Privacy Notice

This notice explains how Simplionex handles personal data in Shiftline, in line with the UK GDPR, the Data Protection Act 2018 and the EU GDPR. Contact our privacy team at support@simplionex.com.

Who is responsible

• Business account holders (planners): Simplionex is the controller of your account data.
• Employees using the app: your employer is the controller. Simplionex is the processor acting on their instructions. Contact your employer first for data requests; we will help them respond.

What we collect

• Planners: email, business name, password (stored hashed by our auth provider), sign-in records.
• Employees: name, department, onboarding code, shift requests (date, times, breaks), replies to approvals, terms acceptance time, and in-app notifications.
• Your PIN and phone-unlock key stay on your device only. We never receive them.
• Support messages you send us.

Why and legal basis

• Providing the service — contract (Art. 6(1)(b)).
• Planning overtime and meeting working time law — the employer's legitimate interests and legal obligations (Art. 6(1)(f), 6(1)(c)).
• Security and fraud prevention — legitimate interests.
• Optional analytics cookies — consent only (Art. 6(1)(a)).

Sharing

We use carefully chosen sub-processors for hosting, database and email. Data may be processed outside the UK/EEA only under adequacy regulations or Standard Contractual Clauses / the UK IDTA. We never sell personal data.

Retention

Shift records are kept while the workspace is active and deleted within 90 days of workspace closure, unless the employer must keep them longer for legal reasons (e.g. working time records are generally kept 2 years).

Your rights

You can request access, correction, deletion, restriction, portability, or object to processing, and withdraw consent at any time. You can unlink your device from within the app. You may complain to the Information Commissioner's Office (ico.org.uk) or your local authority.

Security

Data is encrypted in transit, workspaces are isolated from each other, device links use hashed tokens, and access to employee data is limited to invited planners.