Privacy Policy
Last updated: 5 April 2026
1. Who we are
Subshift ("we", "us", "our") is a trading name used to provide shift staffing automation software. We are based in London, United Kingdom. For any data protection queries, contact us at privacy@subshift.app.
2. What this policy covers
This policy explains how we collect, use, store, and protect personal data when you visit our marketing website at subshift.app (the "Site"). It applies under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
If you are an agency, client, or worker using the Subshift application, additional terms and a separate data processing agreement apply to that usage.
3. Data we collect on this Site
3.1 Contact form submissions
When you submit the contact or early access form, we collect:
- Your name
- Agency / company name
- Email address
- Phone number (if provided)
- Number of workers you place
- Primary sector (if provided)
- Any free-text message you include
Legal basis: Legitimate interest — you have actively requested contact from us by submitting the form.
3.2 Cookies
We use only essential cookies required for the Site to function (e.g. cookie consent preference). We do not use analytics, advertising, or tracking cookies on this Site. If we add analytics in the future, we will update this policy and request your consent before setting any non-essential cookies.
3.3 Server logs
Our hosting provider may collect standard server log data (IP address, browser type, pages visited, timestamps). This data is used solely for security and performance monitoring and is not linked to identifiable individuals.
4. How we use your data
- To respond to your enquiry or demo request
- To set up a trial account if you request one
- To send you relevant follow-up information about Subshift (you can opt out at any time)
- To improve the Site and our services
5. Who we share your data with
We do not sell your data. We may share it with:
- Email delivery providers — to send you confirmation and follow-up emails
- Hosting providers — who store and serve the Site
All third-party providers are bound by data processing agreements and process data only on our instructions.
6. Data retention
Contact form submissions are retained for up to 24 months from the date of submission, unless you request earlier deletion. Server logs are retained for up to 90 days.
7. Your rights
Under UK GDPR, you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — ask us to correct inaccurate data
- Erasure — ask us to delete your data ("right to be forgotten")
- Restriction — ask us to limit how we process your data
- Portability — receive your data in a structured, machine-readable format
- Object — object to processing based on legitimate interest
To exercise any of these rights, email privacy@subshift.app. We will respond within 30 days.
8. Security
We take appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), access controls, and secure hosting infrastructure. However, no method of transmission over the internet is 100% secure.
9. International transfers
Your data may be processed outside the UK where our hosting or email providers operate. Where this occurs, we ensure appropriate safeguards are in place (e.g. Standard Contractual Clauses or adequacy decisions).
10. Changes to this policy
We may update this policy from time to time. Material changes will be noted with an updated "Last updated" date at the top of this page. We encourage you to review this page periodically.
11. Complaints
If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
12. Contact
For any questions about this privacy policy or your personal data, contact us at:
privacy@subshift.app