§ Law & obligations · 12 min read

Works council and co-determination

The rule

The courts interpret this broadly: it is enough for a device to be capable of monitoring. Intent does not matter.

Electronic time tracking therefore requires co-determination. Always. Even if nobody intends to monitor anyone.

What this means in practice

If your business has a works council:

Introducing Zeitflex requires its consent — before you start, not afterwards.
The usual route is a works agreement.
If it is introduced without consent, the works council can have its use prohibited. Data created in the meantime is subject to a ban on its use.

If your business has no works council, co-determination does not apply. The duty to inform employees under Art. 13 GDPR remains.

What belongs in the works agreement

A sound agreement answers at least these points:

Purpose. Meeting the record-keeping duty and preparing payroll — not performance monitoring.
Which data is processed (list below).
Who has access to what, broken down by role.
How long data is retained and when it is deleted.
Reports: which are permitted and which are expressly not — in particular the ban on individual performance profiles.
Corrections: who makes them, and that each one is justified.
GPS: whether it is switched on, and if so, with what accuracy and for what purpose.
Modules: which add-on modules (chat, photo documentation, project reports) are switched on — see the next section.
Employees’ rights: access to their own data, objection, complaints procedure.
Term and termination of the agreement.

Which modules you should agree on beforehand

Zeitflex consists of a core (clocking in/out, timesheet, absences, month-end close) and modules that you switch on and off individually under Settings → Modules. Five of them are capable of monitoring behaviour or performance and therefore belong explicitly in the agreement — even though Zeitflex deliberately built them so that a per-person analysis is difficult or impossible.

Team chat

The chat never switches itself on: it is not one of the core features, and no industry template presets it — not even as a recommendation. It is also the only module that requires explicit confirmation to switch on. Anyone who flips the switch first sees a note on § 87(1) no. 6 BetrVG and on the question of whether a data protection impact assessment under Art. 35 GDPR is needed. Only after confirming with Understood, switch on chat is it active. Switching it off works at any time without a prompt.

What the chat does and does not do technically:

Messages are deleted after 90 days at most. They are not a record.
There is no read receipt per person. Zeitflex only stores up to which message someone has read — never when — and discloses this to no one.
A group needs at least three people — the chat is not meant for one-to-one conversations. Only if the business has fewer active people overall does the minimum drop to that number.
The tax adviser never sees the chat.

More in Team chat: a shout across the yard, no archive.

GPS when clocking in/out

GPS is preset in no industry template; a template may only recommend it. The business makes the decision under Settings → GPS & privacy. In front of the switch there is the legal basis (legitimate interest in being able to prove the place of work, Art. 6(1)(f) GDPR) and the request to inform the team before activating it.

The location is stored only at the moment of clocking in and out.
This applies only to the time clock in the browser and the mobile app — never to the wall terminal.
There is no continuous tracking and no movement profile.
GPS clocking is a feature of the Pro plan.

In detail in Location when clocking in/out (GPS).

Photo documentation

Photos are proof of work for the job — they are attached to the project or the shift, not to a person. The gallery under Documents has exactly two filters: project and search text. There is no filter by employee there, and no “who took how many photos” report either — both deliberately. Above every photo view there is the purpose limitation notice.

Two points that belong in the agreement:

If GPS is switched on for the business, a photo can carry the **location where it was taken**. If GPS is off, Zeitflex discards the coordinate on upload — the photo is still saved.
Photos are retained for five years from the end of the year (limitation period for defects in buildings, § 634a(1) no. 2 BGB (German Civil Code)) and then deleted automatically.

Project reports and individual productivity

The Project/cost-centre times module books working time to jobs. The report under Projects shows hours, labour costs and contribution margin per job — that is a job report, not a report on people. The only sensitive part is the Productivity tab: the share of time booked to projects.

This is how Zeitflex limits this figure:

The team value is always visible. If the team has fewer than three people, Zeitflex marks it as not meaningful — the average of two people is not anonymisation.
Individual values of other people are visible only to owners and managers. Employees see only their own row (Art. 15 GDPR).
Above every productivity view and on every export there is a note that person-related reports require co-determination under § 87(1) no. 6 BetrVG and that, without a works council, the principle of data minimisation (Art. 5(1)(c) GDPR) applies: team value first.

If you agree with the works council that individual values will not be used, write that into the agreement — Zeitflex has no switch that hides individual values from owners and managers. Background on job reports: Was the job worth it?

Announcements with read confirmation

Announcements are switched on as a core feature because they are one-way: a message, not a reply function. If an announcement requires a read confirmation, Zeitflex stores who confirmed and when — as a record, for example for safety training. Only the author and management see this, never colleagues. Whether you use read confirmations should be stated in the agreement.

Which data Zeitflex processes

You can copy this list directly into an agreement or into the information provided under § 90 BetrVG:

Type of data	When	Who sees it
Name, email, personnel number, start date	Master data	Owner, management
Date of birth	only if entered — for youth employment protection	Owner, management
Employment type, working-time model, hourly wage, vacation entitlement	Master data	Owner, management
Start, end, duration of working time, breaks	on every clock-in/out	Person concerned, owner, management, tax adviser
Recording method (time clock on the terminal, web, mobile app or clock-ins delivered later from offline, late entry by hand, import)	on every clock-in/out	Owner, management
Fetched via the interface: start, end, duration and breaks per entry, plus approval status, recording method, name and personnel number — no wage values, no location, no notes, no absences	only if the owner or management create an API key with read access (Pro plan); one month per request, all people in the business	the connected third-party program and whoever has access there
Sent by webhook: the person as an internal ID instead of a name, plus, per selected event — start of a clock-in with recording method (for a late entry also the end); entered, approved or cancelled absence with its type, from, to and half-day — sickness types as a neutral absence: “Sickness” and “Child sick” are sent as “ABWESENHEIT”, vacation, time off in lieu and the other types recognisably; closed month with the number of items; published shift plan with week and number of shifts — no names, no wage values, no location, no notes, no medical certificates	only if the owner or management add a webhook address and select events for it (Pro plan); immediately on every selected event	the connected third-party program and whoever has access there
Location at the moment of clocking in/out	only if GPS is activated	Owner, management
Absence type and period	with requests	Person concerned, owner, management, tax adviser
Medical certificate file	only if uploaded	Person concerned, owner, management — not the tax adviser
Shifts, positions, swaps	during planning	everyone involved
Photo for the job, where applicable location where it was taken	only with photo documentation	People involved in the project, owner, management
Chat messages	only with chat switched on, 90 days at most	Members of the group concerned
Read confirmation for announcements (who, when)	only if required	Author, owner, management
Change log: who, when, what, why	on every correction	Owner, management, tax adviser

About the interface: Without an API key, nothing leaves the business through it. If you create one, the connected program fetches the times of all employees for a month — what it does with them is no longer controlled by Zeitflex. That is why it belongs in the agreement: which program, for what purpose, who has access there. Zeitflex records in the change log that data was fetched — at most one line per key, IP address and month within 24 hours, not every single request. A key remains valid when the person who created it leaves; the owner and management can revoke it under Settings → API & webhooks. Details: Connecting Zeitflex to other systems.

About webhooks: They are the opposite direction — on every selected event Zeitflex immediately sends a message to the address entered, without anyone there having to fetch it. Without an address entered, nothing leaves through this route. The person appears in the message only as an internal ID; if the same program also fetches data with an API key, it can match that ID to a name using that response. The absence events are the sensitive part. Since 4 October 2026, “Sickness” and “Child sick” are sent there only as the neutral type “ABWESENHEIT”. This does not fully hide the health data, though: because vacation and all other types stay recognisable, the third-party program can infer from “ABWESENHEIT” that it was none of them — and learns from the from and to dates when. Which of the two types it was stays hidden; reason texts and medical certificates are never included. Adding, changing and deleting a webhook address are recorded in the change log, individual deliveries only when they fail. Which program receives which events therefore also belongs in the agreement.

What Zeitflex does NOT process: no continuous location tracking, no analysis of keyboard or mouse activity, no screen monitoring, no camera surveillance, no presence detection via Wi-Fi or Bluetooth, no biometric recording of employees, no read receipts in the chat, no photo count per person.

GPS is the most sensitive point

Location data is particularly sensitive. Zeitflex’s approach:

GPS is off by default.
If switched on, the location is recorded only at the moment of clocking in/out — no continuous tracking.
No movement profile is created.

Even so, GPS belongs explicitly in the works agreement. Permanent location tracking would require co-determination and would hardly be defensible under data protection law — which is why we do not build it.

Public sector

There, the staff representation law of the federal government or of the respective federal state applies, with corresponding rules. The process is similar; the sections are different.

Frequently asked questions

We switched Zeitflex on before the works agreement. What now?

Approach the works council immediately and present the data list from this article. Until an agreement is reached, switch off all modules that are not part of the record-keeping duty — chat, GPS, photo documentation, project reports. You can do this under Settings → Modules without losing data: whatever is switched off disappears from the menu and reports, the data is kept and comes back when you switch it on again. Plain time tracking under § 17 MiLoG (German Minimum Wage Act) can usually be settled with the works council more quickly than the add-on modules.

The works council wants nobody to see individual values in productivity. Is that possible?

Not with a switch. Owners and managers see the individual rows as soon as the Project/cost-centre times module is switched on and the plan includes project reports. What you can do: rule out the use of individual values in the agreement, or switch the module off entirely. Booking time to projects still works then — only the report page disappears.

We are a business with eight people and no works council. Do I still have to do anything?

Co-determination does not apply. What remains: inform employees under Art. 13 GDPR about which data Zeitflex processes — the table above is sufficient for this. For GPS, the following also applies: inform the team before switching it on; the settings tab says so too.

Can the works council look up in Zeitflex itself what is stored?

There is no separate role for the works council. What you can provide: the data list from this article, the retention periods from Retention periods and the data access report under Art. 15 GDPR, which every person concerned can retrieve themselves under Settings → Data & deletion — regardless of their role. Anyone who wants to know what Zeitflex stores about them will find it in What Zeitflex stores about me.

Still stuck?

We do not currently provide a model agreement — it would be legal advice, and a poor template is worse than none. The data list above does, however, cover the system description that your works council can request under § 90 BetrVG. For questions about the modules, Support can help; for clocking in/out itself, see Clocking in/out: all methods, and for the obligation behind it, Record-keeping duty.

Last checked on 04/10/2026. We check every article against the application — if something no longer matches, that is a bug and not a difference of opinion.

Dieser Artikel auf Deutsch

Was this helpful?