POPIA notice

This notice is published under the Protection of Personal Information Act, 2013 (POPIA). It explains who decides how personal information is used, why it is used, and how to exercise your rights. It should be read with the Privacy Policy.

Responsible party

For the agency admin account, the responsible party is Attendance Tracker.

• Registered name: [Registered name to be inserted]
• Registration number: [Registration number to be inserted]
• Physical address: [Physical address to be inserted]
• Information Officer: support@attendancetracker.co.za

For learner, host, attendance, device, and document records, the placement agency that created the account is the responsible party. Attendance Tracker is the operator. A request about a learner’s clock-in, photo, or sick note should go to that agency. We will help the agency respond where the record is stored in the service.

Whose information we process

• Agency admins who create or use an account
• Learners whose attendance or documents are recorded
• People named in a host record only to the extent a host name or address identifies a person
• People who contact support

What we process, and why

• Account. Name, email, phone, and password, so we can provide the agency account. Basis: contract.
• Hosts. Workplace name, address, coordinates, and hours, so attendance matches the host you configured. Basis: contract with the agency, processed on the agency’s instruction.
• Learners and attendance. Identity, phone, optional email, access code, and clock-in times, so the agency can run the placement. Basis: the agency’s instruction. The agency must have its own lawful basis.
• Location check. Device coordinates at the moment of a mobile clock-in, compared with the host. Basis: the agency’s instruction, and the learner’s browser permission.
• Device check. A browser token, a ThumbmarkJS device signal, the user agent, and, when a device is not recognised, a verification photo. Basis: the agency’s instruction, to reduce clock-ins from an unknown device.
• Documents. Sick notes and other supporting files, dates, and notes. Basis: the agency’s instruction, so the agency can administer absence.
• Messages. SMS and email for access codes, links, and document reminders. Basis: contract, and the agency’s instruction for learner messages.
• Security and reliability. Session cookies and short-lived clock-in locks. Basis: our legitimate interest in keeping the service working, which does not override your rights.

Special personal information

Sick notes and some supporting documents are information about health. A verification photo is an image of the learner. The agency must have a ground under POPIA before this information is collected. For health information, that is typically because the learner, or a competent person where the learner is a child, has consented, or because another ground in POPIA applies to the agency’s administration of the placement. We use these files only so the agency can view them in the product. We do not use them for marketing, and we do not use the photo as a general biometric identifier across workplaces.

Operators

We share personal information with these operators:

• Strapi, for the database
• Vercel, for hosting, file storage, short-lived locks, and Speed Insights
• Resend, for email
• SMS Portal, for SMS
• Google, for host address search

The device signal is produced in the learner’s browser by ThumbmarkJS before it is sent to us. Operators are required to protect the information and to use it only on our instructions, or on the agency’s instructions where we act as operator.

Cross-border transfers

Vercel, Resend, Google, and parts of the hosting infrastructure may process information outside South Africa, including sick notes and verification photos stored with Vercel. Under section 72 of POPIA, we transfer information where the transfer is necessary for the performance of a contract with the data subject or the agency, or where the recipient is subject to a law, binding corporate rules, or a written agreement that provides protection that is substantially similar to POPIA, including rules on onward transfer.

Your rights

You may ask the responsible party to:

• Confirm whether it holds personal information about you
• Provide a record of that information (POPIA access)
• Correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully
• Destroy or delete information it is no longer authorised to keep
• Object to processing based on legitimate interest, on reasonable grounds that relate to your particular situation

A mobile clock-in can be refused when the device is outside the host radius, or held until a device is verified. That is a workplace rule the agency configured. It is not a decision that produces a legal result about you by automated means alone. If a clock-in is refused, ask the agency to record the time another way.

There is no charge for a reasonable request. We may refuse a request that is manifestly unfounded, excessive, or that would disclose another person’s information, and we will explain why. We may need to confirm your identity before we act. Learner requests may be referred to the agency.

How to ask

Email the Information Officer at support@attendancetracker.co.za with your name, the agency, and what you are asking for. If you are a learner, include the name of the agency so we can direct the request. We aim to respond within a reasonable time and, where POPIA sets a period, within that period.

You may also ask for our PAIA manual. Until the registered company details above are completed, send that request to the same address.

Complaints

If you are not satisfied with our response, you may lodge a complaint with the Information Regulator (South Africa):

• Email: inforeg@justice.gov.za
• Website: inforegulator.org.za

Children

We do not market this service to children, and we do not collect an age. A learner in a learnership may be a child. Before you add a child, you must have the consent of a competent person, or another ground POPIA allows for processing a child’s personal information, and a ground for any health information or photo you ask us to store. We process that information only on your instruction.