Data processing terms
Last updated 12 November 2026
These terms apply when Renewminder Ltd processes personal data on behalf of a customer using ClockinBee. They form part of our terms of service and meet the requirements of Article 28 of the UK GDPR and EU GDPR, and section 21 of South Africa's POPIA.
1. Roles
The customer is the controller (the “responsible party” under POPIA) of the personal data it and its staff put into ClockinBee. Renewminder Ltd, a company registered in England and Wales (company number 16649489), whose registered office is at Dephna House, 7 Coronation Road, London NW10 7PQ (“we”) is the processor (the “operator” under POPIA).
2. Details of the processing
| Subject matter | Providing the ClockinBee service |
|---|---|
| Duration | For as long as the customer uses the service, plus up to 30 days to delete data after the account closes |
| Nature and purpose | Hosting, storing and processing time, leave, approval and employment data so the customer can manage working time and prepare payroll |
| Data subjects | The customer's employees, workers, contractors and managers |
| Personal data | Names, email addresses, job details, worker type, contract hours, employee numbers, pay rates and salaries, pay history, allowances, deductions and benefits, payslips, working time, location at the moment of clock-in where enabled, time off and audit records |
| Special category data | None intended. Some deductions the customer records could reveal trade union membership or health insurance; the customer decides whether to record them and is responsible for the condition it relies on. The customer should not record health or similar details in free-text notes. |
3. Our commitments
- We process personal data only on the customer's documented instructions, which are these terms and the customer's use and settings in ClockinBee, unless the law requires otherwise (in which case we'll tell the customer first unless the law forbids it).
- Everyone we authorise to process the data is bound by confidentiality.
- We apply appropriate technical and organisational security measures, described on our security page.
- We use subprocessors only under written contracts with equivalent protections. The current list is on our subprocessors page. We'll give at least 30 days' notice of a new subprocessor, and the customer may object on reasonable data protection grounds.
- We help the customer respond to requests from people using their rights, and with security, breach notification, impact assessments and consultations with regulators, as far as is reasonable.
- We tell the customer without undue delay, and within 48 hours where possible, after becoming aware of a personal data breach affecting its data, with the information it needs to meet its own obligations.
- When the service ends, we delete the customer's personal data within 30 days, unless the law requires us to keep it. The customer can export its data before then.
- We make available the information needed to show we meet these terms, and allow for reasonable audits, normally by providing written answers and documentation, with at least 30 days' notice and no more than once a year.
4. International transfers
Our database is hosted in the United Kingdom. Where a subprocessor handles data outside the UK or EEA, we rely on adequacy decisions, the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses.
5. Customer's commitments
The customer confirms it has a lawful basis for the processing, has told its staff about it (including any location check), and that its instructions comply with data protection law.
6. Signed copy
If you need a signed copy of these terms for your records, email info@renewminder.com or use our contact form.