Privacy Policy

1. Who We Are

Punchual acts as a data controller for our own operations and as a data processor on behalf of companies (our clients) who use Punchual to manage their employees' attendance data. Company administrators are the primary data controllers for their employees' records.

2. Data We Collect

From Company Administrators:

• Identity data — full name, email address, company name, designation
• Contact data — email address, phone number (if provided)
• Billing data — billing email, payment reference numbers (no card details — handled by Stripe)
• Company data — company name, SSM registration number, address, GPS office location

From Staff Members:

• Identity data — full name, email address, department, designation
• Contact data — WhatsApp number (optional)
• Location data — GPS coordinates at time of punch-in/out, rounded to approximately 1 km precision
• Biometric-adjacent data — selfie photograph taken at time of punch-in for visual identity verification
• Attendance data — date/time of attendance, leave records, absence reasons, overtime duration
• Gamification data — points earned, badges, level, attendance streaks (visible to company colleagues)
• Device data — language preference (stored locally on device only)

3. How We Use Your Data

• Attendance management — recording, verifying, and reporting employee attendance and overtime
• Account management — creating and managing your Punchual account
• Service provision — delivering all features of the platform
• Billing & payment — processing subscriptions and generating invoices
• Security & fraud prevention — preventing buddy punching and unauthorised access
• Leaderboard & gamification — showing staff rankings within your company
• Service improvement — aggregated, anonymised usage analytics
• Legal compliance — fulfilling obligations under applicable law
• Communication — sending service notifications and support responses

4. Legal Basis for Processing

• Contract performance — processing necessary to provide the service you contracted for
• Consent — location access and selfie capture require explicit in-app consent, recorded with a timestamp
• Legitimate interests — fraud prevention, service security, aggregated analytics
• Legal obligation — where required by Malaysian law or applicable regulations

5. Data Retention

6. Data Sharing & Disclosure

We do not sell, rent, or trade your personal data. We share data only with:

• Firebase / Google LLC (USA) — cloud database, authentication, and hosting. Google is our data processor under a Data Processing Agreement. Data may be stored on Google Cloud infrastructure globally.
• Stripe Inc. (USA) — payment processing for subscriptions. Stripe processes billing email and payment data under their own privacy policy and PCI-DSS compliance. We do not store full card details.
• Company administrators — attendance records, leave history, selfie thumbnails, and overtime data are visible to authorised admins within your company only.
• Company colleagues (leaderboard) — your display name, department, points, badges, and attendance streaks are visible to other staff in your company as part of the gamification leaderboard.
• Law enforcement — where required by a valid court order or applicable law enforcement authority.

7. Data Security

• Encryption in transit — all data transmitted via HTTPS/TLS encryption
• Encryption at rest — all data on Google Cloud (Firebase) is encrypted at rest using AES-256
• Role-based access controls — staff can only view their own records; admins are scoped to their own company's data only
• Server-side security rules — Firestore Security Rules enforce access control at database level
• Authentication — Firebase Authentication with email/password; ID tokens verified server-side on all sensitive operations
• Secrets management — all API keys and payment credentials stored in Firebase Secret Manager, never in application code

8. Your Rights (PDPA — Malaysian Users)

Under Malaysia's Personal Data Protection Act 2010, you have the right to:

• Access (Section 30) — request a copy of your personal data we hold
• Correction (Section 34) — request correction of inaccurate or incomplete data
• Withdraw Consent (Section 38) — withdraw consent for data processing at any time (may affect service functionality)
• Prevent Processing — object to processing that causes unwarranted damage
• Erasure — request deletion of your personal data, subject to legal retention obligations

To exercise any right, email punchup@magnusdigital.my with subject "PDPA Data Request". We will respond within 21 working days.

You may also lodge a complaint with the Department of Personal Data Protection Malaysia (JPDP) at www.pdp.gov.my.

9. Your Rights (GDPR — EU/UK Users)

If you are located in the European Union, EEA, or United Kingdom, the following rights apply under GDPR / UK GDPR:

• Right of Access (Art. 15) — request a copy of all personal data we hold about you
• Right to Rectification (Art. 16) — request correction of inaccurate data
• Right to Erasure / "Right to be Forgotten" (Art. 17) — request deletion where there is no overriding legitimate reason to continue processing
• Right to Restrict Processing (Art. 18) — request that we pause processing in certain circumstances
• Right to Data Portability (Art. 20) — receive your personal data in a machine-readable format
• Right to Object (Art. 21) — object to processing based on legitimate interests

Email punchup@magnusdigital.my with subject "GDPR Request". We will respond within 30 days.

You also have the right to lodge a complaint with your local supervisory authority — e.g. the ICO (UK), or your national Data Protection Authority within the EU.

10. International Data Transfers

Your data is processed on Google Cloud (Firebase) infrastructure. Google is certified under the EU-US Data Privacy Framework. Transfers of personal data outside the EEA are protected by Standard Contractual Clauses (SCCs) as required by GDPR.

Stripe Inc. (USA) processes payment data under their own adequacy mechanisms and PCI-DSS compliance framework.

11. Sensitive Data & Consent

Before collecting location data and selfie photographs, we obtain explicit in-app consent. Your consent is recorded with a timestamp.

You may withdraw consent at any time by:

• Revoking location and camera permissions in your device Settings
• Emailing punchup@magnusdigital.my to request account deletion and data erasure

Withdrawal of consent may prevent certain features from working (e.g. GPS attendance verification).

12. Children's Data

Punchual is intended for use by adults (18+) in a professional employment context. We do not knowingly collect data from individuals under 18. If you believe a minor's data has been collected, contact us immediately at punchup@magnusdigital.my.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered administrators by email and display an in-app notification for material changes. Continued use of the Service after changes constitutes acceptance of the updated Policy. Previous versions are available on request.

14. Contact Us