Privacy Policy

1. Introduction

Welcome to WorkTickle ("we," "our," or "us"), a product of Sufix Tech LLC. We are committed to protecting your personal information and your right to privacy.

This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our employee monitoring and time tracking platform, including our website at worktickle.com, our web application at app.worktickle.com, and our desktop and mobile applications (collectively, the "Service").

This policy should be read together with our Terms and Conditions. If you disagree with either, please discontinue use of the Service.

2. Our Role: Controller and Processor

WorkTickle is a business tool that organizations deploy for their own workforce. Our privacy responsibilities differ depending on whose data is involved, and it is important to understand the distinction.

Where we act as a processor, we process monitoring data only on the documented instructions of the Company that subscribes to the Service. The Company decides which employees are monitored, which features are enabled, how long data is kept within the available settings, and how reports are used. The Company is responsible for having a lawful basis for that monitoring and for informing its workforce.

Where we act as a controller — for example when you visit our website, create an account, or contact support — we determine the purposes of processing and this policy applies directly.

Customers requiring a Data Processing Agreement (DPA) under the GDPR, UK GDPR, or similar laws may request one at [email protected].

3. Information We Collect

3.1 Information you provide to us

• Account registration details (name, email address, password)
• Company name, job role, and team structure
• Billing contact details and billing address
• Profile information, preferences, and uploaded brand assets
• Communications you send us, including support requests and feedback

3.2 Payment information

Subscription payments are processed by third-party payment providers. We do not store full card numbers, CVV codes, or bank credentials on our systems. We receive and retain only limited transaction data such as the last four digits of the card, card brand, expiry date, billing country, invoice history, and payment status.

3.3 Monitoring data collected through the desktop and mobile applications

Where enabled by the Company, the Service may collect:

• Screenshots of the active screen at configurable intervals
• Timelapse videos assembled from captured screenshots
• Names of applications and websites used during tracked sessions
• Keyboard and mouse activity counts — we record levels of activity, not the content of what is typed. The Service is not a keylogger and does not capture keystroke content
• Time tracking records, including clock-in and clock-out times, active time, idle time, and breaks
• Device location, which may include precise or live location where the Company has enabled that feature and the device permits it
• Device and technical information such as operating system, device name, application version, and IP address
• Attendance, leave, holiday, and payroll-related records entered into or generated by the Service

3.4 Information collected automatically on our website

• IP address, browser type, device type, and operating system
• Pages viewed, referring URLs, and session duration
• Cookie and similar identifiers, as described in Section 12

4. Important Notice for Monitored Employees

If you believe you are being monitored unlawfully or without notice, you may report this to us at [email protected]. We will investigate and may suspend the account concerned.

5. How We Use Information

We use the information described above to:

• Provide, operate, maintain, and secure the Service
• Generate time records, productivity reports, and attendance data for the Company
• Calculate payroll and generate salary slips where that feature is used
• Detect and alert on activity that suggests manipulation of tracking, such as the use of automation tools
• Process payments, issue invoices, and manage subscriptions
• Send service notifications, security alerts, and administrative messages
• Provide customer support and respond to enquiries
• Diagnose technical problems, monitor performance, and improve the Service
• Detect, prevent, and investigate fraud, abuse, and security incidents
• Comply with legal obligations and enforce our Terms

We do not use monitoring data for our own commercial purposes, we do not sell it, and we do not use it to train artificial intelligence models for third parties.

6. Legal Bases for Processing

If you are located in the European Economic Area, the United Kingdom, or another region with similar laws, we process personal data on the following legal bases:

• Performance of a contract — to deliver the Service to the Company that has subscribed, and to manage your account and billing
• Legitimate interests — to secure our platform, prevent fraud and abuse, improve the Service, and communicate about material changes, provided those interests are not overridden by your rights
• Legal obligation — to meet tax, accounting, and regulatory requirements, and to respond to lawful requests from authorities
• Consent — for non-essential cookies, optional marketing communications, and any processing where consent is specifically requested. You may withdraw consent at any time

Where we act as a processor for monitoring data, the legal basis for that monitoring is determined and documented by the Company, not by us.

7. How We Share Information

We do not sell personal information and we do not share it for cross-context behavioural advertising. We disclose information only in the following circumstances:

• With the Company. All monitoring data associated with a Monitored User is accessible to the administrators authorized by that user's employer.
• With service providers (sub-processors). We use vetted third parties to host, operate, and support the Service, as listed in Section 8. They may access data only to perform services for us and are bound by written confidentiality and data protection obligations.
• For legal reasons. Where required by applicable law, subpoena, court order, or a valid request from a public authority, or where necessary to protect our rights, safety, or property, or that of our users or the public.
• In a business transfer. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction. We will notify affected customers before their data becomes subject to a different privacy policy.
• With your direction. Where you or the Company instruct us to share data, for example through an integration you enable.

8. Sub-Processors

We rely on the following categories of sub-processor to deliver the Service. A current list is available on request at [email protected].

We will give customers advance notice of any new sub-processor that will have access to monitoring data, and customers with a DPA in place may object on reasonable data protection grounds.

9. White-Label and Company Branding

WorkTickle offers white-label features that allow a Company to display its own logo, brand colours, and custom subdomain (for example yourcompany.worktickle.com), and to issue salary slips carrying its own branding.

Branding changes the appearance of the platform only. Regardless of the branding applied, Sufix Tech LLC remains the operator and processor of the platform, this Privacy Policy continues to apply, and the data is stored on our infrastructure. Companies must not represent to their workforce that no third-party processor is involved.

10. Data Retention

We retain data for as long as an account remains active and for the periods set out below.

Following cancellation or termination of an account, Customer Data is deleted from active systems within 90 days, and from routine backups within a further reasonable period, unless we are legally required to retain it or need it to resolve a dispute or enforce our agreements.

Companies should export any records they need to keep before cancelling. Export tools are available within the Service.

11. Data Security

We implement technical and organizational measures appropriate to the sensitivity of the data we handle, including:

• Encryption of data in transit using HTTPS/TLS
• Encrypted storage of passwords and sensitive credentials
• Role-based access controls, so administrators see only their own organization's data
• Restricted internal access on a need-to-know basis
• Authentication controls and session management
• Ongoing security monitoring, logging, and patching

Breach notification. If we become aware of a personal data breach affecting your information, we will notify the affected Company without undue delay and, where required, within 72 hours of becoming aware, providing the information needed for the Company to meet its own notification obligations.

No security system is impenetrable. While we take these steps seriously, we cannot guarantee absolute security, and you are responsible for keeping your own credentials confidential.

12. Cookies and Similar Technologies

Our website and application use cookies and similar technologies:

• Essential cookies — required for the Service to function, including authentication and session management. These cannot be switched off.
• Analytics cookies — help us understand how visitors use our website so we can improve it.
• Preference cookies — remember your settings and choices.

Where required by law, we request your consent before setting non-essential cookies, and you may change or withdraw that choice at any time. You can also control cookies through your browser settings, though disabling certain cookies may affect functionality.

The desktop application does not use advertising cookies or third-party tracking pixels.

13. Automated Processing and Productivity Scores

The Service automatically classifies applications and websites as productive or unproductive, calculates activity and idle levels, and generates productivity scores and reports.

These outputs are automated estimates provided as decision support. We do not make any decision about any individual. Any employment, disciplinary, performance, or payroll decision is taken by the Company, and the Company is responsible for applying human review before relying on Service output.

If you are subject to a decision you believe was based solely on automated processing, contact your employer's administrator to request human review, and refer to Section 14 for your rights.

14. Your Privacy Rights

Depending on where you live, you may have the following rights over your personal data:

• Access — request a copy of the personal data we hold about you
• Correction — request that inaccurate or incomplete data be corrected
• Deletion — request erasure of your personal data, subject to legal and contractual obligations
• Restriction — request that we limit how we process your data in certain circumstances
• Objection — object to processing based on legitimate interests
• Portability — receive your data in a structured, commonly used, machine-readable format
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing
• Complain — lodge a complaint with your local data protection authority

To exercise your rights in relation to data for which we are the controller, email [email protected]. We will verify your identity and respond within 30 days, or within any shorter period required by applicable law. There is no charge unless a request is manifestly unfounded or excessive.

15. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act as amended by the CPRA gives you the right to know what personal information we collect and why, the right to request deletion or correction, the right to opt out of the sale or sharing of personal information, the right to limit the use of sensitive personal information, and the right not to be discriminated against for exercising these rights.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months.

Where we handle personal information on behalf of a Company, we act as a service provider under the CCPA and process that information only for the business purposes set out in our agreement with that Company.

To submit a request, or to submit one through an authorized agent, contact [email protected].

16. International Data Transfers

We operate internationally, and your information may be stored and processed in countries other than your own, including countries that may not provide the same level of data protection as your home jurisdiction.

Where we transfer personal data out of the European Economic Area or the United Kingdom, we rely on an appropriate safeguard recognized under applicable law, which will normally be the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum where relevant, supplemented by additional technical and organizational measures where necessary.

You may request further information about the safeguards applied to a specific transfer by contacting us.

17. Children's Privacy

WorkTickle is a business-to-business Service intended for use by adults in professional settings. Account holders must be at least 18 years old, and the Service must not be used to monitor anyone under the age of 18.

We do not knowingly collect personal information from children. If we become aware that we have collected data relating to a child, we will delete it promptly and may suspend the account responsible.

18. Third-Party Links and Integrations

The Service may link to, or integrate with, third-party websites and applications. This Privacy Policy does not apply to those services. When you enable an integration, data may be shared with that provider under its own terms and privacy policy. We encourage you to review them before connecting any third-party tool.

19. Changes to This Policy

We may update this Privacy Policy from time to time. Where we make material changes, we will notify you by email or by posting a prominent notice within the Service before those changes take effect. The date at the top of this page always reflects the most recent revision.

Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

20. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact us: