UK GDPR-aligned privacy notice for ShiftCover365 platform users. This notice describes the data we actually collect and how the live platform operates today.
1. Introduction
ShiftCover365 ("ShiftCover365", "we", "us", "our") is a workforce cover and accountability platform for shift-based businesses, including Post Offices, retail branches, convenience stores and similar operational workplaces. This Privacy Policy explains how we collect, use, store, share and protect personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Who We Are
Data Controller: ShiftCover365.
Contact: support@shiftcover365.co.uk (general enquiries: hello@shiftcover365.co.uk).
If a formal Data Protection Officer is appointed in future, this policy will be updated with those details.
3. Who This Policy Applies To
This policy applies to managers, branch owners, workers, applicants, demo request leads, website visitors and anyone who contacts or uses ShiftCover365.
4. Personal Data We Collect
We collect only the data needed to operate the platform. Specifically:
- ·Account details — full name, email address, phone number, role (manager or worker).
- ·Password credentials — stored only as a securely hashed value (bcrypt). We never see or store your plain-text password.
- ·Profile details — experience level, preferred role/area, organisation or branch name, optional profile photo.
- ·Shift activity — shifts you post, apply for, accept or cancel; attendance records; no-show and late-cancellation records; reliability score.
- ·Accountability data — ratings, manager notes, trust indicators, Smart ID status (self-declared by the worker and/or confirmed by the manager), till start/mid/end checks and discrepancy reports.
- ·Operational audit logs — system events such as account creation, account deletion, payment attempts and key shift state changes.
- ·Support and demo-request messages — name, email, phone, business name and the content of the message you submit.
- ·Minimal payment identifiers — a Stripe customer ID and saved payment-method ID. Full card numbers, expiry and CVC are held by Stripe, not by ShiftCover365.
We do not currently log IP addresses, device fingerprints or detailed browser telemetry as a feature of the platform. Standard infrastructure logs may exist at our hosting and email providers for security and abuse-prevention purposes.
5. Special Category Data
We do not request special category data such as health information, religious beliefs, political opinions or biometric data. Users should not upload or submit unnecessary sensitive information unless specifically required by a verified operational process.
6. How We Use Personal Data
We use personal data to create and manage accounts, verify email addresses, support shift matching, allow managers to review applicants, record shift attendance, maintain operational audit trails, send verification and password-reset emails, send in-platform notifications, manage demo requests, detect misuse or fraud, provide support, and improve platform security and reliability.
7. Lawful Bases for Processing
Depending on the activity, we rely on one or more UK GDPR lawful bases: contract necessity, legitimate interests, legal obligation and consent. Our legitimate interests include operating a secure workforce platform, preventing misuse, maintaining audit trails, supporting branch accountability and improving service reliability. Where consent is required, users may withdraw consent at any time.
8. Worker Verification and Accountability Records
ShiftCover365 displays reliability indicators, ratings, cancellation history, Smart ID status and shift activity to authorised managers where relevant to shift cover decisions. Smart ID status is either self-declared by the worker or confirmed by a manager in the app — ShiftCover365 does not perform formal identity-document checks, background checks, criminal-record checks or right-to-work verification. Managers remain responsible for legal right-to-work, employment and suitability verification.
9. Till Accountability and Audit Trails
Where enabled, ShiftCover365 records till start/mid/end checks, periodic till checks, discrepancy reports, shift start/end records and accountability notes. These records support operational visibility and should not be treated as automatic proof of liability without appropriate human review and evidence.
10. Who We Share Data With
We may share relevant personal data with:
- ·Authorised managers and workers involved in a shift process within your branch or organisation.
- ·ShiftCover365 administrators — a small number of authorised staff with admin role may view operational data for support, fraud-prevention, dispute-resolution and platform-health purposes.
- ·Trusted processors that help us run the platform (see Section 11).
- ·Professional advisers, regulators or law enforcement where legally required.
We do not sell personal data. We do not share data with advertising networks.
11. Processors and Third-Party Services Currently In Use
The following named processors support ShiftCover365 today:
- ·Resend — transactional email delivery (account verification, password reset, welcome emails) sent from support@shiftcover365.co.uk.
- ·Stripe — payment processing and storage of saved payment-method tokens for branch billing and shift fees.
- ·Emergent — application hosting and object storage (used for profile photos).
- ·MongoDB — database storage for application records.
We do not currently use an analytics, advertising, marketing-automation or third-party tracking processor. If that changes, this policy and the Cookie Policy will be updated.
12. International Transfers
Some of our processors (including Resend and Stripe) are headquartered outside the UK and may process data internationally. Where this happens, we rely on appropriate safeguards such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an equivalent lawful mechanism.
13. Data Retention and Account Deletion
When you tap "Delete account" we do two things at the same time: (1) we immediately deactivate your account so it can no longer sign in; and (2) we automatically create a GDPR erasure request on your behalf. Our team reviews and actions that request within one month, in line with UK GDPR Article 17. You can also raise a deletion request without signing in at /account-deletion.
When an erasure request is approved, we hard-delete personal data across the following collections: user profile, shifts you posted or were assigned to, applications, ratings, chat threads and messages, manager notes, notifications, till logs, till audit logs, time logs, penalties, penalty audit logs, discrepancy checks, staff links, password-reset and email-verification tokens, system logs referencing your user ID and any demo-request rows for your email.
Retention schedule (what we keep, why, and for how long):
- ·Payment transactions — retained for 7 years in line with HMRC tax and VAT record-keeping obligations (lawful basis: legal obligation, UK GDPR Art 6(1)(c)).
- ·GDPR audit rows (Subject Access Requests, deletion requests, policy-acceptance records, phone-confirmation records, onboarding-events, admin-action logs) — retained indefinitely so we can demonstrate compliance with UK GDPR itself (lawful basis: legal obligation + legitimate interests for accountability, UK GDPR Art 5(2)).
- ·Soft-deleted accounts pending erasure review — held only for the duration of admin review, up to one month from the date of the deletion request.
- ·All other personal data — erased when the deletion request is approved, or sooner.
Some records may be retained where there is an active legal hold, an open dispute, an active fraud investigation or an outstanding financial obligation. If a request is rejected on one of these grounds, you will receive a written explanation and you remain free to escalate to the UK Information Commissioner’s Office (ICO).
Re-registering with the same email address after a deactivation but before erasure has been approved will reactivate the existing record; re-registering after erasure has been completed creates a brand-new account with no link to the previous data.
14. Security
We apply reasonable technical and organisational measures including bcrypt password hashing, role-based access controls (manager / worker / admin), JWT-based authentication, secure environment variables, audit logging and restricted administrator access. Session tokens are held in your browser’s local storage and are cleared when you sign out. No online system can be guaranteed completely secure, and ShiftCover365 does not currently hold formal security certifications such as ISO 27001 or SOC 2 — we will update this policy if that changes.
15. Your UK GDPR Rights
Subject to legal limits, you may request access, correction, deletion, restriction, objection, data portability and withdrawal of consent. You may also complain to the UK Information Commissioner’s Office (ICO).
To make a request, contact us at support@shiftcover365.co.uk or use the in-app tools. For deletion: tap "Delete account" inside Profile when signed in, or submit a request at /account-deletion when signed out — both create a tracked GDPR erasure request that our team actions within one month. Self-service tools also exist for correction (Profile editing). Other rights are handled by our support team.
16. Cookies, Local Storage and Similar Technologies
ShiftCover365 does not currently set HTTP cookies. We use browser local storage to keep you signed in (a JWT session token) and to remember whether you have completed the in-app walkthrough. This is functionally similar to a strictly-necessary cookie. We do not currently use analytics, advertising or marketing cookies. See the Cookie Policy for more detail.
17. Children
ShiftCover365 is not intended for children under 18. Users should be legally able to work and use the platform in accordance with applicable laws. The platform does not include an automated age-verification gate; managers and workers are responsible for ensuring lawful use.
18. Changes to This Policy
We may update this Privacy Policy as the platform develops. Updated versions will show a new effective date.
19. Contact
For privacy questions or data rights requests, contact: support@shiftcover365.co.uk.