Privacy Policy

Last updated 26 September 2026. OTK Industries (Pty) Ltd, registration number 2023/955560/07, trading as ShiftSync.

1. Two roles: whose information is it?

• Information about our customers and visitors (the people who sign up, pay, contact us or visit our website): we decide why and how it is processed, so we are the responsible party.
• Information a business puts into ShiftSync about its employees (names, contact details, shifts, leave, clock-in times, pay rates, sick notes): the business (the employer) is the responsible party, and we are its operator, processing that information only on its instructions and under a written agreement (our Terms of Service). If you are an employee and have a question about your information, please contact your employer first; we will help them respond.

2. What we collect

• Account details: name, email address or username, phone number (optional) and role in the workspace. PINs are stored only as a one-way hash, which even we can't read, and wrong tries are counted to lock out guessing.
• Business details: business name, industry, locations and settings.
• Workforce records entered by the business: employee names and contact details, positions, pay rates, contracted hours, rosters and shifts, leave balances and requests, clock-in and clock-out times (including hours staff claim they forgot to clock, with their explanation), and medical certificates. Medical certificates contain health information, which is special personal information under POPIA; they are processed only because the employer is entitled to request them (section 23 of the Basic Conditions of Employment Act) and are visible only to the employee and their managers.
• Billing information: plan, payment status, invoices and the billing email. Card details are entered on Paystack's secure pages and are never stored by us.
• Technical information: IP address, browser and device type, and logs of sign-ins and actions, used for security and to fix problems. If you turn on notifications, we store the address your browser gives us for sending them.
• Messages you send us through the contact page or by email.

3. Why we use it, and on what basis

• To provide the Service you signed up for, and to support you (performance of a contract).
• To bill you and keep financial records (contract and legal obligation, including tax law).
• To keep the Service secure, prevent fraud and fix errors (our legitimate interests and legal obligations).
• To tell you about important changes to the Service, these policies or your account (contract).
• To send you news about ShiftSync. We only do this with your consent or, for existing customers, about similar services, and you can opt out at any time (section 69 of POPIA).

We do not sell personal information, and we do not use employee information for our own marketing.

4. Who we share it with

We share personal information only with service providers who help us run ShiftSync, under agreements that require them to protect it:

• Supabase (database, sign-in and email delivery of sign-in links), hosted in Frankfurt, Germany.
• Vercel (application hosting), with our servers in Frankfurt, Germany.
• Paystack (card payments), in South Africa and Nigeria.
• Browser notification services (for example Apple, Google or Mozilla), which receive the text of a notification only if you turn notifications on.

We may also disclose information where the law requires it, to protect our rights, or to a buyer of the ShiftSync business, who must then protect it in the same way.

5. Information stored outside South Africa

Our database and servers are in the European Union (Frankfurt, Germany). The EU's General Data Protection Regulation gives protection substantially similar to POPIA, and our providers are bound by agreements to protect the information, as section 72 of POPIA requires.

6. How we protect it

We use encryption in transit (HTTPS) and at rest, database rules that keep each business's information separate, role-based access within each business, and sign-in links or hashed PINs that lock after repeated wrong tries. Our own staff can only open a business's workspace to provide support, through an admin console protected by a password and an authenticator code; each such session is limited in time, read-only unless the business agrees otherwise, and recorded with its reason. Our Security page has more detail. If a security compromise affects your personal information, we will notify the affected responsible party (and you, where we are the responsible party) and the Information Regulator as section 22 of POPIA requires.

7. How long we keep it

• Account and workforce records: while the workspace is active.
• After a subscription ends: available for export for 30 days, then deleted within 90 days, apart from copies in backups, which are removed in the normal backup cycle.
• Billing and invoice records: five years, as the Tax Administration Act requires.
• Contact messages: up to two years, unless they become part of a customer record.

Employers must keep certain employment records for three years (section 31 of the Basic Conditions of Employment Act). Please download the records you need before closing your workspace.

8. Your rights

You have the right to:

• ask whether we hold personal information about you, and for a copy of it;
• ask us to correct or delete information that is inaccurate, out of date, or that we may no longer keep;
• object to processing based on legitimate interests, and to direct marketing at any time;
• complain to the Information Regulator: inforegulator.org.za, POPIAComplaints@inforegulator.org.za.

Email support@shiftsync.co.za to make a request. We may need to confirm your identity, and we respond within a reasonable time and in any event within 30 days. Our manual under the Promotion of Access to Information Act is available on request.

9. Cookies

We only use essential cookies, for example to keep you signed in. See our Cookie Policy.

10. Children

ShiftSync is a service for businesses. We do not knowingly collect information about children, except where an employer lawfully records information about an employee who is under 18.

11. Changes

We will post changes to this policy here and tell you about material changes by email or in the Service.

Contact details

Full name

OTK Industries (Pty) Ltd, trading as ShiftSync

Registration number

2023/955560/07

Email

support@shiftsync.co.za

Physical address

18 Diemersdal Road, De Bron, 7530

Website

www.shiftsync.co.za