1. Who We Are
Shift Flow is operated by F.I.D. Integrated Services Ltd, a private company limited by shares incorporated in England and Wales under company number 17005482, whose registered office is 11 Stonecote Road, Aylesham, Kent, United Kingdom, trading as 'Shift Flow' ("we", "us", "our"). Company number 17005482. Contact: hello@fids-studio.com
We have two distinct roles:
- Data controller for organisation account and billing data — the information organisations give us when they sign up and pay for the Platform.
- Data processor for the worker data that organisations upload. Each organisation is the data controller for its own workers.
2. Data We Collect
- Organisation admins: name, email, phone, and organisation details.
- Workers: name, email, phone, department, worker type (staff/volunteer/contracted), hourly rate (staff and contracted only), and contract dates (contracted only).
- Availability preferences: preferred working days and times per worker.
- Attendance: sign-in and sign-out timestamps, hours worked, and estimated pay.
- Location: a single GPS coordinate, captured only in geofence mode at the moment of sign-in.
- Billing data: processed by Stripe. We never store card details.
3. How We Use Your Data & Lawful Bases
- Providing the shift management, attendance, and reporting service (contract performance).
- Automated shift generation where enabled (contract performance).
- Shift reminders and notifications (contract performance).
- Providing support (legitimate interests).
- Billing and tax records (contract performance and legal obligation).
4. GPS & Location Data
A single GPS coordinate is captured only at the moment a worker taps "Sign In" in geofence mode. We never track location continuously, before, or after sign-in. Phone-based and tablet-based sign-in record no location data.
5. Cookies & Local Storage
We use only strictly necessary cookies and local storage: authentication session and user preferences. We do not use advertising, marketing, or analytics tracking cookies. You can clear them from your browser at any time.
6. Who Sees Your Data
- Organisation admins see their own organisation's worker data.
- Workers see only their own shift history, hours, and availability.
- F.I.D. Integrated Services Ltd, a private company limited by shares incorporated in England and Wales under company number 17005482, whose registered office is 11 Stonecote Road, Aylesham, Kent, United Kingdom, trading as 'Shift Flow' staff may access data for support purposes only.
7. Sub-Processors & Third Parties
- Stripe for payment processing: stripe.com/gb/privacy
- Firebase Cloud Messaging for push notification delivery — tokens only, no message content.
- Our third-party cloud hosting and infrastructure provider for hosting, infrastructure administration, and security.
8. International Data Transfers
Data may be processed or stored in data centres outside the UK. Transfers are protected by UK adequacy regulations or equivalent safeguards such as the International Data Transfer Agreement or Standard Contractual Clauses.
9. Data Security
- Encryption in transit.
- Role-based access controls.
- Organisations' data is isolated per organisation.
- Regular platform updates.
10. Data Retention
- Active data is retained while the account is active.
- Worker records are anonymised 30 days after account deletion.
- Billing records are retained for 7 years (legal requirement).
- Expired event-pass organisations keep read-only access to their data indefinitely.
11. Your Rights
Under UK GDPR you have the right to: access, rectification, erasure, restriction of processing, data portability, and objection.
Workers should first contact their organisation administrator (the organisation is their data controller), then us at hello@fids-studio.com. We respond within 30 days.
Complaints can be made to the Information Commissioner's Office at ico.org.uk.
12. Automated Decision-Making
We do not carry out automated decision-making that has legal or similarly significant effects.
13. Changes to This Policy
Updates are posted with a new "Last updated" date.