Location data and employee notice

01 — Information processed and retained

What a time-clock action and optional protection may use.

• the date and time of clock-in or clock-out;
• the latitude, longitude, and estimated accuracy supplied by the device at that moment;
• the calculated distance from the jobsite point configured by the company;
• the jobsite radius and a result such as inside, outside, or unverified;
• the project, assignment, and time entry connected to the action.

When forgotten-punch protection is enabled, the phone may arm an on-device work-zone region monitor up to 30 minutes before a scheduled assignment. It does not submit scheduled-start GPS evidence before the start. From 2 through 30 minutes after the start, the phone may request and submit limited current, point-in-time fixes, normally at the 4-minute checkpoint or when it detects a work-zone state change. The server rejects evidence outside that acceptance window, independently calculates the distance, and temporarily keeps only the derived on-site, off-site, or unverified result, accuracy, distance, and observation time needed to decide the single clock-in reminder. Raw coordinates are not retained for that reminder, and the scheduled-start checks are not continuous tracking. During an open shift, qualifying samples remain memory-only and are not uploaded as a route or location history.

If the protection completes an automatic clock-out, the time entry retains limited evidence including the automatic origin, outside-zone result, final clock-out location and accuracy, server-verified distance beyond the zone, number of qualifying samples, first qualifying time, offline-capture status, and automatic-operation identifier. During an outage, this evidence may remain in the app’s protected offline queue until it can synchronize. It supports review, correction, and safe retry; it is not a travel history.

02 — Purpose and limitations

Confirm work context and help prevent a forgotten punch.

Location helps associate a clock action with the correct job, identify an obvious error, and support timesheet review or correction. Beginning five minutes after a scheduled start, an employee who has not clocked in may receive at most one reminder, with bounded catch-up ending 30 minutes after the start. A recent accurate result can tailor the reminder as on-site or off-site; missing, stale, or inaccurate location uses neutral wording and is not treated as proof that the employee is away.

During an open shift, repeated accurate readings more than 100 metres beyond the configured work-zone boundary can trigger a local reminder. Remaining more than 200 metres beyond the boundary for at least 30 seconds can request an automatic clock-out. Reported GPS accuracy is handled conservatively before distance is evaluated.

A GPS result is a technical indicator, not absolute proof. Buildings, weather, device settings, and networks can reduce accuracy. The feature must not be repurposed to monitor an employee’s private life or movement outside the disclosed scheduled-start window or eligible open shift.

03 — Transparent activation

The employee must know when and why location is used.

Before enabling either GPS validation or forgotten-punch protection, the customer company must provide a clear notice describing the technology, purpose, timing, information processed and retained, people who may view it, retention, consequences of refusal, and available alternatives. The employee must separately turn on forgotten-punch protection in Fondation Flow and grant the device’s Always Location permission before background monitoring can operate. Notification permission is separately requested and is required to display local reminders and status alerts; denying it does not by itself disable the guarded automatic clock-out.

The protection can be disabled in the app. On-device region monitoring may begin at most 30 minutes before the scheduled start, but scheduled-start GPS evidence is accepted only from 2 through 30 minutes after the start. This bounded check ends on clock-in, assignment cancellation, disable, sign-out, or expiry. Open-shift protection ends on clock-out, disable, sign-out, loss of eligibility, or when the saved job zone is unavailable. Manual clocking remains available, and background location can use additional battery.

The company must not request broader permission than necessary or bypass the employee’s device choice. Employment law, a collective agreement, workplace policy, or management rights may require additional analysis and notice.

04 — Access and visibility

Only people with a work-related need should see the result.

05 — Exceptions and corrections

A failed GPS check must not erase the work performed.

If location is unavailable, inaccurate, or outside the configured zone, the app may request an explanation or mark the entry for review. An automatic clock-out closes the open time entry but does not decide payroll or discipline. The employer should review the record and provide a fair way for the employee to explain, correct, or dispute the result before relying on it.

06 — Retention and employee rights

Keep only what is required for the stated purpose.

Temporary background samples are not uploaded or retained as a route. The technical scheduled-start evidence record is deleted after the reminder decision or when its short eligibility window expires. The resulting on-site, off-site, or neutral reminder wording may remain in notification history, without the raw coordinates, accuracy, or measured distance. Point-in-time punch information and the limited final evidence of an automatic clock-out remain connected to the time entry. The customer company determines operational retention subject to law and its agreement. It should not retain location evidence longer than needed for time validation, legal obligations, or a documented dispute. Employees may request access or correction through their employer and may also contact Fondation Flow’s privacy officer.

07 — Employer responsibility

The company decides whether and how the tool is appropriate.

The customer company remains responsible for workplace legality, proportionality, notices, consent where required, role configuration, payroll review, collective agreement obligations, and decisions affecting employees. Fondation Flow provides the tool and supports reasonable privacy and access requests according to its role.