Privacy policy

1. Who we are and our role

TopTimesheets provides time, attendance, scheduling and payroll-file software to businesses (our customers).

For the data of a customer's workers, the customer is the controller and we are its processor: we act on its instructions, under a data processing agreement. For our own account holders, website visitors and billing contacts, we are the controller.

2. Data we process

Account data: name, email, phone, language, role.

Worker data entered by the customer: name, employee number, site, schedule, pay information (basic salary, allowances), IBAN and national ID (encrypted).

Time data: clock-in and clock-out times, breaks, edits and approvals, device and source of each punch.

Location: GPS coordinates and accuracy captured only at the moment of clock-in or clock-out, never in the background.

Selfies: a photo taken at clock-in when the customer turns this on, for a manager to review. We do not run face recognition or create biometric templates.

Website analytics: one visit event per browser session with the page, referrer site and campaign tags, stored in our own database. No third-party advertising trackers.

3. Why we use it (purposes and legal bases)

To provide the service to the customer (contract with the customer; for workers, the customer's legal basis, usually legal obligation for working-time and wage records and legitimate interest in accurate attendance).

Selfies and precise location can be sensitive. Under the Saudi PDPL, biometric data is sensitive data; we avoid processing it as biometrics, and customers must give workers clear notice and, where required, obtain consent before enabling selfies.

To secure the service, prevent abuse and keep audit records (legitimate interest / legal obligation).

To bill customers and send service messages (contract).

4. AI assistant

The assistant uses a third-party AI model provider to word messages and answer questions. We remove phone numbers, emails, coordinates and bank data before sending data to the model. The assistant never makes decisions about individuals and cannot act without a person's confirmation.

Each customer can turn every AI feature off for its organisation. While AI is off, nothing of that customer's is sent to the model provider; rule-based alerts keep working.

5. Sharing and sub-processors

We share data only with service providers that help us run the service, under contracts that protect it. The current list, with what each provider does and where, is on our Sub-processors page; our Data processing agreement sets out the terms.

We do not sell personal data.

6. International transfers

Data may be processed outside the country where it was collected. Where the GDPR, the Saudi PDPL or the UAE PDPL restrict transfers, we rely on the safeguards those laws allow (for example adequacy decisions or standard contractual clauses) and will document them in the data processing agreement.

7. How long we keep data

Customer data is kept while the customer's account is active and deleted or returned when the account is closed, except where the law requires longer retention (for example wage records). Database backups are kept on a rolling basis.

Each customer chooses how long selfies are kept (90 days by default) and whether punch locations are cleared after a number of months once the pay period is locked. A nightly job deletes them; hours and pay are not changed.

8. Your rights

Depending on where you are, you may have the right to access, correct, delete, restrict or object to processing of your data, to data portability, and to withdraw consent.

Workers can download their data and ask for a correction or deletion on the “My data” page in the clock-in app. The employer reviews each request. Where the law requires wage and time records to be kept (a legal hold), they are kept, and the person's name and contact details are removed from them.

If you are a worker, please contact your employer first: they control your data. We will help them answer. You can also complain to your data protection authority (for example SDAIA in Saudi Arabia, the UAE Data Office, or your EU/UK supervisory authority).

9. Security

See our Security page for the measures we use, including tenant isolation, encryption of bank details and an append-only audit log.

10. Changes and contact

We will post changes here and tell customers about material changes in advance. Contact details for privacy questions will be published here before launch.