Who is responsible
IQ Learning Group Limited, of 120 Priory Street, Carmarthen, SA31 1NB, United Kingdom, operates ClockPin.
We are the data controller for account, billing, website and direct support information. For employee details and attendance records entered by a customer business, that business is normally the controller and we act as its processor. Employees should first direct workplace-data questions to their employer.
Information we collect
We may process account names, business names, email addresses, authentication and security records, subscription status, billing identifiers supplied by Stripe, support messages and technical information such as IP address, browser, device, timestamps and service logs.
Customer businesses may enter staff names, roles, PIN-derived security data, locations, clock-in and clock-out events, corrections and manager audit records. We do not need or store full payment-card numbers.
Why we use it
We use information to create and administer accounts; provide terminals, dashboards, reports and support; authenticate users; process subscriptions; secure and troubleshoot the service; prevent fraud and abuse; meet legal obligations; and improve reliable service operation.
Our lawful bases
We rely on performance of a contract for account and service delivery; legal obligation for tax, accounting and compliance records; and legitimate interests for service security, fraud prevention, support and proportionate product improvement. Where consent is legally required, it may be withdrawn at any time.
Payments
Stripe processes payment and billing information under its own privacy notice and provides us with limited transaction details such as payment status, customer identifiers, amount and billing dates. We use those details to administer subscriptions, refunds and payment disputes.
Who receives information
We use carefully selected providers for payment processing, cloud hosting and infrastructure, email delivery, security, monitoring and professional support. Current key providers include Stripe for payments and Microsoft for service email. Providers may only use personal data for authorised services and subject to appropriate contractual protections.
We may also disclose information where required by law, to protect rights and security, during a business reorganisation, or with clear authority from the relevant customer.
International transfers
Some providers may process information outside the United Kingdom. Where required, we use recognised safeguards such as UK adequacy regulations, the UK International Data Transfer Agreement or approved contractual addenda. Details of applicable safeguards may be requested through the Need a hand page.
How long we keep it
We keep active account and attendance data while the service is used. Following account closure, operational data is normally deleted or anonymised after a reasonable export and recovery period, unless the customer requests earlier deletion or law requires longer retention. Financial and transaction records may be retained for up to seven years. Security logs and support records are retained only as long as reasonably needed for their purpose.
Security
We use measures designed to protect information, including access controls, encryption in transit, password hashing, scoped administrative access, audit records and service monitoring. No internet service can guarantee absolute security. Customers remain responsible for authorised users, devices, PIN management and timely removal of former staff access.
Your rights
Depending on the circumstances, UK data-protection law gives you rights to access, correct or erase personal data; restrict or object to processing; receive portable data; and withdraw consent. You may also complain to the UK Information Commissioner's Office. Some rights are limited where we must retain information or where the customer business controls the relevant staff records.
Cookies and service storage
ClockPin uses essential cookies or similar storage for authentication, security and session continuity. We will request consent before using non-essential analytics or advertising technologies where the law requires it.
Children and automated decisions
ClockPin business accounts are not intended for children to purchase. A customer employing young workers is responsible for ensuring that attendance processing is lawful and appropriately explained. We do not use personal data to make solely automated decisions that produce legal or similarly significant effects.
Questions and updates
Use the Need a hand page to exercise a right or ask a privacy question. We may need to verify identity before acting. We may update this notice as the service and providers change; material changes will be highlighted or communicated where appropriate.