Privacy Policy

Interpretation and Definitions

Interpretation

The words of which the initial letter is capitalized have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

Account

means a unique account created for You to access our Service or parts of our Service.

Application

refers to Clockon Me, the software program provided by the Company.

Company

(referred to as either "the Company", "We", "Us" or "Our" in this Privacy Policy) refers to Clockon Me.

Country

refers to: Victoria, Australia.

Device

means any device that can access the Service such as a computer, a mobile phone or a digital tablet.

Employer

means the business or organisation that engages You and uses the Service to manage its shops, rostering, shifts, timesheets and attendance.

Location Data

means information about the geographic location of Your Device, collected at the time You clock in or clock out in order to verify that You are at Your designated worksite (geofencing).

Personal Data

means any information that relates to an identified or reasonably identifiable individual. It has the same meaning as "personal information" under the Privacy Act 1988 (Cth).

Sensitive Information

has the meaning given in the Privacy Act 1988 (Cth) and includes information such as health information. We do not collect biometric information or biometric templates through the Service.

Service

refers to the Application and related services provided by the Company.

Service Provider

means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals engaged by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service, or to assist the Company in analysing how the Service is used.

Third-party Social Media Service

refers to any website or social network through which a User can log in or create an account to use the Service (namely Google and Apple).

Usage Data

refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit or a device identifier).

You

means the individual accessing or using the Service, or the company or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

Collecting and Using Your Personal Data

Types of Data Collected

Personal Data

While using Our Service, We may ask You to provide Us with certain personally identifiable information that can be used to contact or identify You. This may include, but is not limited to:

• Email address
• First name and last name
• Phone number
• Home or business address (where provided)
• Profile picture (if You choose to provide one)
• Workplace and employment-related information created through the Service, such as the shops You are assigned to, shifts, rosters, timesheets, clock in and clock out records, breaks, availability, leave requests, tips and related records
• Employment and pay details recorded by Your Employer through the Service, such as Your role, employment type, pay rates or salary, pay rules and leave balances
• Personal details needed to run payroll — Your date of birth, Your residential address, Your gender, what entitles You to work in Australia, and an emergency contact (see below)
• Payroll details You choose to provide so that You can be paid — Your tax file number and tax declaration answers, Your bank account details (account name, BSB and account number), and Your superannuation fund and member number (see below)
• Location Data (see below)
• Usage Data and Log Data (see below)

Personal Details Needed to Run Payroll

A payroll system will not hold an employee record without a date of birth and a residential address, and Your Employer is required to keep employment records under the Fair Work Act 2009 (Cth) and its regulations. We therefore ask You once for these details, and You can review or correct them at any time in the app (Settings > Profile > Personal details).

These details describe You rather than one particular job, so a single answer applies to every workplace for which You use the Service.

• What entitles You to work in Australia is recorded as a status only — for example "Australian citizen" or "student visa". We do not collect or store Your nationality, Your visa number, or any scan or copy of an identity or immigration document. We record the status because some visas limit the number of hours You may work, and Your Employer needs it to roster You lawfully.
• Gender is collected because Single Touch Payroll reporting to the Australian Taxation Office includes it and some superannuation funds require it. "Prefer not to say" is an available answer.
• Your emergency contact is used only to contact that person if something happens to You at work.

Only You, the business owner and an HR administrator of that business can see these details. Managers and supervisors of an individual shop cannot. Where Your Employer connects an external payroll system, Your Employer uses these details to create and maintain Your employee record in it, and they are disclosed to that provider for that purpose.

Payroll Details: Tax File Number, Bank Account and Superannuation

So that Your Employer can pay You and meet their obligations under Australian taxation and superannuation law, the Service lets You provide Your tax file number (TFN) and tax declaration answers, Your bank account details, and Your superannuation fund and member number. You provide these to one employer at a time: each set of details is attached to a particular employment, so details You give one employer are not visible to another employer who also uses the Service.

Providing a TFN is voluntary. It is not an offence to decline. If You do not provide one, the Service records Your reason and Your Employer may be required by law to withhold tax at the highest rate. We collect a TFN only where its collection is authorised by taxation law for payroll purposes. We handle TFN information in accordance with the Privacy (Tax File Number) Rule 2015 issued under section 17 of the Privacy Act 1988 (Cth). We do not use Your TFN as a general identifier, and We do not use it to match or link Your records for any other purpose.

These values are encrypted and are never displayed again. Your tax file number, BSB, account number and superannuation member number are encrypted before they are stored, and the Service shows only the last few digits (for example *****4472). There is no way for anyone — including You, Your Employer, or Us — to display Your tax file number again once it is saved. To correct it, You enter it again.

Bank account details are treated slightly differently, because someone has to be able to make the payment. An owner or manager of Your workplace can, through a single recorded action, view one of Your bank accounts in full in order to pay You. Every such access is logged, and You can see that log in the Application — who viewed Your details, and when. Whenever Your bank details are added or changed, Your Employer is notified by email, which helps both of You detect unauthorised changes.

We do not disclose Your tax file number, bank account details or superannuation member number to any third party except where required or authorised by law (for example, to the Australian Taxation Office or Your superannuation fund in connection with paying You), or with Your consent. We do not use them for marketing, analytics or any purpose other than paying You and meeting related legal obligations.

Location Data

A core feature of the Service is the ability to clock in and clock out based on Your location (geofencing). With Your permission, the Application accesses Your Device's geographic location at the time You clock in or clock out in order to verify, on Your Device, that You are within the designated area of Your worksite.

This geofence check is performed on Your Device only. Your coordinates are not transmitted to Our servers and are not stored — only the resulting clock in and clock out times are recorded. We only access Your location while You are actively using the Application ("when in use"); We do not continuously monitor or track Your location in the background. You can enable or disable location access at any time through Your Device settings; however, if location access is disabled, the clock in and clock out features may not function.

Usage Data

Usage Data is collected automatically when using the Service. It may include information such as Your Device's Internet Protocol address (e.g. IP address), device type, operating system, unique device identifiers, the features You use, the time and date of Your use, and other diagnostic data.

When You access the Service through a mobile device, We may collect certain information automatically, including the type of mobile device You use, Your mobile device unique ID, the IP address of Your mobile device, Your mobile operating system, and other diagnostic data.

Information from Third-Party Social Media Services

The Company allows You to create an account and log in to use the Service through the following Third-party Social Media Services:

• Google
• Apple

If You decide to register through, or otherwise grant Us access to, a Third-Party Social Media Service, We may collect Personal Data that is already associated with that account, such as Your name and email address. This is used to create and authenticate Your Account.

Information Collected while Using the Application

While using Our Application, in order to provide features of Our Application, We may collect, with Your prior permission:

• Your Location Data, to enable clock in and clock out (processed on Your Device only, as described above)
• Pictures from Your Device's camera and photo library, if You choose to set a profile picture. Profile pictures are uploaded to and stored on Our servers
• A push notification token and Your Device platform (iOS or Android), so We can send You shift updates, reminders and other notifications

You can enable or disable access to these permissions at any time through Your Device settings.

App Updates

So that We can correct and improve the app's screens without waiting for an app store review — a mistake affecting Your timesheet can then be fixed the same day — the app asks Our update provider (Expo) each time it starts whether a newer version of those screens is available, and applies it the next time You open the app. That request tells Expo which platform You are on, which build of the app You have, and an identifier for this installation of the app. It carries none of Your work records and none of the personal information described above.

The installation identifier is created by the app itself. It is not a hardware or advertising identifier, it is regenerated if You reinstall the app, it cannot be used to recognise You in other apps, and it is not linked to Your account. We use these requests to know how many installations are running each version of the app — not to build a profile of You, and never for advertising.

Support Chat

Our website and web dashboard use a customer support chat widget provided by Channel Talk (Channel Corp.). If You use the chat, Channel Talk receives the content of Your messages and technical information about Your device and browser (such as IP address and pages visited) in order to provide the support service.

Log Data

For security and troubleshooting purposes, Our servers keep logs of authentication events (such as login, logout and password reset attempts). These logs record the event type, the email address involved, Your IP address and the time of the event. Server error logs may also record technical details of failed requests. Credentials such as passwords are never written to Our logs.

Advertising, Analytics and App Tracking

We do not use third-party advertising or analytics SDKs in the Application, do not track You across other companies' apps or websites, and do not sell Your Personal Data. On iOS, the Application may request App Tracking Transparency permission; regardless of Your choice, We do not currently use Your device's advertising identifier. You can change this permission at any time in Your Device settings.

Cookies and Local Storage (Web)

Our web dashboard stores authentication tokens and interface preferences (such as Your theme and selected shop) in Your browser's local storage and cookies so that You stay signed in and Your settings are remembered. We do not use advertising or cross-site tracking cookies. The Channel Talk chat widget may set its own cookies to operate the chat service.

Use of Your Personal Data

The Company may use Personal Data for the following purposes:

• •To provide and maintain our Service, including to enable clock in and clock out, rostering, timesheets and attendance tracking, and to monitor the usage of our Service.
• •To manage Your Account: to manage Your registration as a user of the Service and give You access to its functionality.
• •To verify attendance: to use Location Data to confirm that clock in and clock out events occur at the correct worksite.
• •To enable Your Employer's use of the Service: to make Your work-related records (such as shifts, timesheets and attendance) available to Your Employer, who uses the Service to manage its workforce.
• •To contact You: to contact You by email, telephone, SMS or push notification regarding updates, shift reminders, security notices, or other communications related to the Service.
• •To manage Your requests: to attend to and manage Your requests to Us.
• •To improve the Service: for data analysis, to identify usage trends, and to evaluate and improve our Service, products, and Your experience.
• •To comply with the law: to meet our legal and regulatory obligations, resolve disputes, and enforce our agreements.

Your Employer and Workplace Data

Clockon Me is a workforce management tool. Where You use the Service as an employee or staff member, Your Employer determines how Your work-related information (such as shifts, rosters, timesheets, clock in and clock out records, attendance, pay rates and leave) is collected and used through the Service, and We handle that information on Your Employer's behalf. Your Employer can access these records.

The Service also allows Your Employer to export and email reports (for example, timesheet or roster reports in PDF format) that may contain Your name, hours worked, penalty amounts and tips. These reports are sent through Our email delivery provider to recipients chosen by Your Employer (for example, a payroll administrator or accountant).

If You have questions about how Your Employer uses Your work records, or You wish to access or correct records held by Your Employer, please contact Your Employer directly. If You use the Service as a business or Employer, You are responsible for handling Your staff's personal information in accordance with applicable privacy laws.

How We Share Your Personal Data

We do not sell Your Personal Data. We may share Your personal information in the following situations:

• •With Your Employer: Your work-related records are made available to the Employer that engages You, as described above.
• •With Service Providers: We share information with third parties that help Us operate the Service. These currently include: cloud hosting, database and file storage (Amazon Web Services, Sydney, Australia); push notifications (Google Firebase Cloud Messaging); sign-in providers (Google and Apple); address search and maps (Google Maps / Google Places); payment processing for business accounts (Stripe); transactional email delivery (Resend); customer support chat (Channel Talk); and delivery of updates to the app's screens (Expo). Where Your Employer connects an external payroll system, that provider — currently Xero — receives the timesheet hours Your Employer sends for You, and the personal details described above that the payroll system requires in order to hold an employee record. These providers are only permitted to use Your information to perform services for Us.
• •For legal reasons: where required by law or a valid request by a public authority, or to protect Our rights, safety and property (see "Disclosure of Your Personal Data" below).
• •Business transfers: in connection with a merger, sale of Company assets, financing, or acquisition of all or part of Our business. We will provide notice before Your Personal Data becomes subject to a different privacy policy.
• •With Your consent: for any other purpose with Your consent.

Retention of Your Personal Data

The Company will retain Your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use Your Personal Data to the extent necessary to comply with our legal obligations (for example, employment and record-keeping laws may require attendance and timesheet records to be kept for a minimum period), to resolve disputes, and to enforce our legal agreements and policies.

Usage Data is generally retained for a shorter period, except where it is used to strengthen security or improve functionality, or where We are legally required to retain it for longer. When Personal Data is no longer required, We will take reasonable steps to destroy or de-identify it.

Tax file numbers, bank account details and superannuation member numbers are retained only while they are needed to pay You and to meet the record-keeping periods required by Australian taxation, superannuation and employment law. As required by the Privacy (Tax File Number) Rule 2015, We take reasonable steps to destroy or permanently de-identify tax file number information once it is no longer required by law to be retained. Deleting Your account, or Your employment record being removed by Your Employer, deletes these details.

Overseas Disclosure and Transfer of Your Personal Data

Our databases and file storage are hosted with Amazon Web Services in Sydney, Australia, so Your Personal Data is primarily stored and processed in Australia. However, some of our Service Providers operate overseas, so limited information may be transferred to, stored in, or accessed from countries outside Australia, including the United States (Google, Apple, Stripe, Resend, Expo) and the Republic of Korea (Channel Talk), and other countries where those providers operate.

Where We disclose Personal Data overseas, We take steps that are reasonable in the circumstances to ensure the recipient handles Your information in a manner consistent with the Australian Privacy Principles, such as putting contractual protections in place. Data protection laws in those countries may differ from those in Australia.

Security of Your Personal Data

We take reasonable steps to protect Your Personal Data from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include encryption of data in transit, access controls, and secure storage of authentication credentials. However, no method of transmission over the Internet, or method of electronic storage, is 100% secure, and We cannot guarantee absolute security.

Data Breaches

If a data breach involving Your Personal Data occurs and it is likely to result in serious harm, We will notify You and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth), and We will take steps to contain and remediate the breach.

Your Privacy Rights

Under the Australian Privacy Principles, You have the right to:

• request access to the Personal Data We hold about You;
• request correction of Personal Data that is inaccurate, out of date or incomplete;
• request deletion of Your Personal Data, subject to our legal obligations;
• withdraw consent (for example, for tracking or location access) at any time; and
• make a complaint about how We have handled Your Personal Data.

To exercise any of these rights, please contact Us using the details below. We may need to verify Your identity before acting on Your request. We will respond within a reasonable time. Note that some records (such as work records held on behalf of Your Employer) may need to be requested from, or may be retained by, Your Employer.

Delete Your Personal Data

You have the right to delete, or request that We assist in deleting, the Personal Data We have collected about You. You can delete Your Account directly within the Application (Settings → Delete Account), or You can contact Us to request deletion.

Please note that We may need to retain certain information where We have a legal obligation or lawful basis to do so (for example, employment records that Your Employer is required to keep). Some operational records (such as shop-level tip and shift history) may be retained after account deletion in a form that is no longer linked to Your Account. Security logs are retained for a limited period and then overwritten.

Disclosure of Your Personal Data

Business Transactions

If the Company is involved in a merger, acquisition or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law enforcement

Under certain circumstances, the Company may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Other legal requirements

The Company may disclose Your Personal Data in the good faith belief that such action is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of the Company
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of Users of the Service or the public
• Protect against legal liability

Children's Privacy

The Service is a workplace tool intended for use by Employers and their staff, and is not directed at the general public or at children. We do not knowingly collect Personal Data from children other than in the context of a genuine employment relationship (for example, a lawfully employed young worker). Where a User is a minor, the Service should only be used with the involvement and consent of a parent or guardian where required by law.

If You believe We have collected Personal Data from a child without appropriate consent, please contact Us and We will take steps to delete that information.

Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. If You click on a third-party link, You will be directed to that third party's site. We strongly advise You to review the privacy policy of every site You visit.

We have no control over, and assume no responsibility for, the content, privacy policies or practices of any third-party sites or services.

Changes to this Privacy Policy

We may update Our Privacy Policy from time to time. We will notify You of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date at the top.

Where changes are significant, We will let You know via email and/or a prominent notice in the Service prior to the change becoming effective. You are advised to review this Privacy Policy periodically for any changes.