Privacy

Klokk processes personal data of employees — working times, absences, partly health data. Because Klokk runs on your own server, this data stays with you: you are the controller under the GDPR, and Klokk provides the tools you need for it.

What Klokk stores

• Account: name, username, e-mail address, personnel number, role, department, settings.
• Working time: time entries with start, end, breaks, work location, notes, projects — and for each clocking the IP address and browser (to show where a clocking came from).
• Absences and requests, sick leave, time account and vacation bookings, shifts.
• Sign-in: password (as a hash only), two-factor key, passkeys, sessions, push subscriptions.
• Audit log with action, time, IP address and browser.

Who sees what

Role	Sees
Employees	their own data; in the team calendar only “absent” for colleagues
Managers	times and requests of the people whose requests they decide
Admins	everything in their company, including the audit log
Auditors	everything in their company, read-only
Super admins	all companies

The reason for an absence — an illness, for example — is seen only by the person and whoever decides their requests. More in roles.

Access (Art. 15 and 20 GDPR)

Everyone downloads everything Klokk stores about them as a JSON file under Profile → Download my data. Admins download the same for a person under Admin → Users → (person) → Download this person’s data, for a subject access request for example. The download is recorded in the audit log.

Erasure (Art. 17 GDPR)

When an account is deleted — by hand or after a deletion period — Klokk

• deletes everything that belongs to the person alone: sign-in data, sessions, passkeys, push subscriptions, notes, work schedules, requests, shifts;
• keeps the time entries for the traceability of payroll, but without notes, IP addresses and browsers;
• keeps the audit log, but without the person’s IP addresses and browsers and without the old and new values of their account;
• overwrites and deletes the account record itself.

Deletion periods

Under Admin → Settings → Deletion periods super admins set:

Setting	Effect
Delete records after (years)	Time entries, absences, corrections, notes, shifts and audit log older than that. At least 2 years (German § 17 MiLoG, § 16 ArbZG).
Delete deactivated accounts after (months)	Counted from the deactivation, at least 24 months.

0 switches a period off (the default). Deletion runs once a day and is recorded in the audit log. The time account keeps the balance as a carry-over, vacation years are frozen beforehand. Klokk never deletes accounts deactivated by the licence check, nor super admins, automatically.

Caution

Tax- and payroll-relevant documents have their own, longer retention periods. They belong in payroll — export monthly records before Klokk deletes the records.

Protecting the data

• Encryption: with DATA_KEY Klokk encrypts the whole database on SQLite, and the free texts (notes, reasons, comments) on PostgreSQL — see encryption.
• Sign-in: two-factor authentication mandatory for admins and auditors, passkeys, lockout after failed attempts — see signing in & profile.
• Traceability: every change in the audit log.

Connections to the outside

Klokk makes only these connections:

Destination	When	What
licensing.klokk.me	at start-up and daily	licence check — scope in the privacy policy
klokk.me	only when a newer version was reported	loads its release notes; the request carries nothing about the installation
Klokk Radar	only when error reports are switched on (off by default)	anonymised error reports, “Report a bug”, “Suggest a feature”
The browsers’ push services	for push notifications	an encrypted notification to the device
Your SMTP server	when sending e-mail	the e-mail
Your extensions	when webhooks are set up	the events released to them

With ERROR_REPORTS=false, error reports and the “Report a bug” and “Suggest a feature” forms are switched off entirely — see application.