Privacy Policy

Shift Tracker is a workforce and shift-management application available at myst.culturays.com.

For data protection purposes, the organisation responsible for deciding why and how your personal information is processed is the data controller.

Data controller: [Insert your registered business or organisation name]

Business address: [Insert your business address]

Privacy contact: [Insert your privacy contact email address]

In this policy, "we", "us", and "our" refer to the data controller identified above. "You" refers to a worker, authorised administrator, or other person whose information we process through the service.

Depending on how you use the application, we may collect and process the following categories of personal information.

Worker profile information

• Your name.
• Your email address, where provided.
• Your date of birth, where required for workforce administration.
• Your hourly rate, where required for shift or pay calculations.
• Your shift group, work pattern, and cycle-start information.
• Your worker identifier and other profile information needed to operate the service.

Shift and work information

We may process shift dates, shift assignments, work patterns, and other shift-related information entered into or generated by the application. This information helps us display and administer your work schedule.

Requests and administrator reviews

If you request a profile correction, a shift-related change, or deletion of your information, we may retain the request details, the existing and proposed information, your stated reason, its status, the submission date, and any administrator review notes.

Account and technical information

We process information needed to authenticate your account and maintain your session. Depending on the hosting and security configuration, server and security logs may also contain technical information such as IP addresses, request times, browser details, error messages, and access events.

Information you provide

We process information you voluntarily submit through forms, support communications, or requests to the administrator. Please do not submit sensitive personal information unless it is specifically requested and necessary.

We do not intend to collect personal information unrelated to operating the Shift Tracker.

We may use personal information to:

• Create, maintain, and identify worker profiles.
• Authenticate users and maintain secure sessions.
• Display and administer shift schedules and work patterns.
• Record and administer shift-related information.
• Calculate or display shift-related values where the application supports those functions.
• Receive, review, and respond to profile-change and data-deletion requests.
• Allow authorised administrators to manage records and review requests.
• Investigate errors, prevent misuse, and protect the service.
• Respond to support enquiries and comply with legal obligations.
• Establish, exercise, or defend legal claims when necessary.

We do not use worker information for unrelated advertising or sell personal information to data brokers as part of the intended operation of this application.

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we must have an appropriate lawful basis for processing personal information.

• Contract: Where processing is necessary to perform a contract with you or take steps you request before entering into a contract.
• Legal obligation: Where we must process or retain information to comply with applicable law.
• Legitimate interests: Where necessary for legitimate operational, administrative, or security purposes, provided your rights and interests do not override those interests.
• Consent: Where we specifically rely on your consent for a particular purpose. You can withdraw consent at any time, without affecting processing that took place before withdrawal.

The applicable basis depends on the purpose of the processing. We will determine and document the appropriate basis for each activity rather than treating every activity as necessary for a contract or legitimate interests.

The worker portal uses an authentication session cookie namedshift_worker_sessionto recognise an authenticated worker session.

This cookie is intended to support login and account security. It should be configured as an HttpOnly cookie and, where appropriate, use Secure and SameSite attributes. Authentication tokens should not be exposed to client-side JavaScript.

We may use other strictly necessary cookies or similar technologies to maintain security and operate the application. If analytics, advertising, or other non-essential technologies are introduced, we will update this policy and obtain consent where required by applicable law.

You can manage cookies through your browser settings. Blocking necessary session cookies may prevent you from signing in or using parts of the service.

We do not make worker profile or shift information publicly available. Access should be restricted according to each user's role and responsibilities.

We may share information with the following categories of recipients:

• Authorised administrators: To manage worker records, review requests, and administer the service.
• Database and infrastructure providers: To host, store, back up, and serve application data.
• Hosting and security providers: To operate the website, maintain availability, and protect against unauthorised access.
• Professional advisers or authorities: Where reasonably necessary to comply with law, protect rights, or deal with legal claims.

Our application uses Supabase for database-related services. The actual provider list, including hosting, backups, email, logging, and monitoring services, should be confirmed against the services currently enabled for this deployment.

Where service providers process personal information on our behalf, we will take appropriate steps to require suitable confidentiality, security, and data-protection safeguards.

We do not sell your personal information. We will not share it for another purpose unless that purpose is lawful and compatible with our obligations or otherwise properly authorised.

Our service providers or their infrastructure may process or store personal information outside the United Kingdom. Whether an international transfer occurs depends on the providers, regions, backups, and configuration actually used.

Where personal information is transferred internationally, we will identify the applicable transfer requirements and use an appropriate lawful transfer mechanism where required, such as applicable adequacy regulations or approved contractual safeguards.

You can contact us using the details in Section 16 to ask for further information about relevant transfers and safeguards.

We keep personal information only for as long as reasonably necessary for the purposes described in this policy, including applicable operational, contractual, security, and legal requirements.

• Worker profiles: While the profile is active and for any additional period justified by legitimate administrative or legal requirements.
• Shift records: For as long as needed to administer schedules and resolve relevant operational, contractual, or legal matters.
• Change requests: For as long as necessary to review the request, maintain an appropriate decision record, and address relevant disputes or obligations.
• Session records: Until they expire or are revoked, subject to any limited retention needed for security or investigation.
• Security logs and backups: According to their operational purpose and the retention schedules configured for the relevant systems.

These are retention principles, not a representation that fixed deletion periods have already been configured. We will maintain appropriate retention schedules and securely delete or anonymise information when it is no longer needed, unless we must retain it by law or for another valid reason.

We use appropriate technical and organisational measures designed to protect personal information against accidental loss, unauthorised access, alteration, disclosure, or destruction.

Depending on the system and configuration, these measures may include:

• Authentication and role-based access controls.
• Restricted server-side database access.
• Secure session cookies and session expiry.
• HTTPS encryption in transit.
• Secure handling of authentication secrets and credentials.
• Database access restrictions and appropriate backups.
• Monitoring, updates, and investigation of suspected security incidents.

No internet service or storage system can be guaranteed to be completely secure. You should keep login details confidential and report suspected unauthorised access promptly.

Depending on the circumstances and applicable law, you may have the right to:

• Access: Request a copy of the personal information we hold about you.
• Rectification: Ask us to correct inaccurate or incomplete information.
• Erasure: Ask us to delete your information where the legal requirements for erasure are met.
• Restriction: Ask us to restrict certain processing in circumstances provided by law.
• Objection: Object to processing based on legitimate interests or to direct marketing, where applicable.
• Data portability: Request eligible information in a commonly used, machine-readable format where the right applies.
• Withdraw consent: Where we rely on consent, withdraw it at any time.
• Complain: Raise a concern with us or the relevant supervisory authority.

These rights are not absolute in every situation. For example, we may need to retain certain records to comply with legal obligations or establish, exercise, or defend legal claims.

To exercise a right, contact us using the privacy contact details in Section 16. We may need to verify your identity before providing information or making changes.

We will respond within the period required by applicable data-protection law. Requests are generally handled without charge, although the law permits limited exceptions for manifestly unfounded or excessive requests.

Workers can use the available request process to ask for deletion of their personal information. Submitting a request does not itself delete your records.

We may need to verify the request, review applicable legal obligations, and determine whether any information must be retained. We will explain the outcome where appropriate.

If deletion is approved, we will delete or anonymise the relevant information where required and technically appropriate. Some records may need to be retained for legal, security, accounting, dispute-resolution, or other lawful purposes.

Information in backups or security logs may persist for a limited period under the applicable retention arrangements before being securely overwritten or deleted.

You can also contact the privacy contact in Section 16 to make a data-protection request. We will assess it under applicable law, whether or not you use the application's request form.

The intended purpose of Shift Tracker is to support the administration and display of worker profiles and shift records. Profile-change and deletion requests may be submitted through the application for administrator review.

We do not intend to make decisions about workers that have legal or similarly significant effects based solely on automated processing. If this changes, we will update this policy and provide any additional information and safeguards required by law.

Shift Tracker is intended for workforce and administrative use, not as a service directed at children. We do not knowingly collect children's personal information except where it is lawfully required and appropriate for a defined purpose.

If you believe a child has provided personal information inappropriately, contact us so that we can assess the situation and take appropriate action.

The application may contain links to websites or services operated by third parties. Those services have their own privacy practices and policies. We are not responsible for their independent handling of personal information.

Review the privacy policy of any third-party service before providing personal information to it.

We may update this policy to reflect changes in the application, the information we process, our service providers, or applicable law.

We will update the revision date when changes are made. Where a change materially affects how we use personal information, we will provide additional notice where required by law.

Please review this page periodically to remain informed about our privacy practices.

For questions about this policy, to exercise your rights, or to raise a concern about how your information is handled, contact:

If you are dissatisfied with our response, you may complain to the UK's Information Commissioner's Office (ICO), where applicable.

Information and complaint guidance are available from the Information Commissioner's Office.