Version 2026-09-14
Privacy Policy
How personal information is used, who handles it and how to exercise your rights.
On this page
1. Who we are
Timepunch is provided by LUNA PARK IT DEVELOPMENT D.O.O. BEOGRAD-NOVI BEOGRAD, a limited liability company registered in Serbia. Our registered office is Novi Beograd, Bulevar Zorana Đinđića 74/2, Serbia. Our tax identification number (PIB / TIN) is 113841152.
For questions about personal data or to exercise your privacy rights, contact [email protected].
This policy covers our website, accounts and service. If your employer or another organisation gives you access to Timepunch, its own privacy information also applies to how it uses your data.
2. Our role and your organisation's role
Your organisation decides why employee information is entered, which employment rules apply and who has access. For that processing, it is the data controller, and we process employee data on its behalf to provide the service under the Data processing agreement.
We are a controller for separate purposes that we determine ourselves, such as managing our business relationship with Customers, handling enquiries, meeting our own accounting obligations and protecting the service. Our role depends on the purpose of the activity, not simply on who created the account.
For requests concerning employment records, we normally act on your organisation's instructions. You can contact your organisation directly or contact us so that we can help route the request. This does not prevent you from exercising rights that apply directly against us.
3. Information processed
Depending on how you and your organisation use Timepunch, information may include:
- names, email addresses, company details and account information;
- team membership, permissions, employment start dates and working arrangements;
- time-off rules, requests, decisions, dates, durations, balances and related comments;
- messages sent to support and information needed to respond;
- subscription, transaction and billing contact information received in connection with purchases;
- technical information, such as sign-in IP addresses, session identifiers, request information and error diagnostics.
We receive information from you, from the organisation managing your workspace, through operation of the service and, for billing, from the payment provider.
Sick-leave records or free-text comments may reveal health information. Organisations must have an appropriate basis for processing such information and limit it to what is needed. Do not include diagnoses or other unnecessary sensitive details in comments.
4. Purposes and legal grounds
We process workspace data to operate the features requested by the Customer, including applying its rules, handling requests, maintaining calendars and balances, and delivering related notifications. The Customer determines the lawful grounds for the employee-data processing it instructs us to carry out.
For processing where we are a controller, the legal ground depends on the activity:
- performance of a direct contract with an individual, where the processing is necessary for that contract;
- legitimate interests in communicating with business representatives, responding to enquiries, operating a reliable service and preventing abuse, subject to the rights and interests of the people concerned;
- legal obligations, including applicable accounting and disclosure requirements;
- consent for optional activities where consent is required. Any such request identifies its purpose separately, and consent can be withdrawn.
Accepting the Terms is not blanket consent to marketing or to every use of employee data.
5. Who receives information
Within a workspace, access depends on your organisation's assigned roles and permissions. External providers perform specific functions:
- Railway — application and database hosting;
- Cloudflare — traffic delivery and security;
- Resend — delivery of service emails, including their recipient addresses and message content;
- Sentry — error monitoring and diagnostics when enabled;
- Polar — subscription transactions and billing for purchases through Polar, acting as Merchant of Record;
- Google Fonts — font delivery on pages that load fonts from Google.
Their functions and legal roles are not identical. In particular, the Merchant of Record may process transaction information for its own legal obligations. Relevant provider terms and privacy information apply to those activities.
Information may also be disclosed where required by law or where necessary to establish, exercise or defend legal claims. Such disclosures must be limited to the information relevant to the purpose.
6. Hosting and international processing
Our application and primary PostgreSQL hosting region is Amsterdam, the Netherlands. Our service provider company is established in Serbia. External providers and authorised access can involve processing in other countries; the hosting region is not a promise that all information remains exclusively in the Netherlands.
Where applicable law requires safeguards for a transfer, the relevant safeguards must be established before that transfer takes place. Depending on the actual parties and processing, these may include an applicable adequacy decision or contractual safeguards with any necessary additional measures. Contact [email protected] for information about the arrangements relevant to your data and how to obtain a copy of the applicable safeguards.
7. How long information is kept
Workspace data is retained to provide the service according to the Customer's instructions. After service ends, the Customer has 30 days to export its data. Deletion of workspace data, including backup copies, is completed no later than 60 days after service ends. Cancelling renewal does not start this period before the end of paid access.
Earlier return or deletion requests are handled under the data processing agreement and law. We may retain records needed to meet our own legal obligations separately, for the relevant obligation, rather than retaining an entire workspace.
For separate account, support and security purposes, retention depends on the purpose: maintaining active access, resolving an enquiry or incident, and meeting applicable legal or record-keeping obligations. Such records must be removed when no longer needed for that purpose; they are not a basis for indefinite retention of employee records. You can ask us about the retention arrangements applicable to a particular record.
Deactivating an employee's access is different from ending service to the Customer. Your organisation may still need to keep employment records and is responsible for determining its lawful retention requirements.
9. Security
Account authentication, encrypted web connections and role-based permissions help protect workspace information. We must also maintain operational measures appropriate to the processing, including access control, incident handling and protection of retained copies. No online service can guarantee absolute security.
If you believe your account or personal information has been compromised, contact [email protected] promptly.
10. Your rights
Depending on the applicable law and circumstances, you may have rights to access and correct your personal data, request erasure or restriction, object to processing, obtain portable data and withdraw consent where processing is based on consent. These rights are not absolute; some information may need to be retained to meet a legal obligation.
Contact [email protected] with your request. We may need to verify your identity and your relationship to the data before taking action. For employment records controlled by your organisation, we help it respond rather than changing its records without the necessary authority.
You can also complain to a competent data protection authority, including the Commissioner for Information of Public Importance and Personal Data Protection in Serbia, or an authority available to you under applicable law. The governing-law clause in our Terms of Service does not take away these rights.
Questions? Contact [email protected].