Security & Privacy

Glossary

The terms we use

Below we explain which measures and methods we use and how your privacy is arranged at ClockAssist. First, a few terms we use in this statement:

User

Someone who has their own login details for ClockAssist and processes data with it.

Admin

A designated user who can receive day overviews when other users submit their day.

System administrator / IT staff

An employee of an organisation working with ClockAssist who is responsible for the correct installation of the software.

The software

The ClockAssist platform, which can be used on the computer itself, online and on a mobile phone.

Submitting a day overview

A user clicking the Submit button after reviewing and, where needed, adjusting their own day overview, understanding that the data from the day overview then becomes visible to the relevant admin within the organisation the user works for.

Security

How we secure your data

Hosting and server management

ClockAssist uses managed hosting on its own servers, run in a data centre in Amsterdam. The following certifications and quality marks apply:

All connections to the server are encrypted in transit. The data processed in ClockAssist is stored securely in the data centre in Amsterdam. No ClockAssist data is stored or processed outside the European Union and the European Economic Area.

Password management and 2FA

ClockAssist does not store user passwords as text. We only keep password hashes that cannot be deciphered, encrypted with Bcrypt.

On top of the measures we take to protect your data and account, it's wise to choose a strong password yourself (the longer, the safer) and to set up two-factor authentication (2FA). Without your mobile phone, nobody can then log in to your account.

Availability

ClockAssist has an uptime of 99.9%: the software almost never has an outage and is almost always available. If there is an outage, our Development team is notified automatically and we do everything we can to make the platform available again. Our current availability is public on the status page.

Privacy

Privacy by design, not a monitoring tool

Privacy by design

Your privacy within ClockAssist is of the utmost importance to us. ClockAssist is built on the concept of privacy by design. This means that, by definition, all of a user's data can only be viewed by that user, until the user gives permission to share certain data.

The user's privacy

ClockAssist recognises and registers activity on your computer or phone. We are aware that passing this data on to anyone other than you, whether a colleague, an application, or a report that can be traced back to an individual user, is not ethical. In fact, we believe it shouldn't be allowed. That's why we built the software so that the user has full freedom to:

• review the registered data themselves first,
• adjust it themselves first,
• complete it themselves first, and
• submit it themselves, making the data visible to the relevant admin within the organisation.

By upholding privacy by design, it is impossible for users to view another user's data, whatever level they operate at within the software (admin, user or system administrator/IT staff). Impossible, unless that user chooses to submit their day overview. After submission, the day overview data goes to the admin responsible for time registration and/or invoicing within the organisation.

In summary, this is what we can say about your privacy within ClockAssist:

Personal data

Processing personal data

Data we process

ClockAssist processes no personal data other than an e-mail address, first and last name and a business phone number. This data is only used for the software to work correctly: logging in and linking the right logs to the right user. We do not process any special categories of personal data.

We also use the e-mail address to send you product-related information, such as instructions and tips for using ClockAssist. You can always unsubscribe from these e-mails.

Because you also process client data with our software, we are required to sign a data processing agreement with all our clients. Inside the software you can read, sign and download this agreement.

Transfer of personal data

ClockAssist does not pass personal data on to third parties. Nor do we process or store data outside the European Economic Area. We do use applications that enable us to communicate with our clients and store client information:

These applications are international in nature. According to the European Commission, the destination country offers an adequate level of protection, or the supplier is certified under the EU-US Data Privacy Framework.

Retention period of personal data

ClockAssist never keeps your personal data longer than necessary, unless the law justifies or requires a longer retention period. By 'necessary' we mean: as long as needed to guarantee the software works correctly.

Your rights

• Access: you always have the right to access the personal data we keep about you.
• Rectification: you have the right to have your personal data corrected, completed or updated. You change this data yourself in your own account; you are responsible for keeping it correct.
• Withdrawing consent: you have the right to withdraw your consent to the processing of your personal data. By doing so you also agree that you can no longer use ClockAssist.
• Data portability: you have the right to request your personal data and receive it in a common format.

You can exercise your rights by sending an e-mail to info@clockassist.com. We will handle your request as soon as possible, and in any case within four weeks. To fulfil your request we need confirmation of your identity, so always include a copy of your ID.

Terms

Terms and conditions