If your employer uses DutyTick

Last updated 13 October 2026

This page is for the person signing in, not for the company that bought the software. It says what DutyTick records about you, how exact it is, who can see it, how long it is kept, and who to ask about it. Nothing here is hidden in a longer document somewhere else.

DutyTick is made by Hardcode Consulting Private Limited, a company registered in India. Your employer decides what goes into their account and who may see it. We hold it for them and act on their instructions. In the words the law uses, they are the data fiduciary and we are their processor, which matters mostly for one practical reason: most questions about your own record are theirs to answer rather than ours.

What is in your record

Whatever your employer puts there. Typically your name, employee code, work email, designation, department, office and joining date, plus any fields the company has added. Then whatever the company uses DutyTick for: your attendance, your leave requests and their approvals, and documents either of you uploaded.

You can read your own profile and correct what your employer lets you correct. Where a change needs approving, you ask and a manager approves, and both the asking and the approving are recorded.

Everything you do is recorded

Not just changes. Every request your browser makes to DutyTick becomes an entry in an audit trail: who you are, what you asked for, when, and what the answer was. A refusal is recorded too, so an attempt to open something you are not allowed to open is an entry exactly as a successful one is.

This is deliberate and it applies to everybody, your administrators and us included. A payroll figure or a leave balance that somebody changed has to be answerable later, and the only way that works is if the record is made without anybody choosing to make it.

Passwords, codes and tokens never reach it. They are dropped rather than hidden. A bank account number becomes its last four digits and a scrambled value that cannot be turned back.

Where you were

This is the part most people do not expect, so it is set out in full.

Your network address, always

Every request carries the address your internet connection is using, and that address is recorded. We look it up in a database of addresses and record the city and the network it says, which is how a sign-in from somewhere unusual can be noticed at all.

It is often wrong about the city. The office this was built in resolves to a town two hundred kilometres away. A mobile connection can appear to be in another state entirely. Treat a city in this log as a hint and never as a fact about where somebody was.

Your device's own position, only if you allow it

After you sign in, DutyTick asks once whether it may use your device's location. If you say no, that is final: this browser is never asked again and no position is ever recorded from it. If your browser is already set to refuse location, we do not even ask.

If you allow it, your browser hands over a latitude, a longitude and its own estimate of how far off it might be, and that goes with your sign-in, your second factor and each time your session is renewed. Your browser is in charge of that permission and you can withdraw it in your browser's own settings at any time.

How exact it is depends entirely on your device. A reading recorded here while this was being built was correct to within 134 kilometres, which placed the person in the right city and nothing finer. A phone with its satellite positioning on can be much more exact. DutyTick records what the browser claims, including the accuracy figure, and does not improve on it.

A third figure, worked out rather than measured

Where several devices agreeing on a position have recently been seen on the same network address, that is recorded as well, as a better guess about where that address is than the address database gives. Addresses belonging to mobile networks are deliberately left out of this, because one person on a mobile network sharing their location would otherwise place everybody else on that network in the same spot.

You can see your own

Open your profile and then Sessions. Every session you have is listed with the device, the network address and the place it was put, with the same warning about how approximate a place is. You can end any of them, or all of them except the one you are using.

The record cannot be quietly changed

The audit trail refuses to be edited or deleted, in the database itself rather than by a rule somebody could switch off. Every sixty seconds it is sealed into a chain of signatures, so that altering a row, removing one, or relinking the chain around a change can each be detected afterwards.

That protects you as much as anybody. A record of what you did, and of what was done to your record, is only worth something if nobody can tidy it up later, and that includes your employer and includes us.

Who can see it

Inside your employer's account, your employer decides, through roles they configure. Normally you see your own record, your manager sees their team, and an administrator sees the organisation. Reading the audit trail is itself a privilege your employer grants to particular people, and reading it is recorded and kept for two years rather than ninety days, because somebody reading a log is often checking whether they were caught.

On our side, access is limited to the people who need it to run and support the service, and their reads land in the same audit trail as everybody else's.

We do not sell it, we do not use it for advertising, we do not profile you, and we do not use anything in your employer's account to build or improve anything for anybody else.

How long it is kept

Your record, your attendance and your leave

For as long as your employer keeps them, which is their decision and in some cases their legal obligation. Payroll records in particular carry retention periods set by law.

Ordinary entries in the audit trail, including the places above

Ninety days.

Entries recording that somebody read the audit trail

Two years.

Entries recording something that changed

Seven years.

If your employer closes their account

Ninety days later everything describing you is deleted, except the audit trail under the periods above and a few records that exist to stop mistakes being repeated, such as an email address that asked never to be contacted again.

Asking about it

Ask your employer first. They decide what is held about you, so a request to see it, correct it, or have it removed is one they can actually answer, and under both the Indian and the European rules it is their obligation rather than ours.

Write to hi@dutytick.com anyway if you would rather start with us. We will not answer for your employer, and we will tell you who to ask and tell them that you asked.

If you are in India, the Digital Personal Data Protection Act, 2023 gives you the right to see what is held about you, to have it corrected, to have it erased where it is no longer needed, to withdraw consent you gave, and to nominate somebody to act for you. You can complain to the Data Protection Board of India. If you are in the EEA or the UK, the equivalent rights under the GDPR apply and your local supervisory authority takes complaints.

Related

The privacy policy covers this website and anybody who contacts us directly. The data processing terms are what your employer agreed to, in more detail and in their language rather than yours. The subprocessors page names every other company that can touch any of this.

Contact

Hardcode Consulting Private Limited
CIN U58200OD2024PTC047252
hi@dutytick.com