Using Zono Workforce with your staff

Zono Workforce keeps your staff's information on your devices, not ours. That makes your business the one responsible for it under data protection law. This page explains what that involves and gives you a notice you can hand to your team.

General information, not legal advice. Last updated 4 November 2026.

What the app holds about your staff

• Name, staff ID / payroll number, role, date of birth (for under-18 break and hours rules), contracted hours, usual availability, holiday allowance, email address (optional).
• Rotas, holiday, sickness, unpaid leave and training days.
• Clock-in, break and clock-out times, and, if you turn on clocking by phone, where the person was at that moment.
• Their login (username and a hashed password) and a log of sign-ins and changes.

It's stored encrypted on your devices and, if you share it between devices, in your own OneDrive, Google Drive or network folder. Team members' own phones only get their own shifts, clock times and holiday.

Clock-in location

• The phone's location is read only at the moment someone clocks in or out, to check they're within the distance of their work site you set. It isn't tracked at any other time.
• For people marked "Works on the move", the location at clocking is recorded on the timesheet instead of checked.
• Tell staff before you turn this on, and keep it proportionate. A short written assessment of why you need it (a data protection impact assessment) is good practice. See the ICO's guidance on monitoring workers.
• Staff without a suitable phone can clock in on the shop's store terminal instead, which doesn't use location.

Fingerprint and face sign-in

Fingerprint, face and Windows Hello are checked by the phone or PC itself. Neither your business nor ZonoSoft ever receives the fingerprint or face, so you aren't collecting biometric data. It's optional for each person; they can always use their password.

Your main responsibilities

• Tell your staff what you record and why (the template below covers the app).
• Lawful basis: usually running the employment contract, legal obligations (working time, pay and holiday records) and your legitimate interests (checking attendance).
• Keep it secure: give each person their own login, turn on two-step sign-in for managers, and keep devices locked.
• Keep it only as long as you need it: pay and working-time records are commonly kept for 3 to 6 years. Archive people who leave and delete their details when you no longer need them.
• Staff requests: if someone asks for a copy of their information, the rota, timesheet and payroll screens can be printed or exported.

Template notice for your staff

Copy this into your staff handbook or noticeboard and fill in the parts in brackets.