1. Our commitment
Data protection is core to a product that holds right-to-work documents, DBS records and payroll-grade timesheets. NXT Digital Ltd operates Get Shifts in line with UK GDPR and the Data Protection Act 2018, and this page summarises how.
2. Controller & processor roles
For Workforce Data your agency enters, you are the controller and we are the processor — we process that data only on your documented instructions. For our own account, billing and website data, we are the controller (see the Privacy policy).
3. Data processing agreement
A signed DPA incorporating the UK GDPR Article 28 requirements is part of every plan, covering the subject matter, duration, nature and purpose of processing, the categories of data subjects and personal data, and both parties' obligations.
4. Data subject rights
We support access, rectification, portability, erasure, restriction and objection requests in-product and via support@getshifts.co.uk. Where a Worker contacts us directly about data controlled by their agency, we notify the agency without undue delay and assist it in responding within statutory timescales.
5. Sub-processors
We keep a public list of sub-processors — UK hosting, email delivery, SMS delivery and payment processing — each bound by written terms no less protective than ours. Customers are notified at least 30 days before we add or replace a sub-processor, with the right to object.
6. Hosting & transfers
All customer data, including backups, is stored in UK data centres and encrypted in transit (TLS 1.2+) and at rest (AES-256). We do not transfer personal data outside the UK; if that ever changed, transfers would rely on adequacy regulations or International Data Transfer Agreements.
7. Security measures
8. Breach notification
In the unlikely event of a personal data breach affecting your data, we notify you without undue delay and in any case within 72 hours of becoming aware, with the information you need for your own ICO and data subject notifications.
9. Retention & deletion
Workforce Data is retained while your account is active and deleted within 12 months of closure — or within 30 days on written request — except where law requires longer retention. Deletion covers primary storage and rolls through backup cycles.
10. Contact & DPO
Our data protection officer can be reached at support@getshifts.co.uk (marked “FAO Data Protection Officer”), on 0330 808 3871, or at Unit 5, Christie Fields Office Park, Christie Way, Manchester M21 7QY. You may also complain to the Information Commissioner's Office at ico.org.uk.