ITN-Zeiterfassung — every function in detail

Overview & ways in

ITN-Zeiterfassung is a multi-tenant web application. Arrival, departure and break entries are worked out per user against the working time model assigned to them; targets, actual hours, breaks, premiums and balances arise automatically. Clocking happens on whichever device is to hand.

Which menu entries are visible depends on the role: employees clock in and see their own account, editors may change hours (possibly only for the groups assigned to them), and administrators manage users, models and settings and approve leave.

Setting up with the assistant

New in version 1.0.54: an assistant guides administrators step by step through setting up — checking against the real data as it goes what is already right and what is still missing. It complements the „Schnellstart“ (quick start) help chapter, which describes the same steps with pictures and warnings.

What it checks

Seventeen steps, in the order in which a setup works: company details, time zone and date format, clocking buttons, public holidays, your own clocking reasons, premiums, working time models, groups, users, start of time recording and leave entitlement, model assignment, PIN or chip, terminals, phones, locations, payroll export and, finally, a trial run. Each step shows whether it is done, started or open — and exactly what is missing: „6 of 16 employees are still missing something“, for instance, together with their names; a working time model that produces a target on no day at all; public holidays not yet imported for the current year; or phones waiting for approval. Clicking a name opens the personnel record at the relevant tab.

„Zeig mir wo“ (show me where)

One click opens the relevant page, dims the rest and highlights the field or button where you carry on — with a speech bubble such as „click here: + new model“. The page stays fully usable all the while. As you work, the window updates itself: whatever has been saved is ticked off.

„Will ich nicht“ and „Passt so“

Not every company needs every step. „Will ich nicht“ (I don't want this) deliberately leaves a step out; it then counts as done — for all of the tenant's administrators — and can be brought back with „Doch einrichten“ (set it up after all). Whatever cannot be read from the data, such as the time zone or the final trial run, is closed off with „Passt so“ (that's fine).

Where to find it

In a new tenant the assistant opens by itself as long as nobody has clocked in yet. Otherwise it sits at the very bottom of the sidebar, above the help — „🚀 Einrichtung“ (setup), with the progress, 6/17 for instance — and as a button in the „Schnellstart“ help chapter. It is visible to administrators only and changes nothing itself: saving happens as usual on the pages concerned.

Active accounts outside the system groups count as employees; pure administration accounts with no working time model and no clocking entries are left out.

Dashboard — the admin cockpit

The dashboard is both the home screen for clocking in and an overview of the business. Employees see their figures for the day; administrators additionally see outstanding tasks and the status of the whole workforce.

Figures & clocking

At the top are the tiles for the current day: hours worked today, the day's target and the balance, plus a remaining-leave tile with the days left. On public holidays the target is 0. Clocking happens through the large buttons, with only the currently permitted actions active — after arriving, for instance, leaving and taking a break. Reasons of your own (such as „going to the doctor“) appear as additional buttons; below them are today's entries with their source.

Outstanding tasks for administrators

For administrators the dashboard adds an overview of the business. Open requests appear as a figure and a card and can be approved or rejected directly; planned leave becomes real leave with one click. Anyone who has forgotten to clock out shows up, as do incomplete days (arrival without departure) and anything odd in the balances. The status of the terminals (online or offline) and any upcoming dates round the picture off.

The two error lists are clickable: clicking „forgot to clock out“ or an incomplete daily row opens the time tracking view with the employee selected, the month set and the day highlighted — so the error is one click away rather than something to hunt for.

Attendance by group

An overview shows, per group, who is currently in. That makes it possible to see at a glance whether a department is complete.

Approved leave only disappears from the list after a short while, once the overview reloads.

Time tracking — the monthly view

In the time tracking view, editors check and correct an employee's hours month by month. Once a group and a user have been chosen, the current month loads; the arrows or the field at the top switch months. The principle of the page is a calculation you can follow: beside every daily row it says how a figure came about.

The account card in the month header

The account card summarises the time account. The monthly balance shows flexitime including the carry-over from the previous month, counting only the days up to today — future targets do not appear as a deficit. Remaining leave is what is available (entitlement + carry-over from last year + corrections) minus the days taken; a link leads to the working time model assigned.

„Leave planned/future“ and the amount still free to plan follow from the remainder minus any planned leave not yet approved. Planned leave is only deducted from the account when it is approved.

The calendar bar — painting absences

A calendar bar sits above the list of days. After choosing a tool (leave planned, leave, sick, released from duty, or the eraser) you drag across the days with the mouse and enter absences as an area. Rarer types such as sick child, rehabilitation or parental leave are in the „weitere Arten …“ (further types) selector. Days with no model are skipped while dragging; „link“ jumps from the day you clicked down to the matching daily row.

A daily calculation you can follow

Every daily row shows the clocking entries and their source on the left, the calculation in the middle — the break deducted under the model's rule, the day's target, the actual hours and the difference — and corrections and reasons for absence on the right. Nothing is hidden: you can see which break rule applied and how the balance arose. The source of each entry is shown by an icon (🌐 web, 🖥️ PIN terminal, 📍 phone, ✍️ manual, ✏️ changed afterwards); incomplete entries are marked as clocking errors.

Adding and correcting entries

For each day, entries can be corrected, deleted or added with „+ entry“. „+ reason“ enters a genuine absence — all day, or with a time from–to (= half a day). A forgotten day of leave belongs in as „+ reason → leave“, not as a balance correction.

If someone goes home sick during the day, „+ reason → sick“ (and likewise „sick child“) offers the tick box „Rest des Tages als „Krank“ werten“ (count the rest of the day as sick): from the last clock-out, the time up to the day's target is credited, so the day is fulfilled. An all-day sick entry, by contrast, would credit the full target on top of the time worked.

Balance corrections

„+ balance correction“ offers three kinds. Time posts ± hours and minutes, either for the day or for the month, and affects the actual hours and the balance. Leave posts ± days to the leave account (a payout, say, or additional special leave); such postings do not count as a day taken and do not appear in the payroll export. Sick posts ± counted sick days and does appear in reports and the export.

A recycle bin for deleted entries

The ✕ on an entry does not delete it for good but moves it to the recycle bin. Days with deleted entries show a yellow bar at the left of the daily row; clicking it opens the window for restoring them — individually or with „restore all“.

Deleted entries are only removed for good after the recycle bin period set in the settings (0 = never).

Leave & absences

Leave, sickness and release from duty are planned graphically in the calendar — for individual employees and for whole groups — and act directly on the account and the calculation. A leave account per employee records entitlement, carry-over and the remainder.

Entered graphically: just draw the absences

Entering them needs no forms: in the calendar bar you choose the tool you want — leave (planned), leave, sick, release from duty paid or unpaid, a type from „weitere Arten …“ (further types), or the eraser — and then drag across the days with the mouse. The span colours in immediately (leave green, planned hatched, sick red, release from duty yellow) and the account recalculates at once; the eraser removes a marking just as quickly.

The whole group at a glance: planning

The planning page shows the calendar for a whole group — one row per person, one column per day. Leave, planned requests and days of sickness for everyone lie side by side in colour, so that overlaps and gaps (two sales staff in the same week, say) stand out immediately. Here too, planning happens directly in the view rather than in lists. Alongside leave, sickness and release from duty, rehabilitation, phased return to work, maternity protection and parental leave have buttons of their own here as well; sick child and the other rarer types are in „weitere Arten …“.

Requesting rather than shouting across the room

Staff can request leave and the other absences themselves — at a desk or on a phone. Nothing about the hours changes until a decision is made; requested leave merely appears as „planned“ in the grid. The whole process is in the chapter on requests.

Approving with one click

Planned leave appears as an open request on the dashboard. Whoever is responsible sees the employee, the group, the period and the number of days, and approves with one click — the provisional entry becomes counted leave.

Exchanging leave data with your mail server

If the calendar connection to the company mail server is switched on, the application enters every all-day absence automatically as an appointment in the employee's personal calendar. Planned leave appears there as a tentative appointment; on approval the same appointment is automatically set to confirmed — and when the absence is removed it is deleted from the calendar again. Employees see their leave directly in their mail program, on their phone or in webmail, with nothing maintained twice. The connection is optional and is set up per employee with an app password of their own, stored encrypted.

Types of absence

• Leave planned: a provisional entry with no effect on the account, which becomes real leave only on approval.
• Leave: an approved, counted day of leave; half days in steps of 0.5.
• Sick: a day of sickness, all day or with a time from–to.
• Sick child: the employee is well but is caring for their child; paid and calculated like sick, but shown separately in the evaluations.
• Rehabilitation, phased return to work, maternity protection: paid, calculated like sick. If someone clocks in on a day of phased return, the time worked counts in addition.
• Parental leave: neutral — the day counts as fulfilled, producing neither a deficit nor working time in the payroll export.
• Release from duty, paid or unpaid: paid covers the day's target (balance 0), unpaid does not cover it and is merely documented.
• Business travel / training: paid, covers the day's target.
• Special leave: paid, covers the target — but does not count as a day of leave taken.
• Unpaid leave: the target remains, and the day is documented.
• Flexitime compensation: time off in lieu — the day's deficit draws down the flexitime built up.
• Vocational school: generated from the apprentice's school timetable (its own chapter).

With a paid all-day absence and no clocking entries, the day counts as covered: actual = target, balance 0, no break. If work was nevertheless done on such a day (leave entered afterwards on a day with entries, say), the time worked counts in addition, and the day of leave stays used up in the account.

Sick note check: has the certificate come in?

Whether a sick note (the German certificate of incapacity for work, „AU“) is on file is not a second status but an „AU“ tick on the period of sickness; ticked means „AU liegt vor“ (sick note received) and applies to the whole continuous period. The check is off by default and is switched on under Settings in the „Arbeitsunfähigkeit (AU)“ (incapacity for work) card. That is also where you set from which day of sickness a sick note is required — the default is the 3rd day, counted in calendar days. From that day on, „AU fehlt“ (sick note missing) appears in time tracking, in planning, on the dashboard and in the absence overview of the reports until the period is ticked. This applies to sick and sick child; sick notes imported from the payroll software (chapter 13) count as „AU liegt vor“ automatically.

Visible only to administrators and department heads — employees see nothing of it. The sick note check changes nothing about target, actual hours or pay.

The leave account

The leave account shows entitlement, carry-over from the previous year and the remainder. The remainder is the entitlement plus the carry-over minus the days taken; the carry-over runs recursively into the following year, and nothing expires automatically. Real days of leave are counted as taken, half days as 0.5.

A dated history of entitlement

If the entitlement changes — three days more from a particular year, say — the entitlement history is maintained instead of the simple annual figure („from year X: N days“). Each year then calculates with the value that applied at the time; previous years and carry-overs stay correct. Where a history is maintained, only it applies and the simple field has no effect. Individual days can be credited or deducted through balance corrections (special leave or a payout, for instance).

Requests — leave, corrections, approval

Leave, special leave, business travel, flexitime compensation, a forgotten clocking time or a cancellation: staff submit these themselves — at a desk or on the move with a phone. Nothing about the hours changes until a decision is made; once management approves, the program enters the change and records who decided it. The note on the desk and the question shouted across the room both disappear.

Submitting

A submission consists of a type, a period and a reason. For the reason the common cases are offered (forgot to clock, wrong time, clocked twice, terminal unreachable, doctor's appointment, business errand); free text remains possible. For a time correction the form shows the entries for the day chosen: an entry made in error is struck out, and a missing time is added by type and time. Requested leave appears in the grid as „planned“ straight away — so the department sees early who would like time off, without anything being booked yet.

Deciding

Responsibility lies with the person's named line manager; where none is stored, management decides, and otherwise the administrators. Open submissions appear as a figure and a card on the dashboard and can be approved there directly, or rejected with a reason. Nobody may approve their own submission — not even a department head; the button is simply not there.

Before an approved time correction is applied, the server checks whether the day has changed since the request was made. If it has, the approval is refused rather than pasting a stale correction over a newer change.

Who is responsible

The department head role maintains the hours of its groups and decides their submissions, but reaches no administration page. A deputy can additionally be stored per group so that nothing is left lying during a holiday. The management status — which any number of people may hold — decides every submission without a line manager of its own and grants no other rights: no administration, no other people's hours. Anyone who is only an employee cannot approve leave; so only those entitled to decide can be selected as a line manager.

On request the system sends emails in both directions: to those responsible when a submission comes in, and to the employee once it has been decided. If no notification address is stored, the message simply appears in the web and mobile app — nobody needs a mailbox for it.

On a phone

In the mobile app the submissions have a tile of their own: make them, follow their status, withdraw them. Decisions are deliberately made only at a desk. Every correction requested this way stays recognisable afterwards — in the time tracking view the entry carries the note „requested by phone“ along with the name of whoever approved it.

Messages to the workforce

„The delivery will not arrive until 7 tomorrow“ — messages like that used to travel by phone chains and private messengers, past the time tracking system and with no record. Messages reach the same people in the same program: one person, a whole department or everyone. The recipient confirms with „read“, and the sender can see who has taken note. Deliberately one-way — no chat, no discussion; requests go through the request workflow.

Writing is for those who carry responsibility

Administrators and management reach everyone, department heads their own departments (with any stored deputy counted in), and a named line manager additionally the people assigned to them. Only the people and groups you are allowed to reach appear in the recipient selector. Everyone else has a mailbox but no write access.

Normal or important

A normal message waits in the mailbox; the bell in the header and the tile in the mobile app show how many are unread. A message marked important opens as a window at the next start, which can only be closed with „read“ — for when a message really does have to reach everyone.

An important message reaches the time clock too: anyone who has not yet read an important message sees it in large type straight after entering their PIN, as an „⚠️ ACHTUNG“ (attention) window, and confirms it with „Gelesen und verstanden“ (read and understood) — so it also reaches colleagues who use neither the mobile app nor a PC. Normal messages do not appear there.

A record instead of asking around

Under „sent“, each message shows how many recipients have read it — with names and times, if you want. That makes it demonstrable who had the information. A message can be withdrawn; it then disappears from every mailbox. Every send appears in the log with the sender, the subject and the number of recipients.

On a phone

The mobile app has a tile of its own with a counter of unread messages. There is nothing to set up and nothing to switch on: the messages arrive in the app along with the rest of the data. Operating system notifications are deliberately not used — so there is no permission anyone could refuse, and nothing appears on the lock screen. The messages last loaded stay readable without a connection.

Working time models

A working time model sets the target hours, the break deduction, the premiums and the public holiday rule — it is the backbone of every evaluation. Models are maintained under Time tracking → Models.

Target types

• Per weekday: a target of its own for each weekday (Mon–Thu 8.0 / Fri 6.0, say).
• Weekly target: a number of hours per week plus a choice of working days; optionally a daily target of its own, with the remainder distributed evenly across the other working days.
• Monthly flexitime: a monthly target, with the distribution across days left open.
• Free: no target — all the time recorded counts.

Free choice of days — the monthly goal is what counts

Some businesses let their people decide for themselves when they work; all that is binding is a number of hours per month. For this, the monthly target offers the tick box Freie Tageswahl (free choice of days): the monthly target is then not distributed across the days. Every day has a target of 0, no daily deficit arises anywhere, and anyone who does not clock in on a given day gets no „working day without clocking“ notice — after all, they have not missed anything. Instead, the header of the time tracking view shows monthly goal and achieved and, separately, overtime — 167 achieved plus 10 overtime means 177 worked. The monthly goal counts as the target for the period, so overtime is „actual minus goal“. A flexitime account is possible here too — without one, the surplus is shown as „for payout“.

In this model clocking errors stay silent as well — anyone who comes and goes as they please constantly produces unpaired entries. With every other model they are reported as before.

What a day of leave is worth

A whole day of leave, sickness or release from duty normally covers exactly the day's target — and rightly so, as long as there is one. With a free choice of days, though, that target is zero, and a day of leave would be worth nothing.

That is why every day card carries an absence value: how many hours a whole day of absence counts for on that weekday. Left empty, it still means „the day's target“. A calculator suggests the value — the monthly goal divided by the working days in the month. Because that figure varies from month to month, it recommends a fixed value: otherwise the same day of leave would be worth more in February than in October.

Break rules per weekday

The break deduction is chosen per day:

• Free / as clocked: only the break actually clocked is deducted.
• Statutory (German Working Hours Act): more than 6 h ⇒ 30 min, more than 9 h ⇒ 45 min.
• Flat rate: a fixed deduction per day.
• Tiered: a graded deduction depending on how long the day was.

The deduction actually applied is always the greater of the break clocked and the break prescribed; with „as clocked“ only the break actually clocked counts.

Public holiday rule, core hours & clocking window

The public holiday card settles how public holidays are calculated — usually a target of 0 plus the public holiday premiums. Whether it applies is decided by „FE“ in the working-day selection after Mon–Sun: if it is not selected, every public holiday is a day off, whatever the public holiday card says. If it is selected, the public holiday target applies on every public holiday — even one that falls on a Saturday; the weekly target is still distributed across Mon–Sun only. In addition, core hours, a clocking window (arrival–departure, limiting the attendance counted) and a grace period on the first entry can be defined.

Overnight shifts

Where a shift runs past midnight (22:00→06:00, say), a model setting determines which calendar day carries the shift — by default the day of departure, or optionally the day of arrival. The working time and the break of that shift lie entirely on that one carrying day; double counting is ruled out. If the carrying day is a non-working day under the model, the work still counts there as a credit (with a Sunday or public holiday premium where applicable).

The flexitime account & capping

The flexitime account can be switched on or off per model. When it is off, there is no carry-over: every month starts at 0 and a monthly surplus is shown as „for payout“. When it is on, the balance of every previous month moves into the new month as a carry-over. A cap can optionally limit the flexitime balance at the turn of the month — capping only works downwards from above.

Assignment per employee

A model is assigned per user and with a date: it applies from a given day, and earlier periods keep their old model. The history is in the personnel record.

If no model is assigned to a user, no target hours are calculated for them. Deleting a model takes effect retrospectively on every period evaluated with it — which is why deleting one requires the administrator password.

Shift planning

„Who is on lates next week?“ — wherever people work in rotating shifts, the answer usually hangs on a notice board that one person keeps and everybody hunts for. Shift planning turns that into a monthly grid which fills itself from stored patterns: pick the shift group and the month, press „Automatisch vorbelegen“ (pre-fill automatically) — done. And because the clock-in reveals which shift somebody actually worked, reality always stands next to the plan.

Shift groups and shifts

Under Time tracking → Shift planning → Shift groups, one group bundles the shifts of an area, say „Labor“ (the lab) or „Backstube“ (the bakery). For each shift you set a long name and a short name, plus the start of the shift, a tolerance in minutes before and after that start, and a colour. Everything is written as „long name (short name)“; in the grid cell and on the printed plan the short name stands at the top with the start time beneath it.

Beneath that is who belongs to the shift group: „Nicht in der Schichtgruppe“ (not in the shift group) on the left, „In der Schichtgruppe“ (in the shift group) on the right. Employees are dragged across or added with „+“ — across department boundaries too. Exactly these members have a row in the planning grid. Nobody needs an assignment to a shift or a shift pattern for that; only the automatic pre-fill requires those.

Time windows may overlap — with shifts a quarter of an hour apart there is no other way. Anyone clocking in within several matching windows lands in the shift they are rostered for. If the rostered one does not fit, the one with the nearest start time wins.

Activities: where instead of when

Alongside the shifts there are activities — immunohistology, office, quality management, home working. A shift says when the work happens; an activity says where or what. It has no start time of its own and is not recognised on clocking in, but it sits in the grid on equal terms with the shifts.

Where the hours come from

A working time model on the shift is optional. If a shift has none — the normal case — the day is calculated with the employee's personal working time model; everyone therefore keeps their own hours, even when ten people work the same shift. If the shift does have one, it wins: target hours, break rule and premiums of the shift then apply for that day.

That model is dated, just as it is for employees: „this one from 01.01.2026, that one from 01.10.2026“. A past day is calculated with the model that applied on that day — storing a new one from a future date changes nothing about the past.

Count only from the shift start

Per shift you can switch on that an earlier clock-in counts only from the start of the shift. Example: shift 07:00, clocked at 06:45 — counted from 07:00. Anyone arriving later counts from their clock-in; the trimming only works forwards, never backwards. Switched off, the clocking time applies as it does everywhere else.

Assignments: the shift pattern

Under Time tracking → Shift planning → Assignments, every employee is listed on the left, all shifts on the right, and in the middle their shift pattern: a weekly grid from Monday to Sunday, plus a column of its own for public holidays. Shifts are dragged from the list on the right into a day. The cycle runs over up to twelve weeks and then repeats — a two-week alternation between earlies and lates is covered just as well as a fixed week that never changes.

• Several shifts on one day are alternatives with a rank, not double shifts: the planner takes priority 1 and falls back to 2 if that shift is already fully staffed on the day.
• The holiday column overrules the weekday — but only when it is filled. Left empty, the normal weekday applies on a public holiday; shift operations do, after all, work on holidays too.
• Without a pattern somebody is skipped by the automatic planning. Rostering by hand still works for every member of the shift group — the pattern only holds back the automation.

Planning the month

Planning is graphical under Time tracking → Shift planning: pick the shift group and the month, tap a shift at the top to use as a tool and drag across the days in the grid — exactly as in leave planning. A double-click on a day fills the whole calendar week, the eraser takes a planning back, and „frei“ (off) leaves a day expressly empty — unlike an erased day, it will not be proposed again by the next pre-fill. By hand, any day can be planned, Saturdays, Sundays and public holidays included.

With many shifts, the row above the tools helps: „Sortieren“ (sort) orders the shifts by time, by colour or alphabetically, and „Schicht suchen…“ (search shift) finds a shift by its long name or short name — if exactly one matches, Enter takes it straight on as the tool.

The grid shows whole weeks: if a week overlaps with the neighbouring month, it is still shown in full. The days added on are shown dimmed and can be edited quite normally. Beneath the employees is the „Termine“ (appointments) row: one appointment per day for the shift group, with a short name („TÜV“ for an inspection, say), a time and a longer text; the cell shows the short name and time just as it does for a shift. The appointments also appear on the „PDF Mitarbeiter“ and „PDF Alles“ printouts and on the whiteboard.

Most of the work, though, is taken off you by „Automatisch vorbelegen“: it builds the plan from the shift patterns, optionally across one to three months. A preview appears first — how many days are set anew, how many are changed, how many stay untouched and what conflicts there are. Nothing is written until you press the button, and days set by hand as well as days already clocked stay as they are.

Anyone storing a minimum and maximum staffing level per weekday gets two things: below the grid, each shift and day shows how many people stand there — red when understaffed, yellow above the maximum, green when it fits. And the pre-fill tops up open places to the minimum, distributed evenly by number of duties. If the minimum cannot be reached, it still plans what it can — and reports the rest.

The order of the employees can be dragged by the handle and stays as you leave it — which lets you group people into blocks that belong together. The printed plan uses the same order: the printout looks like the screen.

Staffing posts: when the headcount is what matters

The target staffing level is normally attached to the individual shift. But where an area runs several shifts that differ only in their start — 5:00, 6:00, 7:00, 7:15 — „four people on the early shift“ cannot be expressed that way: each start time counts on its own there, and anyone who switches from 6:00 to 7:00 leaves a gap in one row and overfills the other.

A staffing post therefore combines several shifts into one requirement: shifts are dragged into it by the handle, the total is what counts, and beneath the grid there is one row for the post instead of one per shift. The automatic pre-fill follows it too — and gives everyone the shift that suits them best: the member shift with their highest rank.

A shift without a post stays as it was. Its own requirement is not deleted inside a post either, merely ignored: once it is taken out again, its own figure applies.

What the markings in the grid mean

• Dashed border — planned but not yet clocked. A month in the future therefore consists entirely of dashed cells.
• Dashed in white — a planned activity.
• No border — clocked as planned; the duty is confirmed.
• Red border — clocked differently: somebody turned up for a shift other than the planned one.
• Dot in the corner — generated automatically from the pattern. Only such days are overwritten by the next pre-fill.

Plan versus reality

If someone clocks in for the shift they were planned for, the plan counts as confirmed. If they turn up for a different one, the planning stays visible and the actual shift appears beside it — outlined in red in the grid, shown as ≠ in the mobile app, and outlined in red in the PDF as well. The calculation always follows the shift actually worked: whoever works at night receives the night premium, even if they were rostered for the early shift.

Anyone who is rostered and does not turn up receives the target hours of the planned day. Anyone not rostered for a day continues to be calculated with their own working time model — shift planning does not touch them.

In time tracking the recognised shift appears next to each day in the right-hand column, in its colour. It can be switched to another shift from the selector or removed entirely with the ✕, in which case the personal model applies again for that day. A shift set by hand stays put; a further clock-in does not overwrite it.

If the clock-in time is changed afterwards, the shift does not switch by itself; it then has to be corrected separately.

Night shifts across midnight

A time window may run across the change of day, and the form always shows which period results from the start time and the tolerance. The shift is assigned to the day on which it begins: a night shift from 23:40 to 07:10 belongs to the day of the clock-in, even though it ends the following morning. Which calendar day the hours themselves land on is decided by the working time model — the carrier day from chapter 8.

Adding shifts retrospectively

Recognition happens at the moment of clocking in. Anyone who plans a month retrospectively, after clock-ins have already been recorded, therefore ends up with a lot of unconfirmed days. The „Schichten nachtragen“ (add shifts) button works through the existing clock-ins of the month on display and reconciles them with the planning. Days set by hand are left untouched, and a second run changes nothing further.

Three printed plans

The plan goes on paper in three cuts, all in landscape format with a colour legend:

• PDF Mitarbeiter (employees) — the grid alone, for the notice board. Who works when; the staffing figures are of no interest there.
• PDF Alles (everything) — grid and staffing levels, for management.
• PDF Besetzung (cover) — the staffing levels alone, without names: the view of the coverage.

The sheet carries the month in its title, and at the bottom of every page the time of printing and the page number — so anyone at the notice board can tell which version is hanging there. Alongside them there is a slip per employee listing only their own shift days with date, shift and start time.

As a spreadsheet for Excel

Next to the PDF buttons is „Excel (CSV)“: the same grid as a table, one column per day and one row per employee, with the appointments and the staffing levels beneath. It is meant for reading and further calculation — a file changed in Excel cannot be loaded back; planning happens in ITN-Zeiterfassung.

Using a month as a template

„Monat kopieren“ (copy month) takes over the plan of another month — weekday to weekday, not date to date: whoever had the early shift on Mondays in the template has it on Mondays again in the new month. Only empty days are filled; whatever is already in the target month stays untouched. A preview first shows what will be taken over and which days drop off at the edges; nothing is written until you press the button.

Announcing changes

A changed plan is no use if nobody hears about it. „Änderungen mitteilen“ (announce changes) sends every person affected a message to their mailbox — with only their own days, each marked as new, changed or dropped, compared with the version last announced. It is sent only when you press the button, never by itself. A window first shows who would receive what; a remark can be put at the top, and the message can be marked as important. If everyone already knows the plan, „Stand übernehmen, nichts senden“ (adopt this version, send nothing) sets the point of comparison without sending anything.

What employees see

Under Time tracking → My shifts every employee finds their own shifts for the month and, beneath them, the grid of their department — for viewing only, so that people know when their colleagues are in. Another department stays closed to them. Department heads and admins plan under Shift planning instead. In the mobile app the „Meine Schichten“ (my shifts) tile leads to the coming weeks; it can be switched off per device (Administration → Settings → Devices), so a tablet used for clocking in in the workshop stays free of it.

The plan on the wall: the whiteboard

A screen in the corridor shows a shift group's monthly plan in full screen — like a notice on the board, only always up to date. It needs no user sign-in: it is created in the administration as a terminal of the type „Whiteboard (Schichtplan-Anzeige)“ (shift plan display), opened in the browser at …/whiteboard, and identifies itself once with an ID and a secret. It shows the same rows as the planning grid, all-day absences with their short name, the „Termine“ row (there with short name and time only) and whole weeks.

The terminal list sets which shift group and which month appear — the current one, the next or a fixed one — along with the orientation, the zoom and how often the board refreshes itself. Nothing is planned on the whiteboard; every change made in shift planning appears by itself at the next refresh.

Who may do what — and what is protected

Planning is for whoever maintains the department's times: department heads for their own areas, the admin everywhere. The shifts and shift groups themselves are managed by the admin. Employees see the plan; they cannot change anything — not even for themselves.

Deleting a shift requires the admin password, and the dialogue first states what depends on it: how many planned days would lose it, how many of those fall in months already closed, and how many shift patterns refer to it. Past days remain afterwards — they are the record of what happened — and go on calculating with the personal model; future planning on that shift disappears.

Emptying a whole month at once is possible too, but only while it has not yet begun. From the first day onwards people are working to that plan and clocking against it; individual days can still be taken back with the eraser at any time.

Vocational school for apprentices

School days, block weeks and school holidays are stored once per school year against the person — not against the working time model. From that the system generates the school days automatically, eight months ahead on a rolling basis, and enters them in the calendar too where one is set up.

A whole school day counts as meeting the daily target, leaving the balance at 0. For a half school day the class time is credited; work done afterwards is added on top as normal. Public holidays, days with no model and days already occupied are skipped. In the planning view school days are recognisable by a colour and symbol of their own — half days only half filled.

If a class is cancelled, the day is simply erased and does not come back by itself; an additional school day can be set by hand at any time. At the turn of the school year a new entry from a date is enough: the pre-calculated days of the old rhythm disappear from that day onwards, calendar appointments included, and are rebuilt to the new timetable — with no duplicates. The working time model is untouched by all this, so no separate model is needed per year of training.

Premiums

Premiums are a company-wide catalogue of allowances in time or money — night, Sunday, public holiday, overtime or types of your own — which are then assigned within the working time models. The catalogue is maintained under Time tracking → Models → Premiums.

Types & eligibility windows

• Night / Sunday / public holiday: apply within a from–to window; a window may run past midnight (22:00–06:00, for instance), and several separate windows are possible.
• Overtime: daily as max(0, actual − target); weekly on a cumulative basis.
• Premiums of your own: freely created for cases particular to your business.

Paid out or credited as time

For each premium the effect is set — paid out as money or credited as time to the time account — along with the percentage. A premium only takes effect once it is assigned to a day card in a working time model; that way different weekdays can carry different premiums.

The number stored on a premium corresponds to the DATEV wage type and takes precedence over the general wage type mapping under Settings → DATEV.

Reports

Reports evaluate hours per person or group — for a month or a free from–to span, as a table, a PDF and a CSV file. The month or a „period …“ is chosen right at each report, next to the PDF buttons; the choice applies to every report on the page.

Monthly overview

The individual report in its monthly overview form shows daily rows with totals, plus the figures for carry-over, actual, target, difference and flexitime balance. Premiums are also shown as a bonus, along with days of absence (half days as 0.5, sickness including sickness corrections). The flexitime balance applies to date; any capping is shown where it exists.

Daily overview

The daily overview form lists the individual entries along with the calculation. In the daily PDF, the arrival of a shift running past midnight is attributed to the day of departure.

Premium report

The premium form shows arrival, departure, target and actual per day, and then a column for each premium with the time eligible for it (not the bonus). The column header gives the name and rate, „night 25 %“ for instance; a legend at the top lists every premium in the period, and the totals are at the bottom. Arrival and departure are the first and last entry of the shift; where the departure of a night shift falls on the following day, it is marked with „*“. The CSV export contains the same columns.

Group report

The group report sets every employee in a group side by side with their actual, target, difference, carry-over and absences. „PDF overview“ summarises the group; „PDF full report“ bundles everyone's individual reports together.

System groups (inactive / former employees) allow individual reports only, not a group report.

Absences – all reasons

At the top of the reports page, „📋 Abwesenheiten – alle Gründe“ (absences – all reasons) opens a list of every absence entered within your own area: admins see all employees, department heads those of their groups — former and inactive employees included, so that the list is complete in retrospect too. It can be filtered by period, group and type; consecutive days appear as one from–to row, with the total per type beneath. The list goes out as CSV or PDF. With the sick note check switched on (chapter 5), an „AU“ column is added, along with a filter for the periods where the sick note is still missing.

Payroll & DATEV

At the end of the month the export page produces a DATEV import file for payroll — either as Lohn & Gehalt (LuG, ASCII/CSV) or as LODAS. The month, the scope (everyone, one group or one person), the format and the level are chosen before downloading.

What gets exported

• Actual hours, overtime and premiums.
• Leave, sickness and release from duty as days (half days 0.5).
• The level either as monthly values only, or monthly plus daily values.

Wage types & personnel numbers

The wage type numbers come from the settings under DATEV (along with the adviser and client numbers); a number stored on a premium takes precedence. Personnel numbers are maintained per user. If wage types or a personnel number are missing, a warning appears and the employees affected are skipped.

Members of the system groups (inactive / former employees) are not exported. Corrections to the leave account do not appear in the export — only real days of leave; sickness corrections, by contrast, do.

Sick notes from the payroll software

It works the other way round too: the payroll software retrieves the electronic sick note (eAU) from the health insurance fund. Its absence records are exported there as CSV and uploaded under Settings in the „Krankmeldungen aus dem Lohnprogramm“ (sick notes from the payroll software) card. The first time, the columns (personnel number, from, to, optionally the type) and the types are mapped once; after that, uploading is all it takes. A preview first shows what is new, what is already there and which rows cannot be matched — nothing is written until you press the button.

Uploading again creates no duplicates, existing absences are never overwritten, and leave in the file is left alone — leave is requested and approved in ITN-Zeiterfassung. Sick notes imported this way count as „AU liegt vor“ (sick note received) for the sick note check.

Mobile app

The mobile app runs as an installable PWA in the browser at …/app — without an app store and without a rollout by IT. It is aimed at staff who clock in where the work happens.

Installation & pairing the device

The app is opened in the browser and added to the home screen. After the first sign-in the device registers itself and shows a device number. The employee gives that to an administrator, who assigns the phone to a user under Administration → Settings → Devices and approves it. Only after approval do the tiles the person is entitled to — for clocking and for reports — appear.

GPS required

Location is mandatory when clocking; the first time, „precise location“ has to be permitted. If the positioning is too imprecise, the entry is rejected with a note — wait a moment and try again.

On an iPhone, location has to be set to „allow“ in the settings for Safari or for the website, otherwise every attempt to clock will fail.

The offline queue

Without a connection, entries are stored locally and transmitted with their original time once a connection returns. That works even if the app was closed before the location fix arrived — it catches up by itself. Every entry shows its status: transmitted ✓ or waiting ⏳.

Requests on the move

A tile of its own leads to the requests: applying for leave and other absences, adding a forgotten clocking time for a single day, or cancelling an absence already entered. The status of every submission is visible there, open ones can be withdrawn, and the month selector reaches older ones. Decisions are deliberately made only at a desk.

The account card & your own reports

The home screen shows hours worked, target, balance, remaining leave, leave planned or upcoming, and the amount still free to plan. Through „reports“ an employee calls up their own monthly report straight on the phone.

For buffered entries to arrive, the app should occasionally be opened with an internet connection and location active.

Time clock / PIN terminal

The PIN terminal turns a tablet into a fixed time clock for the whole team. It is opened in the browser at …/kiosk: tap the action, enter your personal PIN, done — the PIN identifies the person clocking and takes the place of signing in.

Operation & confirmation

After clocking, a confirmation fills the screen: a greeting with the first name, the action recorded with its time, and cards showing „your overtime“ (when negative, „still to make up“, as of the previous evening), „to work today“ and „your remaining leave“; on leaving, „worked today“ is added. It stays for about eight seconds, and a tap hides it at once. If an unread important message is waiting, it appears straight after the PIN as an „⚠️ ACHTUNG“ (attention) window and is confirmed with „Gelesen und verstanden“ (read and understood). The company logo is shown in the branding corner. The display size scales the whole PIN terminal display, from small to extra large, and takes effect immediately — „standard“ is tuned for 8- to 9-inch tablets.

Your own reports by PIN

Through the reports icon and their own PIN, each person sees their own monthly or daily report; only their own hours are shown.

The offline buffer & settings

If the network drops, clocking carries on working: the entry is stored on the device with its original time, and the confirmation says „saved · no connection“. Once the connection returns, the PIN terminal transmits every entry by itself; a line on the home screen shows how many are still waiting. On first start the terminal ID and secret from the administration are entered; the cog opens the settings after the administrator PIN, including the full-screen lock.

For unattended continuous operation there is additionally an Android PIN terminal app of our own with autostart, which locks the tablet straight into the time clock after switching on.

RFID terminal: clocking with a chip

The time clock is also available as an RFID terminal: a Raspberry Pi with a 7-inch touch display and a chip reader beneath it; an arrow on the screen points to the reader. To set it up, the hardware type in the terminal list is switched from „Tablet (PIN)“ to „RFID-Terminal (Chip)“. On the Pi, the „Startadresse für den Raspberry Pi“ (start address for the Raspberry Pi) is entered as the browser's start page — it contains the pairing, so no keyboard is needed for it.

• Holding up the chip is enough: with no button pressed first, the terminal records the matching action — anyone signed out arrives, anyone present leaves, anyone on a break ends it.
• Button first for a break, an errand or another clocking reason, then the chip. Only after the button does the number pad appear: anyone who has forgotten their chip clocks in there with their PIN.
• No double entries: if someone holds up their chip a second time within 20 seconds, nothing is recorded — the terminal shows „already recorded“.
• Teaching in new chips: an unknown chip is not recorded. Its code appears in large type on the terminal and shows up in the personnel record under „Zuletzt am RFID-Terminal unbekannt“ (last unknown at the RFID terminal) — one click takes it over.
• Without a network the terminal stores entries just as the tablet does, but only if its clock has been synchronised with the server since its last start: the Raspberry Pi has no battery-backed clock. Otherwise it reports „no connection“ rather than storing entries with the wrong time.

„My reports“ and confirming important messages work with the chip too.

Datafox hardware terminals

For entrances, production floors and outdoor areas, robust RFID terminals of the Datafox EVO series are available. They read RFID chips — and, depending on the model, fingerprints — and report every entry directly and encrypted to the server; the browser is not involved, and no server of your own is needed on site.

Chips, biometrics & assignment

Chips are stored per employee as transponders in the personnel record (the number being the chip's UID); several chips per person are possible, and „active“ controls whether they may be used for clocking. On models with a fingerprint sensor the biometric mapping stays in the device — no fingerprint leaves the terminal. If the network drops, the device buffers the entries and sends them on later with their original time.

EVO 2.8

The compact classic for arriving and leaving: a 2.8-inch colour display, robust keys and an RFID reader — the slim option beside the door.

EVO 3.5 Pure Fingerprint

A 3.5-inch touch display with RFID plus biometric identification by fingerprint — clocking with no chip and no PIN.

EVO 5.0 Pure

A generous 5-inch touch display with freely configurable buttons — plenty of room for clear labelling, and glove operation on request.

Setup

Setup happens in two steps: the terminal is created in the application under Administration → Settings → Terminals and is given an ID and a secret. On the device, HTTP(S) with basic authentication is set as the access method — the username being the terminal ID and the password the secret — and /terminal/datafox with the tenant ID is entered as the send path. The serial number appears automatically in the terminal list as soon as the device has reported in for the first time.

Clocking by chip is possible without a Datafox device too: with the RFID terminal on a Raspberry Pi (chapter 15).

Live attendance

The attendance board shows in real time who is currently in. It suits attendance terminals and refreshes itself.

The board is divided into three columns:

• Present: currently clocked in, with the time since when.
• Missing (should be here): a target above 0 today, but not present.
• Away (no target): no daily target today — a day off, leave or sickness.

„Group“ narrows the display down. The visibility of individual people can be switched off per user.

Location checking / geofencing

Locations define permitted places (a geofence) at which clocking by phone or desktop widget is allowed. The check is opt-in and off by default; without it being switched on, locations serve only as information.

Creating permitted places

A location consists of a name, coordinates and a radius. The coordinates can be derived from an address or taken from a real entry made on a phone (➕📍 in the time tracking view). The tolerance is the radius plus the current GPS accuracy (capped at the top), so that imprecise positioning is not rejected out of hand.

Levels & assignment

The check is switched on under Settings → Location check, separately for the phone and the desktop widget. For each channel there are three levels: off (no check), mark only (the entry is allowed but flagged with ⚠️) and block (an entry outside is prevented). For each device it can be set whether it is exempt from the check (field service, say) and which permitted locations it is restricted to.

Entries captured offline and submitted later are never blocked, only flagged. Ordinary clocking through the dashboard is not checked at all.

Log — who changed what

Every change to hours, absences, master data and settings is written down. The log shows the time, the person responsible, the operation and the employee affected — and, on a click, the details, which for a corrected entry includes the value it had before.

It can be filtered by period, by area (clocking entries, absences, requests, users, settings …) and by person; the filtered list can be exported as CSV. Operations with no person named come from automatic runs, such as emptying the recycle bin once its period has expired.

Who sees what is narrowly drawn: administrators see every operation in their company, department heads only those of their own groups, and employees nothing at all. The log is a record view — entries can be neither changed nor deleted. Deleted clocking entries are brought back through the recycle bin in the time tracking view.

Administration & security

Administration brings together users, groups, devices, terminals, public holidays, settings and licences. The application runs as a hosted cloud service accessed over HTTPS in Germany.

Roles & responsibilities

There are four roles: employee (clock in, see your own hours, make submissions), department head (additionally maintain the hours of their own groups and decide their submissions, with no access to administration), administrator and super administrator. Additional rights come on top, such as „edit hours“ (which can be limited to particular groups), „see the duty roster“ or visibility of the project costing.

For requests, the management status can be granted independently of all that — to any number of people. It decides the submissions of everyone for whom no line manager of their own is stored, and grants no other rights. A line manager can be named per person; only those entitled to decide can be selected.

The personnel record

Clicking a name opens the personnel record. Above everything sits a row of core data (active, role, group, working time model, remaining leave, responsibility), and below it five tabs: master data (address, the start and end of time recording, leave entitlement including its history, the internal hourly rate), account & access (role, rights, password, PIN terminal PIN), requests & school (responsibility, school timetables), recording (locations, transponders, calendar) and documents (a memo, a file store). Every card carries an (i) with an explanation of its fields.

Groups & editor rights

Groups bundle staff for viewing and evaluation; every user belongs to exactly one group and is moved by drag and drop. Two system groups — „inactive employees“ and „former employees“ — always come last and cannot be deleted or renamed. Anyone moved there has their account deactivated (no sign-in, no clocking, no changes, no export) and no longer counts towards the licence.

Devices & terminals

Under Devices, phones are approved, assigned to an employee and set up in their rights (clocking on or off, maximum GPS imprecision, location exemptions). Terminals each receive an ID and a secret for setting them up on the device. There are three kinds: time clocks (as a tablet with PIN, as an RFID terminal with chip on a Raspberry Pi, or as Datafox hardware), the attendance board, and the whiteboard, which shows the shift plan on the wall (chapter 9).

Public holidays & settings

Public holidays are imported per region and supplemented with your own one-off or annually recurring dates (a company shutdown, for instance); on a public holiday the target follows the model's public holiday rule. The settings bring together the time zone and date format, the global clocking buttons, the recycle bin period, the location check, the sick note check (chapter 5), the upload of sick notes from the payroll software (chapter 13) and the interfaces (DATEV, email/SMTP).

Add-on module: project time with project budget

Project time recording can be added on: time is clocked to customer, project and activity — at a desk or on a phone, with journeys and a visit report — and the project report evaluates it by period, customer, project and employee. For each project an hours budget and a revenue budget in euros can be stored, both optional and independent of each other, plus a warning threshold (default 80 %). The project report shows the consumption over the whole life of the project as a bar with a traffic light: „OK“, „WARNING“ from the warning threshold, and „EXCEEDED“ from 100 %.

Licences & the peak overview

The licence page shows how many accounts are active at once. What counts is the highest number of simultaneously active accounts within a month (the peak), not the number at month end. It shows the current figure, the highest so far this month, the inactive accounts, a monthly history and a free period query.

Multi-tenancy & operation

The application is multi-tenant; every data query is bound to a tenant. It runs as a hosted cloud service accessed over HTTPS in Germany. Employees and administrators need only a current browser, the mobile app needs an iPhone or Android device as a PWA, the PIN terminal any tablet, and the RFID terminal a Raspberry Pi with a 7-inch touch display and a chip reader. Anyone holding the same login in several tenants chooses at sign-in which one they want.

Protection against attacks from outside

Delivery is hardened: strict browser rules (a content security policy, no embedding in other people's pages, enforced HTTPS), a session cookie that is invisible to scripts and additionally marked „secure“ behind HTTPS, and blocked foreign origins. Against credential guessing there are brakes: at sign-in per origin, on setup links, and on the PIN terminal PIN per terminal — the last of these locks for a short while after several failed attempts and releases immediately on a correct PIN.

Every change to hours, absences, master data and settings ends up in the log. Deleting a clocking entry is a recycle bin operation with a period, not immediate removal — so a slip of the hand stays curable.