Shiftsta Privacy Policy

Shiftsta is a workforce-management platform for Australian registered clubs and hospitality businesses, operated by Itinoco Pty Ltd (“Shiftsta”, “we”, “us”, “our”).

This policy explains how we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). It applies to personal information we collect through the Shiftsta web application, our websites, and related services (the “Platform”).

Shiftsta serves many employers on the same platform. For most worker personal information we process, the worker’s employer (the “Client”) decides how that information is used; in those cases the Client is responsible for its own privacy obligations and Shiftsta acts as a service provider (data processor) under a Data Processing Agreement. This policy covers information for which Shiftsta decides the purpose and means — for example account administration, billing, and product analytics.

Depending on your role (business owner, administrator, manager, or employee), we may collect: identity and contact data (name, work email, a current contact phone number (required for all accounts), role, associated venues); account and authentication data (login credentials, which are never stored in readable form, and session and device information); employment and rostering data (shifts, availability, leave, qualifications, clock-in/out events including the approximate location captured at clock-in); payroll identifiers (only if your employer connects a payroll integration); usage and technical data (pages viewed, features used, approximate location from IP, device type, diagnostics); and your communications with support and notification preferences.

A contact phone number is required for every account. Your employer uses it to reach you about shifts and urgent roster changes, and we may use it to contact you about your account or to verify unusual account activity. We do not use your phone number for marketing, and Platform notifications remain email and in-app.

We collect your approximate location only at the moment you clock in, solely to support review of on-site attendance for that shift — we do not track your location at any other time. Clock-in location is reported by your device and browser; your employer controls how the resulting attendance record is used and is responsible for reviewing it.

We do not intentionally collect sensitive information beyond what is necessary to operate rostering and leave features. We do not collect tax file numbers or bank details — payroll identifiers are handled in your employer’s payroll system, not stored by Shiftsta.

We use personal information to create and administer accounts and authenticate users; provide rostering, availability, leave, clock-in, reporting, and onboarding features; send transactional and notification emails and maintain your in-app inbox; detect and investigate clock-in anomalies and protect Platform security; analyse usage to operate, debug, and improve the Platform; bill Clients and manage our customer relationships; and comply with our legal obligations.

We rely on the practical operation of the Platform and our contracts with Clients as the basis for these uses, consistent with APP 3 (collection) and APP 6 (use and disclosure).

We do not sell personal information. We disclose it to the service providers that help us run the Platform, under contracts requiring them to protect it and use it only on our instructions. The categories of provider we rely on are set out below.

Our analytics and error-monitoring provider receives only pseudonymised usage and diagnostic information — you are identified to it by a random account identifier, not by your name or email — and we configure it to minimise the personal information it receives, including masking personal details in any diagnostic recordings and anonymising IP addresses.

Optional integration — payroll: if your employer connects a supported payroll system (currently Xero), we disclose the employee identifiers and draft timesheet data needed to import employees and export draft timesheets to your employer’s payroll account. This integration is one-directional and is engaged only when a Client connects it.

Some service providers process or store information outside Australia — in particular in the United States (application hosting and content delivery, email delivery, and product analytics). Where we disclose information overseas, we take reasonable steps to ensure the recipient handles it consistently with the APPs (APP 8), and we remain accountable under the Privacy Act for how that recipient handles it. Our primary data store is hosted in Australia. We may also disclose information where required or authorised by law, to protect our legal rights, or in connection with a sale or restructure of our business subject to equivalent privacy protections.

Our primary database, authentication, and file storage are hosted in Australia (Sydney region). Certain ancillary services (email delivery, analytics, application hosting and content delivery) may process limited data overseas as described in section 4.

Consistent with APP 12 (access) and APP 13 (correction), you may request access to the personal information we hold about you, and ask us to correct information that is inaccurate, out of date, incomplete, irrelevant, or misleading.

Much of your information can be viewed and updated directly in the Platform (your profile, availability, notification preferences). For anything you cannot self-serve, contact us using the details in section 10. Where the information is held on behalf of your employer, we may need to refer your request to that employer, who controls that information. We respond to access and correction requests within 30 days and will tell you if we cannot action a request and why.

Dealing with us anonymously (APP 2): where it is lawful and practicable, you may deal with us anonymously or using a pseudonym — for example when making a general privacy enquiry. In practice, most Platform features are tied to your employment and roster, so we usually need to identify you to provide them.

We retain personal information only for as long as needed to provide the Platform, meet legal and record-keeping obligations, and resolve disputes. While a Client’s subscription is active, we retain their workforce records so the Client can meet its own record-keeping obligations (including the Fair Work Act 2009 (Cth) requirement to keep employee records for 7 years). When a Client’s subscription ends, their data remains available to the Client for export for 60 days, after which we delete or de-identify it — except where we are required by law to retain it, and excepting residual copies in backups, which are deleted in the ordinary course of our backup cycle. We may retain and use data that has been aggregated and de-identified so that it no longer identifies any person, venue, or Client. You may request deletion of information we are not required to retain; some records (such as audit logs and certain employment records) are retained for legally mandated periods and cannot be deleted on request.

We take reasonable steps to protect personal information, consistent with APP 11 and the technical and organisational measures expected under APP 11.3. Technical measures include strict separation of each Client’s data from every other Client’s; encryption of data in transit (HTTPS/TLS) and at rest; least-privilege access controls and tamper-evident logging of administrative actions; and ongoing monitoring and security review.

Organisational measures include staff privacy and security training and confidentiality obligations, documented data-handling procedures and access governance, and a data breach response plan exercised periodically.

No system is perfectly secure. If a data breach occurs that is likely to result in serious harm, we will respond in line with our Data Breach Response Plan and our obligations under the Notifiable Data Breaches scheme.

We use limited automated processing to operate the Platform and protect its integrity — most notably automated checks that assess clock-in events (using your clock-in location, the time, and your rostered shift details) and flag unusual ones (for example, a location or time that does not match the shift) for a manager to review. A flag is a prompt for human review, not a determination: a manager makes any operative decision and can disregard the flag at their discretion.

Where this kind of automated processing is used to make, or substantially assist in making, a decision that could reasonably be expected to significantly affect your rights or interests, we disclose the kinds of personal information used (your clock-in location, timestamps, and rostered shift details) and the kinds of decisions involved (attendance and timekeeping review). New transparency obligations for automated decision-making under APP 1 commence on 10 December 2026; we are treating that as a firm deadline and will confirm the scope of these disclosures with legal counsel before then.

For privacy questions, access or correction requests, or complaints, contact the Privacy Officer, Shiftsta — email support@shiftsta.com.

We will acknowledge your complaint promptly and aim to respond within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

We may update this policy from time to time. We will post the updated version at shiftsta.com/privacy and update the “Last updated” date below. Material changes will be communicated through the Platform or by email where appropriate.