US State Privacy Notice
DRAFT — NOT YET IN EFFECT. This document is a working draft prepared for review by an attorney. It has not been approved, is not legal advice, and does not bind anyone in its current form. Text in square brackets, such as
[LEGAL ENTITY NAME], is a placeholder that still has to be filled in.
This notice supplements our Privacy Policy for residents of California and of
other US states with comprehensive privacy laws. [ATTORNEY: confirm whether we meet any state law's applicability thresholds; during a free beta we may not, but the notice is offered anyway.]
1. Workers whose employer uses Tick Tack Timetrack
When your employer uses the Service, we act as its service provider (or processor). Your employer decides what is collected about you and is responsible for giving you its own notice at collection and for answering your requests. Send requests about your work records to your employer. If you send them to us, we will forward them to your employer and help it respond.
2. Personal information we handle for ourselves
In the last 12 months we have collected, for our own purposes, the following categories, as described in the Privacy Policy:
| Category (as named in California law) | Examples | Source | Purpose |
|---|---|---|---|
| Identifiers | Name, email address, IP address, account identifiers | You; your browser | Creating and managing the company account, security, communications |
| Commercial information | Plan and account history | You | Running the account; billing after the beta |
| Internet or network activity | Server logs, records of Terms acceptance with IP address and browser | Your browser | Security, fraud prevention, proving contract acceptance |
| Professional information | Your role at the customer company | You | Managing the account |
We do not collect sensitive personal information for ourselves for the purpose of inferring characteristics about anyone. Precise location, photos and pay data in the Service are processed only on the employer’s instructions.
3. No sale or sharing
We do not sell personal information and do not share it for cross-context behavioural advertising, and we have not done so in the past 12 months. We have no actual knowledge of selling or sharing the personal information of anyone under 16. Because of this, there is no “Do Not Sell or Share” link to use; we honour Global Privacy Control signals anyway.
4. Disclosures for business purposes
We disclose the categories above to our subprocessors (hosting, email, maps, and, if enabled, error monitoring) only so that they can provide services to us.
5. Your rights
Depending on your state, you may have the right to:
- know what personal information we have collected about you, where it came from, why, and to whom we disclosed it;
- get a copy in a portable format;
- correct inaccurate information;
- delete it, subject to legal exceptions (for example, records we must keep to show what was agreed);
- opt out of sale, sharing, targeted advertising, and certain profiling (we do none of these);
- appeal our decision on your request.
We will not discriminate against you for using these rights.
6. How to make a request
Email [DPO/PRIVACY CONTACT] or write to [LEGAL ENTITY NAME], [ADDRESS]. We will confirm
receipt within 10 business days and respond within 45 days, which we may extend once by another
45 days if we tell you why. We will verify your identity by confirming control of the email address
we hold for you. An authorised agent may make a request for you with your signed permission; we may
ask you to confirm your identity directly. To appeal a decision, reply to our response with
“Appeal” in the subject line; if you are not satisfied with the outcome you may contact your state
attorney general.
7. Retention
How long we keep each category is set out in section 7 of the Privacy Policy.
8. Changes
Each version of this notice is published at /legal/ccpa/<version>/.