Privacy Policy
This Privacy Policy explains how personal data is processed in IzyShift. IzyShift is a staff scheduling, time and attendance, and payroll-preparation service. It runs on izishift.cc, app.izishift.cc and punch.izishift.cc, in the @izyshift_bot Telegram bot and Mini App, and in the IzyShift Android app. It is written to meet the information duties in Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").
1. Who we are, and our two roles
IzyShift is operated by BLACKBREAD LTD, registered in Cyprus under number HE 352187, VAT number CY10352187S, at Agias Zonis 5, 3027 Limassol, Cyprus ("we", "us"). Contact for privacy matters: info@izishift.cc. We have not appointed a data protection officer, because the law does not require one for our activities. Please use the email above.
We process personal data in two different roles.
| Role | Whose data | Examples |
|---|---|---|
| Controller (we decide why and how) | Our customers' account owners and billing contacts; visitors of izishift.cc; people who contact us or send an invoice request | account and billing data, invoices, support messages, website server logs |
| Processor (we act for the employer) | Employees, managers and other staff that a business (our "Customer") adds to its IzyShift workspace | schedules, clock-ins, hours, pay rates, shift notes |
If you are an employee: your employer is the controller of your data in IzyShift. Your employer decides what is recorded and why. We process it on your employer's behalf under a Data Processing Agreement. For questions or to exercise your rights over that data, contact your employer first. If you contact us, we will pass your request on to your employer and help them answer it (see section 8).
2. Data we process for Customers (processor role)
What is recorded depends on which features your employer uses.
| Category | Data |
|---|---|
| Identity and contact | first and last name, work email, phone (optional), login, password (stored only as a salted hash), language, and, if you link it, your Telegram user ID and Telegram name |
| Employment organisation | company, venue, department, position, access level, hire and termination dates, maximum weekly hours, notes your managers keep on your staff card, personal rules (for example lateness tolerances) |
| Schedule and leave | shifts, breaks, shift notes, publication history, leave and time-off requests and balances, including the absence type (e.g. holiday, sick leave). No medical details are requested |
| Attendance | clock-in and clock-out times, how the punch was made, approvals and corrections, lateness, early leave and no-shows, punctuality ranking. Depending on your employer's settings: the IP address of the device, your GPS location only at the moment you punch in or out (never continuous tracking), and the 4-digit PIN used at the punch terminal |
| Pay | pay type and rates, adjustments, calculated hours and pay. Visible only to owners and administrators |
| Bank details for salary payouts | only if your employer pays salaries through IzyShift's payroll payouts feature: the name on your bank account, your IBAN and, optionally, BIC; payroll runs with the net amount to pay, adjustments (bonus, deduction, advance) with comments, and payment status. Purpose: paying your salary — IzyShift prepares the bank payment file for your employer's bank (later possibly a payment provider chosen by your employer). Bank details are stored encrypted, shown masked (country and last 4 characters only), visible only to owners and administrators, and every change and every view of the full IBAN is logged. They are not included in any other export. Your employer may let you submit your own details for approval |
| Shift notes ("How did the shift go?") | text you write, up to 4 photos (resized, with location metadata (EXIF) removed), and voice messages if your employer turns them on. Voice is sent for automatic transcription, and only the text is kept, not the audio |
| Sales data from the POS | if your employer connects its POS (for example Syrve), sales figures by day and hour, used to compare labour cost with revenue |
| Technical and security | session records (when and how you logged in), an audit log of administrative changes, notification logs, bot conversation state |
3. Data we process as controller
| Category | Data | Purpose | Legal basis (GDPR Art. 6(1)) |
|---|---|---|---|
| Customer account | name and email of the person who registers the company, company name, acceptance of our terms (versions, time, IP address) | creating and running the account, proving acceptance | (b) contract; (f) legitimate interest in keeping evidence of acceptance |
| Billing | legal name, address, VAT number and its VIES check result, billing email, plan and period, invoices and credit notes, payment status, Viva transaction reference and masked card number (last digits only) | taking payment, invoicing, renewals, refunds | (b) contract; (c) legal obligation (tax and accounting law) |
| Invoice requests and enquiries | name, company, email, phone, address, VAT number, message, IP address | answering requests from the website or app | (b) steps before a contract; (f) answering enquiries and preventing abuse |
| Support and communication | emails and Telegram messages to us | support, service notices (e.g. changes to terms, payment failures) | (b) contract; (f) legitimate interest |
| Website and security logs | IP address, date and time, requested page, browser user agent | operating and securing the Service, preventing abuse and fraud | (f) legitimate interest in a secure service |
| Account deletion requests | who asked, when, status | handling and evidencing deletion requests | (c) legal obligation (GDPR Art. 17, 12); (f) |
We do not use your data for advertising, we do not sell it, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Lateness and pay calculations follow rules set by your employer. Your employer reviews them, and they can be corrected by a person.
4. Where data comes from
- From you, when you register, join by an invitation link, use the app or bot, or contact us.
- From your employer, who may add your name, contact details, position, schedule and pay data.
- From the systems your employer connects, such as its POS.
- From Telegram, if you link your Telegram account: your Telegram user ID and the name in your Telegram profile.
- From the EU VIES system, for VAT number checks of business customers.
5. Recipients and sub-processors
Inside a workspace, data is visible according to the access levels your employer sets. For example, colleagues can see the shared schedule if the employer allows it, and only owners and administrators see pay.
Outside the workspace, we use the following providers. The full, current list, with locations and safeguards, is on the Sub-processors page.
- Hetzner Online GmbH (Germany): servers in the EU (Germany and Finland), hosting the application and database.
- Google (Gmail): sending service emails, and storing encrypted backup copies.
- Telegram: notifications and the bot, only for users who link Telegram.
- OpenAI: transcription of voice shift notes, only if the employer turns voice notes on.
- Viva Payment Services S.A. (Greece): card payments by Customers. Viva acts as an independent controller for payment processing under its own privacy notice.
We may also disclose data where the law requires it, for example to tax authorities, courts or regulators, or to protect our rights. If our business is transferred, data may pass to the successor under the same commitments.
6. International transfers
The application and database are hosted in the EU. Some providers may process data outside the European Economic Area:
- Google and OpenAI may process data in the United States. For these transfers we rely on the providers' Standard Contractual Clauses approved by the European Commission and, where the provider is certified, on the EU–US Data Privacy Framework.
- Telegram processes messages under its own terms. Telegram does not offer data processing terms to bot operators, and it may process data outside the EEA. Linking Telegram is optional. If you do not link it, IzyShift works through the web app and the Android app, and nothing about you is sent to Telegram.
7. How long we keep data
| Data | Retention |
|---|---|
| Customer workspace data (processor role) | for as long as the Customer's account is active. After the account ends or the company is deleted, it is kept 90 days (for restoration or export), then deleted or anonymised. Employers may need to keep timesheets and pay records longer under labour and tax law; they keep their own exports for that purpose |
| Bank details for salary payouts (processor role) | while the employer keeps them on your staff card. They are deleted when the employer removes them, when your account deletion is carried out, or with the rest of the workspace (see above). Completed payroll runs keep only the masked account (country and last 4 characters) as the employer's payment record |
| Login data of an employee who deletes their account | removed 30 days after the request (or earlier if the employer confirms). See Delete your account |
| Invoices, credit notes, payment records, billing details | for the period required by Cyprus tax, VAT and accounting law (currently up to 7 years after the end of the relevant year) |
| Invoice requests and enquiries that did not lead to a contract | 24 months |
| Acceptance records of terms | for the life of the account plus 6 years (limitation period for claims) |
| Web server logs (IP address, user agent) | 14 days |
| Sessions | until logout or expiry (30 days) |
| Public demo sandboxes | deleted automatically within 24 hours |
| Encrypted backups | rolled over within 60 days |
8. Your rights
Under the GDPR you have the right to:
- access your personal data;
- have it rectified;
- have it erased;
- restrict its processing;
- data portability;
- object to processing based on legitimate interests.
Where processing is based on consent, you can withdraw consent at any time. Currently we rely on consent for nothing.
- Data in an employer's workspace. Please contact your employer. If you write to us, we will forward your request to your employer within 5 business days and help them respond. We cannot decide on your employer's behalf what records it must keep.
- Data we hold as controller. Write to info@izishift.cc. We answer within one month. This can be extended by two months for complex requests, in which case we will tell you. We may ask you to confirm your identity.
- Deleting your login account. You can do this yourself in the app (Settings / More → Delete account), or by writing to us. See Delete your account.
You also have the right to lodge a complaint with a supervisory authority. In Cyprus this is the Commissioner for Personal Data Protection, 15 Kypranoros Street, 1061 Nicosia, Cyprus (postal address: P.O. Box 23378, 1682 Nicosia), www.dataprotection.gov.cy, commissioner@dataprotection.gov.cy. You can also complain to the authority in the EU country where you live or work.
9. Security
We protect data with technical and organisational measures. They include:
- encryption in transit (TLS);
- encryption at rest of bank details (IBAN) and integration credentials;
- hosting in the EU;
- hashed passwords;
- access control by role, enforced on the server;
- separation of each customer's data;
- encrypted daily backups;
- restricted administrative access.
See our Security Overview. No system is perfectly secure. If a personal data breach occurs, we notify the affected Customer, and where required the supervisory authority and individuals, as the law requires.
10. Children
IzyShift is a workplace tool for adults. It is not directed at children, and Customers must not create accounts for persons under 16. If you believe that a child's data has been entered, contact us and we will help the employer remove it.
11. Cookies
We use only strictly necessary cookies and local storage (for login, language and display preferences). We use no analytics or advertising cookies. See the Cookie Policy.
12. Changes
We may update this policy. Material changes are announced in the app or by email at least 30 days in advance, unless a change is required sooner by law. The version and effective date are shown at the top of this page.
13. Contact
BLACKBREAD LTD, Agias Zonis 5, 3027 Limassol, Cyprus. Email: info@izishift.cc.