Privacy notice
This page covers two things: what happens to details you send through this website, and how staff data is handled in the KiteClock app.
Last updated 24 October 2026.
1. This website
Enquiries
When you use the contact form, KiteClock is the controller of what you send: your name, work email and business name, and if you give them, your phone number, team size and message. We use them to reply to you and, if you ask, to set up your trial. Our lawful basis is legitimate interests: answering an enquiry you've made.
To stop the form being abused, we also keep a scrambled code made from your internet address (a keyed hash; we never store the address itself), and the page you sent the form from. Enquiries are deleted after 2 years.
Cookies and analytics
This website sets no cookies and uses no analytics or advertising trackers. See cookies.
Who handles it
- Vercel hosts this website.
- Supabase stores enquiries, in Amazon Web Services' EU (Ireland) region.
2. The KiteClock app
Who is responsible
When a business uses KiteClock for its staff, the business (your employer) is the controller: it decides why and how staff data is used. KiteClock is the processor: we store and process that data on the employer's instructions. Staff accept a privacy notice in the app before their location or a photo is ever used.
What the app uses
- Name, work email, job details, payroll number and pay rates, set by the employer.
- Clock-ins, breaks and clock-outs, with the time, the method (phone, NFC tag, QR code or kiosk) and the site.
- Location, only at the moment someone taps in the app and only if their clock-in policy uses it: latitude and longitude, accuracy, distance to the site and whether they were inside its fence. Never in the background.
- A photo at clock-in, only if the employer turns it on. There's no face recognition.
- Rotas, holiday and leave requests, and timesheet changes, each with who made them and why.
How long it's kept
- Clock records: the period the employer sets, from 2 to 10 years (working-time records must be kept for at least 2).
- Clock-in photos: the employer's setting, 1 to 365 days (30 by default).
- Payroll export files: 30 days.
- Leave records: at least 6 years.
Your rights
Staff can ask their employer for a copy of their data, which an admin can download from KiteClock, or to correct it. When someone leaves, the employer can erase their identity, contact details, locations and photos, keeping the hours, pay and leave records the law requires. To make a request, contact your employer. You can also complain to the Information Commissioner's Office (ico.org.uk).
Sub-processors
- Supabase: database, file storage, sign-in and server functions, in AWS EU (Ireland).
Contact
For any privacy question, use the contact form.