Workpass records attendance using your location and — unless your employer has switched to device unlock — a selfie. Your face is sensitive personal information under Philippine law, so it is used only with your consent, only to verify your own attendance, and never sold or used to advertise to you.
Two different organisations handle your information when you use Workpass, and the Data Privacy Act of 2012 (RA 10173) gives them different duties.
For anything in this policy you can reach our Data Protection Officer, Workpass at privacy@workpass.ph.
Account and identity: your name, mobile number, your email address where you have one, your role at your workplace, and your profile photo if you add one.
Employment and pay: your rate, pay schedule, branch, shift, leave, deductions, and your SSS, PhilHealth, Pag-IBIG and TIN numbers where your employer records them. These come from your employer, not from us.
Attendance: the date and time of each clock in and out, the branch, your device's location at that moment, how accurate that location was, and basic device information such as model, operating system and app version.
Biometric information, where your employer uses selfie attendance: a photo taken at each clock in and out, and a face template — a list of 128 numbers describing your face, which cannot be turned back into a photograph. Both are used only to check that the person clocking in is you.
Activity feed, unless you switch it off: that you started and finished a shift, and which badges you earned. Never your clock times, your branch or your location.
Support and security: messages you send us, and records of sign-ins and failed sign-ins.
Your location is read at the single moment you press clock in or clock out, to confirm you are at your workplace. That is the only time the app asks for it.
Workpass does not track your location continuously, does not run in the background to follow you, and does not record where you go between shifts or after your shift ends. Where your employer has set up a mobile branch — a stall, a site visit, a delivery round — there is no fixed point to measure against, and the app records only that the shift happened.
You can refuse location access in your phone's settings. Attendance through the app will not work without it, because there would be nothing to verify. Tell your manager, so your time can be recorded another way.
Under section 3(l) of the Data Privacy Act, information about a person's face is sensitive personal information. It is protected more strictly than an ordinary record, and it cannot be processed merely because it would be convenient for an employer.
So, where your employer uses selfie attendance:
You may withdraw your consent at any time by writing to privacy@workpass.ph or by telling your employer. Withdrawing it stops any further selfie processing. It does not undo attendance already recorded, and your employer will need another way to record your time — which the law also entitles them to ask for.
There is an alternative in which no biometric data reaches us at all. Where your employer switches on device unlock, you confirm a shift with your own phone's fingerprint or face unlock. Your fingerprint and your face stay inside your phone's secure hardware; the app never sees them, and neither do we. All that reaches Workpass is your phone's signed confirmation that the unlock succeeded. If you would rather not hand over a selfie, this is the thing to ask your employer for.
Different information rests on different grounds under the Act:
We do not process your information for advertising, and we do not make decisions about you by automated means alone. Whether a shift counts, whether an exception is approved, and what you are paid are all decided by a person at your company.
Your employer's owner, administrators and payroll managers, for the business you work at. Nobody at another business can see your records.
Your colleagues, but only what you deliberately share: your name, photo and role, and the shifts and badges you post to the activity feed. Your pay, your rate, your government numbers, your selfies and your clock times are never shown to a colleague who is not a payroll administrator.
Every Workpass user, but only if you switch on public sharing yourself. A public post carries your first name, your photo and a badge — never your surname, your workplace, your clock times or your location.
Our service providers, who process data on our instructions and for nothing else: Supabase (database, file storage and authentication), Vercel (hosting), Semaphore (the SMS that invites you), Resend (the emails we send), and our payment provider for your employer's subscription. Some store data outside the Philippines; where they do, we rely on their contractual data-protection commitments, as the Act requires.
Government agencies and courts, where the law requires it — a DOLE inspection of time records, or a lawful order.
We do not sell your personal information. There is no version of Workpass that is paid for with your data.
Attendance and payroll records are kept for as long as your employer's obligations require. Philippine labour rules require daily time and payroll records to be kept for at least three years, and tax rules require pay records to be kept longer.
Selfies are attendance evidence and are kept on the same basis, so a disputed shift can still be settled months later. Your face template is deleted when your employment record is closed, or when you withdraw consent, whichever comes first.
Activity posts are removed when you delete them, and are hidden from everyone the moment you switch sharing off.
When your employer closes their account, their records are deleted after a wind-down period during which they can export them.
The Data Privacy Act gives you the right to be informed, to object, to access your information, to have it corrected, to have it erased or blocked in the cases the Act allows, to be indemnified for damage caused by inaccurate or unlawfully obtained information, and to receive a copy of it in a portable form.
For your employment and attendance records, ask your employer: we process them on their instructions, and handing their records to someone else on request is not ours to do. For your account, write to privacy@workpass.ph. We answer within the periods the Act's implementing rules set.
If you are not satisfied, you may complain to the National Privacy Commission at privacy.gov.ph, or by email to complaints@privacy.gov.ph.
Access is enforced in the database itself, not only in the app. Every record carries the business it belongs to, and the rules deciding who may read it run on the server — so a signed-in user cannot reach another business's data by changing what the app asks for.
Selfies are held in private storage, reachable only through short-lived links issued to someone already entitled to see them. Attendance can only be written through checks that verify location, sequence and identity; the app cannot insert a record directly.
Traffic is encrypted in transit. Passwords are stored hashed by our authentication provider, and we never see them.
No system is perfectly secure. If a breach occurs that puts you at real risk of serious harm, we will notify the National Privacy Commission and the people affected, within the time the Act requires.
Workpass is for people in employment and is not intended for children. We do not knowingly create accounts for anyone below the minimum working age.
This policy is versioned. When we change it in a way that affects you, we raise the version and ask you to read and accept it again the next time you open the app. The version you accepted, and when, is recorded against your account.
This is version 2026-09-14, effective 8 September 2026.
Data Protection Officer, Workpass
Workpass, Bohol, Philippines
privacy@workpass.ph