Introducing time tracking without losing trust
Time tracking touches a sensitive nerve: staff can easily experience it as monitoring. That can be defused, technically and organisationally — with data minimisation, clear rights and an arrangement the works council can support.
Not whether, but how
Since the Federal Labour Court ruling of September 2022 the division of roles is clearer than many assume.
The ruling came out of proceedings about co-determination: a works council wanted to force the introduction of electronic time recording. The court denied it that right of initiative — on the grounds that the duty to record already exists in law, and that co-determination applies only where a question is not already settled by statute.
A practical division of labour follows from that. Whether hours are recorded is not open to negotiation. How they are recorded very much is: which routes are used, whether the mobile app with its location check is deployed, which evaluations are produced, who may see them, how corrections are handled. Those are exactly the points that make sense in a works agreement — and they decide whether the introduction lands as progress or as mistrust.
Our advice from practice: settle these questions before the technical setup, not after. An environment once configured with every option turned on is hard to dial back — and the impression sticks.
Collect only as much as the purpose requires
The purpose of recording is to document working time — not to observe behaviour. That distinction decides what may be collected and what may not. Absences are held as a type, not as a diagnosis. Location is captured when clocking, not continuously. Evaluations are aimed at time accounts, not at individuals' attendance patterns.
The controller within the meaning of the GDPR remains your company. ITN-Network processes the data on your behalf, governed by a data processing agreement; processing takes place in a data centre in Germany.
Some functions draw on map services. When someone displays the address of an entry made on a phone, our server resolves it through OpenStreetMap (Nominatim), passing on only the entry's latitude and longitude. When the administration looks up the coordinates of a permitted location or — in the Projektzeit add-on module — of a customer address from that address, the address goes through our server to OpenStreetMap (Nominatim). Map links, for example on an entry, open Google Maps only when they are clicked.
Deletion periods, retention and the details of the data processing agreement are settled as part of the engagement — bring your own requirements and those of your data protection officer into the preparation.
Editors see and change only the groups they are responsible for.
People who can see their own hours and accounts can report mistakes early — which takes the monitoring character out of it.
Changes are recorded. That protects both sides, employees included.
When the time tracking enters absences in personal calendars, sickness, child sick leave, rehabilitation, phased return to work and maternity protection all appear there only as „Krank“ (sick) — never with the exact type, never with a note. If you prefer, every appointment says only „Abwesend“ (absent).
Whether the check on permitted locations applies is your decision, not the software's: one level for the whole account, separately for phone and PC, with exemptions per user or device.
The log and the rights, openable in the meeting
Two views answer the two questions a works council asks first: who sees what — and what was changed?
Four points to settle before the setup
Answering these questions beforehand saves arguments later — and lets the environment be configured properly from the start.
Which recording routes will be used?
Browser, phone, PIN terminal, terminal — per group of employees. The mobile app with its location check is the point that needs the most explaining.
Will the location check be used?
If so, with what response when there is a discrepancy — mark only or block — and who is exempt. If not, it stays at the location recorded at the moment of clocking, which the app requires anyway.
- one level for the whole account, separately for phone and PC
- exemptions per user or device
- no movement profile
Who may see which evaluations?
Map editor rights per group rather than giving everyone everything. It is quick to set up and hard to retrofit later.
How are corrections handled?
Who may enter something after the fact, is a reason required, how are employees informed? Traceability here is in both sides' interest.
How rights, groups and logging are represented in the application is set out in the administration chapter of the feature reference.
Step by step in the manual (in German): change log · location check.
Frequently asked questions about data protection and co-determination
Does the works council have to agree to time tracking?
The duty to record is itself statutory and therefore not up for negotiation — that was the core of the Federal Labour Court ruling of 13 September 2022. Co-determination applies to how it is arranged: which routes are used, how location data is handled, who may see which evaluations. For an assessment in your own business, consult your legal advisers.
What data arises from time tracking?
At its core, timestamps attributed to a person: arrival, departure, the start and end of breaks, from which targets, actual hours, breaks, premiums and balances are calculated. Alongside that, absences such as leave or sickness recorded as a type, not as a diagnosis. Where recording happens through the mobile app, the location at the moment of clocking is added.
Are employees' locations tracked continuously?
No. Location is captured at the moment of clocking, not continuously. No movement profile arises — only a record of where an entry was made from. Whether entries are additionally checked against permitted locations is something you set for the whole account, separately for phone and PC. Individual users or devices can be exempted.
Who can see employees' hours?
Editor rights per group control that. A site manager sees their own area, head office sees the whole, and employees see their own hours and accounts. Changes are logged so it stays traceable who altered what.
What applies to messages to the workforce?
Messages appear in the app. They go out by email only in addition, and only when the sender chooses it while writing — through your own mail server, to the stored notification address; there are no push notifications. With the email the text leaves the time tracking, so confidential personnel data does not belong in it. The time tracking keeps read messages for ten years.
Who is the controller for data protection purposes?
Your company, as the employer, is the controller. ITN-Network processes the data on your behalf; that is settled by contract. Processing takes place in a data centre in Germany.
More on this: what the law requires and the mobile app with its location check.