Terms of use and privacy policy
String Workforce — String Systems
1. Definitions and scope
The “Platform” is the String Workforce attendance service provided by String Systems (Jordan), in its cloud and local editions. The “Company” is the organisation that registers an account. A “User” is any member of the Company's administration who accesses the account. An “Employee” is a person whose data and attendance are recorded in the Company's account.
This document (terms of use, privacy policy and data processing agreement) is the entire contract between String Systems and the Company and applies to every User and Employee who uses the Platform. Where the Company has a signed agreement with String Systems, that agreement prevails over anything inconsistent here.
2. Acceptance and authority
By registering an account, clicking “I agree” or using the Platform you accept these terms. This electronic acceptance is a valid and binding agreement under the Jordanian Electronic Transactions Law No. 15 of 2015.
The person who registers the account confirms that they are of legal age and legally authorised to bind the Company to these terms; the Company remains responsible for everything done from its account.
3. The account and the Company's responsibilities
The Company is responsible for the accuracy of the data it enters, for its administration and employee accounts, for keeping passwords and API keys confidential, and for telling us immediately about any unauthorised use.
The Company is the sole employer of its Employees and is responsible for complying with labour law, social security and its approved internal regulations, and for informing its Employees that attendance is recorded electronically and what data is collected when they clock in. The Platform is a tool for recording and calculating attendance; it does not replace the Company's decisions or its legal advice.
The Company publishes its own policy for its Employees from the Settings page (a ready-made text based on the labour law of its country is proposed at registration). The policy is shown to every Employee for acceptance before they can clock in, and the text each Employee accepted stays visible in their account.
4. Data processing roles (data processing agreement)
The Company is the “controller” of its Employees' data and String Systems is a “processor” that processes it on the Company's behalf solely to provide the service and according to its documented instructions, including these terms and the account settings.
As processor we undertake to: keep the data confidential and limit access to staff who need it to provide support; apply appropriate security measures; use sub-processors only for hosting, email and backups; help the Company answer Employees' requests about their data; notify the Company of any security breach affecting its data without undue delay and within 72 hours of becoming aware of it; and delete or return the Company's data when the service ends as set out in section 9.
5. Trial, subscription and payment
Every Company starts with a free fourteen-day trial with all features. The Company then chooses one of the plans shown on the Subscription page; the plan sets the number of Employees and locations and how long attendance photos are kept.
Subscriptions are paid in advance for the chosen period using the methods shown on the Subscription page and are activated once payment is confirmed. Prices exclude taxes and duties payable by law, which the Company bears. Fees for a period that has started are not refunded unless the law requires it or we are unable to provide the service for a reason attributable to us.
When a subscription or trial ends the Company gets a grace period during which the service stays available for renewal; after that, access to the account is locked while the data is kept under section 9 until the subscription is renewed or the data is deleted. We send an email reminder before and at expiry. We may change prices with at least thirty days' notice; a change never applies to a period already paid.
6. The local edition and its licence
The local edition is software installed on a server the Company owns and activated with a licence key tied to one installation. The licence is personal to the Company and non-transferable, is renewed with the subscription, and the key remains valid across updates.
The software may not be copied, modified, decompiled, reverse-engineered, rented out or have its licensing mechanism bypassed. The Company is responsible for its server, backups, security, certificates and operating-system updates; we are responsible for the software itself and its updates.
7. The data we collect
Company and administration data: name, email address, phone number, country, company settings and subscription history.
Employee data entered by the Company: name, employee number, department, job title, contact details and whatever profile data the Company chooses to add.
Attendance data: clock-in, clock-out, break and departure times, the location and its accuracy at the moment of recording, the verification photo if the Company enables it, the device or browser identifier, the network (IP) address, and the records of biometric terminals the Company connects. If the Company enables face verification, the Employee's reference image and verification frames are processed for that purpose only and never used for anything else.
Audit and usage logs: who performed each action, when and from which address, and sign-in logs, to protect accounts and review changes. We collect no more data than the service needs.
8. How we use the data
We use the data only to run the service: recording and calculating attendance, producing the reports and payroll figures the Company requests, sending notifications and account and subscription emails, technical support, and protecting accounts and preventing abuse.
We never sell or rent the data, never use it for advertising or third-party marketing, never use Company or Employee data to train artificial-intelligence models, and look at a Company's data only as far as needed to provide support or fix a problem.
9. Retention, deletion and export
Attendance photos are deleted automatically when the retention period of the Company's plan ends. Sign-in and audit logs are kept for twelve months and then deleted unless the law requires otherwise.
All other Company data is kept for the duration of the subscription and the grace period. After the account is closed or the grace period ends without renewal we keep the data for ninety days so the Company can export it or renew, then delete it permanently within a further thirty days, backups included. The Company can export its data at any time in Excel and CSV formats from the reports and employee pages, and can ask us to delete its account by email.
The Company must export the attendance records it needs before deletion in order to meet the record-keeping duties that labour law imposes on it.
10. Data security
Connections to the service are encrypted (HTTPS), passwords are never stored in clear text but hashed with a modern algorithm, each Company's data is logically isolated from every other, administrative access to the servers is key-based and fully logged, and encrypted backups are taken daily.
The service offers two-factor authentication for administration users, device binding for Employees and geofenced attendance, and we recommend enabling them. The Company remains responsible for its Employees' devices, its network and its passwords.
11. Data sharing and service providers
We share data with no one except our hosting, email and backup providers, to the extent needed to run the service and under confidentiality obligations, or when the law, a court order or an official request from a competent authority requires it, in which case we inform the Company unless the law forbids it.
Data may be stored on servers outside the Company's country. We choose providers that apply recognised security measures and remain answerable to the Company for their processing on our behalf.
12. Rights of Employees and data subjects
Employees can view their attendance record in their account and request a correction, and can see in their account the policies they accepted and when.
Personal data is processed in accordance with the Jordanian Personal Data Protection Law No. 24 of 2023 and the equivalent legislation of the Company's country. Requests for access, correction, deletion or objection are made to the Company as controller, and we help it respond within the legal time limits. Employees also have the right to complain to the data-protection authority of their country.
Photos, location and biometric data are sensitive; the Company therefore enables these features only after informing its Employees of them and of their legal basis, and the data is used exclusively to evidence attendance and never shared outside the Company's account.
13. Acceptable use
The Platform may not be used for unlawful purposes, to enter false attendance data, to clock in on someone else's behalf, to tamper with the location or the device, to attempt access to another Company's data, to probe, attack, disrupt or overload the service, to send unsolicited messages through it, or to resell the service without a written agreement.
The API is available within reasonable usage limits set by the plan; we may throttle excessive use or disable abusive keys. We may suspend or terminate an account in breach after a warning, or immediately where the breach is serious or threatens the service or other users.
14. Intellectual property
The Platform, its software, design, trademarks and documentation belong to String Systems and are protected by intellectual-property laws; these terms grant only a limited, non-exclusive, non-transferable right of use for the duration of the subscription. The Company's and its Employees' data belong to the Company, which grants us a licence to use it only as needed to provide the service. We may use any improvement suggestion the Company makes without compensation.
15. Availability and support
We make reasonable efforts to keep the cloud edition available at least 99.5% of each month, excluding scheduled maintenance announced in advance whenever possible and outages beyond our control. Support is provided by email on business days and we aim to answer within two business days.
16. Disclaimer
The service is provided “as is” and “as available”. We do not warrant that it will be uninterrupted or error-free, nor the accuracy of attendance data recorded by Employees or devices or of the locations their phones report. Reports and calculations (including overtime, deductions and payroll figures) are aids that depend on the Company's settings and data; the Company is responsible for reviewing them before relying on them and for its decisions towards its Employees. The Platform gives no legal or accounting advice, and the ready-made legal texts in it are templates the Company must review with its adviser.
17. Limitation of liability
To the extent permitted by law, we are not liable for any indirect or consequential loss or for loss of profits, data or reputation, and our total liability for any claim relating to the service does not exceed the amount the Company paid us in the twelve months before the event. This clause does not limit liability that the law does not allow to be limited, such as liability for fraud or gross negligence.
18. Indemnity
The Company indemnifies us against any claim or loss arising from its breach of these terms or of the law, from its data, or from its disputes with its Employees or any third party in connection with its use of the Platform, including reasonable legal fees.
19. Term, termination and suspension
These terms apply from registration until the account is closed. The Company may close its account at any time from the Subscription page or by emailing us. We may suspend or terminate the account for non-payment after the grace period, for a breach of section 13, where the law requires it, or if we discontinue the service with at least ninety days' notice.
On termination the retention, export and deletion rules of section 9 apply, and the clauses that by their nature survive (intellectual property, limitation of liability, indemnity, governing law) remain in force.
20. Force majeure
Neither party is liable for delay or failure in performing its obligations (other than payment) caused by circumstances beyond its reasonable control, such as natural disasters, war, civil unrest, general internet or power outages and acts of government.
21. Changes to these terms
We may update these terms from time to time. The updated version is published on this page with the date of the last update, and we notify Companies of material changes by email at least thirty days before they take effect. Continued use of the service after that date means acceptance; a Company that does not agree may close its account before then.
22. Governing law and disputes
These terms are governed by and construed under the laws of the Hashemite Kingdom of Jordan. The parties try to settle any dispute amicably within thirty days of written notice; failing that, the courts of Amman have jurisdiction, without prejudice to any mandatory rights that the law of the Company's country grants the Company or its Employees.
This document was written in Arabic and translated into other languages for convenience; in case of discrepancy the Arabic text prevails.
23. General provisions
If a competent authority holds any clause invalid, the remaining clauses stay in force. The Company may not assign its rights under these terms without our written consent; we may assign them to a successor that continues to provide the service. Formal notices are sent by email to the Company's registered address and to our address below and are deemed received on the next business day. Our not enforcing a clause is not a waiver of it.
24. Contact
For any question about these terms or your data, to exercise your rights, or to report a security issue, write to us at: info@stringsystems.net