Privacy Policy

1. Who We Are

PunchdIn ("we," "us") operates the PunchdIn time-tracking service. For the purposes of the EU General Data Protection Regulation (GDPR) [citation:2], we act as a data processor for the employee and time-entry data you submit through the Service, and as a data controller for the account and billing information of our business customers.

Our EU representative, appointed under Article 27 GDPR, can be reached at eu-rep@punchdin.com.

2. Data We Collect

2.1 Account Data (Controller)

• Name, email address, phone number (if provided)
• Company name, billing address, VAT/tax ID
• Payment method details (processed by our payment provider; we do not store full card numbers)
• Login credentials (hashed passwords)

2.2 Employee Data (Processor)

When your employer uses PunchdIn, we process the following on their behalf:

• Employee name, email or phone number, job title, employee ID
• Time punches: clock-in, clock-out, break start/end timestamps
• Location data: GPS coordinates captured at the moment of a punch when a site has geofencing enabled. We do not track continuous location.
• Device information: model, operating system version, IP address at the time of a punch

2.3 Usage Data

• Pages visited, features used, browser type
• Error logs and diagnostic information

3. Why We Collect It

• To provide the Service: recording work hours, generating reports, enforcing geofences.
• To manage accounts: authentication, billing, support.
• To improve the Service: diagnosing problems, understanding usage patterns.
• To comply with law: tax, accounting, and legal obligations.

4. Legal Basis for Processing (GDPR)

For personal data of EU/EEA residents, we rely on the following legal bases under Article 6 GDPR [citation:2]:

• Performance of a contract (Art. 6(1)(b)): to provide the Service you have subscribed to.
• Legitimate interests (Art. 6(1)(f)): to improve the Service, ensure security, and prevent fraud.
• Legal obligation (Art. 6(1)(c)): to comply with tax and accounting requirements.
• Consent (Art. 6(1)(a)): where required for optional features or marketing communications.

Location data. Processing of GPS coordinates for geofencing is based on the performance of the contract between us and your employer, and on your employer's legitimate interest in verifying work location. Your employer is responsible for providing any notice or obtaining any consent required by local employment law.

5. Sharing Your Data

We do not sell personal data. We share data only with:

• Sub-processors: hosting providers, email delivery services, SMS gateways, payment processors. A current list is available at /legal/subprocessors.php.
• Your employer: if you are an employee using the Service through your company's account, your employer (the data controller) has access to your time and location data.
• Legal authorities: when required by law or valid legal process.

6. Retention

Account data is retained for the duration of the subscription plus 30 days after termination. Employee time and location data is retained according to the retention settings configured by your employer, or for the default period of 7 years to comply with payroll record-keeping requirements, unless a shorter period is agreed.

7. Your Rights (GDPR)

If you are in the EU/EEA, you have the right to:

• Access your personal data (Art. 15)
• Rectify inaccurate data (Art. 16)
• Erasure ("right to be forgotten") (Art. 17)
• Restrict processing (Art. 18)
• Data portability (Art. 20)
• Object to processing (Art. 21)
• Lodge a complaint with a supervisory authority (Art. 77)

To exercise these rights, contact us at privacy@punchdin.com. If your request concerns employee data (time punches, location), we will forward it to your employer, who is the data controller for that data.

8. California Privacy Rights (CCPA/CPRA)

California residents have the right to:

• Know what personal information is collected, used, shared, or sold
• Delete personal information (with exceptions)
• Correct inaccurate personal information
• Opt out of the "sale" or "sharing" of personal information
• Limit the use of sensitive personal information
• Non-discrimination for exercising these rights

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

To submit a request, email privacy@punchdin.com or use the "Privacy Request" form in your account settings. We will verify your identity before processing the request.

9. Quebec Rights (Law 25)

Quebec residents have rights under the Act respecting the protection of personal information in the private sector (Law 25) [citation:7], including:

• Access and correction of personal information
• Deletion of personal information
• Withdrawal of consent
• Portability of personal information
• Not to be subject to automated decision-making based solely on personal information

Our Privacy Officer can be reached at privacy@punchdin.com.

10. International Transfers

We store data in the European Union and the United States. When we transfer EU/EEA personal data outside the EEA, we rely on the European Commission's Standard Contractual Clauses (SCCs) or an adequacy decision. Our Data Processing Agreement incorporates the SCCs by reference.

11. Security

We use encryption in transit (TLS), hashed passwords, and access controls. Passwords are hashed with modern algorithms. Location data is captured only at the moment of a punch, not continuously.

12. Children

The Service is not directed to individuals under 16. We do not knowingly collect personal data from children.

13. Changes

We may update this Privacy Policy. Material changes will be notified by email and by a notice on the Service at least 30 days before taking effect.

14. Contact

Data Protection Officer:
Email: dpo@punchdin.com
Address: Rauenthalerstr. 1, 14197 Berlin, Germany