Who we are

ShiftFriend is provided by Adtimera ApS, CVR 40551867, Industriparken 10, 4100 Ringsted, michael@adtimera.dk. This policy explains how we process personal data when you visit our website, create an account, use ShiftFriend as a company or employee, or contact us.

If you have questions about your data, you can always write to michael@adtimera.dk.

Our two roles

• Controller: We are the controller for data about our customers and users as customers: accounts (name, email, hashed password), subscription, billing and invoices, contact form requests, the website and the cookie consent log.
• Processor: When a company uses ShiftFriend for its employees, the company is the controller of the employees' data and we only process it on the company's instructions, as governed by our data processing agreement. If you are an employee, please direct requests about your data to your employer – we help the employer respond.

What data we process

• Account and contact: name, email, language, phone (optional), login data and the time of consent and acceptance of terms, including IP address.
• Billing: company name, CVR, address, EAN, invoices, credit notes and payment status.
• Employee data (as processor): names, contact details, employee number, shifts and hours, clock-ins, hourly pay and supplements, absence and holiday – including sickness, which is health data –, availability, GPS position when clocking in by phone, profile photos, chat messages, documents, the company logo and push subscriptions.
• Requests: what you write in the contact form, and technical information about your browser if you write from the app.
• Website: IP address and technical data needed to show the site and – only with your consent – usage statistics.

Purposes and legal bases

• Providing and operating ShiftFriend, creating and managing accounts: contract (GDPR Art. 6(1)(b)).
• Invoicing and bookkeeping: legal obligation under the Danish Bookkeeping Act (Art. 6(1)(c)).
• Security, abuse prevention (e.g. limiting login attempts) and documenting acceptance: legitimate interest (Art. 6(1)(f)).
• Answering requests: legitimate interest (Art. 6(1)(f)) or contract if you are a customer.
• Statistics on the website and in the app: consent (Art. 6(1)(a) and the Danish cookie order). You can withdraw consent at any time.
• Employee data is processed on the customer's instructions. The customer determines its own legal basis, typically the employment relationship, legal obligations and for sickness Art. 9(2)(b).

How long we keep data

The following deletion rules run automatically in ShiftFriend:

• GPS coordinates on clock-ins are deleted after 12 months. The flag showing that the clock-in was outside the area is kept.
• Contact form requests, the log of sent emails and the cookie consent log are deleted after 24 months.
• Employees are anonymised 5 years after their end date: the name is replaced with "Former employee", and contact details, photo, birth date, phone, employee number, GPS and chat name are removed. Hours and pay figures are kept. The company can also anonymise earlier.
• Invoices and credit notes are kept for 5 years after the end of the financial year under the Bookkeeping Act – also if the company is deleted.
• If a company deletes its account, all its data is deleted after a 30-day grace period.
• Your user account is kept until you delete it yourself under My account.

Recipients and sub-processors

We never sell personal data. We use these sub-processors:

• Emergent (platform provider): operations, hosting, database (MongoDB), file storage for photos, documents and logos, AI gateway and email gateway. Region: [to be completed: hosting region].
• Anthropic (Claude) via Emergent's gateway: only when the company uses the AI schedule. Employee names, availability, rules and shifts are sent.
• Email provider: Resend, Inc. (USA) – transfer based on the EU standard contractual clauses/EU-US Data Privacy Framework.
• PostHog: usage statistics, only with consent.
• Meta Platforms (Meta Pixel): only on our campaign pages and when a new company is created, and only if you have consented to marketing.
• Google Fonts: fonts are loaded from Google, which thereby receives your IP address.
• OpenStreetMap Nominatim: when a manager looks up an address to set up phone clock-in, only the address text is sent from the manager's browser.
• Apple, Google and Mozilla: delivery of push notifications (the notification text) to devices that turned them on.
• Stripe (card payments) and Twilio (SMS) are only used if those features are enabled. They are currently disabled.

Transfers outside the EU/EEA

Some providers are located in the USA or may access data from there: Google (Google Fonts receives visitors' IP address), PostHog (only with consent), Anthropic (only when the AI schedule is used) and Resend (sending emails). Transfers are based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on the Commission's standard contractual clauses. Platform hosting region: [to be completed: hosting region].

Cookies and local storage

Necessary storage (no consent required):

• vb_at and vb_rt: your login (access and refresh key).
• vb_lang and vb_lang_sync: your language. vagtbord_theme: light or dark theme.
• sf_consent: your cookie choice.
• vagtbord_me_*, vagtbord_kloc, vb_mlayout and vb_spcolor: your view settings in the app (e.g. selected location and layout).
• sf_kiosk_*: the company's name and logo on the tablet time clock.
• The example company is only stored in your own browser.

Statistics (only with consent): We use PostHog to see how the site is used, e.g. page views and clicks. All typed text and all fields are masked, no sessions are recorded on app pages, and you are not identified as a person. PostHog sets cookies starting with ph_. They are deleted if you withdraw consent.

Marketing (only with consent): On our campaign pages (/kampagne/) we use Meta Pixel from Meta Platforms to measure whether ads on Facebook and Instagram lead to a demo request or a new account. The pixel only loads if you have turned on "Marketing", and it sends the page view, demo request and company creation to Meta. Meta sets cookies such as _fbp. No content from the app is sent. Meta may process data in the USA (EU-U.S. Data Privacy Framework).

You can change or withdraw your consent at any time via "Cookie settings" at the bottom of the page and in the app menu.

Your rights

You have the right of access, rectification, erasure, restriction, data portability and to object. You can withdraw consent at any time. Owners can download all company data, and employees can download their own data in the app.

If you are an employee of one of our customers, your employer is the controller – contact your employer first.

You can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, www.datatilsynet.dk.

Changes

We update this policy when our processing changes. The current version and date are shown at the top.