Privacy Policy

1. Data operator and contacts

The operator of the timeflow.biz website data is Khizmatrasonii Nav LLC, Dushanbe, Republic of Tajikistan.

For employee data processed in the mobile app and system, the operator is the employer organisation (for example, a university) that connected TimeFlow for its staff; the Company acts as a processor on its instructions and under contract.

For any data questions, write to info@hizmatrason.tj.

2. Scope of this Policy

The Policy covers all parts of the TimeFlow product:

• the timeflow.biz website (information pages and the request form);
• the TimeFlow mobile app for Android and iOS (com.hizmatrason.timeflow);
• face-recognition terminals, kiosks and the server side of the system.

3. What data we collect on the website

• Contact details from the request form: name, organisation name, phone number, email address and message text.
• Anonymised technical visit data: device type, browser, operating system, language, page, referrer and approximate region (from IP, without storing the IP itself).

4. Data collected by the mobile app and system

• Biometric data — a facial image and derived biometric template used to recognise an employee at check-in.
• Location data — the device’s precise location, including in the background (background location permission) — detailed in section 5.
• Camera access — to capture the face for check-in and enrolment.
• Time-tracking data — check-in/out records, time, place, shift, late and overtime statuses, explanations.
• Device technical data — model, OS version, app version, technical identifiers and a push token for notifications.

5. Location data: how and why we use it

The TimeFlow mobile app requests access to the device’s location, including access in the background (background / BACKGROUND_LOCATION permission), for the following time-tracking purposes:

• Geo-verification of check-ins — confirming that a check-in or check-out was made at the workplace agreed with the employer.
• Field-employee geotracking — showing a live location map and movement history during the working day for employees whose work involves travel.

6. Background location access and consent (Prominent Disclosure)

Background location access (when the app is minimised or the screen is off) is used only for field-employee geotracking and is enabled ONLY when both conditions are met: (1) the employer has enabled geotracking for the employee and (2) the employee has granted background location permission in the device settings.

Before the first access to location, including background, the app shows a prominent disclosure explaining what location data is collected, why, and that collection may continue in the background, and asks for the employee’s explicit consent.

The employee may decline location access or revoke it at any time in the device settings. In that case geo-verification and geotracking become unavailable, while the rest of the app keeps working.

Location data is available only to the employee’s employer; we do not sell it, do not share it with advertising networks or data brokers, and do not use it for advertising.

7. Biometric data and consent

The facial image and biometric template are processed solely to identify an employee at check-in and on the employer’s instructions. They are stored in the organisation’s separate protected system, are not shared with third parties other than the employer, and are not used for any other purpose. An employee may withdraw consent via the employer; after withdrawal the biometric data is deleted or anonymised.

8. Purposes and grounds of processing

• Time tracking, calculation of lateness and overtime, timesheets and discipline control — based on the employment relationship, the employer’s instruction and the employee’s consent.
• Handling website requests — based on your consent and pre-contractual steps.
• Improving the website and anonymised traffic analysis — based on legitimate interest.

9. Sharing with third parties

We do not sell personal data. Employee data (including biometrics and location) is available only to their employer — the client organisation that connected TimeFlow. Web analytics services (Google Analytics, Yandex Metrica) may be used to analyse website traffic, processing anonymised data on their side under their own policies. Data may be disclosed only upon a lawful request of the authorised state bodies in cases provided for by law. The app does not share location data or biometrics with advertising networks or data brokers.

10. Retention and security

Employee data is kept for the duration of the employment relationship and to the extent required by the employer, after which it is deleted or anonymised. Website requests are kept for the period needed to handle them. We apply organisational and technical safeguards: channel encryption (HTTPS/TLS), access control, a separate database per organisation and storing passwords as cryptographic hashes.

11. Your rights

• Obtain information about the processing of your data and request its correction, blocking or deletion.
• Withdraw consent, including consent to location and biometric processing — via the employer or by writing to info@hizmatrason.tj.

12. Children

The TimeFlow product is intended for employee time tracking and is not directed to children under 16; we do not knowingly collect children’s data.

13. Changes and contacts

We may update this Policy; a new version takes effect upon publication on timeflow.biz. For privacy questions, write to info@hizmatrason.tj.