Data processing agreement

This agreement is between the organisation that uses Shiftbrook (the controller) and Helix Platforms Ltd, company no. 17032196 (the processor). It covers personal data about the controller’s staff that is entered into Shiftbrook. It sits alongside the terms of use.

What is processed

The subject matter is running rotas, on-site clock-in, leave and timesheets. Data subjects are the people the controller adds to the organisation. The data is names, contact details, roles, locations, shifts, clock times, leave, timesheets, and a profile photo if one is uploaded. The phone’s location is read only at clock-in and clock-out. Processing lasts while the organisation uses Shiftbrook, and afterwards for the retention period the controller sets.

Instructions

We process that data to provide Shiftbrook, and on the written instructions the controller gives through the product or by email to [email protected]. We tell the controller if an instruction appears to break UK data protection law.

Our duties

• People who handle the data are bound to keep it confidential.
• We use the measures on the security page. We do not claim a certified security scheme.
• We help the controller answer a request from a member of staff, using the download and anonymise tools in the product and by email where a tool is not enough.
• We tell the controller without undue delay if we become aware of a personal-data breach in Shiftbrook.
• At the end of the service, the controller can download the data. Anonymising a person, and deleting payroll rows after the retention period, work as described in the privacy notice.

Sub-processors

We use these sub-processors. Optional ones run only if the controller connects them.

• DigitalOcean, for hosting the application on App Platform and the Postgres database on Managed PostgreSQL in the London LON1 region.
• Resend, for email, when email sending is switched on.
• Stripe, for card payments on a paid plan.
• Google, Apple or Microsoft, if someone uses that sign-in.
• Xero, Slack or Microsoft Teams, if an owner or admin connects that product.

We will tell the controller before we add a sub-processor that handles staff data as part of the core service. The controller can object by email. If we cannot reasonably offer the service without that sub-processor, the controller may stop using Shiftbrook.

Audits

The controller may ask, in writing, for information we reasonably need to show that this agreement is being followed. We do not offer an on-site audit as a standard term.

This agreement is governed by the law of England and Wales.