Fareclock, Inc. Privacy Policy (DPF-Compliant)

Effective Date: December 2025

1. Introduction & Scope

Fareclock, LLC (“we,” “us,” “our”) is committed to protecting the privacy of individuals in the European Union (EU) and United Kingdom (UK), whose personal data we process. We comply with the EU–U.S. Data Privacy Framework (DPF) and the UK Extension.

We have self-certified to the U.S. Department of Commerce that we adhere to the DPF Principles. If there is any conflict between this policy and the DPF Principles, the DPF Principles govern.

This Privacy Policy describes the types of personal data we collect, how we use it, your rights, and how to contact us.

2. Covered Entity

This Privacy Policy applies to Fareclock, LLC, a U.S.-based company, and business activities covered by our DPF certification.

3. Personal Data We Collect

We collect and process the following categories of personal data:

Identity and Contact Information

Name
Email address
Employee identifiers
Account login information

Employment and Workforce Data

Role and department

Work location
Shift schedules
Time and attendance data
Payroll-related information
Manager-employee hierarchy information

Biometric Data

Face images used to verify employee identity when clocking into work

Device, Usage, and Log Data

IP address and device information
App usage logs
Support requests and communications

Customer Administrative Data

Billing information
Subscription records
Communications with customer administrators

4. Purposes for Processing

We process personal data for the following purposes:

Providing our time and attendance, scheduling, payroll, and HR software services
Verifying employee identity during clock-in
Delivering customer support and service notifications
System performance monitoring, fraud prevention, and security
Billing, invoicing, and financial operations
Compliance with legal obligations

We do not use personal data for purposes that are materially different from or incompatible with these purposes without first providing notice and, where required, obtaining consent.

5. Choice and Consent

We provide individuals with choices regarding how we use and disclose their personal data.

For certain categories of data, including biometric face images, we obtain affirmative, opt-in consent when required by law or when using the data for a new purpose.

Individuals may opt out of:

Disclosures to third parties not acting as agents
Uses of personal data for materially different or new purposes Requests may be submitted to the contact information in Section 13.

6. Onward Transfer to Third Parties

We may disclose personal data to third parties for the purposes described above. These include:

Service Providers / Processors

Cloud hosting platforms
Analytics and IT service providers
Customer support tools
Data security and monitoring services

Billing and Payments

Stripe (payment and billing processor)

Communication Providers

Twilio (SMS/voice communications)
Brevo (email communications)

All third parties that receive personal data must provide at least the same level of privacy protection as required by the DPF Principles. We remain responsible for their handling of your data unless we prove we are not responsible for an event giving rise to damage.

7. Data Security

We implement reasonable and appropriate administrative, technical, and physical safeguards to protect personal data against loss, misuse, unauthorized access, disclosure, alteration, or destruction.

Safeguards include encryption, access controls, employee training, and security monitoring.

8. Data Integrity and Retention

We limit the collection and processing of personal data to what is relevant for its intended purpose.

We retain personal data only for as long as necessary to provide our services, fulfill contractual and legal obligations, or for legitimate business needs.

We take reasonable steps to ensure that personal data is accurate, complete, and current.

9. Individual Rights: Access, Correction, and Deletion

Individuals whose data we process have the right to:

Request confirmation of whether we hold their personal data
Request access to their data
Request correction of inaccurate data
Request deletion of their data, subject to legal or contractual retention requirements

Requests may be submitted to the contact information below. We respond within the timeframes required by the DPF Principles.

10. Recourse, Enforcement, and Dispute Resolution

Fareclock, LLC complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, as set forth by the U.S. Department of Commerce. Fareclock, LLC has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. If there is any conflict between the terms in this privacy policy and the DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework Program (DPF Program), and to view our certification, please visit https://www.dataprivacyframework.gov/.

With respect to personal data received or transferred pursuant to the DPF Program, Fareclock, LLC is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission.

Pursuant to the DPF Program, EU and UK individuals have the right to obtain our confirmation of whether we maintain personal information relating to you in the United States. Upon request, we will provide you with access to the personal information that we hold about you. You may also correct, amend, or delete the personal information we hold about you. An individual who seeks access, or who seeks to correct, amend, or delete inaccurate data transferred to the United States in reliance on the DPF Program should direct their query to privacy@fareclock.com

If requested to remove data, we will respond within a reasonable timeframe.

We will provide an individual opt-out choice, or opt-in for sensitive data, before we share your data with third parties other than our agents, or before we use it for a purpose other than which it was originally collected or subsequently authorized. To request to limit the use and disclosure of your personal information, please submit a written request to privacy@fareclock.com

In certain situations, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

If you are an EU or UK Individual, where we transfer your personal data to third party service providers who perform services for us or on our behalf, we are responsible for the processing of that data by them and shall remain liable if they process your personal data in a manner inconsistent with the DPF Principles, unless we prove that we are not responsible for the event giving rise to the damage.

If you have a complaint regarding our compliance with the DPF, please contact us first so we may resolve it.

If we are unable to resolve a complaint, you may submit a complaint to our independent recourse mechanism:

BBB National Programs

DPF Dispute Resolution Program

In compliance with the DPF Principles, Fareclock, LLC commits to resolve DPF

Principles-related complaints about your privacy and our collection or use of your personal information. European Union and United Kingdom individuals with inquiries or complaints regarding our handling of personal data in reliance on the DPF should first contact Fareclock, LLC, using the information provided in the ‘Contact Information’ section of this policy.

Fareclock, LLC has further committed to refer unresolved DPF Principles-related complaints to a U.S.-based independent dispute resolution mechanism, BBB NATIONAL PROGRAMS. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed by us, please visit https://www.bbbprograms.org/dpf-complaints for more information and to file a complaint.

We will cooperate with this mechanism and comply with its decisions. This service is provided at no cost to you.

If still unresolved, you may have the option to invoke binding arbitration. If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms.

See https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction for more information on this process.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, Fareclock, LLC commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) with regard to unresolved complaints concerning our handling of human resources data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF in the context of the employment relationship.

11. Required Disclosures

We may disclose personal data in response to lawful requests from public authorities, including to meet national security or law enforcement requirements.

We will limit such disclosures to what is legally required.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When changes are made, we will revise the “Effective Date” above and post the updated version on our website.

13. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our DPF compliance, please contact:

Fareclock, LLC
Attn: Privacy Officer
Email: privacy@fareclock.com
Address: 2833 Smith Avenue # 422, Baltimore, MD 21209, US