Privacy Policy
Last updated: 30 October 2026
What personal information this software processes
- Identity & contact details — name, email address, phone number.
- Employment details — role, department, shift, employee number, leave balances and history.
- Attendance data — clock in/out times, location (if GPS capture is enabled), a photo (if photo capture is enabled).
- Biometric device reference — a Device ID (a number) linking an employee to a fingerprint/face scan on physical hardware. The actual fingerprint or face template is never stored in Pixel Time itself — it stays on the physical device. This is still "biometric information" under POPIA Section 26 in terms of the overall system, which is why explicit consent is required before enrollment (see below).
- Any custom fields a Customer has chosen to add (e.g. ID number, banking details) — entirely at that Customer's discretion, not required by Pixel Time itself.
Why this information is collected
Solely to provide time & attendance management for the Customer's business: recording hours worked, managing leave, producing payroll-ready exports, and the other core functions of the software. Data is not used for any other purpose, and is not sold or shared with third parties beyond what's needed to operate the software itself (e.g. sending an email notification).
Biometric consent
Because biometric information carries extra protection under POPIA Section 26, Pixel Time requires an admin to explicitly confirm that an employee's written consent was obtained before that employee's Device ID is linked to a fingerprint/face terminal — this is recorded (who confirmed it, and when) and is a mandatory step, not optional. A printable consent form for employees to sign is available to admins from Team.
How long information is kept
South African law sets minimum retention periods that apply regardless of what any individual would prefer — Pixel Time doesn't automatically delete data before these periods, since doing so could itself be a compliance problem for the Customer:
- The Basic Conditions of Employment Act (BCEA) requires certain employment records to be kept for 3 years after employment ends.
- SARS requires payroll and tax-relevant records to be kept for 5 years.
After these periods, a Customer may request deletion — see below.
Your rights (if you're an employee)
Under POPIA, you have the right to know what information is held about you, request a copy of it, request correction of inaccurate information, and request deletion once any legally required retention period has passed. Since your employer is the Responsible Party, these requests should go to them first. If you're unable to reach them, you can contact Pixel Plus IT and we'll assist in routing the request: see Contact us.
Security measures
- Multi-factor authentication is mandatory for every web login and cannot be disabled.
- Passwords and PINs are stored using industry-standard one-way hashing (bcrypt), never in plain text.
- Every meaningful action (data access, exports, deletions, approvals) is recorded in an audit log.
- Clock-in photos and uploaded documents are served only through access-controlled pages, never as direct public files.
- Login attempts are rate-limited to prevent automated password-guessing.
Data export and deletion
Admins can export their company's full data, or an individual employee's data, at any time from Settings. Deleting a company's workspace entirely is possible from Settings, with a clear warning about the retention periods above before proceeding.
Contact
For any privacy-related question, contact us — support and privacy requests are handled by email only, at pos@positive-sa.co.za.
This Privacy Policy is part of, and should be read alongside, the Software License Agreement.