Privacy Policy

This policy explains how Attendance Tracker handles personal information in the placements application. The product is for a placement agency that records learners at host workplaces.

Who we are

Attendance Tracker is the publisher of this service. For your agency admin account, we are the responsible party under the Protection of Personal Information Act, 2013 (POPIA).

• Registered name: [Registered name to be inserted]
• Registration number: [Registration number to be inserted]
• Physical address: [Physical address to be inserted]
• Email: support@attendancetracker.co.za

When you add hosts and learners, and when learners clock in or upload documents, you (the placement agency) are the responsible party for that information. We process it as your operator, on your instructions. Your duties are set out in the Terms and the POPIA notice.

Agency account

When you sign up or update your profile, we collect:

• First name, last name, work email, phone number, and password
• Country (signup defaults to South Africa)
• The agency name you enter during setup

Password-reset email is sent when an admin asks to reset a password. Service email is sent from noreply@attendancetracker.co.za through Resend.

Hosts and learners

Information the agency or a learner provides includes:

• Host workplace name, street address, map coordinates, country, working hours, and break rules
• Learner name, identifier, access code, phone number, optional email, role, start date, and the host they are placed at
• Clock-in and clock-out times, early, late, or on-time status, hours, and breaks

We SMS and email the learner’s name, access code, and a link to clock in or to upload a document. Those links contain the learner’s name and identifiers. Treat the links and access codes as confidential.

Location

If clock-in is limited to the host workplace, the learner’s browser shares the device location so we can check whether the clock-in is within about 2 kilometres of the host coordinates you saved. We use that location for the check. A host can be set to allow clock-in without that check.

Device check

Mobile clock-in can recognise the browser used to clock in. We store a device token in the browser, a device signal produced by ThumbmarkJS, and the browser’s user agent when the device is linked to the learner. If the device is not recognised, we may ask for a photo to confirm who is clocking in. That photo is stored with our hosting provider and can be viewed by the agency. Anyone who obtains the storage link could also open the file, so we treat the link as confidential.

Sick notes and other documents

A learner can upload a sick note or another supporting document, with the date range, the document type, and an optional note. These files can include health information. They are stored with our hosting provider. The agency can open them from the dashboard. Anyone who obtains the storage link could also open the file. The agency receives email or SMS reminders when a document is outstanding.

Technical data

• A session cookie so agency admins stay signed in
• A cookie that remembers whether the sidebar is open
• A short-lived break timer cookie on a mobile clock-in page
• A short-lived lock, kept for about a day, so a double tap does not create two clock-ins
• Vercel Speed Insights, which records performance data about how pages load

Host address search uses Google Places. The address you select is saved with the host.

Why we use it

• To create and secure the agency account
• To record learners, hosts, attendance, and documents
• To send access codes, clock-in links, and document reminders
• To check that a clock-in comes from a recognised device at the host workplace
• To keep the service reliable and to limit misuse

Who we share it with

We use operators to run the service:

• Strapi, which stores the agency, host, learner, attendance, device, and document records
• Vercel, which hosts the application, stores document and verification files, keeps short-lived clock-in locks, and provides Speed Insights
• Resend, which delivers email
• SMS Portal, which delivers SMS to South African mobile numbers
• Google, when you search for a host address

We do not sell personal information. We may also disclose information if the law requires it, or to protect the service, our customers, or other people.

Transfers outside South Africa

Some of these operators process information outside South Africa. We make those transfers where they are needed to perform our contract with you, or where the operator is bound by law, binding corporate rules, or an agreement that provides a level of protection comparable to POPIA. More detail is in the POPIA notice.

How long we keep it

We keep agency, host, learner, attendance, device, and document records while the agency account is open. If you delete a learner, we delete that learner’s records from the service, including documents and device photos we still hold for them. We may keep a limited record where the law requires it, or where we need it for a dispute. Clock-in locks expire after about a day.

Security

Admin access is password-protected. Learner links require the token in the URL. You should keep passwords and access codes private, and only send links to the learner they belong to. Document and photo files are stored at an address that is hard to guess. No method of storage or transmission is completely secure.

Your choices and rights

You can update your profile in account settings. You can ask us to access, correct, or delete personal information we hold as responsible party, or object to processing. Learners should ask the placement agency first, because the agency decides what those records contain. How to make a request, and how to complain to the Information Regulator, is in the POPIA notice.

Learners and children

The product is used for learners on placement. It does not collect a date of birth. We do not market the service to children. If a learner is a child, the agency must have the authority POPIA requires before the learner is added, including the consent of a competent person where that consent is required. Admin accounts are for the agency, not for children.

Changes

We will post changes on this page and update the date at the top. If a change materially affects learner or host information you have entrusted to us, we will also email the account address where that is practical.

Contact

Questions about this policy: support@attendancetracker.co.za.