Privacy Policy
This Privacy Policy explains how SIA DeskTime ("DeskTime", "we", "us", "our") processes personal data when an individual ("you") uses the DeskTime.com website, DeskTime real-time productivity and time tracking service, and any related services ("Services"). This Privacy Policy applies to individuals who interact with DeskTime in their own capacity, use our Services for individual needs, visit our website, and communicate with us directly.
1. Introduction
1.1 DeskTime shall process Personal Data in accordance with applicable data protection laws and in respect of Data Subjects within the European Economic Area ("EEA") DeskTime shall comply with requirements of European Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regards to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ("GDPR").
1.2 In this Privacy Policy, the term "DeskTime" refers to SIA DeskTime, a company registered in the Republic of Latvia, registration number: 40203168348, address: Ojāra Vācieša street 6B, LV-1004, Riga, Latvia.
1.3 The terms "Personal Data", "Data Subject", "Processing", "Controller", "Processor", and "Supervisory Authority" as used in this Privacy Policy shall have the same meanings as given in the GDPR.
2. Our Role
2.1 For the purposes described in this Privacy Policy, DeskTime acts as a data controller. This means that we determine the purposes and means of processing personal data covered by this Privacy Policy.
2.2 If you use the Services for your own personal purposes (for example, as a freelancer or an individual registering independently), you are considered a user of the Services in your own capacity, and DeskTime acts as the controller of your personal data in accordance with this Privacy Policy.
2.3 However, where the Services are used by a company, organization, or other legal entity ("Client") that creates an account and enables access for end-users (such as employees or other individuals), DeskTime acts as a data processor on behalf of the Client. In such cases, the Client acts as the data controller and determines the purposes and means of processing end-user personal data, and the applicable privacy policy of the Client will govern such processing rather than this Privacy Policy. The processing of such data by DeskTime is governed by a Data Processing Agreement (DPA), which forms an integral part of the Terms of Service.
3. What Information Do We Process?
3.1 We collect and process personal data that you provide directly to us, as well as data generated through your use of the Services and data collected automatically through technical means.
3.2 Please note that some options within the Service allow you to voluntarily disclose your personal data, such as adding your photo or any data that you enter in notes, and some special category data (for example, data concerning health as the reason for absence when using the Absence Calendar feature). DeskTime does not require you to submit such data, as it is not essential to the provision of the Service, and you may use the Service without providing it.
Registration
3.3 When you register with us and create a DeskTime account, we will process the following information:
3.4 The legal basis for this processing is the performance of a contract between you and DeskTime, or the taking of steps at your request prior to entering into such a contract.
Using the Services
3.5 When you use our Services or adjust your account settings (for example, set preferences, subscription details, and other configuration choices), we process various types of personal data. The scope of information collected and processed may vary depending on the configuration of the system and the features you have enabled.
3.6 By taking actions such as uploading a profile photo, entering notes (which, depending on how you use them, may include special category data such as health data), using the absence calendar, and adding "away time", you are actively providing this information in your DeskTime account. We do not require you to submit such data as it is not essential for providing our Services, and the Services are available without providing us with the aforementioned data. Therefore, please note that you can delete this information at any time.
3.7 Generally, during the use of our Services, we may process the following information:
Full name
Email address
Payment information
Photo (voluntary)
Location, time zone, IP address
Start and end time of use, work duration, working days, time spent on breaks, hourly rate, and absence calendar
Offline time input options, private time input options
Names of applications used, names of tasks worked on, and websites visited
Screenshots of your computer screen (if enabled)
Number of keystrokes or mouse movements
Employee pay (when using the project cost calculation tool)
3.8 The legal basis for this processing is the performance of a contract between you and DeskTime, or the taking of steps at your request prior to entering into such a contract.
Providing customer support and resolving disputes
3.9 We process certain personal data when you contact us or when we assist you through our customer support services to address concerns or answer inquiries. We may process:
3.10 The legal basis for this processing is our legitimate interest to respond to your inquiries, provide support and resolve issues, as well as evaluate the quality of our support.
Processing payments
3.11 To send you invoices, process payments for the Service, refunds, and other transactions, as well as to manage account billing, we process the following information:
3.12 The legal basis for this processing is performance of a contract between you and DeskTime, and compliance with legal obligations related to accounting and taxation.
Marketing and news communication
3.13 If you have agreed to receive marketing communication, discount offers, and personalized content from DeskTime, we may process your e-mail address to send you such updates and share your personal data with our marketing service providers, including Google. Please note that the data will be shared in hashed format to ensure enhanced protection of your privacy. When you subscribe to our blog or newsletter, we will process your e-mail address to send you informative materials, such as newsletters and advertisements. At any point in time, you can unsubscribe from receiving the above-mentioned information by clicking the "Unsubscribe" link included in the footer of each email. For these purposes, we may use:
3.14 We process this information based on your consent to receive marketing communications and updates.
3.15 Separately, we may send you important service-related communications, such as system updates, new features, security notifications, and other information necessary for the proper use of the Services. Such communications are based on our legitimate interests in ensuring the effective operation, security, and continuous improvement of the Services and are not considered direct marketing.
Analytics, development, and improvement of our Services
3.16 We process certain data to monitor and analyze system performance, detect errors, prevent fraud or misuse, maintain the integrity and security of our systems, and ensure the proper functioning of the Services. We may also analyze how our Services are used to improve them, develop new features, enhance the user experience, measure the effectiveness of our marketing activities, and track their conversion. For this purpose, we may process:
Browser type and browser software version
Device information
DeskTime client version, the path to the application
IP address
Usage logs, error reports, and other technical data
3.17 We process this information based on our legitimate interests, including maintaining and improving our Services, ensuring security and stability, better user experience, developing new features and solutions, and analyzing our Services.
Resolving issues and disputes
3.18 In certain situations where it is reasonably required, we may process your personal data to exercise or defend our legal rights, including enforcing contractual obligations, preventing or detecting fraud, or handling disputes of any kind. We may also process your personal data when necessary to comply with applicable legal or regulatory requirements and to cooperate with law enforcement authorities. For these purposes, we may process:
Full name
Email address and postal address
Account information or any other related data, which may be required for this purpose
3.19 We will process this data based on our legitimate interest in safeguarding our legal rights and resolving any disputes or legal issues, as well as to comply with applicable legal or regulatory requirements, including cooperating with law enforcement authorities.
Interacting with our website
3.20 When you visit the DeskTime website, we may automatically collect and process information that may contain your personal data, such as:
Device identifiers and browser user agent
IP address
Pages you access
Your location, based on IP address
Other information collected from cookies and similar technology we use on our website
Learn more about how we use cookies on our website by reading our Cookie Policy.
4. Third-Party Integrations
4.1 You can connect certain third-party services to your DeskTime account to enhance the functionality of the Services. These are external applications or platforms that can integrate with DeskTime, and you can choose to enable or disable each integration at any time.
4.2 When you enable a third-party integration, the service may share certain information with DeskTime. For example, if you sign up using a social media account like Microsoft, Google, Apple, or LinkedIn, we may receive your name, email address, or user ID from that service. Similarly, if you connect a calendar or project management tool, we may receive information from that software that you have allowed to share with DeskTime. We encourage you to review the privacy policies and settings of any third-party services you use to understand how they handle your personal data.
5. Retention Period
5.1 We retain personal data associated with your account for as long as you maintain your DeskTime account or as otherwise necessary for us to provide you with the Service.
5.2 We retain data created by you during your use of the Service for 13 months. Data relating to clock-in and clock-out times and breaks, where such data is not accompanied by app data, document data, or other productivity-related information, is retained for 3 years. After this period, such data is scheduled for deletion or anonymization, and will be fully removed once the deletion process is completed. Please note that, due to the nature of backup systems, some data may temporarily remain in backups, but will be securely deleted in the course of a regular backup cycle.
5.3 After you terminate your relationship with us by deleting your DeskTime account or otherwise terminating the contract for DeskTime Service, we may continue to store certain information as reasonably necessary to comply with our legal obligations (including, but not limited to information relating to payment), to resolve disputes, if any, to prevent fraud and abuse, to enforce our agreement, and/or to protect our legitimate interests. Such data will be deleted or anonymized once it is no longer required for these purposes.
6. Sharing Data With Third Parties
6.1 We may share your personal data with third parties (processors), such as data hosting, communication, content delivery, cybersecurity service providers, email and other messaging and monitoring services, IT, legal, and financial service providers, and others who reasonably need it when they provide certain services to us.
6.2 Third-party service providers may receive and use only the minimum amount of personal data required, depending on their specific function and purpose, to help provide and improve our Services. We will only share personal data with third-party service providers committed to complying with their obligations under applicable data protection laws.
6.3 We may transfer your personal data to third-party service providers outside the EEA. Where such transfers take place, we ensure that they are carried out in compliance with applicable GDPR provisions and that an adequate level of protection is afforded to your personal data. This includes, where applicable, relying on adequacy decisions adopted by the European Commission, entering into Standard Contractual Clauses (SCCs), or implementing other appropriate safeguards recognized under GDPR, such as approved codes of conduct or certification mechanisms. In all cases, we ensure that recipients are subject to appropriate contractual and organizational obligations to protect personal data and process it only in accordance with our instructions and applicable law.
6.4 In certain situations, we have a legal obligation to disclose your information to third parties, if required by law, or to request information from public authorities under applicable laws and regulations.
6.5 We may share your information with third parties when it is in our legitimate interest, e.g., to our parent company, subsidiaries, affiliates, distributors, and resellers, for the provision of Services and other purposes as described in this Privacy Policy. We may also share your personal data in case of a merger, sale of assets, transfer of undertaking, where personal data is part of assets subject to such transactions, or otherwise restructuring the provision of our Services.
7. Your Rights
7.1 As a data subject, you have certain statutory rights regarding your personal data. Subject to any exemptions provided by law, you may have the right to request access to your personal data, to seek to update, delete, or correct your data, to restrict or object to the processing of your data, as well as the right to portability of your personal data. You can use these rights by contacting DeskTime.
7.2 If you believe that DeskTime has unlawfully processed your personal data, you have the right to submit a complaint to DeskTime, or you may submit a complaint to a respective data protection supervisory authority in your country.
7.3 If you are an individual whose personal data has been provided to DeskTime by our Client (e.g., you are an employee of our Client), please contact the respective Client to exercise your rights.
8. Security
8.1 We take the security of your personal data seriously and implement appropriate technical and organizational security measures to protect it in line with applicable data protection laws. Our approach to information security follows recognized industry standards, and DeskTime is certified under ISO/IEC 27001, reflecting our commitment to maintaining a high level of data protection.
8.2 Access to personal data is limited to authorized personnel who need it to perform their duties. All such personnel are subject to strict confidentiality obligations and are not permitted to access or process personal data without proper authorization.
9. Privacy Policy Changes
9.1 We may occasionally amend this Privacy Policy, for example, when we introduce new services or new features. The amendments to this Privacy Policy enter into force once uploaded to our website.
