Privacy Policy

1. Introduction

ShiftSignal ("we", "our", or "us") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and safeguard your information when you use our service, in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

ShiftSignal is operated by Daren Green, who acts as the data controller for any personal data processed through the service.

2. Data We Collect

We collect only the information necessary to provide our shift-sharing service:

• Account information: your name, email address, and optional profile image.
• Shift schedule data: your watch pattern, shift assignments, on-call availability, personal notes, and calendar annotations.
• Access relationships: records of who you have invited or accepted as a viewer of your schedule.
• Preference data: your chosen theme (light/dark) and notification settings.
• Technical data: session cookies required for authentication and security. We do not use analytics, tracking, or advertising cookies.

3. Lawful Basis for Processing

We process your personal data under the following lawful bases defined by Article 6 of the UK GDPR:

• Performance of a contract: processing your account and schedule data is necessary to deliver the ShiftSignal service you have requested.
• Legitimate interests: session cookies and authentication tokens are essential for the secure operation of the service.
• Consent: where you optionally provide additional information (such as a profile image), you consent to its use within the service.

4. How We Use Your Data

• To create and maintain your account.
• To store and display your shift schedule to viewers you have explicitly authorised.
• To manage access invitations and sharing links between firefighters and their approved viewers.
• To send service-related notifications (e.g., access request approvals).
• To secure your account through authentication and session management.

We do not sell your personal data. We do not use your data for advertising, profiling, or automated decision-making.

5. Data Sharing

Your shift schedule is shared only with viewers you have explicitly approved through our invite system. You can revoke access at any time.

We use trusted third-party infrastructure providers (cloud hosting and database services located within the European Economic Area or the UK) to operate the service. These providers act as data processors under our instruction and are bound by appropriate data processing agreements.

We will not transfer your personal data outside the UK or EEA unless adequate safeguards are in place, as required by UK data protection law.

6. Data Retention

We retain your personal data for as long as your account remains active. If you delete your account, we will remove your personal data within 30 days, unless we are required to retain it for legal or regulatory reasons.

Session data and authentication tokens are temporary and expire automatically.

7. Your Rights

Under the UK GDPR, you have the following rights regarding your personal data:

• Right of access — request a copy of the data we hold about you.
• Right to rectification — correct any inaccurate or incomplete data.
• Right to erasure — request deletion of your data (the "right to be forgotten").
• Right to restrict processing — limit how we use your data in certain circumstances.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests.

To exercise any of these rights, contact us at support@shiftsignal.uk. We will respond within one calendar month, as required by law.

8. Cookies

ShiftSignal uses only essential session cookies required for authentication and security. These cookies are strictly necessary for the service to function and are set automatically when you log in.

We do not use analytics, tracking, marketing, or third-party cookies of any kind. Because our cookies are essential and do not track you across sites, we rely on the "strictly necessary" exemption under the Privacy and Electronic Communications Regulations (PECR) rather than consent.

9. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. This includes encryption in transit (TLS), secure authentication protocols, and access controls.

10. Children's Privacy

ShiftSignal is not intended for children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Any material changes will be communicated to registered users via email or through the service. The date at the top of this page reflects the most recent revision.

12. Contact & Complaints

For questions about this Privacy Policy or to exercise your data rights, email us at:

support@shiftsignal.uk

You have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO). Visit ico.org.uk/make-a-complaint for more information.