Privacy Policy

2020

General

---

“We” “us” “our” and “Timecloud” shall mean Timecloud Limited and “you” and “your” means the person or entity accessing the Website, subscribing for the Services, or otherwise interacting with us.

“Services” means any services made available to you by Timecloud, including through the Website.

“Website” means https://jointimecloud.com/, www.editmytime.com, and https://safeonsite.co/

This privacy policy was last updated on 4th September 2020

This Policy does not apply to the personal information of our employees.

 

1. Disclaimer: Service Data

---

1. Our Services may require the collection, storage and use of personal information (which may include name, biometric data and payroll information) of:
   1. those of your employees and/or contractors who use our Services to sign in and out of work;
   2. those of your employees and/or contractors whose personal information you have entered into a Website; and
   3. individuals who use the Services or to sign in and out of your premises,

(Service Data).

2. You may provide us with Service Data. In addition, we may collect on your behalf Service Data directly from your employees, contractors and visitors to your premises. We store Service Data in a secure manner in accordance with paragraph 12 below and process it on your instructions to deliver the Services.
3. By agreeing to this privacy policy, you agree that we collect, store and process Service Data on your behalf. It is your sole responsibility to meet your obligations under the Privacy Act 1993 (or the relevant legislation in your jurisdiction if you are not based in New Zealand) in relation to Service Data, including:
   1. communicating with your employees and contractors about the purpose for collection, storage and use of their personal information; and
   2. obtaining permission from your employees and contractors to have their personal information collected, stored and used by you, or by us on your behalf, in conjunction with our Services.
4. By using our Services, you warrant to us that you have met all your legal obligations relating to the collection, storage and use of the Service Data.
5. The remainder of this privacy policy applies to all personal information we collect, store and process excluding Service Data. Any reference to “personal information” in the remainder of this privacy policy is a reference to personal information excluding Service Data.

 

2. Purpose of information collection

---

Timecloud collects personal information for the purpose of carrying out our business, providing you with the Website and the Services, and for Timecloud to better understand, manage and market the Website and the Services.

 

3. Personal information of minors

---

We do not intend to collect personal information from children aged under 16. If you have reason to believe that a child under the age of 16 has provided personal information to us through our Website and/or by using the Services, please contact us at the email address set out at paragraph 18 below.

 

4. Collection of information

---

1. We collect and hold personal information about (but not limited to):
   1. clients and potential clients;
   2. persons we deal with in the course of carrying out business and delivering Services;
   3. persons who access and use the Website;
   4. Timecloud contractors, and potential employees and contractors; and
   5. other individuals who come into contact with us.
2. The kind of information we collect from you will depend on the purpose for and circumstances of collection but may include:
   1. identifying information such as your name, appearance, date of birth, citizenship or residency;
   2. contact information, such as your postal address, telephone number and email address;
   3. payment information, such as credit card or bank account details;
   4. information provided by you through registration on our Website;
   5. information provided to us by you through any other method (such as through recruitment processes, correspondence or discussions);
   6. information collected by us through click tracking in relation to your use of our Website, including the tracking of the content you access and any of our services you utilize, and
   7. information collected by us through log files or cookies (as set out in sections 6 and 7).
3. We may collect personal information from you:
   1. directly, such as when you interact with us in person or via phone or email, when you access or use our Website, when you provide us with documents such as a contract or a curriculum vitae, or when you fill in an online form;
   2. automatically, such as when you visit our Website or social media; and
   3. from third parties, such as our professional advisors, a person you have provided as a referee, or publicly available information.
4. Failure to provide necessary personal information when requested may result in certain services and/or opportunities not being available to you.
5. We may also collect aggregated information generated by our systems, which tracks traffic to our Website but does not relate to you personally (see section 8 below).

 

5. Identifiers

---

Information about your computer and about your visits to and use of the Website (such as your IP address, location, browser type and user name) may be recorded when you log in to our Website. This information may be used to identify you. We will treat this information as personal information.

 

6. Log files

---

We use log files in order to enhance your experience on our Website and to analyze trends. Log files gather information, such as which URL you just came from, which URL you visit next, what browser you are using and your IP address. This information is used to analyze trends and to administer and operate our Website.

Users who log into our Website also have their IP address recorded. An IP address can be used to identify a user; we will treat this information as personal information.

 

7. Cookies

---

Our Website uses temporary cookies to keep a session open after a user logs in. We may use the information we obtain from the cookies in the administration of our Website and to improve our Website. These cookies help us recognize previous visitors and also identify the route history of users. We treat information collected by cookies and other similar technologies as non-personal information unless:

1. applicable laws require us to treat them as personal information; and
2. to the extent that non-personal information is combined with personal information, we treat the combined information as personal information for the purposes of this privacy policy.

Some browsers allow you to refuse to accept cookies. However, this may have a negative impact on the usability of our Website.

 

8. Other information

---

We will have access to and may use other information, such as number of users, traffic patterns and demand for the Service, for the purpose of monitoring server and software performance as well as for our other internal purposes. We may also collect information about all system interactions with users while they are logged in. This information is owned by us and may be used to verify actions taken by a user or to better understand the behaviour of users in order to improve our Website.

 

9. Use of information

---

The personal information you provide may be used by us, any person or other entity which directly or indirectly controls, is controlled by or is under common control with us (an Affiliate) and each of our and our Affiliates’ employees, officers, agents and contractors to:

1. assist us in conducting our business and providing Services;
2. perform our contractual obligations to you;
3. assess your suitability to work with or for us;
4. communicate with you in the context in which you have engaged with us, including responding to queries and complaints;
5. bill you for amounts owed by you to us or pay you for amounts owed by us to you;
6. verify your identity for use of our Website, conduct address verification or credit checks for invoicing and billing purposes and enrich your profile and search ability;
7. assist in providing better Services to you by tailoring the Services to meet your needs;
8. provide you with further information about us or other websites or goods or services offered by us or our Affiliates or which we consider may be of interest to you. You may opt out of receiving such information from us by emailing us or using the “unsubscribe” function in any communication that we send you;
9. market, promote and otherwise publicise our Services (including through direct marketing), and to carry out market research and surveys (by Timecloud only, not by third parties). You may opt out of receiving any marketing, promotional, publicity or market-research-related correspondence from us by emailing us or using the “unsubscribe” function in any communication that we send you;
10. keep our Website relevant and of interest to users;
11. show you advertising and information that is most relevant to you and your interests; this may include using retargeting technologies to display ads on other websites based on your interactions with our site. We partner with networks like Google Ads and Facebook for this purpose. You can manage retargeting through your browser's settings.
12. assist in arrangements with other organizations (such as loyalty program partners or third-party applications that integrate with the Services) in relation to a product or service we make available to you;
13. allow us to run our business and perform administrative and operational tasks (such as training staff, risk management; developing and marketing products and services, undertaking planning, research and statistical analysis, systems development and testing, keeping our records up to date, and being efficient about how we fulfil our legal and contractual duties);
14. detect any fraud or crime, or for money laundering and counter financing of terrorism purposes in connection with any laws, rules or regulations in New Zealand or overseas; and
15. satisfy any other purpose that is stated to you at the time of collection or that you otherwise authorize.

 

10. Information sharing and disclosure

---

1. In relation to personal information, we:
   1. will not disclose personal information we collect from you other than as set out in this privacy policy or as otherwise agreed with you;
   2. may disclose information about you, including your personal information, to our Affiliates and each of our and our Affiliates’ employees, officers, agents and contractors for the purposes set out in paragraph 9; and
   3. may disclose your personal information if we determine in good faith that disclosure is reasonably necessary to protect our rights and pursue available remedies, enforce our terms and conditions, investigate fraud, or protect our operations or users; and
   4. may disclose information about you, including your personal information, to our contractors and suppliers to enable them to provide services and products to us in relation to our Services and Website, including transaction processing services, hosting services and support services.
2. Information collected through our Website that does not identify users is owned by us and may be disclosed by us. We may share aggregated demographic information about our user base with our Affiliates, partners and advertisers.
3. At your request, we will share your personal data with your representative or any person acting on your behalf (for example, financial advisers, lawyers, attorneys, accountants, executors, administrators, trustees or auditors).
4. We may enable you to share information with third party applications or websites that integrate with the Services (e.g. a payroll provider’s website). You can choose to share your information (including personal information) with the third party application or website. Information collected by these third parties is subject to their terms and policies. Timecloud is not responsible for the terms or policies of third parties.

We operate our business in New Zealand. We may need to share some of the personal information we collect about you with organisations both inside and outside of New Zealand, including in Australia and the United States of America. We will not do this without your permission unless we believe on reasonable grounds that the organisation is subject to privacy laws that provide a comparable safeguard to those in New Zealand, or the organisation is required to protect your personal information in a way that, overall, provides comparable safeguards to those in New Zealand privacy law.

Advertising and third-party links

Our Website may contain links to a variety of advertising and third-party Website sources. Some of these links may request or record information from users or use cookies or other methods to collect information from you. We have no control over the content or privacy policy practices of those sites and encourage our users to review the privacy policies of those sites before engaging in any activity with them.

 

11. Security of your personal information

---

We are committed to data security. We will take reasonable and appropriate technical and organizational precautions to prevent the loss, misuse or unauthorized alteration of your personal information. For example, we store data in computer servers with limited access that are located in controlled facilities. However, due to the nature of email and the internet, we cannot guarantee the privacy or confidentiality of your personal information. We may store your information in cloud or other types of networked or electronic storage. We will only store your personal information electronically and not in hard copy.

When you provide us with personal information, that information may be collected, stored and processed on servers located outside of New Zealand. Where we transfer personal information outside of New Zealand, we will meet our obligations in paragraph 10 and the GDPR Privacy Statement.

Sensitive information, such as data entered during the registration process, is encrypted using SSL technology.

Credit card payments are encrypted and processed using an external credit card payment processor and details are not stored by us.

 

12. Your Rights

---

Without limitation, you have the following rights:

1. The right to be provided confirmation of whether we hold personal information about you, and access to that information.
2. The right to request that we correct personal information we hold about you and to request that there be attached to the information a statement of the correction sought but not made.

To exercise your rights, or if you require further information about how your personal data is used by us, you can contact us at: [email protected].

You can also contact us if you have any questions or complaints about how we collect, use, disclose, manage or store your personal information. Where we are required by applicable law to provide further information about our use or disclosure of your personal information, we will use reasonable endeavors to do so.

We will respond to your request, where required by law, within 20 working days from the date your request is received. We will inform you if this timeframe is not achievable and extend this timeframe as permitted by applicable law. We may charge a fee to cover the costs of meeting your request, in particular if your request is urgent.

If we do not agree to provide you with access to, or to amend or erase, your personal information as requested or otherwise meet your requests, we will notify you accordingly. Where appropriate, we will provide you with the reason(s) for our decision and the mechanisms available to complain about the refusal. If the rejection relates to a request to change your personal information you may make a statement about the requested change and we will attach this to your record.

In some circumstances, as set out in the Privacy Act 1993, we may not grant access to your personal information. In those cases we will, if permitted by law, provide you with the reasons why your request has been refused.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) via the OAIC website, www.oaic.gov.au.

We will keep your information for so long as is required for our business operations or by applicable laws.

 

13. Business transitions

---

In the event of a change in ownership of all or a portion of Timecloud Limited or our Website, your user information may be transferred to the new owner so that the Website can continue operations. In this event, your information would remain subject to this privacy policy.

 

14. Users outside New Zealand

---

The information we collect may be processed in and transferred between your location and New Zealand. You should note that New Zealand may have different data protection laws to those in force in your location. If you are located in the European Economic Area (EEA), you have the additional rights set out in paragraph 19 of this privacy policy.

 

15. Linking and advertising

---

We may include links to third-party materials (Linked Sites) on our Website as well as advertising. Advertisers or Linked Sites may ask you to provide information. We do not have control over the privacy policies of Linked Sites or advertisers. Further requirements about Linked Sites are set out in our Website terms and conditions. Please read carefully their privacy policies to find out how they collect and process your personal data

 

16. Changes in privacy policy

---

We reserve the right to make changes to our privacy policy and alter Website functionality. We encourage you to regularly review this privacy policy for the latest information on our privacy practices.

 

17. Contact details

---

If you have any questions about our privacy policy, or any other matter (including a complaint), please feel free to contact us. You can reach us in one of the following ways: email [email protected], or call 1300 940 831.

 

18. European Union General Data Protection Regulation (GDPR)

---

The GDPR establishes a uniform data protection law across the EEA and aims to protect the privacy and use of EEA residents’ personal data in an increasingly digital world. The following GDPR Privacy Statement sets out how we will comply with these obligations to protect the data of customers who are in an EEA country.

EUROPEAN UNION GENERAL DATA PROTECTION REGULATION (GDPR)

GDPR Privacy Statement

This GDPR Privacy Statement only applies to the collection and processing of ‘EU personal data’. ‘EU personal data’ means any personal data (as that term is defined in the GDPR) of an individual who is located in the EEA (whether the individual is a citizen of an EEA country or otherwise). This section will apply to you and the processing of your EU personal data if you are located in an EEA country. This section does not apply with respect to your personal information if you are located outside of the EEA countries, even though you may be a citizen of an EEA country.

For the purposes of this GDPR Privacy Statement, the term ‘process’ has the same meaning given to it under the GDPR and may include any operation or a series of operations performed on EU personal data, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

EU personal data that is collected by us may have been sourced directly from you, a third party or implied from your use of our products or services. We will process EU personal data in accordance with this GDPR Privacy Statement and our privacy policy. To the extent of any inconsistencies between other sections of our privacy policy and this GDPR Privacy Statement in relation to the processing of EU personal data, this GDPR Privacy Statement prevails.

This GDPR Privacy Statement was drafted with brevity and clarity in mind. It does not provide exhaustive detail of all aspects of our collection and use of personal data. However, we are happy to provide any additional information or explanation needed. For further information, please contact us through the contact details provided in paragraph 18.

GDPR Principles

Any EU personal data will be:

1. processed lawfully, transparently and in a fair manner;
2. collected only for the purposes identified in this privacy policy or any other agreed specified purposes and not further processed in a manner incompatible with those purposes;
3. collected in an adequate and relevant manner and limited to what is necessary in relation to the purposes for which the EU personal data is processed;
4. kept current and up-to-date in accordance with our privacy policy;
5. stored in a form which permits us to identify you, but only for the period necessary in relation to the relevant purposes identified in our privacy policy; and
6. stored and processed securely to protect EU personal data against unlawful or unauthorized access and accidental loss, damage or disclosure in accordance with our privacy policy.

Lawful basis for processing

We will only collect and process EU personal data where we have lawful bases. This may include where:

1. you have given consent;
2. the processing of EU personal data is necessary for the performance of a contract with you (such as to deliver the services you have requested or that have been requested on your behalf); and
3. the processing of EU personal data is necessary for the purposes of our ‘legitimate interests’ and/or those of our Affiliates, provided that such processing does not outweigh your rights or freedoms.

Where we rely on your consent to process personal data, you have the right to withdraw, restrict or decline your consent at any time and where we rely on legitimate interests, you have the right to object. If you have any questions about the lawful bases upon which we collect and process EU personal data please contact us through the contact details provided in section 18.

Rights of EU personal data subjects

In addition to other rights you may have as set out in this privacy policy, you may exercise the data protection rights set out below in relation to your EU personal data:

1. Access and Portability: a request can be made by you for a copy of your EU personal data (and any other information relating to your EU personal data permitted under Article 15 of the GDPR) held by us in accordance with the ‘Your rights’ section of our privacy policy. In addition, you may request to be provided with EU personal data in a structured, commonly used and machine readable format (including for the purposes of transferring to another party).
2. Restrictions and Objections: You may request that we limit our use or processing of your EU personal data by requesting that we delete or no longer use your EU personal data or that we limit how we use your data, this may include where you believe it is not lawful for us to hold your EU personal data or instances where your EU personal data was provided for direct marketing purposes and you no longer want us to contact you. We will do so, if we are:
   1. relying on our own or someone else’s legitimate interests to process your personal information, except if we can demonstrate compelling legal grounds for the processing; or
   2. processing your personal information for direct marketing.
3. Please note that certain conditions may apply to the exercise of these rights.

Our responsibilities as a ‘data controller’ and ‘data processor'

We may act as the ‘data controller’, the ‘data processor’ or in some instances both the data collector and data processor simultaneously in relation to EU personal data. We will be a data controller where we determine the purposes and means of the processing of EU personal data alone or jointly with others. To the extent that we are a data controller with respect to EU personal data, we:

1. set out in our privacy policy how we collect personal information (including EU personal data), how it is stored, to whom such personal information is disclosed and how the EU personal data is otherwise processed;
2. only appoint processors under agreements that the processor will comply with the GDPR;
3. will maintain a record of processing activities which are under our responsibility (where required by GDPR);
4. co-operate with relevant authorities which enforce the GDPR; and
5. implement appropriate technical and organisational security measures to protect EU personal data and report any data breaches to authorities and affected individuals as required by the GDPR in accordance with our privacy policy.

If a third party discloses EU personal data to us for a specific purpose, we will be acting as a data processor in processing the EU personal data for that purpose. Where we collect Service Data in accordance with paragraph 1 of this privacy policy, we will be a data processor of that information, and you will be the data controller. Where we act as a data processor, we will:

1. only act on the controller’s documented instructions;
2. impose confidentiality obligations on all personnel who process the EU personal data;
3. not appoint sub-processors without the prior written consent of the controller;
4. at the instruction of the controller, return or destroy the EU personal data in accordance with our privacy policy; and
5. where applicable, assist the controller in complying with the rights of the data subjects of the EU personal data;
6. maintain and keep accurate records of processing activities (where required by GDPR); and
7. implement appropriate technical and organisational security measures to protect EU personal data and report any data breaches to controller without undue delay.

Where we are a data processor of ‘special categories’ of personal data about your employees or contractors (as defined in the GDPR), you confirm that you have obtained explicit consent to that processing from your employees and contractors.

Disclosure to third parties

If we are required to disclose your EU personal data to third parties, including data processors or sub-processors, we will notify the third party that it has an obligation to handle any EU personal data in accordance with the GDPR, and, where we have an agreement with that third party, that agreement will comply with the requirements of the GDPR.

In the event we are responsible for a transfer of EU personal data outside of the EU, such transfer will be for the necessary and lawful performance of our services, including the establishment, exercise or defense of a legal right.

Transfer of information overseas

We are based in New Zealand. This means that if you are an EU resident, your personal information will be transferred and stored outside the European Economic Area. New Zealand has ‘adequacy’ for the purpose of Article 45 of Regulation (EU) 2016/679.

Certain personal information may be transferred to third countries and/or international organisations outside New Zealand and the European Union for storage or where required for compliance with law. Where personal information is transferred outside of the EEA or New Zealand, it will be:

1. to a country or organization that has ‘adequacy’ for the purpose of Article 45 of Regulation (EU) 2016/679 (including organisations subject to the Privacy Shield);
2. transferred subject to the European Commission’s model contracts for the transfer of personal data to third countries (i.e., the standard contractual clauses), pursuant to Decision 2004/915/EC and Decision 2010/87/EU as appropriate; or
3. a transfer that otherwise complies with Chapter 5 of the GDPR.

How do you make a complaint?

If you have a complaint about how we handle your EU personal data, you can contact us: email [email protected], or call 1300 363 992.

If you still feel your issue or request has not been resolved to your satisfaction, then you can escalate your privacy concern to the relevant data protection authority (for example in the place you reside or where you believe we breached your rights). If your complaint relates to how we handled your access and correction requests you may take your complaint directly to the New Zealand Privacy Commissioner, or the authority of the country in which you are located.

Contact details for escalating complaints

Office of the New Zealand Privacy Commissioner:

1. Online: www.privacy.org.nz
2. Phone: +64 4 474 7590 or +64 9 302 8680
3. Email: [email protected]

Office of the Australian Information Commissioner:

1. Online: oaic.gov.au
2. Phone: +61 1300 363 992
3. Email: [email protected]