Privacy Policy
We are dedicated to safeguarding your personal data and ensuring full transparency regarding location services and device usage permissions.
Introduction
This Privacy Policy describes how 365shift ("we," "our," or "us") collects, uses, shares, and protects your personal information when you use our human resources management platform, mobile applications, and related services (collectively, the "Services").
We are committed to protecting your privacy and ensuring transparency in how we handle your data. This policy complies with the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and other applicable data protection laws.
IMPORTANT: Background Location Access Disclosure
Why We Need Background Location Access
Our app requires access to your location even when the app is closed or not in use for the following essential workforce management features:
- •Automated Check-In/Check-Out: Automatically clock in when you arrive at your assigned work location and clock out when you leave, ensuring accurate attendance tracking without manual intervention.
- •Geofencing for Work Sites: Verify that employees are present at designated work locations during their assigned shifts for security and compliance purposes.
- •Emergency Response: Enable rapid location identification for security personnel and emergency responders during critical incidents, even if the app is in the background.
- •Site Round Verification: Track and verify that employees complete their assigned site rounds for client reporting and accountability.
- •Real-Time Team Coordination: Allow supervisors to coordinate team members and dispatch personnel to locations as needed during active shifts.
When Background Location is Collected
Background location data is ONLY collected during the following times:
- During your scheduled work shifts when you are on duty
- When you have explicitly clocked in for work through the app
- When emergency response features are activated
Important: You can disable background location tracking at any time through your device settings, though this may limit certain features like automated check-in/check-out.
Your Control Over Location Data
- You can revoke location permissions at any time in your device settings
- You can request deletion of your location history through the app settings
- You can view all collected location data in your profile
- Location data is encrypted and never sold to third parties
Data Controller Information
Company Name: 365shift
Service Name: 365shift Platform
Email: privacy@365shift.com
Address: Athens, Greece, European Union
Data Protection Officer: dpo@365shift.com
Information We Collect
1. Personal Identification Information
- Full name, email address, phone number
- Date of birth, gender, nationality
- Government-issued identification numbers (as required by law)
- Profile photographs and biographical information
- Employment history and qualifications
2. Professional Information
- Job title, department, and role within organization
- Work schedule, shifts, and attendance records
- Performance reviews and evaluations
- Training and certification records
- Salary, compensation, and benefits information
3. Location Data (Foreground and Background Location)
Our mobile application ("Mobile Sentinel" / "365shift Mobile") accesses, collects, and processes precise location data (GPS, cellular network, and Wi-Fi coordinate metadata) to support safety, site rounds, and workforce scheduling compliance.
Foreground Location Data: Collected when you actively open and use the application (e.g., to record a checkpoint, submit an incident report, log observation details, or manually trigger the SOS emergency alert).
Background Location Data: Accessed and collected even when the app is closed or not in use (running in the background) for the following essential workforce features:
- Automated Check-In/Check-Out: To verify when you arrive at or depart from your assigned geofenced job site, ensuring accurate attendance logs without requiring manual device inputs.
- Site Round and Route Tracking: To document that assigned site rounds are completed on schedule, providing proof of service to our clients.
- Emergency SOS Dispatch: To enable instant location coordinates sharing with supervisors and emergency response coordinators when an active incident or SOS signal is triggered, ensuring rapid support.
Privacy Enforcement: Background location tracking is strictly restricted to active working hours and shifts. The app does NOT track your location when you are clocked out or off duty. You may revoke or modify location permissions in your device settings at any time, but doing so will prevent automated shift verification.
4. Technical and Usage Data
- IP address, device type, and operating system
- Browser type and version
- Login times and session duration
- Pages viewed and features accessed
- Geographic location data (with consent)
- Cookies and similar tracking technologies
5. Communication Data
- Messages sent through our platform
- Support requests and correspondence
- Feedback and survey responses
- Notifications preferences
Legal Basis for Processing (GDPR)
We process your personal data based on the following legal grounds:
- Contract Performance: Processing necessary to fulfill our services and employment contracts
- Consent: Where you have given explicit consent for specific processing activities
- Legal Obligation: Compliance with employment laws, tax regulations, and legal requirements
- Legitimate Interests: Business operations, security, fraud prevention, and service improvement
How We Use Your Data
- •Service Delivery: Provide, maintain, and improve our HR management services
- •User Management: Create and manage user accounts, authentication, and access control
- •HR Operations: Employee onboarding, scheduling, attendance tracking, performance management
- •Communication: Send service updates, notifications, and respond to inquiries
- •Analytics: Analyze usage patterns to improve features and user experience
- •Security: Detect, prevent, and address fraud, abuse, and security issues
- •Legal Compliance: Meet regulatory requirements and enforce our terms
Data Sharing and Disclosure
We may share your information with:
Within Your Organization
Authorized team members, managers, and administrators with role-based access permissions
Service Providers
Third-party vendors who assist in operating our services (cloud hosting, analytics, customer support) under strict confidentiality agreements
Legal Requirements
Law enforcement, regulatory authorities, or legal processes when required by law
Business Transfers
In connection with mergers, acquisitions, or sale of assets (with notice to you)
Critical Privacy Guarantee: We do NOT sell, rent, lease, or trade your personal information, including your location data (both foreground and background), to any third parties or advertising brokers. Location data is shared exclusively with your employer's designated organizational supervisors/administrators, and is stored securely in our database for audit, security, and scheduling validation logs.
International Data Transfers
Your data may be transferred to and processed in countries outside your jurisdiction. We ensure adequate protection through:
- EU Standard Contractual Clauses (SCCs)
- EU-U.S. Data Privacy Framework participation
- Adequacy decisions by the European Commission
Data Security Measures
We implement industry-leading security measures to protect your data:
Encryption
TLS 1.3 for data in transit, AES-256 for data at rest
Access Control
Role-based permissions, multi-factor authentication
Monitoring
24/7 security monitoring and intrusion detection
Audits
Regular security audits and penetration testing
Certifications: ISO 27001 (Information Security), ISO 9001 (Quality Management), SOC 2 Type II compliant
Data Retention
We retain your personal data for as long as necessary to:
- Provide our services and fulfill contractual obligations
- Comply with legal, accounting, or reporting requirements
- Resolve disputes and enforce our agreements
- Maintain business records for legitimate business purposes
Typical retention periods: Active employment data is retained during employment plus 7 years after termination (or as required by local labor laws). Anonymized analytics data may be retained indefinitely.
Location Logs Retention: Precise GPS route logs and background coordinates are retained for a maximum of 90 days for client validation and operational safety audits, after which they are deleted or automatically aggregated into coarse-grained summaries, except where a longer retention period is requested by your employer to document a legal dispute or incident report.
Your Data Protection Rights
Under GDPR and applicable laws, you have the following rights:
Right to Access
Request a copy of your personal data we hold
Right to Rectification
Correct inaccurate or incomplete information
Right to Erasure
Request deletion of your data (right to be forgotten)
Right to Restriction
Limit how we process your data
Right to Portability
Receive your data in a portable format
Right to Object
Object to processing based on legitimate interests
Right to Withdraw Consent
Withdraw consent for specific processing activities
Right to Lodge Complaint
File a complaint with your data protection authority
To exercise your rights: Contact us at privacy@365shift.com or through your account settings. We will respond within 30 days.
Cookies and Tracking Technologies
We use cookies and similar technologies for:
- •Essential Cookies: Required for service functionality and security
- •Functional Cookies: Remember your preferences and settings
- •Analytics Cookies: Understand how you use our services (with consent)
You can control cookies through your browser settings. Note that disabling certain cookies may affect service functionality.
Children's Privacy
Our services are not intended for individuals under 16 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child, please contact us immediately at privacy@365shift.com.
Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be communicated through:
- Email notification to registered users
- Prominent notice within our application
- Updated "Last Modified" date at the top of this policy
Continued use of our services after changes constitutes acceptance of the updated policy.
Contact Us
For questions, concerns, or to exercise your data protection rights:
Privacy Email: privacy@365shift.com
Data Protection Officer: dpo@365shift.com
Support: Available through your account settings
Address: 365shift, Athens, Greece, EU
EU Data Protection Supervisory Authority
If you are located in the EU and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection authority or the Hellenic Data Protection Authority (Greece).
App Store Compliance
This privacy policy meets the requirements of the Apple App Store and Google Play Store. Our mobile applications handle data in accordance with this policy and platform-specific guidelines.