Evidence and notices
Choose which evidence clock-ins record (face, selfies, location), on what basis, what employees are told, and how long it's kept.
Agoo is in early access. This page describes the feature as it ships to early-access organisations; screens are illustrative.
A clock-in always records who, where, when and how. Evidence is anything more: a face match at the kiosk, a selfie, or the phone's location check. Your organisation is the data controller and decides what to record, under the Data Protection Act, 2012 (Act 843). Agoo gives you the switches and keeps the records that show what you decided and what each employee was told.
The three evidence types
| Evidence | Records | Plans |
|---|---|---|
| Face | That the kiosk matched the employee's face. The template stays on the kiosk; Agoo never receives it. See Face clock-in. | Growth and above |
| Selfie | A photo taken with a QR, PIN, NFC or phone punch. Off, optional or required. Its metadata (including any GPS location) is removed when it's stored. | Starter and above |
| Location | With phone clock-in: whether the phone was inside the site's geofence (or on its Wi-Fi), and the fix's accuracy. Optionally the coordinates, and the Wi-Fi network's name and address. | Starter and above |
All three are off until you turn them on, in Console → Attendance → Settings → Evidence and notices (Owners and Admins publish notices and choose how long evidence is kept). Your developer can also set them with the attendance settings API. Sites can narrow or widen what the organisation allows.
Notices and basis
Before an evidence type can be switched on, you publish a notice: the plain explanation employees see of what is recorded, why, where it's kept and for how long. Each notice has a basis:
- Required by the organisation. You record your legal basis: the employment contract, a legal obligation, or your legitimate interests (Act 843, section 37(3)). Employees acknowledge the notice. Capture goes ahead whether or not they have acknowledged it yet, and they can't opt out. The API lists everyone who hasn't acknowledged the current version.
- Employee consent. Only employees who consent have that evidence recorded. Without consent it isn't captured, and a method that needs it isn't offered to them: they use another method, or the kiosk's fallback. They can withdraw consent at any time, and new capture stops at once.
Required is the default when you turn an evidence type on. Publishing a change makes a new version; employees then acknowledge (or consent to) that version. Notices, acknowledgements, consents and withdrawals are all kept with their dates, how they were given and who recorded them, and are written to the audit trail.
Only Owners and Admins, who hold the Data & privacy permission, can publish notices or change retention. API keys can't.
At the kiosk
When your organisation asks for a selfie with clock-ins, the kiosk shows your selfie notice to an employee who hasn't yet answered its current version, before they choose Clock in or Clock out:
- Required by the organisation: the notice, with I understand. The selfie is taken either way.
- Employee consent: the notice, asking whether they agree, with I agree and No, thanks. With no consent, no selfie is taken, and they still clock in.
I understand and I agree are recorded as an acknowledgement or a consent to that version of the notice, given at the kiosk, even when the kiosk is offline (the record reaches Agoo when it reconnects). Under a consent notice, the kiosk reminds them they can change their mind at any time in the Workspace app or by asking their manager. When a selfie is due, the kiosk takes it with the front camera after a 3, 2, 1 countdown, then records the punch.
Face clock-in at the kiosk, and its notice, are planned.
In the Workspace app
When an employee clocks in on their phone (iPhone, iPad or Android), the app shows your location notice before it first uses their location, and your selfie notice before it first takes a selfie, for each version they haven't answered:
- Required by the organisation: the notice, with I've read this. Location is checked, and a selfie taken when you ask for one, either way.
- Employee consent: the notice, with I agree and Not now. Without consent, the app doesn't use their location or take a selfie, and they clock in at the kiosk, or by scanning the kiosk's code where you allow it.
Answers given in the app are recorded like those at the kiosk, as given in the app, and wait on the phone when it's offline. In Me → Clock-in privacy, employees can read each notice again and see what they answered and when. Under a consent notice they can Withdraw my agreement; new capture stops from their next clock-in. An acknowledgement of a required notice can't be withdrawn, because it only records that they were told.
The app uses location only while its clock-in screen is open, never in the background. Coordinates leave the phone only when you keep coordinates; otherwise the app sends only whether the phone was inside the site's area, with the accuracy. In the same way, the Wi-Fi network's name and address are sent only when you keep them.
How long evidence is kept
| Evidence | Kept by default | You can choose |
|---|---|---|
| Selfies | 90 days | 1 day to 10 years, or until deleted |
| Coordinates | 90 days, then cleared from the punch | 1 day to 10 years, or until deleted |
| Location check result and accuracy, Wi-Fi match | With the punch, for your attendance retention (7 years by default) | |
| Face match result | With the punch |
Withdrawing consent stops new capture; evidence already recorded is kept until its retention date. A data subject request can still erase it. A legal hold pauses deletion for what it covers.
In the API
GET /attendance/settingsandPATCH /attendance/settingsread and change methods, evidence, notices and retention.GET /people/{person_id}/attendance-evidenceshows a person's status and the kiosks they're enrolled on;POSTrecords an acknowledgement or consent from a paper form or your HR system.GET /attendance/evidencelists everyone's status, such as who hasn't acknowledged the current notice.- Punches carry
selfie_file_id,location,wifiandface_checkonly when they have them. In consent mode, evidence for someone who hasn't consented returnsconsent_required.
Face clock-in
Let staff clock in by face at the kiosk, on the basis your organisation chooses, with a fallback that always works. Never used for visitors.
Rosters
Plan who works when at each site on a drag-and-drop roster, repeat it with patterns, import it from a spreadsheet and publish it to staff, who see their shifts in Agoo Workspace, claim open shifts and swap with colleagues, with the Labour Act's rest rules checked.