Privacy Policy

Who this policy is for

Link HR is a human-resources platform operated by LinkCo. Employers subscribe to it and enrol their staff; those employees then use the Link HR web app and the Link HR mobile app to clock in and out, request leave, view payslips and hold work conversations.

This policy covers all of that. It is written for the employee reading it, because the employee is the person whose data is involved and has the least say in the arrangement.

Your employer decides what is collected — we operate the system

Under Jordan's Personal Data Protection Law, your employer is the data controller and LinkCo is the data processor. That is not a formality; it reflects how the system actually works. Your employer decides who is enrolled, where a workplace geofence sits, whether a photo is required when you clock in, which leave and payroll rules apply to you, and how long you remain on the system. We process that data on their instruction and do not use it for our own purposes.

To see, correct or delete your data, contact your employer's HR department first. They will action the request with us. If you cannot reach your employer, write to us at [email protected] and we will refer the request to them.

Two narrow things are ours rather than your employer's, and for those LinkCo is the controller: enquiries submitted through the demo form on this website, and the account and billing records of the subscribing organisation itself.

What the apps ask your permission for

Your device will prompt you before any of these. You can refuse, and you can withdraw permission later in your device settings — though refusing location will prevent clocking in where your employer requires attendance to be confirmed at the workplace.

• Precise location — used to confirm you are at the workplace when you clock in or out. Nothing is tracked between punches; we do not follow your position in the background or while the app is closed.
• Camera — where your employer requires a photo at clock-in. The image is uploaded and kept with the attendance record.
• Photo library — only for files you choose to attach to a request, such as an expense receipt or a supporting document.
• Face ID, Touch ID or fingerprint — used to unlock the app on your device. This check happens entirely on the device. No biometric data is ever sent to us or stored on our systems, and we could not access it if we wanted to.

Location, and the device signals that come with it

This deserves its own section because it is the most sensitive thing the app handles and because it is more than a coordinate. When you clock in or out, the app sends your latitude and longitude, the accuracy your device reported, and whether your device's operating system reported the location as faked.

From that, we work out a trust status for the punch — recorded as mocked, not detected, or unknown — and your employer can see it on the punch. That status is something we infer, not something your device tells us.

Both exist to detect falsified attendance. We name them explicitly rather than folding them into the word "location", because a statement about whether your device may have been faking its position is a different kind of statement from where you were.

What is collected as you use the service

• Identity and employment records — your name, email address, employee number, employer, job details and role, plus records your employer maintains about you such as identity documents, dependants and emergency contacts.
• Attendance — punch times and locations, break windows, lateness and the daily and monthly totals derived from them.
• Pay and requests — payslips and their components, leave balances and history, loans, expenses, overtime, corrections and the approval trail for each.
• Messages you send and receive inside the app.
• A notification token for each device you sign in on, so we can deliver push notifications to it.
• Diagnostics — crash reports and error traces, used to fix faults.

Where your data is stored

The Link HR application and its database run on servers located in Germany. If you are in Jordan, this means your personal data is transferred outside Jordan and stored in the European Union. We are telling you this plainly because Jordan's Personal Data Protection Law requires a cross-border transfer to be disclosed rather than assumed.

Files you or your employer upload — clock-in photos, profile photos, documents, receipts and request attachments — are stored with Cloudflare on its global storage network.

Who else processes your data

We use a small number of third-party providers to run the service. Each one processes data only to deliver a specific function — hosting, file storage, email delivery, push notifications, crash diagnostics. We publish the full list, what each provider handles and where it operates, and we keep it current: see our sub-processors page.

We do not sell personal data, and we do not share it for advertising.

How long it is kept

Retention is measured from the point the record is created, unless stated otherwise. Where the law requires a longer period than we would otherwise keep, the law wins.

• Clock-in photos — 12 months.
• Punch location and device-trust signals — 24 months.
• In-app messages — 24 months.
• Push notification tokens — 90 days after last use.
• Attendance records — 7 years.
• Payslips and payroll records — 7 years, as Jordanian law requires of your employer.
• Personal documents — for your employment, plus 7 years.
• Audit records of administrative actions — 7 years.
• Employee-import source files uploaded by your employer — 7 days after the import finishes.
• Demo enquiries from this website — 24 months.

Deletion — and what survives it

When your record is erased, your name is replaced, and your national ID, email addresses, phone numbers, home address, date of birth, bank and payment details, tax and social-security numbers and your photo are removed. Dependants, emergency contacts and medical details are deleted outright. Free text about you across leave, loan, expense, travel, overtime, correction, disciplinary, document and appraisal records is scrubbed. Your files are deleted from storage and every active session is ended.

Your payroll records are deliberately kept. So are your employee number, employer, and hire date. Jordanian law obliges your employer to retain wage records for seven years, and an erasure cannot override that. In plain terms: erasure removes who you are, and keeps the wage record the law requires your employer to keep.

Erasure is carried out by LinkCo. Your employer's HR team cannot complete it alone — they raise it with us and we run it. If your employer's subscription ends, the same erasure is applied across their whole organisation once the grace period lapses.

Getting a copy of your data

You can view your own records in the app at any time — your attendance, payslips, leave balances, requests and documents. For a copy of your records beyond what the app shows, ask your employer's HR department, who can produce them from the system. We do not currently offer a self-service export, and we would rather say so than imply one exists.

Security

Traffic between your device and our servers is encrypted with TLS. Sensitive fields — bank account numbers, payment aliases, authenticator secrets and medical insurance details — are additionally encrypted in the database, and the system refuses to store them unencrypted. Access to your records inside Link HR is limited to the people your employer has granted the relevant permission, and administrative and security-relevant actions are recorded in an audit log.

Children

Link HR is a workplace system and is not directed at children. We do not knowingly collect data from anyone below the legal working age in their jurisdiction.

Changes to this policy

If we change how data is collected, where it is stored, who processes it, or how long it is kept, we will update this page and its date. Material changes will be communicated to subscribing employers, who are responsible for informing their staff.

Contact us

For anything about your own records, contact your employer's HR department first — they hold the relationship and can act fastest.

For anything else, or if you cannot reach your employer, write to [email protected]. Link HR is operated by LinkCo.