Privacy Policy
Last updated: 15 June 2026
1. Introduction and Who We Are
Nagy Zsolt e.v. ("we", "us", or "our") is a sole proprietorship registered in Hungary (tax number: HU72388080), with its registered address at Csillagvirág str. 29, 9200 Mosonmagyaróvár, Hungary. We operate the Shiftina platform (the "Service").
This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have in relation to it — when you visit our website or use our Service.
We are committed to protecting your personal data in full compliance with Regulation (EU) 2016/679 ("GDPR") and applicable national data protection law.
Please read this policy carefully. If you do not agree with its terms, please do not access or use the Service.
2. Data We Collect and Our Legal Basis for Processing
We collect and process the following categories of personal data, each on the legal basis indicated:
2.1 Account and Identity Data
Full name, email address, username, and job title or role within your organisation.
Legal basis: Performance of a contract (Article 6(1)(b) GDPR) — this data is necessary to create and maintain your account and provide the Service.
2.2 Contact Data
Email address and, where provided, phone number.
Legal basis: Performance of a contract (Article 6(1)(b) GDPR) and our legitimate interest (Article 6(1)(f) GDPR) in providing customer support and communicating service-related information.
2.3 Scheduling and Workforce Data
For users whose accounts are managed by an organisation using Shiftina, this includes availability information, shift assignments, scheduling preferences, and related workforce data entered into the Service.
Legal basis: Performance of a contract (Article 6(1)(b) GDPR) and, where applicable, the legitimate interest of the subscribing organisation. In this context, we act as a data processor on behalf of the subscribing organisation, which acts as the data controller. Please refer to your organisation's own privacy notice for more information about how they use this data.
2.4 Device and Technical Data
IP address, browser type and version, operating system, device type, and unique device identifiers.
Legal basis: Our legitimate interest (Article 6(1)(f) GDPR) in maintaining the security, stability, and performance of the Service.
2.5 Usage Data
Pages visited, features used, time spent, links clicked, and navigation patterns within the Service.
Legal basis: Our legitimate interest (Article 6(1)(f) GDPR) in understanding how the Service is used in order to improve it.
2.6 Cookie and Tracking Data
Information collected through cookies and similar technologies as described in Section 5 below.
Legal basis: Your consent (Article 6(1)(a) GDPR) for non-essential cookies, or our legitimate interest for strictly necessary cookies.
3. How We Use Your Information
We use the personal data we collect for the following purposes:
- to create and manage your account and provide access to the Service;
- to operate, maintain, and improve the features and functionality of the Service;
- to respond to your support requests and enquiries;
- to send you service-related communications, such as notifications of updates, security alerts, or changes to these policies;
- to analyse usage patterns and improve the overall user experience;
- to detect, investigate, and prevent fraudulent transactions, abuse, and other illegal activities;
- to comply with applicable legal obligations.
We will not use your personal data for automated decision-making that produces legal or similarly significant effects without your explicit consent, except where permitted by applicable law.
We will never sell your personal data to third parties.
4. Third-Party Service Providers
We share personal data with carefully selected third-party service providers (sub-processors) only where necessary to operate the Service. These providers are contractually bound to process personal data solely on our instructions and in compliance with the GDPR.
Current sub-processors include:
- Brevo — transactional email and communication services (used to send account notifications and support correspondence).
A full and up-to-date list of our sub-processors, including their location and the purpose of processing, is available at: Sub-processor List
We will notify you of any material changes to our sub-processor list in advance, in accordance with our obligations under the GDPR.
We do not share your personal data with third parties for their own marketing or advertising purposes.
5. Cookies and Tracking Technologies
We use cookies and similar tracking technologies to operate and improve the Service. A cookie is a small text file placed on your device when you visit our website.
Types of cookies we use:
- Essential Cookies: Strictly necessary for the website and Service to function. These cannot be disabled without significantly impairing your use of the Service. No consent is required for these cookies.
- Analytics Cookies: Help us understand how visitors interact with the Service, which pages are visited most, and where errors occur. This data is aggregated and anonymised where possible. These cookies are only set with your consent.
- Preference Cookies: Allow the Service to remember choices you have made, such as language or display settings, to provide a more personalised experience. These cookies are only set with your consent.
We do not use marketing or advertising cookies on the Shiftina platform.
You can manage or withdraw your cookie consent at any time via the cookie settings banner on our website, or through your browser settings. Please note that disabling certain cookies may affect the functionality of the Service.
6. Data Storage and International Transfers
All personal data processed in connection with the Service is stored exclusively on servers located within the European Union.
We do not transfer personal data to countries outside the EU/EEA unless:
- the European Commission has issued an adequacy decision for the destination country; or
- appropriate safeguards are in place in accordance with Chapter V GDPR, such as Standard Contractual Clauses (SCCs) adopted by the European Commission.
Details of any international transfers and the applicable safeguards are included in our sub-processor list at Sub-processor List.
7. Data Retention
We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, or as required by applicable law. Our general retention approach is as follows:
- Account data: Retained for the duration of your account and deleted within 90 days following account closure, unless a longer retention period is required by law.
- Scheduling and workforce data: Retained for the duration of the subscribing organisation's active subscription and deleted or returned within 30 days following subscription termination, in accordance with Article 17 GDPR.
- Usage and technical logs: Retained for up to 12 months for security and diagnostic purposes, then deleted or anonymised.
- Communications and support records: Retained for up to 3 years to allow us to resolve any subsequent queries or disputes.
- Invoicing and billing records: Retained for 8 years in accordance with Hungarian accounting law.
Where retention is based on a legal obligation, data will be retained for the minimum period required by that obligation and securely deleted thereafter.
8. Your Rights Under GDPR
If you are a resident of the European Union or European Economic Area, you have the following rights in relation to your personal data:
- Right to Access (Article 15 GDPR): You may request a copy of the personal data we hold about you.
- Right to Rectification (Article 16 GDPR): You may request that we correct any inaccurate or incomplete personal data.
- Right to Erasure (Article 17 GDPR): You may request that we delete your personal data, subject to certain legal exceptions (for example, where we are required to retain it by law).
- Right to Restriction of Processing (Article 18 GDPR): You may request that we restrict the processing of your personal data in certain circumstances.
- Right to Data Portability (Article 20 GDPR): You may request that we provide your personal data to you in a structured, commonly used, and machine-readable format, or transmit it directly to another service provider where technically feasible.
- Right to Object (Article 21 GDPR): You may object to the processing of your personal data where we rely on our legitimate interests as the legal basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
- Right to Withdraw Consent (Article 7(3) GDPR): Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
To exercise any of these rights, please contact us at support@shiftina.com with "Data Protection Request" in the subject line. We will respond within one (1) calendar month of receiving your request, as required by Article 12 GDPR.
Right to lodge a complaint: If you believe we have not handled your personal data in accordance with the GDPR, you have the right to lodge a complaint with the competent data protection supervisory authority. In Hungary, this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH):
- Website: https://www.naih.hu
- Address: Falk Miksa utca 9-11, 1055 Budapest, Hungary
If you are located in another EU member state, you may also contact the supervisory authority in your country of residence.
9. Data Security
We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, in accordance with Article 32 GDPR. These measures include, among others, encrypted communications (TLS), access controls based on the need-to-know principle, regular backups, and security monitoring.
However, no method of transmission over the internet or electronic storage is completely secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee absolute security.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours and, where required, notify you without undue delay.
10. Children's Privacy
The Service is designed for professional business use and is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from anyone under 18. If you are a parent or guardian and believe that a minor has provided us with personal data, please contact us immediately at support@shiftina.com and we will take steps to delete that information promptly.
11. Links to Other Websites
Our Service may contain links to third-party websites or services that are not operated by us. We have no control over the content or privacy practices of those sites and accept no responsibility for them. We encourage you to review the privacy policy of any third-party site you visit.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. Where a change is material, we will provide at least 30 days' prior notice by email to the registered account holder and/or by a prominent notice within the Service before the change takes effect.
The date at the top of this policy reflects when it was last updated. We encourage you to review this page periodically. Your continued use of the Service after a revised policy has taken effect constitutes your acceptance of the updated terms.
The current version of this Privacy Policy is always available at /legal/privacy/.
13. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact us:
- Email: support@shiftina.com (please include "Data Protection" in the subject line for privacy-related requests)
- Post: Nagy Zsolt e.v., Csillagvirág str. 29, 9200 Mosonmagyaróvár, Hungary
We aim to respond to all data protection enquiries within one (1) calendar month.
For related legal documents, please see: