Privacy Policy

1. Introduction

Shifter ("the Platform") is operated by Playblast Ltd ("we", "us", "our", or "Playblast"), a company registered in the United Kingdom. This Privacy Policy explains how we collect, use, disclose, and otherwise process your personal data in connection with our services.

This Privacy Policy applies to all users of Shifter, including workers and property representatives seeking staff ("users").

2. Legal Basis and Jurisdiction

This Privacy Policy is governed by the laws of the United Kingdom and complies with the General Data Protection Regulation (GDPR) and UK Data Protection Act 2018. If you are located in other European countries, your data protection rights remain protected under applicable EU and national privacy laws.

3. What Personal Data We Collect

We collect and process the following categories of personal data:

3.1 Data You Provide Directly

• Contact Information: Name, email address, phone number, and postal address
• Professional Information: Employment history, qualifications, professional certifications, and legal status (including right to work documentation)
• Availability Data: Shift availability, preferred work locations, and scheduling preferences
• Account Information: Username, password, and profile details
• Communication Data: Messages and correspondence through the Platform
• Payment Information: Bank details, payment method information (processed securely by our third-party payment provider Stripe)
• Tax Information: Tax identification numbers and declaration details (you are responsible for providing accurate information)

3.2 Data We Collect Automatically

• Device and Access Data: IP address, browser type, device identifier, and timestamp of access
• Usage Data: Your interactions with the Platform, including pages visited, features used, and time spent
• Cookies and Tracking Technologies: We use cookies to enhance your experience and maintain security
• Analytics Data: Information about how you use the Platform to improve our services
• Email Engagement Data: Whether you open emails we send you and whether you click links within them, used to ensure notifications are reaching you

3.3 Data About Your Behavior

• Shift Responses and Applications: Details of shifts you have applied for or been matched with
• Ratings and Feedback: Performance ratings, feedback from properties, and behavioral records
• Platform Interactions: Any reports, disputes, or issues raised through the Platform

4. Purposes and Legal Basis for Processing

4.1 Service Provision

• Matching and Connection: To match workers with properties seeking staff and facilitate contact exchange
• Account Management: To create, maintain, and manage your account
• Communication: To send you service-related notifications, updates, and respond to inquiries
• Payment Processing: To process payments and maintain financial records through Stripe

Legal Basis: Performance of contract (Article 6(1)(b) GDPR)

4.2 Compliance and Safety

• Legal Compliance: To comply with UK and EU legal obligations
• Fraud Prevention: To prevent fraud and unauthorized access
• Platform Security: To maintain the security and integrity of the Platform
• Account Verification: To verify your professional status and eligibility to use the Platform

Legal Basis: Legal obligation (Article 6(1)(c) GDPR) and legitimate interest (Article 6(1)(f) GDPR)

5. Who We Share Your Data With

5.1 Data Sharing with Properties

Once you engage with the Platform as a worker, your contact information (name, phone number, email address) will be shared with properties seeking staff. This sharing is essential to the Platform's core function: connecting workers with employers. By using Shifter, you consent to this sharing.

5.2 Third-Party Service Providers

We use the following third-party service providers to operate the Platform:

• Supabase: Database hosting and management
• Firebase: Real-time data and analytics
• Stripe: Payment processing and financial services
• n8n: Workflow automation
• Resend: Email delivery, including tracking of email opens and link clicks

6. Data Retention

6.1 Retention Periods

• Active Account Data: Retained while your account is active and for ongoing operations
• Shift Records and Analytics: Retained indefinitely for business analytics, performance tracking, and algorithmic improvement, subject to security protections
• Communications and Correspondence: Retained for historical records and dispute resolution
• Payment Data: Retained in accordance with UK tax and financial regulations (typically 6 years)
• Deleted Accounts: After account deletion, we retain data for 30 days to prevent fraud; remaining data is securely deleted within 90 days, except where legally required or necessary for analytics

7. Your Rights Under GDPR

You have the following rights regarding your personal data:

• Right of Access: You have the right to request access to your personal data and receive a copy in a structured, commonly used format.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data.
• Right to Erasure: You have the right to request deletion of your personal data, subject to certain exceptions.
• Right to Restrict Processing: You have the right to request that we restrict the processing of your data for certain purposes.
• Right to Data Portability: You have the right to receive your data in a structured format and transmit it to another service provider.
• Right to Object: You have the right to object to processing of your data for direct marketing and certain other purposes.
• Right to Lodge a Complaint: If you believe we have violated your privacy rights, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the UK or your national data protection authority.

8. Data Security

8.1 Security Measures

We implement comprehensive technical and organizational security measures to protect your personal data, including:

• Encryption: Data transmitted and stored with encryption protocols
• Access Controls: Restricted access to personal data on a need-to-know basis
• Third-Party Security: Third-party service providers (Stripe, Supabase, Firebase) maintain enterprise-grade security
• Regular Audits: Periodic security assessments and compliance reviews
• Incident Response: Procedures to detect and respond to security incidents

15. Contact Us

For questions, concerns, or requests related to this Privacy Policy, please contact us:

This Privacy Policy is effective as of November 2025 and governs all use of Shifter.