Data processing terms

Last updated 13 October 2026

These terms say what we do with the personal data inside a company's DutyTick account, what we will not do with it, who else touches it, how long it is kept, and what happens when the account closes. They are written to be read by the company buying DutyTick rather than by a lawyer, and they are meant to be the honest version rather than the broad one.

DutyTick is operated by Hardcode Consulting Private Limited, a company registered in India. In these terms we and us mean that company, and you means the company using DutyTick for its people.

Where you have a written agreement with us, these terms form part of it. Where you do not yet, they still describe what we actually do, which is the point of publishing them.

Who decides what

You decide. The employee data in your account is yours: you decide what goes in, who may see it, and what it is used for. Under the Digital Personal Data Protection Act, 2023 you are the data fiduciary for it, and where the GDPR applies you are the controller. We process it on your instructions and we are your processor.

Your instructions are the product. Configuring a role, inviting a person, switching a feature on, running a report: that is how an instruction reaches us. We do not act outside them, and if we were ever asked to do something we thought unlawful we would say so rather than quietly do it.

Two things in your account are our own decision rather than yours, and it is better to say so plainly than to file them under "as instructed".

The first is the audit trail

Every request anybody makes is recorded, including requests that were refused, and including where the person was when they made it. You cannot configure it and you cannot switch it off. It is how the platform stays accountable, to you and to us, and a log a customer could disable would be worth nothing. What it holds, and what a person recorded in it is entitled to know, is set out in full on the page written for the people who use DutyTick, and we expect you to point your employees at it.

The second is keeping the service running

Bounce and complaint records, suppressed addresses, counts, and the operational signals that keep email delivering are ours and survive your account. They describe behaviour rather than people, except for a suppressed address, which is kept precisely so that it is never contacted again.

What we process

Whatever you put in. In practice that means:

• Employee records: name, employee code, work email, designation, department, office, joining date, and the custom fields you add.
• Attendance and leave: punch times, the channel used, approvals, balances and the reasons given.
• Documents you or your employees upload.
• Sign-in and session records for everybody in your account, including the device and the address they came from.
• The audit trail, described above.
• Where you use DutyTick Send, the addresses you send to, the content of those messages, and what the receiving mail servers said about them.

Your own account and billing contacts are a separate matter. Those we hold as fiduciary in our own right, not as your processor, and the privacy policy covers them.

What we do not do with it

• We do not use it for our own purposes. Not for research, not for benchmarks, not to build or improve a model for anybody else.
• We do not sell it, rent it or share it for anyone else's marketing.
• We do not merge it with another customer's data. An account is separated structurally rather than by a filter we remember to apply.
• We do not read your employees' records to find things out. Our access exists to run and support the service, nothing is reached without a reason, and every read is in the same audit trail as yours.

Who else touches it

A small number of companies, each doing one job. They are named, with what they do and where they do it, on the subprocessors page. That page is the list, it is kept current rather than drafted once, and before a new company starts handling your data we update it and write to your account's administrator.

Each of them acts on our instructions and for the purposes on that page only. We stay responsible to you for what they do.

Where it is

Today DutyTick runs on one deployment, and that deployment is in the European Union, in Finland. Our central systems, which hold accounts and billing and no workforce data, run in the same place.

Where your employee data sits, and where it is processed, is set in your agreement with us rather than by a default we apply to everyone. The product is built so that a residency promise is structural: the data lives on the deployment attached to your offices, and the server names claim no country, because a hostname is not a guarantee. If you need a specific country or region, that is a conversation before you buy rather than a setting afterwards.

What leaves, and why

Email. Outbound messages are delivered by a provider processing them in the United States, so a recipient's name and address and the contents of the message are handled there. The same provider holds uploaded documents and serves the application itself.

Under the Digital Personal Data Protection Act, 2023 a transfer is permitted except to a country the Government of India has notified against, and none of these are. Where the GDPR applies, that provider contracts on the European Commission's standard contractual clauses.

The bot check in front of sign-in runs at the edge of a global network, so the address a sign-in came from is seen wherever the visitor is nearest to. It sees an address and a browser, never your data.

Security

What is true today, rather than what we intend:

• Everything is served over TLS. Nothing about DutyTick is reachable without it.
• Passwords are stored hashed and are not recoverable by us. Tokens, codes and bank numbers never reach a log or an audit entry: they are dropped rather than masked, and a bank number becomes its last four digits and a hash.
• Administrative access requires a second factor and a registered device key.
• Who may do what is decided by roles you configure, enforced on every request on the server rather than by hiding a button.
• Uploaded documents are private objects. A link to one is signed, short-lived and issued to a person who is allowed to see it.
• The audit trail refuses an update or a delete in the database itself, and is sealed into a hash chain every sixty seconds. An altered row, a deleted row and a chain relinked around a change are each detectable. Neither you nor we can quietly rewrite what happened.
• Each deployment pins its newest chain hash with our central systems hourly, and holds theirs, so neither side can rewrite its own history alone.

We hold no security certifications. SOC 2 and ISO 27001 are planned and claiming them before they exist would be worse than not having them.

If something goes wrong

If we become aware of a breach affecting your data we tell your account's administrator without undue delay, and we tell them what we actually know: what happened, which data was involved, what we have done, and what is still unknown. We would rather send an incomplete notice early than a tidy one late.

We help you meet your own obligations, including to the Data Protection Board of India or to a supervisory authority under the GDPR, and we will give you what we hold that bears on it.

How long things are kept

While your account is open, your data stays until you delete it, except where the product has a retention period of its own. Those are:

Audit entries for ordinary reads

Ninety days.

Audit entries for reading the audit trail itself

Two years. Somebody reading the log is often checking whether they were caught, so that reading is kept longer than an ordinary one.

Audit entries for anything that changed something

Seven years.

The body of a message sent through DutyTick Send

Seven days after the send.

The record of that message, its recipients and what happened to them

Ninety days, counted from the message rather than from each event, so a bounce that arrives late goes with its message instead of outliving it.

The receiving provider's own report on a message

Six months, detached from the message rather than deleted, because it is the evidence a deliverability dispute is argued from.

A suppressed address

Indefinitely. This is the one record a deletion request does not remove, because removing it would let that address be contacted again.

Some records carry statutory retention periods, payroll among them, which override a deletion request for as long as the law says so.

Closing the account

Closure is two acts, ninety days apart. Asking for it puts the account into closing: your administrator keeps signing in and can withdraw the request, everybody else is signed out, and the service stops acting for you. Ninety days later the tenant is deleted on the deployment and then centrally.

What survives deletion, and why:

• The audit trail, under the retention periods above. It is the record of what was done, and deleting it on request would make it worthless.
• Suppressed addresses and the deliverability state behind them. An address that asked never to be contacted again is not re-enabled by a company leaving, and a company proving the same domain again inherits them.
• Your purchases, collections and refunds, which are accounting records.
• The account row itself, marked closed.

Everything else that describes your people goes. Ask us before the ninety days are up and we will give you a copy of what you hold.

What is yours to do

We can only be a good processor of data you were entitled to give us. So:

• You need a lawful basis for holding your employees' data and for whatever monitoring you switch on. In most places employment and legitimate interest cover attendance; in some they do not, and consent or a works council agreement is needed.
• You have to tell your people. The page written for them exists so that you can point at it rather than write one, and it is not a substitute for your own notice.
• Local law on monitoring employees is yours to comply with. We provide the switches and the record; we do not advise on whether you may use them where you are.
• Who you make an administrator is your decision, and an administrator can see the whole organisation.
• Keep your own access safe. We cannot tell a stolen session from a real one beyond what the second factor and the device key already do.
• Do not put data into DutyTick that you are not entitled to put into third party software. If you are unsure, ask your own advisers before you load it.

Requests from your own people

An employee asking to see, correct or delete what is held about them is asking you, because you decide what is held. If one writes to us instead we will not answer for you: we tell them to ask you, and we tell you they asked. Where you need our help to answer, ask and you will get it.

Changes

If these terms change materially the date at the top changes and we tell your account's administrator. We will not narrow what we promise here quietly.

Contact

Hardcode Consulting Private Limited
CIN U58200OD2024PTC047252
hi@dutytick.com