מדיניות פרטיות

In a Nutshell

• Organizations around the world trust TimeClock 365 with their workforce information. Protecting that information, and the personal data of every individual, is both a privilege and a duty for us.
• We mostly process personal data on behalf of our Clients. If you are an employee of one of our Clients, please contact your employer first – your employer has full control over your information.
• We also collect and process personal data about visitors to our websites, our business contacts and our customers.
• We respect your rights over your personal data.
• For any question, contact us at [email protected] or open a support ticket.

1. Introduction and Definitions

This Privacy Policy explains how TimeClock 365 Ltd., company no. 516135183, of 15 HaHaresh St., Hod HaSharon ("TimeClock 365", "we", "us" or "our") processes personal data.

TimeClock 365 is a technology platform that we own and operate. It helps organizations manage their workforce’s time, attendance, projects, tasks, access control and payroll, as well as property such as vehicles and packages. These organizations are referred to as "Clients". The service consists of a mobile application (the "App"), physical clock devices and access control hardware (the "Devices"), and a cloud platform that Clients access through the App and a dedicated web portal (the "Portal") (together, the "Platform"). Clients use the Platform to pay their employees and contractors and to carry out other workforce functions. Anyone who uses the App, the Devices or the Portal is an "End User".

Clients decide why and how they use the Platform and how data is collected through it. We process End User data on behalf of our Clients and under their instructions, and the Clients control that data. For example, if you work for a company called CorpCo, you are an End User and CorpCo is our Client; CorpCo has full control over your data and directs how we process it. Our processing on behalf of Clients is governed by our agreements with them, including our Data Processing Agreement, available at https://timeclock365.com/data-processing-agreement/.

If you are an End User and have any concern about your personal data, please contact your employer first. Your employer’s contact details appear in the App and in any communication you receive from TimeClock 365.

Separately, we operate websites, including timeclock365.com, and collect data about their visitors ("Visitors"). Some Visitors and other people who communicate with us become our business contacts ("Contacts") or Clients. For Visitors, Contacts and Clients, we act as the data controller, and you may contact us directly.

2. What Personal Data Do We Process?

End Users (data processed on the Platform)

• Identification information: full name; identification numbers (such as an ID number, Social Security number or passport number); date of birth; gender; profile photo; usernames and passwords used to access the Platform.
• Contact details: country and time zone; work and home addresses; phone numbers; email address.
• Location information: exact and approximate location, where enabled by the Client.
• Work-related information: employer; employee ID; division, department, role and title; employment start and end dates; work days and hours; project and task information; salary, wages and other compensation.
• Biometric data: where the Client has enabled biometric features, as described below.
• Any personal data contained in photos, media and files uploaded by Clients or End Users.
• Any other personal data that Clients or End Users enter or share on the Platform.

Biometric data

Where a Client chooses to use biometric features, Devices and the Platform may process fingerprint and facial characteristics in order to identify End Users for time and attendance, access control and security purposes. Depending on the Device and the settings chosen by the Client, biometric templates may be stored on the Devices, in our cloud environment, or both.

We process biometric data only on behalf of, and under the instructions of, the Client, and solely for these purposes. We do not sell, lease or trade biometric data, and we do not use it for any other purpose. Biometric templates stored in our cloud environment are protected by logical separation, encryption and restricted access.

The Client is responsible for informing End Users and for obtaining any consent or written release required by law before biometric features are used, including on our behalf as the Client’s service provider. Biometric data is permanently deleted when the purpose for which it was collected has been fulfilled – for example, when the End User is removed from the Platform, when the Client disables the feature, or when the Client’s account is closed – and in any event within the period required by applicable law (for example, under the Illinois Biometric Information Privacy Act, no later than three years after the End User’s last interaction with the Client). Questions about Devices at your workplace should be directed to your employer.

Contacts and Clients

• Identification information: full name; identification numbers; date of birth; gender; profile photo.
• Contact details: as listed above for End Users.
• Social networking information you have shared with us.
• Work-related information: company, division, department, role and title.
• Payment information: bank account number, credit card details or other billing information.
• Personal data contained in photos, media and files you send us.
• Any other personal data you provide to us through any channel, including email, customer support and product feedback.

Anyone using the Platform or our websites

Usage, log, analytics and other device and technical data, including device information and identifiers, operating system information, IP address, browser and session information, browsing history and referral sources, cookie information, language, connectivity, configuration, file metadata, and usage details such as screen views, clicks and time spent. On our websites, this may also include advertising identifiers.

3. Personal Data of Children

The Platform is a workforce management tool and is not intended for children. We do not knowingly collect personal data about children. If you believe that we have collected such data, please contact us.

4. How Do We Collect Personal Data?

End Users

We receive End User data in two ways: (a) from the Client, through the Platform, the Portal, Client-operated Devices, the Client’s use of the App or otherwise; and (b) directly from the End User, through the App, the Devices, the Portal, our websites, our customer support channels or otherwise.

When installing the App, you must accept its terms of use and this Privacy Policy. The App also asks for device permissions, such as location, camera, photos and file storage, which allow us to access those features and the related data in order to provide our services to Clients. Granting permissions is optional. Permissions are granted under the App’s terms, this Privacy Policy, the terms and policies of Google Play or the Apple App Store (depending on your device), and your device manufacturer’s terms. You may revoke permissions in your device settings or uninstall the App at any time.

If required data is not received from the App or a Device, the Platform may not work properly, and the Client may receive incomplete or inaccurate information about you, which could affect your work or pay. Please consult your employer about the effects of disabling permissions or uninstalling the App.

Contacts and Clients

• Directly from you, through website contact forms, email, phone, fax, conferences, meetings or other channels.
• From other Clients, Contacts, resellers, business partners or third parties, who share information based on their own interactions, purposes, legal bases and privacy policies.
• By supplementing existing records with information you provide, information we receive from others, and data collected from your use of the Platform or our websites.

Visitors and End Users

We may also receive data through your device, operating system and browser. Various technologies contribute to this, including cookies (described below), Microsoft Azure, WordPress and its plugins, Google analytics and advertising technologies, and other analytics and advertising providers. Our websites do not currently respond to browser or device "Do Not Track" signals.

5. Cookies

A cookie is a small file that your browser saves on your computer or mobile device. We use cookies to collect information and to support our services – for example, to save login credentials, enable features, understand how you interact with us, monitor the use of our websites, products and services, and personalize your experience and advertising. You can set your browser to block cookies; if you do, our websites and the Platform may not work properly.

6. Purposes of Processing

The Platform

Clients determine the purposes of processing End User data, and these may differ between Clients. Examples include employee and contractor time and attendance management; field agent management; project and task management; salary, payroll and compensation calculation and payment; fleet management and vehicle tracking; logistics and package or goods tracking; and other uses.

We use End User data to provide our services to Clients under their instructions, so that they can achieve their own purposes. Based on the Client’s instructions and Portal settings, or on the End User’s own settings, the Platform may use device and contact details to communicate with End Users – for example, by email or text message reminding them to clock in and out, log hours, or record attendance, project and task activity.

Our own purpose with respect to the Platform is to provide our services to Clients in accordance with our agreements with them and applicable law. We may also use usage and analytics data, and aggregated or de-identified data that cannot reasonably be used to identify any individual, to improve the Platform, the App, the Devices and the Portal, and for research. We do not sell End User data and do not use it for advertising or marketing.

Our websites, Clients, Contacts and Visitors

• Delivering and improving our products and services.
• Providing information about TimeClock 365, our products and services.
• Providing customer support, billing and invoicing.
• Contacting you by email, phone, SMS and other messaging platforms.
• Analyzing and optimizing traffic to and use of our websites and the Platform.
• Protecting TimeClock 365, our staff, our Clients and our systems.
• Online advertising across channels, including targeting you and people with similar characteristics ("lookalikes") on search engines, websites, apps, messaging and social platforms, and offline.
• Direct marketing across channels, including email, SMS, messaging and postal mail. You may opt out at any time by using the unsubscribe link in any communication or by contacting us.

7. Legal Bases for Processing

The Platform (Client as controller, TimeClock 365 as processor)

Clients, as controllers, may rely on any of the following legal bases:

• Legal obligation – the Client must comply with a law, such as labor regulations.
• Contract – the processing is necessary to perform a contract with the individual, or to take steps at the individual’s request before entering into a contract.
• Vital interests – the processing is necessary to protect the individual or another person, for example to ensure accurate pay for hours worked.
• Legitimate interests – the Client or a third party has a legitimate interest, such as securing its workforce, vehicles and property, assigning tasks to mobile staff based on their location, or verifying attendance.
• Public interest – in some cases, the processing is necessary for a task carried out in the public interest or in the exercise of official authority.
• Consent – the individual has consented to the processing for one or more specified purposes.

TimeClock 365, as processor, may rely on the following legal bases: legal obligation (compliance with data protection and privacy laws that apply to processors); contract (performance of our contracts with Clients); vital interests (protecting Clients, their staff and management); legitimate interests (conducting our business); and consent given through the App or otherwise for the purposes stated in this Privacy Policy.

Our websites, Clients, Contacts and Visitors (TimeClock 365 as controller)

We may rely on the following legal bases: consent, for the purposes stated in this Privacy Policy; contract, including steps taken at your request before entering into a contract; vital interests, such as protecting our Clients and staff; legal obligation, such as keeping billing records; and the legitimate interests of TimeClock 365 or our Clients, such as running our business, developing and delivering our products and services, and marketing and selling them.

8. Recipients of Personal Data

The Platform

• The Client, as controller, receives all End User data, so that your employer has access to and control over it.
• The contact details of Client representatives are shared with End Users and others who need them in order to meet legal obligations.
• Clients may share data with their staff, HR software providers, payment providers and others they select.
• We use sub-processors to provide the Platform. Our current sub-processors are listed in our Data Processing Agreement, available at https://timeclock365.com/data-processing-agreement/.

Clients, Contacts and Visitors

• Your data is held in third-party CRM, support and billing systems.
• Some of your details may be shared with our staff, consultants, resellers, affiliates and business partners for research, cooperation, joint promotions, sales and events.

Everyone

• Service providers that process data on our behalf, on a need-to-know basis, including hosting and backup, analytics, website technology, advertising technology and security providers. Each receives only the data required for its purpose.
• Aggregated or de-identified information that cannot reasonably be used to identify any individual may be shared for any purpose.
• Law enforcement agencies, courts and government bodies, when ordered by a competent authority under applicable law.
• In connection with a merger, asset sale, financing, liquidation, bankruptcy or acquisition, the other party and its advisors, before and after the transaction.

9. Security

We are ISO/IEC 27001 certified. We apply recognized security standards and organizational measures, including encryption of data in transit and at rest, multi-factor authentication for administrative access, role-based access control and regular backups, and we perform due diligence on our partners and processors. However, no system is completely secure, and we cannot fully guarantee the security of your personal data. Please help protect your data by using strong passwords, keeping your credentials safe, limiting access to your devices and signing out of the Portal when you finish using it.

10. Data Location and International Transfers

Platform data, including backups, is hosted on Microsoft Azure in Western Europe. Some of our personnel and service providers – such as email delivery, payment processing, website analytics and advertising providers – may access or process personal data from other countries, including the United States. Where we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to a country that is not recognized as providing an adequate level of protection, we rely on appropriate safeguards, such as the EU-U.S. Data Privacy Framework or the Standard Contractual Clauses approved by the European Commission.

11. Retention

We retain personal data for as long as reasonably necessary for the purposes described in this Privacy Policy, or longer where required or permitted by law, and as needed to resolve disputes, enforce our agreements and protect our staff and Clients. Retention periods depend on the type of data, our contracts and legal requirements.

Platform data is retained in accordance with our agreements with Clients. After a Client’s account is terminated, the Client may export its data within ninety (90) days, after which the data is deleted from our production environment, and from backups within a further ninety (90) days, as set out in our Data Processing Agreement. Biometric data is deleted as described in Section 2.

When personal data is no longer needed, we delete or de-identify it. Where this is technically impractical, for example in backups and archives, we keep the data secured in accordance with standard practices until it is deleted.

12. Your Rights

If you are an End User, please contact your employer, who is the controller of your data. Otherwise, please contact us. Depending on the laws that apply to you, and subject to their conditions, you may have the following rights:

• Access to your personal data.
• Rectification of inaccurate or incomplete personal data.
• Erasure of your personal data (the "right to be forgotten").
• Restriction of processing.
• Data portability, in a structured and commonly used format.
• Objection to processing, including for direct marketing.
• Not to be subject to decisions based solely on automated processing. We do not make such decisions.
• Lodging a complaint with the data protection authority in your country.

Residents of certain U.S. states may have additional rights under applicable state privacy laws, such as the right to know, delete and correct personal data and to opt out of targeted advertising. We do not sell personal data. We will not discriminate against you for exercising your rights.

The rights of access, erasure, rectification and portability cannot be exercised once the data has been deleted or de-identified at the end of its retention period. You may withdraw your consent at any time, but other legal bases, including statutory or contractual requirements, may still apply. Revoking App permissions or uninstalling the App stops new data from being sent, but may make the Platform less functional and leave the Client’s data incomplete or inaccurate, which could affect your work or pay. Please consult your employer about these effects.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect product developments, industry standards or new regulations. The "Last updated" date at the top of this page shows when it was last changed. We will notify you personally of material changes and will seek your consent where required by law. Please review this Privacy Policy periodically. Use of our services may require your agreement to the updated terms and policy; if you do not agree, please stop using our services. End Users should check the consequences of doing so with their employer.

14. Contact Us

If you are an End User, please contact your employer first. Your employer’s contact details appear in the App and in automatic messages from the Platform. If you do not know who the controller of your data is, our customer support team can help you identify it.

For any other question or request regarding this Privacy Policy or your personal data, contact us at [email protected], open a support ticket, or write to TimeClock 365 Ltd., 15 HaHaresh St., Hod HaSharon.