Privacy Policy - ShiftHero

Download The App

Download The App

Your privacy is important.

Please find our full privacy policy below outlining how we handle your information.

You can contact our compliance officer in writing at gdpr@shifthero.co.uk

Effective: September 2026

1. Our Privacy Policy

ShiftHero Trading Limited ("ShiftHero", "we", "us" or "our") is committed to protecting the privacy and security of your personal information.

This Privacy Policy explains how we collect, use, store and share personal information when you visit or use our website, use our digital services or applications, make an enquiry, register as a candidate or worker, work through ShiftHero, or interact with us as a client, prospective client, supplier or other business contact.

It is intended to provide privacy information under applicable UK data protection legislation, including the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018. Our use of cookies and similar technologies is also subject to the Privacy and Electronic Communications Regulations ("PECR"), as amended.

ShiftHero Trading Limited is a data controller for the personal information for which we determine the purposes and means of processing. In some circumstances another organisation, such as a client or end hirer, may be a separate controller for its own processing.

This Policy does not form part of any contract of employment, contract for services or terms of engagement. We may provide additional or more specific privacy information where appropriate.

2. Who This Policy Applies To

This Policy applies, as relevant, to:

- visitors to our website and users of our online services;

- people who submit an enquiry, request information, contact us or apply for work through our website or other channels;

- candidates, prospective candidates, temporary workers, agency workers and contractors;

- users of the ShiftHero candidate, worker or client-facing applications and platforms;

- client and prospective-client representatives and users;

- suppliers, professional contacts and other business contacts; and

- other individuals whose personal information we lawfully process in connection with our recruitment and staffing services.

A separate employee privacy notice may apply to individuals employed directly by ShiftHero in internal office or corporate roles.

3. Data Protection Principles

We will process personal information in accordance with data protection law. This means personal information must be:

- processed lawfully, fairly and transparently;

- collected for specified, explicit and legitimate purposes and not used incompatibly with those purposes;

- adequate, relevant and limited to what is necessary;

- accurate and, where necessary, kept up to date;

- kept for no longer than necessary; and

- processed securely using appropriate technical and organisational measures.

4. Website Visitors And Online Services.

Information Collected When You Visit Our Website.

When you visit our website or use our online services, we may collect technical and usage information. Depending on your device, browser, settings and consent choices, this may include:

- IP address and approximate location derived from it;

- browser type and version, operating system and device information;

- pages viewed, links followed, referring pages or websites and navigation information;

- dates, times and duration of visits or interactions;

- technical identifiers and information generated by cookies or similar technologies; and

- security, diagnostic and server-log information.

We may use this information to operate and secure our website and online services, diagnose faults, prevent misuse, understand how our services are used, improve user experience and, where permitted, measure the effectiveness of our communications and marketing.

Our lawful basis may include our legitimate interests in operating, protecting and improving our website and services. Where consent is required for a particular cookie or similar technology, we will seek that consent before using it.

Website Enquiries, Applications and Forms.

If you complete a form, request a call, enquire about staffing, apply for work, submit a CV or otherwise contact us through our website or online services, we may collect:

- your name and contact details;

- company, role and business contact information where relevant;

- the content and subject of your enquiry;

- CV, work history, skills, qualifications or application information where you are seeking work;

- documents or files you choose to provide; and

- other information you voluntarily include in your communication.

We use this information to respond to your enquiry, provide or discuss our services, take steps towards a contract, process a work application or registration, maintain appropriate business records and follow up where appropriate.

The lawful basis will depend on the circumstances and may include taking steps at your request before entering into a contract, performing a contract, complying with legal obligations or our legitimate interests in responding to enquiries and operating our recruitment business.

5. Cookies And Similar Technologies

Our website and digital services may use cookies and similar storage or access technologies. Cookies are small files or identifiers stored on or accessed from a device.

We may use:

- strictly necessary technologies required for core website functionality, security, network management, preferences or services requested by you;

- analytics technologies to understand how visitors use our website and services and to improve performance and usability; and

- other optional technologies where they are introduced for functionality, measurement or marketing purposes.

Where required by PECR, we will obtain consent before using non-essential cookies or similar technologies. You can use our cookie settings to manage your preferences. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

We currently use or may use Google-provided analytics and website measurement services, including Google Analytics, subject to the choices presented through our cookie controls. These services may process technical identifiers and information about use of our website.

More detailed information about individual cookies and technologies, their providers, purposes and duration should be set out in our Cookies Policy and/or cookie preference centre. Where there is a conflict between a generic description in this Policy and the current cookie preference centre, the current service-specific information should be reviewed and kept aligned.

6. Candidates, Temporary Workers and Agency Workers

Information We May Collect.

Depending on your registration, role, assignment and applicable requirements, we may collect and process:

- identity and contact information, including name, title, address, telephone number and email address;

- date of birth and, where relevant, gender;

- National Insurance number, tax information, bank details, payroll records, pay, holiday and pension information;

- emergency contact and next-of-kin information;

- photographs and profile information;

- CV, application information, work history, references, skills, qualifications and experience;

- Right to Work documentation and evidence;

- driving licence information, licence checks, endorsements, qualifications and role-specific compliance information;

- availability, preferred work, assignment locations, bookings, shifts, working hours, timesheets and attendance records;

- training, induction, assessment, professional membership and site-eligibility records;

- performance information, client feedback, complaints, conduct, cancellations, no-shows, disciplinary or grievance information where relevant;

- communications with us and information generated through use of our systems;

- information relating to accidents, incidents, fines, damage or legal disputes where relevant; and

- other information reasonably required to provide recruitment services, administer an assignment or meet legal, regulatory, audit, insurance or client requirements.

How We Collect Candidate And Worker Information.

We normally collect information directly from you during registration, recruitment and throughout your relationship with ShiftHero. We may also receive relevant information from:

- former employers, referees and recruitment sources;

- clients, end hirers and sites at which you work or are considered for work;

- government services and identity or Right to Work checking services;

- driving licence, qualification, background or compliance-checking providers;

- payroll, pension and other service providers; and

- information generated during assignments, including timesheets, attendance, performance and client feedback.

How We Use Candidate And Worker Information.

We may use personal information to:

- register you with ShiftHero and manage your profile;

- assess your skills, qualifications, experience, availability and suitability for work;

- carry out identity, Right to Work, driving licence, qualification, reference and other appropriate compliance checks;

- match you with suitable opportunities and assignments;

- introduce or supply you to clients and prospective clients;

- provide clients and end hirers with information reasonably required to assess suitability for, arrange or administer an assignment;

- arrange, confirm and manage assignments, shifts and working arrangements;

- communicate bookings, cancellations, changes and other work-related information;

- manage availability;

- administer timesheets, working hours, pay, holiday entitlement and assignment records;

- manage performance, conduct, attendance, cancellations, no-shows, complaints and assignment-related matters;

- meet client, regulatory, audit, insurance and compliance requirements;

- operate our recruitment and workforce-management systems;

- process relevant information through client or end-hirer workforce-management systems where reasonably necessary to administer an assignment or potential assignment;

- maintain records of previous assignments, inductions, training and client or site eligibility; and

- communicate relevant work opportunities and information about your relationship with ShiftHero.

7. ShiftHero Applications And Digital Platform

ShiftHero operates digital systems, including web and mobile applications, through which candidates, workers and authorised client users may register, provide or update information, submit documentation, manage availability, receive or manage bookings, view assignment information, complete or approve records and communicate with ShiftHero.

Information provided through or generated by these systems may form part of the relevant candidate, worker or client record and may be used for the purposes described in this Policy.

Device, Notification And Technical Information.

Where our applications use push notifications or other digital communications, we may process device identifiers, notification tokens and related technical information required to provide those services.

Location Information.

Some ShiftHero services or features may use location information where this is necessary for a clearly identified feature, for example to support location-aware assignment functionality, site-related processes or other functions made available within the application.

Where device permission is required, your device or operating system will provide the relevant permission control. We will only use location information for the purposes communicated to you and in accordance with an appropriate lawful basis. Where a feature does not require precise location, we will seek to avoid collecting more precise information than is necessary.

8. Clients, Prospective Clients And Client Users

If you represent a client or prospective client, or use a ShiftHero client-facing service, we may process:

- name, job title and business contact details;

- company, site and account information;

- communications, meetings, enquiries and service records;

- account, purchase-order, timesheet, approval and invoicing information where relevant;

- user-account, access and security information;

- bookings, staffing requirements and service preferences; and

- other information reasonably required to provide and administer our services.

We use this information to establish and manage client relationships, provide recruitment and staffing services, administer accounts and bookings, provide platform access, communicate about services, maintain records, protect our systems and pursue legitimate business interests.

Our lawful bases may include performance of a contract, taking steps before entering into a contract, legal obligations and our legitimate interests in providing and developing our services and managing business relationships.

9. Suppliers And Other Business Contacts

Where you represent a supplier, professional adviser or other business contact, we may process your name, role, business contact details, communications and information relevant to our relationship.

We generally use this information to manage the business relationship, obtain or provide services, maintain records and communicate with you. Our lawful basis will usually be contractual necessity or our legitimate interests in operating and managing our business.

10. Lawful Bases For Processing

We only process personal information where the law allows us to. Depending on the activity, we may rely on:

- Contract - where processing is necessary to take steps at your request before entering into a contract or to perform a contract with you;

- Legal obligation - where processing is necessary for us to comply with a legal obligation;

- Legitimate interests - where processing is necessary for our legitimate interests or those of a third party, provided your interests, rights and freedoms do not override those interests;

- Vital interests - in limited circumstances where processing is necessary to protect your life or that of another person;

- Public task - in limited circumstances where processing is necessary for a task carried out in the public interest or under official authority; and

- Consent - where consent is the appropriate lawful basis, including where required for certain optional cookies or technologies.

Where we rely on legitimate interests, those interests may include operating a recruitment business, finding and supplying suitable workers, administering assignments, managing client relationships, protecting our systems, preventing fraud, maintaining business records and improving our services.

Some processing may be justified by more than one lawful basis.

11. Special Category Personal Information

Certain information receives additional protection under data protection law. Depending on the circumstances, this may include information about health or disability, racial or ethnic origin, religious or philosophical beliefs, trade union membership, sexual orientation, biometric or genetic information.

We will only process special category information where an Article 6 lawful basis and an applicable additional condition under data protection law are satisfied. This may include processing necessary for employment, social security or social protection obligations and rights; health and safety or occupational purposes where lawful; substantial public interest purposes; legal claims; vital interests; or explicit consent where appropriate.

12. Criminal Conviction And Offence Information

We will only collect and use criminal conviction or offence information where it is appropriate for the role, assignment or purpose and where the law permits us to do so. Where applicable, we will use the additional safeguards and policy documentation required by law.

13. If You Do Not Provide Information

Where particular information is required by law, contract, client requirement or to provide a requested service, failure to provide it may mean that we cannot register you, assess suitability, arrange or continue an assignment, pay you, provide platform access, respond fully to an enquiry or enter into or perform a business relationship.

Where information is optional, we will seek to make this clear where appropriate.

14. Our Group

ShiftHero Trading Limited forms part of a wider group of companies under common ownership and control.

ShiftHero Trading Limited is the data controller responsible for the personal information described in this Privacy Policy where that information is processed in connection with ShiftHero's recruitment, staffing and related services.

We may share personal information with other companies within our group where this is reasonably necessary for legitimate business purposes, including group administration, finance, governance, legal and regulatory compliance, information technology, intellectual property management, business continuity and the operation or development of shared services.

Where personal information is shared within our group, we will only share information that is reasonably necessary for the relevant purpose and where an appropriate lawful basis applies.

Where another group company processes personal information for its own purposes, that company may act as a separate data controller and will be responsible for complying with its own obligations under applicable data protection law.

15. Data Sharing

We may share personal information where this is necessary and lawful for our recruitment and staffing services, digital services, business operations or legal obligations. We seek to limit information shared to what is reasonably necessary for the relevant purpose.

Who We May Share Information With.

- clients, prospective clients and end hirers;

- sites and organisations at which workers are considered for or undertake assignments;

- authorised client representatives;

- workforce-management, Vendor Management System (VMS), scheduling, compliance, timesheet, purchase-order and related technology platforms used by ShiftHero, clients or end hirers;

- payroll, accounting, pension and benefits providers;

- IT, hosting, communications, analytics and other technology providers;

- identity, Right to Work, driving licence, qualification, reference, background and compliance-checking providers;

- professional advisers, auditors, insurers and finance providers where appropriate;

- government departments, regulators, courts, law-enforcement bodies and other authorities where required or permitted by law; and

- other third parties where necessary to establish, exercise or defend legal claims or protect the rights, property or safety of ShiftHero, our workers, clients or others.

- other companies within our group, where there is a legitimate and lawful reason for sharing the information;

Clients, End Hirers And Workforce-Management Systems.

When a worker is considered for, booked onto, inducted for or supplied to an assignment, it may be necessary for ShiftHero to provide relevant personal information to the client or end hirer.

Clients and end hirers may use their own workforce-management systems or third-party technology platforms to manage contingent workers. Relevant information may therefore be entered into or processed through those systems for purposes including worker identification, assignment and shift management, compliance, inductions, site access, communication, timesheets, approvals, purchase orders and invoicing.

Depending on the arrangement, a client or end hirer may act as a separate data controller for some of its processing. Technology providers may act as processors for ShiftHero, a client or another controller. A separate controller is responsible for its own processing and privacy obligations.

Consent And Data Sharing.

We do not generally rely on consent where sharing is reasonably necessary to provide recruitment services, administer our relationship with an individual, arrange or manage an assignment, comply with a legal obligation or pursue our legitimate interests or those of a third party.

Where consent is the appropriate lawful basis for a particular activity, we will ask for it separately and explain the relevant processing.

16. Security

We maintain appropriate technical and organisational measures designed to protect personal information against accidental or unlawful loss, alteration, disclosure, access or destruction. Access is limited to people and organisations with an appropriate business need.

Where a third-party provider processes personal information on our behalf as a processor, we require appropriate contractual, confidentiality and security arrangements. Where information is shared with another organisation acting as a separate controller, that organisation is responsible for its own processing in accordance with data protection law.

We maintain procedures for responding to suspected personal data breaches and will notify affected individuals and/or the Information Commissioner's Office where required by law.

17. International Transfers

Some service providers, clients, end hirers or technology providers may process or store personal information outside the United Kingdom.

Where a transfer is restricted under UK data protection law, we will use an appropriate lawful transfer mechanism or safeguard where required, which may include UK adequacy regulations, appropriate contractual safeguards or another permitted mechanism. Information about relevant safeguards can be requested using the contact details below.

18. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including legal, regulatory, tax, accounting, payroll, insurance, audit and reporting requirements and the establishment, exercise or defence of legal claims.

Retention periods vary according to the type of information and relationship. In deciding how long to retain information we consider its amount, nature and sensitivity, the purposes for processing it, the risk of harm from unauthorised use or disclosure, whether the purpose can be achieved by other means and applicable legal requirements.

Where appropriate, information will be securely deleted, destroyed or anonymised when no longer required. Further detail may be contained in our internal retention schedule or policy.

19. Automated Decision-Making And Profiling

Automated decision-making occurs where an electronic system makes a decision about an individual without meaningful human involvement. We do not envisage making decisions that produce legal or similarly significant effects solely by automated means unless we have an appropriate lawful basis and safeguards.

If we introduce such processing, we will provide the information required by data protection law, including meaningful information about the processing and applicable rights.

20. Direct Marketing And Communications

We may communicate with business contacts about ShiftHero services where permitted by applicable data protection and electronic-marketing law. Where consent is required for a particular electronic marketing communication, we will seek it.

You can ask us to stop sending direct marketing at any time using an unsubscribe mechanism where provided or by contacting us. Service, account, assignment, compliance or other non-marketing communications may still be sent where necessary.

21. Keeping Information Accurate

It is important that personal information we hold is accurate and current. Please tell us if relevant information changes during your relationship with ShiftHero.

22. Your Rights

Depending on the circumstances and lawful basis, you may have the right to:

- request access to personal information we hold about you;

- request correction of inaccurate or incomplete information;

- request erasure of personal information in certain circumstances;

- request restriction of processing in certain circumstances;

- object to processing based on legitimate interests in certain circumstances;

- object to direct marketing at any time;

- request transfer of certain personal information where the right to data portability applies;

- withdraw consent at any time where processing is based on consent, without affecting processing already carried out before withdrawal; and

- rights relating to certain solely automated decisions where applicable.

These rights are not absolute and may be subject to legal conditions and exemptions. We may request information reasonably necessary to verify your identity before responding.

You will not normally have to pay a fee to exercise your rights. However, the law may allow us to charge a reasonable fee or refuse a request where it is manifestly unfounded or excessive.

23. Compliants

If you have concerns about how we use personal information, please contact us first so that we can investigate and respond.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection matters.

24. Contact Us

For questions about this Privacy Policy, our use of personal information, or to exercise a data protection right, please contact:

ShiftHero Trading Limited
For the attention of: Compliance Officer
Email: gdpr@shifthero.co.uk
You may also contact us using our current published business contact details.

If we appoint a Data Protection Officer or change the relevant privacy contact, this section will be updated.

25. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal obligations or processing activities.

Where an update is material, we will take reasonable steps to bring it to the attention of affected individuals. We may also provide additional or just-in-time privacy information where a particular new use of personal information requires further explanation.

The effective date shown at the beginning of this Policy indicates the current published version.