ShiftBoss is a workforce management app for shift-based businesses (rotas, clock-in/out, timesheets, tips and leave). This policy explains what personal data the app handles and your rights under UK GDPR.
Your employer (the business using ShiftBoss) is the Data Controller for the personal data held in the app. They decide how and why your data is used.
ShiftBoss is the Data Processor. We process your data only on behalf of your employer, following their instructions and the UK GDPR.
The app provider (ShiftBoss) cannot read team chat messages and cannot see your personal or financial details — email, phone, National Insurance number, bank details, pay rate, ID/right-to-work documents or PIN. Those are visible only to your employer's Admin. Provider access is limited to what is needed to set up and support the app (branding, branches, billing and technical fixes), and is time-boxed.
To manage work schedules, calculate pay, process leave, and comply with employment law (National Minimum Wage, right-to-work obligations, HMRC payroll requirements).
Data is held while you are employed, and for up to 6 years after employment ends (HMRC payroll retention requirement).
All data is encrypted in transit (HTTPS) and stored in Google Firebase (Firestore). Access is restricted to authorised staff (Admin and Manager roles).
We do not sell your data. Data is processed using Google Firebase (hosting, database, authentication) and Stripe (subscription billing for the business account only). We share data only as needed to provide the service or where required by law.
For data access, correction or erasure requests, speak to your employer or manager. You can also contact us at [email protected]. For UK complaints, contact the ICO at ico.org.uk.