Privacy Policy

KronoSync Smart Attendance Management System

Last updated: 20 August 2026

1. Introduction

KronoSync ("we", "us", "our") operates the KronoSync Smart Attendance Management System, including our website, web application, the KronoSync mobile app, and related services (collectively, the "Service"). The Service provides ZKTeco biometric device integration, attendance tracking, shift and leave management, payroll processing, and workforce reporting.

This Privacy Policy explains what personal data we collect, how we use it, and the choices you have. It is prepared with reference to the Personal Data Protection Act 2010 ("PDPA") of Malaysia.

2. Roles and Responsibilities

  • Company administrators and employers – When you register a company on KronoSync, you are the data controller for the personal data within your organisation. KronoSync processes that data as a data processor on your instructions.
  • Employees – Your employer invites you to the Service and decides what data is recorded about you. If you have questions about why your data is collected or want it corrected, please contact your employer's HR department or administrator first.

3. Information We Collect

Account and company information

  • Name, email address, phone number, profile photo, and a securely hashed password for user accounts.
  • Company details, branding, and configuration settings provided by company administrators.
  • API tokens created by users for integrations.

Employee and attendance records

  • Employee master data maintained by your employer, such as name, employee ID, department, designation, and employment dates.
  • Check-in and check-out times, late arrivals, early departures, overtime, shift schedules, and leave records.
  • Historical attendance data imported from ZKTeco devices or uploaded by administrators.

Biometric identifiers

  • Fingerprint and facial templates are enrolled in and stored on your organisation's ZKTeco devices. Depending on how the devices are configured, either the verification result only or a device-scoped identifier is transmitted to KronoSync. We do not sell biometric templates and do not use them for any purpose other than attendance verification requested by your employer.

Location and device data (mobile app)

  • If your employer enables location-stamped or geofenced attendance, we collect the device's GPS position at the moment you check in or check out from the KronoSync mobile app.
  • Device model, operating system, app version, and push notification tokens (Firebase Cloud Messaging) used to deliver attendance reminders and company announcements.

Payroll and documents

  • Salary components, allowances, deductions, and payslip documents generated in the payroll module, where your organisation subscribes to it.

Usage and log data

  • IP address, browser type, pages visited, and actions performed within the Service, retained for security, auditing, and troubleshooting.

4. How We Use Information

We use personal data to:

  • provide, operate, maintain, and improve the Service;
  • record attendance, compute overtime, leave balances, and payroll outputs;
  • send operational notifications such as check-in, check-out, and shift reminders;
  • authenticate users and protect accounts against unauthorised access;
  • generate reports for your organisation and comply with applicable legal obligations; and
  • provide customer support.

We do not sell personal data, and we do not use employee biometric or attendance data for advertising.

5. How We Share Information

We share personal data only as follows:

  • Within your organisation – with the administrators and managers your employer authorises.
  • Service providers – hosting and infrastructure providers, and Google Firebase for push notifications and authentication-related services. Where your organisation sends announcements via WhatsApp, message delivery is processed by WhatsApp (Meta).
  • Legal requirements – where disclosure is required by law, regulation, or legal process.

6. Cookies and Session Data

The Service uses essential cookies for login sessions, authentication, and security (for example CSRF protection). We do not use advertising or third-party tracking cookies. Analytics or live-chat widgets embedded on our public pages may set their own cookies as described by those providers.

7. Data Security

We protect personal data using measures including encryption in transit (HTTPS), password hashing, role-based access control, scoped API tokens, session management, audit logging, and regular backups. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

8. Data Retention

We retain personal data for as long as your organisation's account is active or as needed to provide the Service. When an account is deleted or a subscription ends, data is deleted or de-identified within a commercially reasonable period, except where longer retention is required by law (for example payroll and statutory employment records).

9. Your Rights Under the PDPA

Subject to the PDPA, you may request access to, or correction of, your personal data, and may withdraw consent to its processing. Because most data is controlled by your employer, requests should normally be directed to your employer's administrator, who can action them within KronoSync. You may also contact us using the details below.

10. International Transfers

Our infrastructure and providers (for example Google Firebase) may process or store data outside Malaysia. Where this occurs, we take reasonable steps to ensure the data is protected to a standard consistent with the PDPA.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced within the Service or by notification to company administrators. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

12. Contact Us

Questions about this Privacy Policy or your personal data can be directed to: