Sub-processors
The third parties that process Customer data on our behalf, what each one does, where it does it and how the transfer is protected.
365shift (Veyral IT Solutions) uses a small number of specialised providers to run the Services. Where a provider handles personal data that a Customer has entrusted to us, it is a "sub-processor" under Article 28 of the GDPR. Each sub-processor is bound by a written contract to process the data only on our instructions, to keep it confidential and secure, and to delete it when the engagement ends.
Changes. Before a new sub-processor receives Customer data we update this page and inform Account Owners by e-mail. A Customer that objects on reasonable data protection grounds may terminate its subscription for the affected service.
Infrastructure and service sub-processors
Supabase
Provider's privacy notice- Purpose
- Database, authentication, file storage and server functions — the platform that holds every Customer account.
- Data involved
- All Customer data: user profiles, rosters, clock and location records, messages, files, audit logs.
- Location
- European Union — Stockholm, Sweden (hosting); Supabase, Inc. is established in the United States.
- Transfer safeguard
- Data stays in the EU. Standard Contractual Clauses cover any support access from outside the EU.
- Purpose
- Hosting and content delivery of the website and the web application; anonymous page-speed measurement.
- Data involved
- Request data: IP address, browser identifier, page address (without query parameters).
- Location
- United States, with edge servers worldwide.
- Transfer safeguard
- Standard Contractual Clauses.
- Purpose
- Delivery of the e-mails the Services send (rosters, notifications, invitations, password resets) and receipt of replies to them.
- Data involved
- Recipient name and e-mail address, the content of each e-mail.
- Location
- United States.
- Transfer safeguard
- Standard Contractual Clauses.
- Purpose
- Subscription payments, card storage and the customer billing portal.
- Data involved
- Billing contact name and e-mail, company billing details, payment card (entered directly with Stripe).
- Location
- Ireland (Stripe Payments Europe) and United States.
- Transfer safeguard
- Standard Contractual Clauses.
- Purpose
- Issuing of invoices to Customers.
- Data involved
- Company name, VAT number, tax office, billing address, invoice lines.
- Location
- Greece (European Union).
- Transfer safeguard
- Not required — processing within the EU.
- Purpose
- Gemini models for the AI-assisted features (schedule suggestions, evaluation, training, interview and procedure drafts, help assistant); address suggestions on the sign-up form; map data and web fonts on the website.
- Data involved
- The content a Customer sends to an AI feature (names, roles, shift and evaluation data as needed by that feature); the address typed at sign-up; visitor IP address for fonts.
- Location
- United States and European Union.
- Transfer safeguard
- Standard Contractual Clauses. 365shift does not allow its data to be used to train models.
- Purpose
- Map tiles for the team-location map in the web application.
- Data involved
- Site coordinates set by a Customer; viewer IP address.
- Location
- United States.
- Transfer safeguard
- Standard Contractual Clauses.
Expo (Expo Application Services)
Provider's privacy notice- Purpose
- Routing of push notifications to the iOS and Android apps.
- Data involved
- Device push tokens, notification title and text.
- Location
- United States.
- Transfer safeguard
- Standard Contractual Clauses.
Apple (APNs) and Google (FCM)
Provider's privacy notice- Purpose
- Final delivery of push notifications to the device by the platform operator.
- Data involved
- Device push tokens, notification title and text.
- Location
- United States.
- Transfer safeguard
- Standard Contractual Clauses.
- Purpose
- Our support and information mailboxes (support@ and info@365shift.com).
- Data involved
- The content of e-mails you send to us and our replies.
- Location
- European Union (Zoho Corporation B.V., Netherlands).
- Transfer safeguard
- Not required — processing within the EU.
Recipients that are not sub-processors
ΕΡΓΑΝΗ II (Greek Ministry of Labour). When a Customer uses the ΕΡΓΑΝΗ module, we transmit its hiring and working-time declarations to the Ministry's information system in the Customer's name. The Ministry is an independent public authority, not our sub-processor; the data it receives is set by Greek labour law.
Our own staff. Support requests are handled by Veyral IT Solutions' own team in Greece. We do not outsource support to third-party call centres.
Other Users in your company. Colleagues who see your data do so because your employer gave them a role in its account; they act for your employer, the controller, not for us.
Questions about a sub-processor, or a request for a copy of the data processing terms we hold with one, can be sent to support@365shift.com. The full description of how we process personal data is in our Privacy Policy.