Privacy policy

ClockWitness is provided by Espírito Rebelde Publicidade e Marketing Lda.

Address: Rua da Fábrica 222, Armazém 2, 4470-768 Maia, Portugal

Registration number: 509360378

Privacy and data protection contact (DPO): Bruna Teixeira, privacy@clockwitness.com. Use this address for any question about this policy or about your data.

Account data

Name, email address, password (stored only as a hash, never in plain text), company, role (owner, manager or team member), language and time zone and, if you turn on two-factor authentication, that second factor's secret. We also record the devices linked to the account (computer name, operating system and agent version) and, in an audit log, important actions, with date, time and IP address. This is used to create and manage the account, authenticate whoever signs in and protect the service.

Hours and time records

Start and end of each work session, breaks, project and activity, task descriptions and corrections made to the records. If the company uses those features, also schedules, shifts, absences and leave, and hourly rates to calculate pay or bill its own clients.

Screen captures

While a session is recording on the computer, the desktop agent takes screenshots of every monitor, at the frequency the company sets (by default, about one every 2 minutes). The company can turn screenshots off for the whole team or for specific people. Every time someone views another person's screenshots, it is recorded in the audit log.

Activity

Per time interval: whether there was keyboard and mouse activity (never what is typed or which keys are pressed), periods of inactivity, and a statistical summary of the rhythm of mouse movements, used to flag patterns that look automated — a signal for review by a person, never an automated decision. If the company keeps it switched on, also the name of the applications and the title of the windows in the foreground and the time spent in each. ClockWitness is not a keylogger and does not record video of the screen.

Location (mobile app)

Only if the company requires it and the person grants location permission on the phone: the GPS coordinates at clock-in and clock-out and the workplace they correspond to. If the company turns on automatic clock-in and clock-out by zone, the app sends its position to detect arrival at or departure from a workplace. We do not store routes or continuous location throughout the day.

Billing

Company name, country, tax (VAT) number, account owner's email, plan, number of people, payment and credit history, and the customer and payment-method identifiers the payment provider returns to us. The billing address and card details are entered directly on the payment provider's page; card details never pass through our servers.

Website and communications

When you visit the website, our servers process your IP address and technical request data (browser, page requested) to serve the pages and prevent abuse. If you request an account or sign up, we process what you enter in the form (company, name, email, phone, team size, partner code). We send service emails (invitations, password recovery, notices about the trial period and payments, reports and alerts you set up) and, if you turn them on, browser notifications. If you write to us, we use your message to reply. To diagnose faults we collect technical error reports, configured to leave out personal data such as IP addresses and cookies.

We host the personal data we process in data centres in the European Union, and we store our backups in the European Union in encrypted form.

Some of our authorised personnel, and some external service providers (for example external hosting, infrastructure, payment, email and technical support services), may access or process personal data from countries outside the European Economic Area (EEA). This includes countries that the European Commission has not recognised as providing an adequate level of data protection. Where this happens, we transfer or allow access to personal data only under one of the safeguards in Chapter V of the GDPR:

• an adequacy decision of the European Commission for the country concerned, including, for the United States, the EU–U.S. Data Privacy Framework where the recipient is certified under it; or
• the Standard Contractual Clauses adopted by the European Commission, together with a transfer impact assessment and any additional measures it shows are needed.

Everyone who accesses personal data from outside the EEA must protect it to the same standard we owe you under the GDPR, and must not give it less protection. In particular: they are bound by confidentiality obligations; they receive only the access their role needs; they access the data only through encrypted, authenticated connections, and access is logged; they must not keep copies outside our systems; they may use the data only on our instructions.

In exceptional cases where none of these safeguards applies, we rely only on a derogation in Article 49 of the GDPR, for example where the transfer is necessary to perform a contract with you or at your request.

You can ask for more information about these safeguards, or for a copy of them, by writing to privacy@clockwitness.com.

For customers: if you, or users you authorise in your workspace, access ClockWitness data from outside the EEA, that access is made on your instructions and under your responsibility as controller, and you are responsible for making sure it meets the data protection laws that apply to you.