1. Introduction

ShiftPaye ("ShiftPaye", "we", "our" or "us") provides workforce management tools designed to help businesses manage employee scheduling, shifts, timesheets, leave requests, user accounts and related administrative workflows.

This Privacy Policy explains how we may collect, use, disclose, store and otherwise handle personal information when you visit our website, create an account or use our services.

This policy should be read alongside any applicable service agreement, subscription terms and notices provided when personal information is collected.

2. Who Is Responsible for Personal Information?

Depending on the circumstances, ShiftPaye and the business using the platform may have different responsibilities for personal information.

• ShiftPaye: May handle account, website, subscription and technical information to operate and support the platform.
• Business customers: May enter or manage employee information, shifts, timesheets and leave records for their own business purposes. The customer is responsible for ensuring it has an appropriate legal basis and any required notices or permissions for that information.
• Authorized users: Employees and other users should use the platform in accordance with their organization's policies and applicable law.

The exact responsibilities depend on the services provided, applicable agreements and relevant privacy legislation.

3. Information We May Collect

3.1 Company and account information

Depending on how the platform is used, this may include company name, business contact details, account identifiers, usernames, role assignments, registration information and account status.

3.2 Employee and workforce information

Business customers may enter or maintain information such as employee names, work contact details, assigned roles, shift schedules, work hours, timesheets, leave requests and related administrative records.

3.3 Timesheet and payroll-related information

If enabled and entered by an authorized customer, the platform may handle work-hour records, timesheet information, payroll workflow data and related employment records. The specific information depends on the features used.

3.4 Tax profile information

If an available feature collects employee tax profile details, those details may include information entered by an employee or an authorized company representative. Only describe specific tax fields here after confirming which fields the live platform actually collects and stores.

3.5 Subscription and Payment Information

ShiftPaye may collect and maintain information needed to manage subscriptions, billing status, payment confirmations and transaction records. Depending on the payment method used, this may include a payment reference, transaction identifier, payment amount, payment date and subscription status.

Payment card information: ShiftPaye does not store customers' full credit card or debit card numbers, card security codes (CVV/CVC), or complete payment card details in its application database, provided these details are not submitted to or stored by ShiftPaye's website, application, logs or other systems.

If a third-party payment provider is used in the future, payment card information may be collected and processed directly by that provider under its own terms and privacy policy. ShiftPaye will update this policy to accurately describe the provider and the information received by ShiftPaye.

For bank transfers, ShiftPaye may retain transaction references, payment confirmation details and other information submitted by a customer or required to administer a subscription. Customers should not submit card security codes, passwords or unnecessary financial information through support requests or general text fields.

3.6 Technical and usage information

Depending on the website configuration and services in use, technical information may include browser type, device information, IP address, access logs, error reports and information about interactions with the website or platform.

4. How We Use Information

Subject to applicable law, information may be used to:

• Create and administer company and user accounts.
• Provide employee scheduling, shift, timesheet and leave workflows.
• Manage user permissions and company access.
• Administer subscriptions, payments and account status.
• Respond to support requests and communicate service information.
• Maintain, troubleshoot and improve the platform.
• Protect accounts, investigate suspected misuse and help prevent fraud.
• Meet applicable legal, regulatory and contractual obligations.

We should only use personal information for purposes that are identified, permitted by law and appropriate to the circumstances in which it was collected.

5. Legal Basis and Consent

Where required by applicable law, we will identify the appropriate legal basis for collecting, using or disclosing personal information. Depending on the circumstances, this may include consent, providing a requested service, contractual requirements or legal obligations.

Consent requirements and available exceptions differ by jurisdiction and type of information. Where consent is relied on, it will be handled in accordance with applicable law.

6. How Information May Be Shared

We may disclose personal information where necessary and permitted by law, including in the following circumstances:

• Within a customer's organization: Authorized administrators, supervisors, accountants or other permitted users may access information according to their assigned roles and permissions.
• Service providers: Hosting, technical support, security, communications or other providers may process information on our behalf where they are actually engaged.
• Legal requirements: Information may be disclosed where required or authorized by law or a valid legal process.
• Business changes: Information may be involved in a proposed or completed business transaction, subject to applicable privacy requirements.

We do not authorize disclosures beyond what is appropriate for the relevant purpose and applicable legal requirements.

Before publishing: Identify the actual hosting provider, email or notification services, analytics tools and other third parties that receive personal information, where applicable.

7. Storage and International Processing

Personal information may be stored or processed in locations determined by our hosting infrastructure and service providers. Depending on those arrangements, information may be processed outside the province or country where the individual is located and may be subject to the laws of that location.

Before publishing this section, confirm the locations used by your hosting provider and any connected services. Do not claim that all data remains in Canada unless you have verified this.

8. Security Safeguards

Appropriate safeguards should be used to protect personal information against loss, unauthorized access, disclosure, alteration or misuse. Depending on the actual implementation, safeguards may include access controls, permissions, secure connections, backups, updates and monitoring.

No online platform or method of electronic storage can be guaranteed to be completely secure. ShiftPaye should maintain safeguards appropriate to the sensitivity of the information and the risks involved.

Only describe specific safeguards as implemented after verifying them in the live application and hosting environment.

9. Data Retention

Personal information should be retained only for as long as reasonably necessary for the purposes for which it was collected, subject to applicable legal, contractual and recordkeeping requirements.

Retention periods may vary for account records, subscription information, employee records, timesheets, support requests and technical logs. Some information may need to be retained after an account closes where required by law or necessary to resolve disputes.

Before publishing, establish actual retention periods and explain how information is deleted, anonymized or otherwise disposed of when it is no longer required.

10. Privacy Rights and Choices

Depending on the applicable law and circumstances, individuals may have rights to request access to personal information, request corrections, withdraw consent where consent is the basis for processing, or raise concerns about how information is handled.

Employees whose information is managed by an employer through ShiftPaye may need to contact their employer first for records controlled by that organization. ShiftPaye may assist with requests relating to information for which it is responsible.

Requests will be reviewed and handled according to applicable legal requirements. Some exceptions or restrictions may apply.

11. Canadian Privacy Laws

ShiftPaye aims to handle personal information in accordance with applicable Canadian privacy legislation. Depending on the organization, the information involved and the activities being conducted, applicable laws may include British Columbia's Personal Information Protection Act (PIPA), Alberta's Personal Information Protection Act, Quebec's private-sector privacy legislation and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

We seek to limit the collection of personal information to appropriate purposes, explain why information is collected, use and disclose it only as permitted by applicable law, maintain appropriate safeguards, and retain it only as long as necessary for legitimate purposes and applicable legal requirements.

Subject to applicable law and its exceptions, individuals may request access to personal information under an organization's control and request correction of inaccurate information. We will review and respond to requests in accordance with the law that applies.

Where required, ShiftPaye will address privacy complaints and report or notify affected individuals and regulators about privacy breaches in accordance with applicable legal requirements.

The applicable privacy law depends on the circumstances. This policy does not represent a claim that one particular law applies to every ShiftPaye customer or user.

12. Cookies and Similar Technologies

Our website or platform may use cookies or similar technologies that are necessary for functions such as maintaining sessions, remembering preferences or supporting website operation. Other technologies, such as analytics tools, should be disclosed where they are actually used.

The cookies and technologies in use depend on the WordPress configuration, plugins, analytics tools and app implementation. Review the live website and configure any required consent mechanism before publishing this section.

13. Children's Privacy

ShiftPaye is intended for business and workforce management use, not as a service directed at children. Business customers should ensure that information entered into the platform is appropriate for its intended use and handled in accordance with applicable law.

14. Third-Party Websites and Services

Our website may link to third-party websites or services. Their privacy practices are governed by their own policies. We encourage users to review those policies before providing personal information to third parties.

15. Changes to This Privacy Policy

We may update this policy to reflect changes to the platform, our information-handling practices or applicable legal requirements. The revised policy will be published on this page with an updated revision date. Where required by law, we will provide additional notice or obtain consent.

16. Contact Us About Privacy

If you have a question, concern or request regarding this Privacy Policy or the handling of personal information, contact ShiftPaye using the privacy contact details below.