Sub-processors
The third parties that process Customer data on our behalf, what each one does, where it does it and how the transfer is protected.
365shift (Veyral IT Solutions) uses a small number of specialised providers to run the Services. Where a provider handles personal data that a Customer has entrusted to us, it is a "sub-processor" under Article 28 of the GDPR. Each sub-processor is bound by a written contract to process the data only on our instructions, to keep it confidential and secure, and to delete it when the engagement ends.
Changes. Before a new sub-processor receives Customer data we update this page and inform Account Owners by e-mail. A Customer that objects on reasonable data protection grounds may terminate its subscription for the affected service.
Infrastructure and service sub-processors
Supabase
Privacy notice- Purpose
- Database, authentication, file storage and server functions — the platform that holds every Customer account.
- Data involved
- All Customer data: user profiles, rosters, clock and location records, messages, files, audit logs.
- Location
- EUEuropean Union — Stockholm, Sweden (hosting); Supabase, Inc. is established in the United States.
- Transfer safeguard
- Data stays in the EU. Standard Contractual Clauses cover any support access from outside the EU.
Vercel
Privacy notice- Purpose
- Hosting and content delivery of the website and the web application; anonymous page-speed measurement.
- Data involved
- Request data: IP address, browser identifier, page address (without query parameters).
- Location
- USUnited States, with edge servers worldwide.
- Transfer safeguard
- Standard Contractual Clauses.
Resend
Privacy notice- Purpose
- Delivery of the e-mails the Services send (rosters, notifications, invitations, password resets) and receipt of replies to them.
- Data involved
- Recipient name and e-mail address, the content of each e-mail.
- Location
- USUnited States.
- Transfer safeguard
- Standard Contractual Clauses.
Stripe
Privacy notice- Purpose
- Subscription payments, card storage and the customer billing portal.
- Data involved
- Billing contact name and e-mail, company billing details, payment card (entered directly with Stripe).
- Location
- EU · USIreland (Stripe Payments Europe) and United States.
- Transfer safeguard
- Standard Contractual Clauses.
Elorus
Privacy notice- Purpose
- Issuing of invoices to Customers.
- Data involved
- Company name, VAT number, tax office, billing address, invoice lines.
- Location
- EUGreece (European Union).
- Transfer safeguard
- Not required — processing within the EU.
Google
Privacy notice- Purpose
- Gemini models for the AI-assisted features (schedule suggestions, evaluation, training, interview and procedure drafts, help assistant); address suggestions on the sign-up form; map data and web fonts on the website.
- Data involved
- The content a Customer sends to an AI feature (names, roles, shift and evaluation data as needed by that feature); the address typed at sign-up; visitor IP address for fonts.
- Location
- US · EUUnited States and European Union.
- Transfer safeguard
- Standard Contractual Clauses. 365shift does not allow its data to be used to train models.
Expo (Expo Application Services)
Privacy notice- Purpose
- Routing of push notifications to the iOS and Android apps.
- Data involved
- Device push tokens, notification title and text.
- Location
- USUnited States.
- Transfer safeguard
- Standard Contractual Clauses.
Apple (APNs) and Google (FCM)
Privacy notice- Purpose
- Final delivery of push notifications to the device by the platform operator.
- Data involved
- Device push tokens, notification title and text.
- Location
- USUnited States.
- Transfer safeguard
- Standard Contractual Clauses.
Recipients that are not sub-processors
ΕΡΓΑΝΗ II (Greek Ministry of Labour). When a Customer uses the ΕΡΓΑΝΗ module, we transmit its hiring and working-time declarations to the Ministry's information system in the Customer's name. The Ministry is an independent public authority, not our sub-processor; the data it receives is set by Greek labour law.
Our own staff. Support requests are handled by Veyral IT Solutions' own team in Greece. We do not outsource support to third-party call centres.
Other Users in your company. Colleagues who see your data do so because your employer gave them a role in its account; they act for your employer, the controller, not for us.
Questions about a sub-processor, or a request for a copy of the data processing terms we hold with one, can be sent to support@365shift.com. The full description of how we process personal data is in our Privacy Policy.