Your data and privacy

Your workspace's data belongs to your company. This guide covers what that means under the Data Protection Act, 2020 (Jamaica) and what you can do yourself.

Who's responsible

• Your company is the data controller for your employees' information: you decide what goes into Ovrilo and why. Tell your staff what you record about them (for example in a staff privacy notice), and only collect what you need. For instance, ask for medical certificates only when your policy requires one.
• Ovrilo is the processor: we store and process that information only to run your workspace. The details are in our data-processing statement, alongside the terms of service and privacy notice.

How it's protected

• Your workspace has its own database and encryption keys; no other customer's data sits next to yours.
• Sensitive details are encrypted, and every connection is encrypted.
• People only see what their role and teams allow. Pay rates and pay items need pay access; sick notes are only visible to those who can see that person's time off.
• Every change to a punch keeps the original and records who changed it and why. The Activity log shows who did what.
• Our support staff only step in with your permission, for a limited time, and you're told each time.
• Your workspace is backed up every night.

When an employee asks about their data

Employees can see their own hours, roster, time off and profile in Me, and update their phone and emergency contact. If someone asks for a copy of what you hold, or for a correction:

1. Open their profile under Employees to check and correct their details.
2. Export their timecards from Timecards (print or PDF) and reports from Insights.
3. Still need something? WhatsApp us and we'll help you pull it together.

Taking your data with you

You can export timecards, Pay Run files and every Insights report at any time. Before you leave, WhatsApp us and we can help you export everything else.

Closing your workspace

WhatsApp us to close it. We keep the workspace for 90 days in case you change your mind, then delete its database, files, backups and encryption keys. Invoices are kept as long as the law requires.