Clock-in geolocation and GDPR

A fix, not a tracker

The reading happens only when the employee clocks in or out, and only if consent is active. The register keeps latitude, longitude, accuracy in metres and the time of the fix. It does not keep a route.

Managers in the organisation see those coordinates and can open them on a map. The same fields appear in the CSV and the PDF when a location exists. Without a location the columns stay empty and the punch remains valid, unless the employer has required a fix.

Consent and withdrawal

The employee accepts or refuses in the app. Consent can be withdrawn in settings. Withdrawal applies to later punches. Entries already stored stay in the register: they are used for payroll and for the inspection file.

The legal description of bases and rights — access, rectification, objection, a complaint to the Data Protection Authority — is in the privacy notice. The employer is controller for employee data. PREGJA GROUP acts as processor, in the European Union.

When the employer requires a location

The setting is off by default. If it is on, clock-in and clock-out are refused without consent, or if the phone cannot provide a fix. Horodata still stores no coordinates without the consent given in the app.

Whether that requirement is lawful at a given workplace is for the employer to assess, not for the software publisher. A site, a delivery round and a shop are not the same. The construction guide says what a fix shows, and what it does not.

What not to expect from it

The location of a clock-in does not replace a site badge, an access control or proof of continuous presence. Accuracy depends on the phone and the place. A fix accurate to a hundred metres does not draw a room.

It is also not used to calculate an expense claim or travel time. Those sit outside the time register.

Order of work

1. Choose the rule. The employer leaves location optional, or requires it on every clock-in and clock-out. The second choice blocks the punch if consent is refused or no fix is available.
2. Collect consent. The employee grants it in the app before a coordinate can be stored.
3. Clock. On clock-in or clock-out a single fix is read: latitude, longitude, accuracy, time. No tracking in between.
4. Withdraw if needed. The employee withdraws consent in settings. Punches already written stay in the register.