Privacy policy
Shifty keeps the attendance register for people employed in private households: when they arrive and leave, their leave, and the papers an employer has to hold. That means handling personal information about workers — some of it sensitive, like ID numbers and bank details. This page says what we collect, why, who can see it, where it is kept and what you can ask of us. It is written to meet South Africa's Protection of Personal Information Act (POPIA).
1. Who we are
Shifty is a South African company whose registration with the Companies and Intellectual Property Commission (CIPC) is in progress. Until it is complete, Shifty is operated by its founder, Wiekus van der Walt, who is accountable for it.
Contact for anything on this page: privacy@shiftygroup.com.
2. Two roles
For households using Shifty (the employer and anyone they make a manager), Shifty decides how the account information is used, so we are the responsible party for it.
For the records of the people a household employs, the household is the employer and is responsible for its employment records, as the law already requires of it. Shifty keeps those records on the household's behalf and only uses them to run the service for that household and for the worker. A worker employed by two households has one profile, which both can see.
3. What we collect
About employers and managers
- Name, email address and password (the password is stored only as a secure hash).
- Household name and country, and the name, address and boundary of each property.
- Which rights each manager has, and the decisions they make (approving leave, overtime, phones and shifts).
About workers
- Employment: name, mobile number, occupation, start date, pay rate and working terms, and which days and hours they work.
- The register: each clock-in and clock-out time; the phone's location at that moment and its accuracy; whether an NFC tag or a printed code was used; and whether the location looked simulated.
- Requests: leave and overtime requests, with any reason given.
- Documents: copies of the contract, ID and work permit uploaded, and their expiry dates.
- Banking details: account holder, bank, branch code, account number and type.
- Profile, if the worker adds it: photo, preferred name, home language, date of birth, home address, ID or passport number, tax number, and an emergency contact's name, relationship and phone number.
- The phone: an app-generated device identifier, the platform, and a notification token. Workers sign in with a one-time code from their employer, which links that phone to their job; no phone number is verified.
- Records of access: when somebody opens a worker's documents, banking details or ID number, and who.
An emergency contact is a third person. A worker should only add someone who has agreed to be contacted.
4. What we do not do
- No tracking. Location is read only while Shifty is open, to check that somebody is inside the property when they clock in or out. Shifty does not follow anyone's location in the background or when the app is closed.
- No selling, no advertising, no analytics trackers.
- Fingerprint and face stay on the phone. When Shifty asks the phone to confirm it is you, the phone checks and answers yes or no. We never receive biometric data.
- ID documents are read on the phone. Filling in a profile from an ID or passport is done on the device; the picture is not sent anywhere to be read.
- Photo locations are removed. A profile photo is resized and re-saved on the phone before upload, which removes the location a camera stores in it.
5. Why we use it
- To keep the register and run employment: recording hours and leave, working out pay previews, and the records South African employment law requires an employer to keep. This is needed to perform the employment relationship and to meet legal obligations.
- To keep the register honest: the location check, the tag or code, and the device identifier stop clock-ins from somewhere else or from somebody else's phone. This is our legitimate interest and the household's.
- To tell people what they need to know: leave answers, papers running out, a shift closed automatically, somebody arriving or late.
- Optional details (photo, emergency contact, filling in from an ID) are used because the worker chose to add them, and can be removed.
6. Who can see what
- A worker can see their own records at every household they work for.
- The household's owner, and managers given the right, can see the records of the people the household employs — not anyone else's.
- ID and tax numbers are shown to the employer masked. Showing them in full is recorded, and the worker can see when it happened.
- Banking details can be seen by the employer so that they can pay the worker, but only the worker can change them, and the worker is notified whenever they change. Showing the account number is recorded.
- Opening a worker's documents is recorded, and the worker can see who opened what and when.
- Shifty's own staff access information only to run, support and secure the service.
7. Service providers, and where information is kept
We use these providers to run Shifty. Each only receives what its job needs.
- Supabase — the database, sign-in and file storage. All records, documents and photos are stored in its Frankfurt, Germany data centre.
- Expo and Google Firebase Cloud Messaging — deliver push notifications (receive the notification token and the notification's text, which can include a first name).
- Cloudflare — runs this website and handles email sent to our shiftygroup.com addresses.
- Komoot (Photon), Germany — looks up a property's address while an employer types it (receives only the typed address).
Some of these providers are outside South Africa. POPIA allows personal information to be sent abroad where the recipient is bound by law or binding terms that give adequate protection (section 72). Our main store is in the European Union, whose General Data Protection Regulation provides that protection, and our providers are bound by their own data protection terms.
8. How we protect it
- Information is encrypted in transit, and access is enforced by the database itself: every request is checked against who is asking.
- Documents and photos are in private storage, reached only through links that expire within minutes.
- Printed clock-in codes are stored only as a one-way fingerprint, so a copy of the database does not contain a working code.
- If a security breach puts personal information at risk, we will tell the Information Regulator and the people affected as POPIA requires.
9. How long we keep it
- Attendance and pay records are kept for at least three years, because employers must keep them that long.
- Documents, banking details and profile are kept while the person is employed through Shifty. A replaced document or photo is deleted within about an hour.
- When an account is closed, we delete or de-identify its information, except what the law requires us or the employer to keep, which is deleted when that period ends.
10. Your rights
Under POPIA you may ask whether we hold information about you and for a copy of it; ask us to correct or delete it; object to how it is used; and withdraw consent you gave for optional details. Workers can also ask their employer. Write to privacy@shiftygroup.com. We answer within 30 days, and may need to confirm who you are first.
Deleting your account: in the app, under Me (workers) or Setup → Account (employers), or by following these steps without the app.
Some information cannot be deleted while the law requires it to be kept — the attendance register, for example. If so, we will say what, and for how long.
11. Children
Shifty is not intended for anyone under 18, and we do not knowingly hold their information.
12. Changes
When this policy changes, the date at the top changes. If a change affects how information you have already given is used, we will tell you in the app first.
13. Information Officer and complaints
Information Officer: Wiekus van der Walt, reachable at privacy@shiftygroup.com.
If you are not satisfied with our answer, you may complain to the Information Regulator (South Africa): inforegulator.org.za.