Geofenced clock-in and time theft in UK hospitality

By Zynthio. Published 29 April 2026, updated 12 September 2026. Editorial policy

General information for UK hospitality operators, not legal advice. If something here is wrong or out of date, the editorial policy explains how to report it.

Geofenced clock-in checks where a shift is actually started, and carries working time, minimum wage and data protection duties with it.

Geofenced clock-in checks where the device is before it accepts a clock-in, so a shift only starts on the record once someone is at the venue. That closes the gap left by off-site clock-ins and rounded start times between the hours paid and the hours worked. It does not settle on its own who was holding the phone, and it does not replace a manager reading the week back against the rota, but it turns attendance from a matter of trust into a record with a time and a place attached.

The many small ways hours get inflated

Time theft in hospitality rarely looks like fraud. It looks like a colleague tapping someone in a little early so the shift technically started on time, or a sign-in sheet rounded up to a tidy number out of habit rather than accuracy. Add a slow clock-out at the end of the night, a shared tablet at the pass that anyone can reach, and a manager too busy on a Friday to read every entry, and the gap between hours paid and hours worked widens without anybody deciding that it should. None of it usually feels dishonest to the people doing it, which is why it survives a stern reminder at the team meeting. Published estimates of what this costs UK employers come from commercial surveys rather than official statistics, so they are worth treating with caution. A venue can work out its own exposure from its own numbers instead: take the average hourly rate for the roles affected, add employer National Insurance and pension, and multiply by the time each week the records cannot account for. That figure is defensible because it comes from the payroll rather than from somebody else's sample.

How geofenced clock-in works

A geofence is a boundary around the site. In Zynthio, each site can carry one: a location geocoded from the site address, with a radius chosen per site. When a team member clocks in or out, the system compares the device location against that radius before the entry is accepted. Each site also decides what happens when the reading falls outside it. Blocking refuses the clock-in outright. Flagging accepts it, records the distance and sends it to a review queue, which gives a manager something specific to ask about rather than a general suspicion. Staff can clock in from their own phone or from a shared device at the pass, and managers can still add attendance by hand, correct an event, and close a shift somebody forgot to end, so a flat battery does not become a payroll dispute. This sits naturally inside rota and clock-in software built for hospitality, because the same system already holds who was meant to be on, so the clock-in confirms or corrects the plan rather than living as a separate sheet.

Why buddy punching survives manual systems

Paper sign-in sheets and shared tablets fail for the same reason: nothing at the point of entry confirms who is present. Catching every instance by eye would mean watching the door all night, which is not a realistic use of a manager's shift, and CCTV is rarely reviewed minute by minute against a sign-in sheet unless a dispute has already started. It is worth being precise about what a geofence fixes and what it does not. It answers whether the device was at the venue. It does not, by itself, answer whose finger was on the screen, and on a shared device sitting permanently at the pass the location test is satisfied before anyone touches it. Venues that want the identity question answered as well have staff clock in on their own phones, signed in under their own accounts, and keep the shared device for exceptions. The table sets out where the two approaches differ in practice.

Location data is personal data

A location reading attached to a named worker is personal data, and processing it makes the employer a data controller under the UK GDPR and the Data Protection Act 2018. Three things need settling before the first clock-in. The first is a lawful basis, recorded in writing rather than assumed: employers usually rely on legitimate interests or on the performance of the employment contract, and consent is a weak choice at work because staff are rarely free to refuse it. The second is transparency. Workers have to be told what is collected, at what moments, why, who can see it and how long it is kept, in a privacy notice they can find without asking. The third is necessity and proportionality. The data protection principles require personal data to be used fairly, lawfully and transparently, for specified purposes, and limited to what is adequate, relevant and necessary. A location check taken only at the moment of clocking in and out is far easier to justify against that test than a continuous feed of where staff are during a shift. The Information Commissioner's Office publishes guidance on monitoring workers and is the regulator that would consider a complaint, so read it before writing the policy, assess the impact where the monitoring is systematic, and tell staff how to challenge a reading they believe is wrong.

The working time and wage records to keep

Accurate attendance is also evidence. Under regulation 9 of the Working Time Regulations 1998, an employer must keep records adequate to show whether the limits on weekly working time and night work have been complied with, and retain them for two years. Since January 2024 the same regulation states that records may be kept in whatever manner and format the employer reasonably thinks fit, and that daily hours need not be recorded for every worker where compliance can be shown without them. The limits themselves are unchanged: an average of 48 hours a week across a 17-week reference period unless the worker has opted out in writing, an uninterrupted break of at least 20 minutes where daily working time exceeds six hours, and at least 11 consecutive hours of rest between working days. Pay records are a separate duty. Employers are responsible for keeping records that prove they pay the minimum wage, HMRC officers can ask to see payment records at any time, and records created on or after 1 April 2021 have to be kept for at least six years. Rounded hours matter here, because a start time recorded later than it happened can pull an effective hourly rate under the legal minimum without anyone intending it. The free minimum wage checker tests a rate against the hours actually recorded.

What accurate attendance data feeds downstream

The value of a location-verified clock-in is not only in the minutes it catches. Once attendance can be trusted, the numbers built on top of it can be trusted too. In Zynthio, approved attendance becomes a timesheet for the period, approved in bulk with a sign-off a manager can reopen, and exported for payroll, though the platform is not a payroll bureau and does not file with HMRC. Labour cost reporting then reflects what happened on the floor rather than what the rota predicted, which is the ground covered in controlling labour costs without cutting corners on service, and it feeds planning generally, as set out in the true cost of poor rota management. None of that works from inflated or rounded hours, because any analysis built on them repeats the same distortion further along, whether that is a labour percentage on a report or next month's staffing forecast.

Fairness for staff and managers alike

Location-verified attendance is not mainly about catching people out, and presenting it to a team that way tends to produce the resentment it was meant to avoid. Most staff never attempt to game the clock, and for them an accurate record means being paid for the early start and the late finish that used to disappear into rounding. For managers, it replaces an awkward conversation built on guesswork with a timestamp and a distance that either supports a claim or does not, applied to everybody on the same terms. A worker who disputes their hours can be shown what the system captured instead of being asked to take a manager's word for it, and can ask for a correction where the reading is wrong, which is also what the data protection rules expect. The honest framing for a team briefing is that the venue is replacing trust nobody can check with a record anybody can.

Keeping this on the record

Every clock-in, clock-out and flagged off-site attempt needs to sit where a manager can review it against the rota and against a dispute months later, not briefly on a device that gets wiped or lost. Zynthio holds attendance alongside the shifts it relates to on its rota software page, so timesheets, holiday and minimum wage checks all draw on the same verified hours, and the privacy notice, the lawful basis and the retention period belong beside them as part of the same policy.

See how Zynthio handles this