§ Law & obligations · 9 min read
Works council and co-determination
The rule
The courts interpret this broadly: it is enough for a device to be capable of monitoring. Intent does not matter.
Electronic time tracking therefore requires co-determination. Always. Even if nobody intends to monitor anyone.
What this means in practice
If your business has a works council:
- Introducing Zeitflex requires its consent — before you start, not afterwards.
- The usual route is a works agreement.
- If it is introduced without consent, the works council can have its use prohibited. Data created in the meantime is subject to a ban on its use.
If your business has no works council, co-determination does not apply. The duty to inform employees under Art. 13 GDPR remains.
What belongs in the works agreement
A sound agreement answers at least these points:
- Purpose. Meeting the record-keeping duty and preparing payroll — not performance monitoring.
- Which data is processed (list below).
- Who has access to what, broken down by role.
- How long data is retained and when it is deleted.
- Reports: which are permitted and which are expressly not — in particular the ban on individual performance profiles.
- Corrections: who makes them, and that each one is justified.
- GPS: whether it is switched on, and if so, with what accuracy and for what purpose.
- Modules: which add-on modules (chat, photo documentation, project reports) are switched on — see the next section.
- Employees’ rights: access to their own data, objection, complaints procedure.
- Term and termination of the agreement.
Which modules you should agree on beforehand
Zeitflex consists of a core (clocking in/out, timesheet, absences, month-end close) and modules that you switch on and off individually under Settings → Business. Five of them are capable of monitoring behaviour or performance and therefore belong explicitly in the agreement — even though Zeitflex deliberately built them so that a per-person analysis is difficult or impossible.
Team chat
The chat never switches itself on: it is not one of the core features, and no industry template presets it — not even as a recommendation. It is also the only module that requires explicit confirmation to switch on. Anyone who flips the switch first sees a note on § 87(1) no. 6 BetrVG and on the question of whether a data protection impact assessment under Art. 35 GDPR is needed. Only after confirming with Understood, switch on chat is it active. Switching it off works at any time without a prompt.
What the chat does and does not do technically:
- Messages are deleted after 90 days at most. They are not a record.
- There is no read receipt per person. Zeitflex only stores up to which message someone has read — never when — and discloses this to no one.
- A group needs at least three people — the chat is not meant for one-to-one conversations. Only if the business has fewer active people overall does the minimum drop to that number.
- The tax adviser never sees the chat.
More in Team chat: a shout across the yard, no archive.
GPS when clocking in/out
GPS is preset in no industry template; a template may only recommend it. The business makes the decision under Settings → GPS & privacy. In front of the switch there is the legal basis (legitimate interest in being able to prove the place of work, Art. 6(1)(f) GDPR) and the request to inform the team before activating it.
- The location is stored only at the moment of clocking in and out.
- This applies only to the mobile time clock — never to the wall terminal.
- There is no continuous tracking and no movement profile.
- GPS clocking is a feature of the Pro plan.
In detail in Location when clocking in/out (GPS).
Photo documentation
Photos are proof of work for the job — they are attached to the project or the shift, not to a person. The gallery under Documents has exactly two filters: project and search text. There is no filter by employee there, and no “who took how many photos” report either — both deliberately. Above every photo view there is the purpose limitation notice.
Two points that belong in the agreement:
- If GPS is switched on for the business, a photo can carry the **location where it was taken**. If GPS is off, Zeitflex discards the coordinate on upload — the photo is still saved.
- Photos are retained for five years from the end of the year (limitation period for defects in buildings, § 634a(1) no. 2 BGB (German Civil Code)) and then deleted automatically.
More in Filing documents and records.
Project reports and individual productivity
The Project/cost-centre times module books working time to jobs. The report under Projects shows hours, labour costs and contribution margin per job — that is a job report, not a report on people. The only sensitive part is the Productivity tab: the share of time booked to projects.
This is how Zeitflex limits this figure:
- The team value is always visible. If the team has fewer than three people, Zeitflex marks it as not meaningful — the average of two people is not anonymisation.
- Individual values of other people are visible only to owners and managers. Employees see only their own row (Art. 15 GDPR).
- Above every productivity view and on every export there is a note that person-related reports require co-determination under § 87(1) no. 6 BetrVG and that, without a works council, the principle of data minimisation (Art. 5(1)(c) GDPR) applies: team value first.
If you agree with the works council that individual values will not be used, write that into the agreement — Zeitflex has no switch that hides individual values from owners and managers. Background on job reports: Was the job worth it?
Announcements with read confirmation
Announcements are switched on as a core feature because they are one-way: a message, not a reply function. If an announcement requires a read confirmation, Zeitflex stores who confirmed and when — as a record, for example for safety training. Only the author and management see this, never colleagues. Whether you use read confirmations should be stated in the agreement.
Which data Zeitflex processes
You can copy this list directly into an agreement or into the information provided under § 90 BetrVG:
| Type of data | When | Who sees it |
|---|---|---|
| Name, email, personnel number, start date | Master data | Owner, management |
| Date of birth | only if entered — for youth employment protection | Owner, management |
| Employment type, working-time model, hourly wage, vacation entitlement | Master data | Owner, management |
| Start, end, duration of working time, breaks | on every clock-in/out | Person concerned, owner, management, tax adviser |
| Recording method (time clock on the terminal, web and app, correction, import, interface) | on every clock-in/out | Owner, management |
| Location at the moment of clocking in/out | only if GPS is activated | Owner, management |
| Absence type and period | with requests | Person concerned, owner, management, tax adviser |
| Medical certificate file | only if uploaded | Person concerned, owner, management — not the tax adviser |
| Shifts, positions, swaps | during planning | everyone involved |
| Photo for the job, where applicable location where it was taken | only with photo documentation | People involved in the project, owner, management |
| Chat messages | only with chat switched on, 90 days at most | Members of the group concerned |
| Read confirmation for announcements (who, when) | only if required | Author, owner, management |
| Change log: who, when, what, why | on every correction | Owner, management, tax adviser |
What Zeitflex does NOT process: no continuous location tracking, no analysis of keyboard or mouse activity, no screen monitoring, no camera surveillance, no presence detection via Wi-Fi or Bluetooth, no biometric recording of employees, no read receipts in the chat, no photo count per person.
GPS is the most sensitive point
Location data is particularly sensitive. Zeitflex’s approach:
- GPS is off by default.
- If switched on, the location is recorded only at the moment of clocking in/out — no continuous tracking.
- No movement profile is created.
Even so, GPS belongs explicitly in the works agreement. Permanent location tracking would require co-determination and would hardly be defensible under data protection law — which is why we do not build it.
Public sector
There, the staff representation law of the federal government or of the respective federal state applies, with corresponding rules. The process is similar; the sections are different.
Frequently asked questions
We switched Zeitflex on before the works agreement. What now?
Approach the works council immediately and present the data list from this article. Until an agreement is reached, switch off all modules that are not part of the record-keeping duty — chat, GPS, photo documentation, project reports. You can do this under Settings → Business without losing data: whatever is switched off disappears from the menu and reports, the data is kept and comes back when you switch it on again. Plain time tracking under § 17 MiLoG (German Minimum Wage Act) can usually be settled with the works council more quickly than the add-on modules.
The works council wants nobody to see individual values in productivity. Is that possible?
Not with a switch. Owners and managers see the individual rows as soon as the Project/cost-centre times module is switched on and the plan includes project reports. What you can do: rule out the use of individual values in the agreement, or switch the module off entirely. Booking time to projects still works then — only the report page disappears.
We are a business with eight people and no works council. Do I still have to do anything?
Co-determination does not apply. What remains: inform employees under Art. 13 GDPR about which data Zeitflex processes — the table above is sufficient for this. For GPS, the following also applies: inform the team before switching it on; the settings tab says so too.
Can the works council look up in Zeitflex itself what is stored?
There is no separate role for the works council. What you can provide: the data list from this article, the retention periods from Retention periods and the data access report under Art. 15 GDPR, which every person concerned can retrieve themselves under Settings → Data & deletion — regardless of their role. Anyone who wants to know what Zeitflex stores about them will find it in What Zeitflex stores about me.
Still stuck?
We do not currently provide a model agreement — it would be legal advice, and a poor template is worse than none. The data list above does, however, cover the system description that your works council can request under § 90 BetrVG. For questions about the modules, Support can help; for clocking in/out itself, see Clocking in/out: all methods, and for the obligation behind it, Record-keeping duty.
Last checked on . We check every article against the application — if something no longer matches, that is a bug and not a difference of opinion.
Was this helpful?
Related articles
- Record-keeping duty — clearly explainedWho has to record working time, what exactly, since when — and what already applies today from the planned change in the law.
- Clocking in and out by phone, tablet or browserThree routes, one record: when each route is the right one, what each can do, which PIN rules apply at the terminal and what happens without a connection.
- Retention periodsHow long working-time data, sick notes and payroll records must be kept, which periods Zeitflex has set for each type of data, and what the nightly deletion run does.
- GPS when clocking in/out: what is stored, who sees it, when it is goneTwo switches, one snapshot when clocking in and out, six months — and no radius, no tracking. What Zeitflex does with the location and what it explicitly does not do.
- Team chat: a shout across the yard — no archive, no recordThree commitments: at least three people per group, a retention period instead of an archive, and management never reads along silently.
- Employment contract, records, photos: documents in ZeitflexFour document types, clear visibility, fixed deletion periods — and why the tax adviser sees nothing here.
- Was the job worth it? Post-calculation with budget and contribution marginThe project analysis compares actual hours with the budget and labour costs with the contract value — and states explicitly what is missing from the labour costs.
- What Zeitflex stores about me — the data access reportEvery person obtains their own access report under Art. 15 GDPR themselves — readable and as a file, without going through the business.