Workplace biometric clock-in — privacy notice
Version 2 · POPIA section 18 capture notice · Last reviewed 2026-05-24. Questions? Contact the Werktyd team.
Your employer (the Responsible Party) uses Werktyd (the Operator) to record your working time using a face scan.
What is collected
A numeric face template (biometric data — “special personal information” under POPIA s.26) plus your clock in/out times, worker number and name. The template — not the photograph itself — is what your employer uses to recognise you at the kiosk.
One face thumbnail is also kept (a small photo from your enrolment) so your employer can identify you on their staff list inside the Werktyd dashboard. Only the employer (the Responsible Party) can see it — workers cannot see other workers' thumbnails. The thumbnail is deleted immediately when you leave employment, and is never used for identity matching (the numeric template alone is used for that).
Why (purpose)
Solely to record attendance and working hours for payroll and the employer’s record-keeping duty under the Basic Conditions of Employment Act. It is not used for anything else and is not sold or shared for marketing.
Your choice
You may decline the face scan and use a PIN instead, at no penalty. Ask your employer.
Where it is processed
On secure servers in Germany (European Union), whose GDPR protections are recognised as adequate under POPIA s.72. This transfer is disclosed here and governed by an operator agreement.
If you clock in by Telegram
If your employer uses Telegram clock-in, your selfie is sent through Telegram (a third-party messaging service), which may process and store it on servers outside South Africa, before Werktyd converts it to the numeric template and deletes the image. By sending a selfie to the clock-in Telegram bot you consent to this. If you would rather not use Telegram, ask to clock in at the on-site device or use a PIN — at no penalty.
Chat assistant & voice notes
To understand typed or spoken chat messages to the assistant (for example, an owner asking “who is at work?”), Werktyd uses AI language services — currently OpenRouter / Google Gemini for text and Groq Whisper for voice-note transcription — which may process the message outside South Africa. No face data, ID numbers or photographs are ever sent to these services: only the message text or audio, plus (where needed) worker numbers and first names. Voice audio is transcribed and not stored.
How long it is kept
Your face template is deleted when you leave employment (after a short dispute buffer). Your time records are kept for at least 3 years as the law requires, then deleted.
Your rights
You may ask to see, correct or delete your information, or object to processing — at /popia/request. You may also complain to the Information Regulator (South Africa).
Contact
Operator: Werktyd — privacy@werktyd.co.za. Your employer is the Responsible Party; their Information Officer handles rights requests.