Facial recognition, done compliantly

Yes, when it is done correctly. A face template used to identify someone is special category data, so you need a lawful basis, an Article 9 condition, a clear notice, a data protection impact assessment (DPIA) and a genuine alternative. TempClock shows workers a versioned notice in English, Polish, Romanian or Lithuanian before any camera use, records their answer with the notice version and language, and lets anyone who says no clock in with a badge and PIN or through a supervisor.

You, the agency, are the controller and choose it: an Article 6 basis plus an Article 9 condition, most often explicit consent with a real alternative. You document the decision in your DPIA before you switch face clock-in on. A pre-filled DPIA template is available on request, as part of our compliance pack.

Consent has to be freely given, so nobody has to use their face to be paid. A worker who declines clocks in with their badge and a PIN, or a supervisor clocks them in. If a worker withdraws consent later, their face template, stored face data and reference photo are deleted straight away and they move to PIN. Their time records stay, under a separate basis.

The face template is held in the face-matching service (Amazon Web Services Rekognition, Ireland). TempClock stores the enrolment reference photo and a photo taken when someone clocks in by PIN (or from their phone, if you allow phone clock-in), in your instance (hosted in France), visible only to users with access to that worker or site. The photo taken at a face clock-in is sent for matching and then discarded. The template and reference photo are deleted within 4 hours of a worker being made inactive. Other retention periods (for example 90 days for PIN clock photos) are set by you in Data retention.

The TempClock application, database and uploaded files are hosted in the EU, in GoDaddy's data centre in France. Face matching and the enrolment liveness check run at Amazon Web Services in Ireland (eu-west-1). The UK's adequacy regulations cover personal data sent to the EEA, so no extra transfer safeguard is needed for either. An encrypted copy of the nightly backup is pulled every day to a separate server in the UK held by TempClock. Optional services (the SMS add-on and AI features, both off unless you choose them) use providers in the United States under UK transfer safeguards. The full sub-processor list is in our privacy policy and DPA.

Only the people whose role needs it. Agency Coordinators work with workers, shifts and exceptions without seeing pay figures; pay rates, pay totals and margins show only to users with pay access, on screen and in downloads. Client portal users see only the sites ticked for them and never see pay rates; client dashboard users see only their own company's sites. API keys have their own access levels, with pay as a separate one. Every refused request is recorded in the audit log.

A suspected data breach is handled as a P1: a first response within 30 minutes from 07:00 to 22:00 UK time and within 2 hours overnight, every day of the year, and we tell you without undue delay so you can meet your own reporting duties. The nightly backup is encrypted, with 14 daily and 8 weekly copies kept, and a separate encrypted copy in the UK. Our recovery targets are 24 hours for data (RPO) and 8 hours to restore service (RTO).

At enrolment, AWS Face Liveness checks that a live person is present. At clock-in, the face is matched against the worker whose badge was entered, so it only succeeds for that worker. You can also switch on an anti-photo movement check per site. No system makes buddy clocking impossible: PIN clocks are photographed and flagged for review, and an identity mismatch can raise an alert.