and the user agent.
• Support data: messages you send us and the records needed to answer them.

What the mobile app asks for, and why

The app requests operating system permissions. Each one maps to a specific function, and you can decline any of them, though declining a permission your employer relies on may stop you from punching from your phone.

• Location. Used to confirm you are inside the branch geofence at the moment you punch. The Android app currently declares the background location permission and the iOS app declares the always-and-when-in-use permission. In the current version, location is read at the moment of a punch and is not sampled between punches. We are narrowing these declarations to match that behaviour.
• Local network and Wi-Fi information. Used to read the SSID and BSSID of the network you are joined to so it can be compared against the branch network list. It does not give us access to anything else on that network.
• Photo library. Used only when you attach a document to a leave request or set a profile photo.
• Notifications. Used to tell you about approvals, rejections and reminders.

Why we handle it

Attendance, leave, shift and payroll data is handled so your employer can run its workforce: recording hours, approving leave, producing payroll input, and meeting record-keeping duties under local labour law.

Location, network and device data is handled for one narrow purpose, which is confirming that a punch was made by the right person at the right place. Each check is optional and is switched on by your employer, not by us. Where the law requires consent for a check, your employer is responsible for obtaining it.

Authentication, audit and technical data is handled to keep accounts secure, to investigate suspected misuse, and to diagnose faults.

What we do not do

We do not sell personal data. We do not share it with advertisers, and we do not use it to build advertising profiles.

We do not sample your location in the background between punches.

We do not use your attendance, leave or payroll data to train machine learning models offered to other customers.

We do not read the contents of the Wi-Fi networks you connect to. We record the network identifier only.

Who we share it with

Data is shared only where it is needed to run the service.

• Your employer, including the HR, payroll, line manager and administrator users your employer has authorised. What each of them can see is governed by the role your employer assigned.
• The infrastructure providers we use to host and operate the platform. These are listed by name, purpose and location on our sub-processors page.
• Authorities, where we are legally required to disclose.
• A successor entity, if the business is transferred, subject to this policy continuing to apply.

Where your data is stored

Production data is hosted on Amazon Web Services. Uploaded files, including leave attachments, are stored in Amazon S3 in the US East (N. Virginia) region. Caching runs on Upstash. The full list, with the purpose and region of each provider, is on our sub-processors page.

This means that if you are based in the UAE, Saudi Arabia, Jordan or elsewhere in the region, your data is processed outside your country. If your organisation has a data residency requirement, raise it with us before you roll TimeGate out, because it affects how we would need to deploy for you.

International transfers

Because hosting is in the United States, personal data originating in the EEA, the UK or a country with similar transfer rules will cross a border. Where that happens we rely on the transfer mechanisms our infrastructure providers make available, including standard contractual clauses where they apply.

Our data processing agreement sets out the transfer terms that apply between TimeGate and a customer.

How long we keep it

Retention is set by your employer, because employment records are usually governed by local labour and tax law. While an account is active, attendance, leave and payroll records are kept for as long as your employer keeps them.

We do not currently run an automated retention or purge schedule. Deletion happens when a customer asks for it, or when an account is closed and we delete or irreversibly anonymise the data associated with it. If you need a specific retention period enforced automatically, tell us before you sign, so we can agree it in writing rather than leave you relying on a manual process.

Backups are rotated on a fixed schedule, so a deleted record can persist in an encrypted backup for a period after deletion before it is overwritten.

Security

Traffic between the apps and our servers is encrypted in transit. Passwords are stored as one-way hashes. Session tokens on mobile are kept in the operating system secure store rather than in general app storage. Access tokens are short lived and refresh tokens are stored hashed.

Access to production data is limited to the people who need it to operate the service, and sensitive payroll fields are encrypted at rest with a key held outside the database.

Our security page sets out the controls in more detail.

No system is perfectly secure. If a breach affects your data, we notify the affected employer without undue delay so they can meet their own notification duties.

Your rights

Depending on where you live, you may have the right to ask for a copy of your data, to correct it, to delete it, to restrict or object to how it is handled, and to receive it in a portable format.

Because your employer controls the record, please raise these requests with your HR team. If you contact us directly we will forward the request to them and support them in answering it. You also have the right to complain to your local data protection authority.

Children

TimeGate is a workplace tool and is not intended for anyone under the minimum working age in their jurisdiction. We do not knowingly collect data from children.

Changes to this policy

We update this policy when the product or our providers change. The date at the top reflects the last revision. Material changes affecting customers are communicated to the account contact.

Contact

Privacy questions can be sent to hello@timegate.me. If you are an employee using TimeGate through your employer, contact your HR team first, because they control your record.