Privacy Notice for Employees: Time Tracking and Employee App (Full Version)

Part 1: The short version

1. Your employer, [COMPANY], uses the software kloq to manage working time, absences and rosters. You use it via web, kiosk, terminal or the employee app.
2. We process only the data needed for these purposes. For each data category we check whether it is necessary.
3. We do not create performance, behaviour or movement profiles, and we do not analyse data to assess or compare employees.
4. You can see your data at any time. The app has a view "Who has seen my data?" showing the date, role and purpose of each access.
5. You have rights (Part 5). You can contact us at any time: [DATA PROTECTION CONTACT COMPANY].
6. Where a function is voluntary (for example push reminders), you suffer no disadvantage if you do not use it.

This notice applies in Austria, Germany and Switzerland. Where the legal position differs, it says so. It is not legal advice.

Part 2: Who is responsible?

Service provider. The software is operated by [FIRMA]. [FIRMA] processes your data only on our behalf and on our instructions (processing on behalf). Contact: [KONTAKT]. Hosting takes place in [HOSTING LOCATION, EU] with [PROVIDER].

Part 3: What we process and why (by purpose)

Each section states: what for, which data, on what basis, who sees it, how long it is kept. The legal bases are: Art. 6(1)⁠(b) GDPR (performance of the employment contract), (c) (legal obligation), (f) (legitimate interest) and (a) (consent, only where voluntary). For health data, Art. 9(2)⁠(b) GDPR applies in addition. In Germany, section 26 BDSG also applies, in Austria the Labour Constitution Act (ArbVG), in Switzerland Art. 328b of the Code of Obligations and the Data Protection Act.

3.1 Time (working time recording)

• What for: Recording working time, calculating pay and supplements, proving compliance with statutory working time limits.
• Data: Name, personnel number, time and type of booking (clock in, clock out, break, errand), channel (web, kiosk, terminal, app), corrections with reason and the person who corrected.
• Basis: Art. 6(1)⁠(b) and (c) GDPR (Austria: recording duty under the AZG; Germany: ArbZG and MiLoG; Switzerland: Art. 73 ArGV 1); Germany also section 26 BDSG.
• Who sees it: You; your team lead sees the times of the group; HR and payroll for settlement. Your team lead does not see the channel of your booking.
• Retention: AT 36 months, DE 36 months, CH 60 months (starting values); terminal read events 30 days. Payroll records are kept longer (see Part 4).
• Mandatory or voluntary: Time recording is part of the employment relationship. Without this data we cannot calculate your pay correctly. You can choose the channel.

3.2 Roster

• What for: Planning shifts and staffing, checking statutory rest periods and maximum working hours, preferred days off, shift swaps.
• Data: Shifts, days off requested and availability (voluntary), swap requests, rule-check notices, differences between plan and clock-in (as notices only). Your date of birth is used only to check youth protection and is not shown in team views.
• Basis: Art. 6(1)⁠(b), (c), (f) GDPR; co-determination (AT section 97 ArbVG, DE section 87 BetrVG, CH Art. 48 ArG and Art. 69 ArGV 1).
• Who sees it: You; team lead and HR for planning; payroll for supplements.
• Retention: As time bookings; days off and availability [6 months] after the planning period.
• Note: Plan versus actual notices are aids for clarification, not accusations. They are never the sole basis for a measure.

3.3 Location (only if used)

• What for: [PURPOSE, FOR EXAMPLE PROOF OF WORK LOCATION FOR FIELD SERVICE OR CONSTRUCTION SITES].
• Mode: [OFF / NFC TAG ONLY / GEOFENCE WITH FLAG / GEOFENCE WITH ENFORCEMENT].
• Data: Result (inside, outside, unknown, not collected), accuracy in metres, identifier of the place or NFC tag. Coordinates are not stored. [IF THEY ARE: JUSTIFICATION, AT MOST 30 DAYS]
• When: Only at the moment of booking. No background location, no continuous tracking.
• Basis: Art. 6(1)⁠(f) GDPR [JUSTIFICATION]; in Austria and Germany on the basis of the works agreement; in Switzerland Art. 328b of the Code of Obligations and Art. 26 ArGV 3 (no behavioural monitoring). Access to your device's location happens only when you trigger the booking yourself and the operating system permits it.
• Who sees it: You and HR. Your team lead sees at most the notice "plausibility check needed", not the place.
• Retention: Result as time bookings. Raw data, if provided for, at most [0 to 30] days.
• Your choice: You do not have to grant location access. You then book through another channel (kiosk or web) without disadvantage. "Outside" is normal for field service and home office and leads to no sanction. We do not build movement profiles.

3.4 Absences

• What for: Managing leave, care leave and other absences for payroll and planning.
• Data: Period, type of absence (from a small catalogue), request status, approval.
• Basis: Art. 6(1)⁠(b) and (c) GDPR.
• Who sees it: You; HR and payroll; your team lead and colleagues see only "absent", not the reason.
• Retention: As payroll records (AT 84, DE 72, CH 120 months; starting values).

3.5 Health (sick leave)

• What for: Continued payment of wages, notifications, deployment planning.
• Data: The fact and expected duration of incapacity for work, type (illness, accident, other). No diagnosis. Never upload a certificate that shows a diagnosis; only the copy meant for the employer. [IF UPLOAD IS ENABLED: photo of the certificate. In Germany, your employer retrieves the electronic certificate from the health insurer for statutorily insured employees; a photo is then not needed.]
• Basis: Art. 6(1)⁠(b), (c) and Art. 9(2)⁠(b) GDPR (Germany also section 26(3) BDSG; Switzerland Art. 328b of the Code of Obligations).
• Who sees it: HR and payroll. Your team lead sees only "absent" or "not available", as far as needed for deployment planning. Every access to an attachment is logged.
• Retention: Period as payroll records; attachment until settlement plus 6 months.
• Protected periods: Pregnancy, breastfeeding or disability appear in planning only as a neutral restriction without a reason. We store type and period for this, no diagnosis.

3.6 Push notifications and the app

• What for: Login, notifications about roster changes, requests, reminders.
• Data: Account, device identifier, push token (pseudonymous), settings. Notifications contain no content from health or pay data.
• Basis: Login and operation of the app: Art. 6(1)⁠(b) GDPR. Reminders are voluntary: Art. 6(1)⁠(a) GDPR (consent). You can switch them off in the app at any time; withdrawal takes effect immediately.
• Recipients: Delivery runs through Apple (APNs) and Google (FCM) in the USA, see Part 4.
• Retention: Device identifier and token until logout or leaving the company.

3.7 Access log ("Who has seen my data?")

• What for: Security, traceability of changes, transparency for you.
• Data: Time, action, role of the accessing person, object type, purpose. Names of accessing persons are not shown, except where there is a legitimate interest.
• Basis: Art. 6(1)⁠(f) GDPR (security, accountability); Switzerland Art. 4 DSV for sensitive data.
• Retention: 12 months. The content is encrypted.
• Note: The log is not used for performance or behaviour monitoring of the persons who access data.

3.8 Biometrics (only if used, off by default)

• Fingerprint or other biometric terminals exist only if we have justified their necessity. They are never the only option: you can book with a badge or PIN, without disadvantage.
• The characteristic stays in the terminal; kloq receives only your identifier. The basis is your explicit consent (Art. 9(2)⁠(a) GDPR; Switzerland Art. 6(7) revFADP), which you can withdraw at any time. On withdrawal or when you leave, the characteristic is deleted in the terminal within [7] days.

3.9 Receipt recognition (only if used, off by default)

• Photographed receipts (meals, travel) can be read automatically (amount, date, merchant). Provider: Anthropic (USA). You confirm the result. You can also enter receipts by hand. Sick leave documents are never processed this way.
• Basis: Art. 6(1)⁠(b) and (c) GDPR. Retention: Receipts AT 84, DE 96, CH 120 months; at the provider [ENTER ASSURANCE].

3.10 Leaving the company and mailbox (only if used)

• Your mailbox is locked at the time you leave. There is an out-of-office note naming a contact person, without the reason for leaving. Content is accessed only for a documented reason, with approval by two people, excluding private folders, and we inform you. Business emails are archived according to retention periods. Your consent is only an additional option, never the only one. After you leave you can still reach us for access requests, payslips and withdrawal at [CONTACT FOR FORMER EMPLOYEES].

Part 4: Recipients, transfers abroad, retention

4.1 Recipients

You can request the current list of sub-processors.

4.2 Transfers to third countries

Apple and Google (push) and Anthropic (receipt recognition, only if enabled) are based in the USA. The transfer relies on [DATA PRIVACY FRAMEWORK / STANDARD CONTRACTUAL CLAUSES]. For Switzerland, the Swiss-US Data Privacy Framework (in force since 15 September 2024) applies where the recipient is certified. You can request a copy of the safeguards. Support access takes place from the EU or Switzerland or on the basis of a transfer safeguard.

4.3 Retention

Data that must still be retained is blocked, not used, and deleted or irreversibly made unreadable once the period has expired.

Part 5: Your rights

1. Access to your data and a copy (Art. 15 GDPR; Switzerland Art. 25 revFADP). We reply within one month (AT, DE; extendable by two months, with reasons) or within 30 days (CH). In the app you can export your data yourself. In Austria you also have a claim to receive your working time records (section 26 AZG).
2. Rectification of inaccurate data. We correct faulty bookings; the original booking remains visible for evidence purposes.
3. Erasure (Art. 17 GDPR), unless a retention duty applies. Then we block the data and delete it when the period ends.
4. Restriction of processing (Art. 18 GDPR).
5. Objection to processing based on legitimate interests.
6. Data portability (Art. 20 GDPR; Switzerland Art. 28 revFADP): you receive the data you provided in a machine-readable format.
7. Withdrawal of consent at any time with effect for the future; in the app under "My consents". Withdrawal takes effect immediately; the lawfulness of earlier processing is not affected.
8. Complaint to the supervisory authority: Austria: Data Protection Authority (DSB); Germany: [COMPETENT STATE AUTHORITY]; Switzerland: Federal Data Protection and Information Commissioner (FDPIC).
9. Support from the works council or employee representation: you can turn to [WORKS COUNCIL].

For all requests contact [DATA PROTECTION CONTACT COMPANY]. We verify your identity before releasing data.

Part 6: Further information

1. No automated decisions. There are no decisions made solely by automated means that significantly affect you. Notices from the system are reviewed by people.
2. No profiles. We do not create performance, behaviour or movement profiles.
3. Voluntary functions. If you do not use them, you suffer no disadvantage.
4. Data breaches. We report personal data breaches to the supervisory authorities where required (Art. 33 GDPR; Switzerland Art. 24 revFADP) and inform you if there is a high risk for you.
5. Security. Encryption, role model, access log and separate storage of sensitive data.
6. Changes. We update this notice when the processing changes (for example with a new function) and tell you beforehand.

As of: [DATE], version [VERSION].