Employee Privacy Notice
In short
- Your employer uses IzyShift to plan shifts and record working time.
- Your employer decides what is recorded and why. We, IzyShift, process your data only on your employer's behalf.
- Your data is stored on servers in the EU.
- We do not sell your data or pass it to third parties. We use it only to run the service, and to improve the product in anonymised form.
1. Who is responsible
Your employer is the controller — the company you work for, named in the app. For questions about your data, contact your employer first.
BLACKBREAD LTD is the processor. It provides IzyShift (HE 352187, Agias Zonis 5, 3027 Limassol, Cyprus) and acts only on your employer's instructions, under a data processing agreement (Art. 28 GDPR). Contact: info@izishift.cc.
2. What data is processed
Depending on the features your employer uses:
- name, phone, email (if you have one); Telegram ID and name, if you link the bot;
- position, department and venue;
- schedule, breaks, leave and absences (type of absence only, no medical details);
- clock-in and clock-out times, and how you made them;
- pay rates, hours and calculated pay, visible only to the owner and administrators;
- bank details, only if your employer pays salaries through IzyShift. They are stored encrypted;
- shift notes, photos and voice messages, if turned on. Voice is converted to text; the audio is not kept;
- technical data: IP address and device and browser type at login and when you confirm this notice;
- a log of actions.
3. How clock-ins are recorded
Your employer chooses which methods to use:
- Terminal: a tablet at the venue, with your personal PIN.
- Phone (app or bot): if location checks are on, your location is checked only at the moment you clock in or out. There is no continuous tracking.
- Venue Wi-Fi: the network address of your device at the moment you clock in.
- Syrve POS: if turned on, the times you log in and out of the employer's Syrve till can be passed to IzyShift as clock-ins and clock-outs. IzyShift may also keep your employee card in Syrve up to date (name, position, till PIN, stored encrypted).
- Manual correction by a manager, shown in the log.
4. Why, and on what legal basis
- To organise work, plan shifts, record working time and calculate pay: necessary for your employment contract (Art. 6(1)(b) GDPR) and for the legal duty to keep time and pay records (Art. 6(1)(c)).
- To confirm that clock-ins are made at the workplace and to manage punctuality: your employer's legitimate interest (Art. 6(1)(f)). You can object (see section 7).
We use the data only to provide the service. To improve the product, we use only aggregated, anonymised statistics that do not identify you.
The legal basis is not your consent. On first login you see the button "I have read this and accept". Pressing it confirms that you have read this notice and accept the terms of use of the service. It is not consent within the meaning of Articles 6(1)(a) and 7 GDPR. If you do not press it, your employer may still keep working-time records, and you can always clock in for work.
Terms of use for you: use only your own login; keep your password and PIN to yourself; no medical or other sensitive details in notes or photos; follow the acceptable use rules in our Terms of Service.
Linking Telegram is your choice.
5. Who can see your data
- Your employer's managers and administrators, according to their access level.
- Colleagues see the shared schedule, as your employer has set it up.
- Pay is visible only to the owner and administrators.
- We (IzyShift) access it only for support and to run the service.
We do not sell your data or pass it to third parties, except sub-processors needed to run the service, or where the law requires it:
- hosting: servers of Hetzner Online GmbH in the EU (Germany and Finland);
- sending service emails;
- Telegram, only if you link the bot;
- OpenAI, only if your employer has turned on voice notes.
Some of these providers may process data outside the EU, under the European Commission's Standard Contractual Clauses or, for Telegram, under its own terms. Full list: https://izishift.cc/legal/subprocessors/
6. How long data is kept
- Schedules, time and pay records: as long as the law requires and your employer decides, usually several years after your employment ends.
- Your login (login, phone, Telegram link): deleted when you delete your account or your employer removes you.
- If your employer stops using IzyShift: deleted within 90 days after its contract with us ends.
- Backup copies: up to 60 days.
7. Your rights
You can ask for access, correction, erasure, restriction or a copy of your data, and object to processing based on legitimate interest. Please contact your employer; we help them answer. You can also write to info@izishift.cc, and we will pass your request on to your employer.
Deleting your login: in the app, More → Profile → Delete account. The request is carried out after 30 days. Work records that the law requires to be kept stay with your employer. See https://izishift.cc/legal/delete-account/
Complaints: to the data protection authority in your country. In Cyprus: the Commissioner for Personal Data Protection (www.dataprotection.gov.cy).
8. Changes
If we change this notice materially, you will see the new version when you log in. More details: our Privacy Policy.