Data Processing Agreement
Version 2, 1 November 2026. Adds site sign-in (visitors, contractors and deliveries), directory sync and site passes.
This Data Processing Agreement ("DPA") forms part of the agreement between Timeclock.Kiwi Limited, 151 Belford Street, Waverley, Dunedin 9013, New Zealand ("we", "the Processor") and the company using Timeclock.Kiwi ("you", "the Controller"). It applies when we process personal data for you that is covered by the EU General Data Protection Regulation (GDPR), the UK GDPR or a similar law, and meets Article 28 of the GDPR.
An admin accepts this DPA for their company by ticking it on the GDPR checklist in Settings. We record who accepted it and when. Where this DPA and our other terms disagree about personal data, this DPA applies.
1. What we process
| Subject and purpose | Providing Timeclock.Kiwi to you: recording working time, rosters, jobs, leave and safety check-ins, signing visitors in and out of your sites, and producing reports and payroll exports. |
|---|---|
| Duration | For as long as you use Timeclock.Kiwi, then until the data is deleted under section 9. |
| People the data is about | Your employees, contractors and other workers, and your admins and managers. If you use site sign-in: visitors, contractors and delivery drivers who sign in at your sites, people you invite or add to your watchlist, and the staff in any directory you connect so visitors can pick who they're seeing. |
| Kinds of personal data | Names, email addresses, PINs; clock in, clock out and break times; jobs, tasks, notes and materials; kiosk used, IP address, and GPS location when clocking in with the mobile app; rosters, availability, leave and swap requests; skills; safety check-ins, alerts and their locations; notifications sent to them. |
| Site sign-in data | For visitors: name, company, mobile, email, vehicle registration, visitor type, who they came to see, sign in and sign out times, the safety checklist and induction videos they agreed to, their signature, a photo, contractor documents (the type, number, issuer and expiry date, no images of them), the host's reply, and for sign-ins on their own phone, how far they were from the site. For watchlist entries: name, mobile, email, the sites it applies to and your reason. For directory staff: name, email, mobile, job title and office. |
| Special category data | Not intended. Timeclock.Kiwi doesn't use biometrics: visitor photos are only shown to people, so staff can recognise who is on site, and are never used for face matching. Don't put health or other special category details into notes, leave reasons or watchlist reasons unless you have a lawful basis to. |
2. Your instructions
We process personal data only on your documented instructions, which are this DPA, our terms, and the way you set up and use Timeclock.Kiwi, unless the law requires otherwise (in which case we tell you first, unless the law forbids it). We tell you if we think an instruction breaks data protection law.
3. Confidentiality
Everyone at Timeclock.Kiwi who can access your data is bound by confidentiality and only accesses it when needed to run or support the service.
4. Security
We take appropriate technical and organisational measures under Article 32, including:
- Encryption of data in transit (HTTPS) and hashed passwords.
- Each company's data kept separate and every request checked against the signed in person's company and permissions.
- Managers limited to the people in the groups they manage, and to the visitors at the sites they manage.
- Watchlist reasons are only shown to admins and managers, never on the kiosk. Links in host emails are signed and only work for that one visit.
- Directory connections only read staff details. Their keys are stored on our servers and never sent to kiosks.
- Activity logs of changes to time records.
- Regular backups, and access to servers limited to the people who run them.
5. Sub-processors
You authorise us to use the sub-processors below. We give each one data protection terms at least as protective as this DPA, and remain responsible for them. We'll update this list at least 30 days before adding or replacing a sub-processor; if you object on reasonable data protection grounds, you may stop using Timeclock.Kiwi and we'll refund any prepaid time you haven't used.
| Sub-processor | What for | Data | Location |
|---|---|---|---|
| Postmark (ActiveCampaign, LLC) | Sending emails such as invites, password resets, rosters and data export links | Name, email address, email content | United States |
| Google Firebase Cloud Messaging (Google LLC) | Push notifications to the mobile app | Device token, notification text | United States |
| OpenStreetMap Foundation (Nominatim) | Turning a safety check-in's GPS position into an address | GPS coordinates only, no names | United Kingdom |
| Stripe, Inc. | Billing your company | Admin name and email, billing details (no worker data) | United States |
Payroll and accounting apps you connect (such as Xero or QuickBooks) aren't our sub-processors: you choose to send data to them under your own agreement with them.
The same goes for the directory you connect for site sign-in (Microsoft Entra ID, Google Workspace, or another service using SCIM): we only read your staff list from it, on your instructions. Induction videos are fetched from wherever you host them, with no personal data sent. YouTube videos play in YouTube's own player on the kiosk, so YouTube sees the kiosk's internet address but not who is watching.
6. Where data is kept
Your data is stored in New Zealand. The European Commission has decided New Zealand gives adequate protection (Decision 2013/65/EU), as has the United Kingdom. Where a sub-processor outside New Zealand, the EU or the UK receives personal data, we rely on an adequacy decision or the European Commission's Standard Contractual Clauses.
7. Helping you with people's rights
Timeclock.Kiwi lets you answer requests yourself: workers can view and download their own data and report wrong times in the app, and admins can export any person's data and correct or delete records. Admins and managers can find a visitor's visits on the Visitors page and export them, and admins can delete a visit or everything about a visitor. If a worker or visitor contacts us directly, we pass the request on to you and don't answer it ourselves unless you ask us to.
We also help you, as far as reasonable, with security, breach notification, data protection impact assessments and consulting your supervisory authority (Articles 32 to 36).
8. Data breaches
If we become aware of a personal data breach affecting your data, we tell you without undue delay, with what we know about what happened, the data and people affected, the likely consequences and what we're doing about it, so you can meet your own 72 hour notification duty.
9. Deleting data
- While you use Timeclock.Kiwi, you choose how long time records are kept with the data retention setting, and records older than that are deleted automatically.
- Visits, visitor invites and visitors' contractor documents follow the same retention setting. Visitor photos are deleted 30 days after the visit, whatever the setting.
- Watchlist entries are kept until an admin removes them, and are then deleted. Directory staff are updated at each sync, removed when they leave the directory, and all deleted when you disconnect the directory.
- An admin can close your account in Settings. Billing stops, kiosks stop and only admins can still sign in. Everything is permanently deleted 90 days later, and every admin is emailed when the account closes and again 14 days before deletion. Until then you can export your records or reopen the account.
- We keep our own billing records (invoices and payments) for as long as tax law requires. They don't contain your workers' data.
- Deleted data drops out of our backups as they are replaced.
10. Audits
We make available the information you reasonably need to show compliance with Article 28, and answer reasonable written questions. If that isn't enough, you may audit us (or have an independent auditor do so) once a year at your cost, with 30 days' notice, in a way that doesn't expose other customers' data.
11. Contact
Questions about this DPA or your data: [email protected].