Privacy policy

If you clock in with InstaClock, your employer is the data controller — they decide what is collected and why, and they are your first point of contact for any question or request about your data. InstaWebsite acts as a data processor: we store and process attendance data on your employer's instructions and do not use it for our own purposes.

• Identity and contact details — your name, and where your employer provides them, your email address and phone number.
• Clock events — the timestamps of your clock-ins, clock-outs and breaks, and the location (site) they relate to.
• GPS location — only at the moment of clocking in or out. When GPS verification is enabled by your employer, your device's position is captured once, at the instant you clock in or out, to check you are within the site's geofence. InstaClock never tracks your location continuously and never in the background.
• Optional photographs. Some employers enable a photo at clock-in as evidence of who clocked in. Photos are used only as evidence for attendance disputes. They are never used for facial recognition, biometric identification, or any automated matching.
• Hashed IP addresses — stored in hashed form for security and audit purposes, not in a directly readable form.

The purpose is attendance recording for employment: verifying who worked, when, and where, so hours can be paid correctly, lateness and absence can be managed fairly, and disputes can be resolved with evidence. Your employer determines the lawful basis for this processing (typically its legitimate interests as an employer or performance of the employment contract) and should tell its staff how attendance monitoring works before using it.

• Attendance records are retained for a period configured by the employing organisation, in line with its own employment and payroll obligations.
• Clock-in photographs are deleted after 30 days by default; employers can configure a different retention period within the limits the product allows.
• When an organisation closes its account, its data is deleted or returned in line with our processing agreement with that organisation.

Under UK GDPR you have the right to:

• Access a copy of the personal data held about you;
• Rectification of inaccurate data (for example a wrongly recorded clock time — your employer can correct it, and every correction is recorded in an audit trail);
• Erasure in the circumstances UK GDPR provides, and to object to or ask for restriction of certain processing.

Please direct these requests to your employer, as the data controller — InstaClock gives them the tools to respond, including data export and deletion. If you are unhappy with how your data has been handled, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

Employers using InstaClock remain responsible for their own UK GDPR compliance: telling staff about attendance monitoring, choosing a lawful basis, completing any required assessments (for example where GPS or photos are enabled), setting appropriate retention periods, and responding to data subject requests. InstaClock provides tools that support compliance — retention controls, audit trails, export and deletion — but using InstaClock does not by itself make an employer compliant with the law.

InstaClock is hosted in the UK. Data is encrypted in transit, access is restricted per organisation and per role, and administrative actions are recorded in an audit trail. InstaWebsite support staff can only access an organisation's data when that organisation explicitly grants time-limited access, and every support action is audited.

Questions about this policy or about InstaWebsite's role as a processor can be sent via instawebsite.co.uk/staff-clock-in. Questions about how your workplace uses InstaClock should go to your employer.