In short: we collect what is needed to run shifts, patrols, incidents, invoices and payroll for the firm you work for or with. We don’t sell personal data, we don’t advertise to you, and this website doesn’t use tracking cookies. If your employer uses ShiftHive, your employer decides what is recorded and is your first point of contact.
1. Who we are
ShiftHive is a workforce management service for firms that staff sites, made up of a mobile app, a web app and this website (together, the Service). It is provided by ShiftHive Ltd of Nairobi, Kenya (ShiftHive, we, us).
This policy explains what personal data we handle, why, and what you can do about it. It is written to follow the Data Protection Act, 2019 of Kenya.
2. Whose data it is
There are two different situations, and your rights are exercised differently in each.
- You work for, manage, or are a client of a firm that uses ShiftHive. That firm (our Customer) decides what is recorded and why. It is the data controller, and ShiftHive is its data processor, handling the data on its instructions. Questions and requests about your records should go to that firm first; we will help it respond.
- You contact us directly, for example by booking a demo on this website, emailing or calling us, or registering a company. For that information, ShiftHive is the data controller.
3. What we collect
From people who contact us or register a company:
- Company name, your name, work email, phone number, industry, team size and anything you write in your message.
- Account and billing details for the company once it becomes a Customer.
On behalf of our Customers, about their workers and staff:
- Identity and contact details: name, phone number, role, and where the firm chooses to record them, ID number, next of kin, licences, training and disciplinary notes.
- Work records: rosters, check-in and check-out times, breaks, patrol scans, attendance and scorecards.
- Location at the moments described in section 5.
- Incident reports, notes, comments and photos submitted from the app.
- Pay information: pay rates, deductions, payslips and the bank or M-Pesa details needed to pay the worker.
- Device information: the phone the app is activated on, app version, battery level and last-seen time, and a token used to send push notifications.
On behalf of our Customers, about their clients:
- Names and contact details of the client’s contacts, the client’s sites, contracts, invoices and payment records.
We do not ask for, and the Service is not designed to hold, sensitive personal data such as health, religion or biometric information.
4. How we use it
- To provide the Service: proving attendance and patrols, routing incidents and SOS alerts, preparing invoices and payroll, and showing each client its own sites. This is done under our contract with the Customer, and on the Customer’s lawful basis as an employer or contracting firm.
- To sign people in and keep accounts secure: sending activation codes by SMS and sign-in codes by email, and detecting misuse.
- To respond to you: arranging a demo, answering questions and giving support.
- To run and improve the Service: fixing faults, monitoring performance and planning features, using aggregated information wherever we can.
- To meet legal obligations and to establish or defend legal claims.
We do not sell personal data, use it for advertising, or make decisions about individuals by automated means alone. Scorecards are calculated from attendance and patrol records using weights the Customer sets; what the Customer does with them is its decision.
5. Location data
Location is central to what ShiftHive does, so we want to be specific. The app records a worker’s location:
- when they check in or out, to confirm they are at the site;
- when they scan a patrol checkpoint or use GPS proof for one;
- when they report an incident or send an SOS; and
- while they are on duty, so that supervisors can see the team on the live map.
The app asks for the phone’s location permission before any of this happens. Location records are visible to the worker’s own managers and supervisors and, for their own sites only, to the client contacts the firm has invited.
6. Who we share it with
- The Customer and its users. A worker’s records are visible to their firm’s managers and supervisors. Client contacts see who is on duty, attendance, patrols and incidents at their own sites, and their own invoices. They never see pay rates, payroll or other clients.
- Service providers that help us run ShiftHive, each receiving only what it needs: cloud hosting and database services, file storage for photos and documents (Cloudflare), SMS delivery (Africa’s Talking), email delivery (Resend), push notifications (Google Firebase) and website hosting (Vercel).
- Payment providers. Where a Customer pays workers or collects from clients through M-Pesa or a bank, the details needed for that payment go to Safaricom or the bank under the Customer’s own account.
- Authorities, where the law requires it or a valid legal request is made.
- A successor business, if ShiftHive is ever merged or sold, under the same protections as this policy.
7. Where it is stored
Some of the providers above store or process data on servers outside Kenya. Where personal data leaves Kenya, we rely on the safeguards the Data Protection Act, 2019 requires, including contracts that commit the provider to protect it.
8. How long we keep it
- Customer records are kept for as long as the Customer’s account is active. After the agreement ends the Customer has 30 days to request an export, and then we delete the data, except for what the law requires us to keep.
- Demo requests and enquiries are kept for up to 24 months after our last contact, unless you become a Customer or ask us to delete them sooner.
- Billing and tax records are kept for the period required by Kenyan law.
- Backups are overwritten on a rolling schedule, so deleted data may remain in backups for a short time before it is removed.
9. How we protect it
- Data is encrypted in transit between the app, the browser and our servers.
- Each company’s data is kept separate from every other company’s, and access inside a company follows the roles its managers assign.
- Payment and messaging credentials that Customers store with us are encrypted.
- Photos and documents are served through links that expire.
- Access to production systems is limited to the people who need it to operate and support the Service.
No system is perfectly secure. If a breach affects your personal data, we will notify the Customer concerned, and the Office of the Data Protection Commissioner where the law requires, without undue delay.
10. Your rights
Under the Data Protection Act, 2019 you have the right to:
- be told how your personal data is used;
- access the personal data held about you;
- have inaccurate or misleading data corrected;
- have data deleted where there is no longer a lawful reason to keep it;
- object to, or ask for a restriction of, certain processing; and
- receive your data in a portable form.
If your records are held for a firm that uses ShiftHive, please send your request to that firm; we will support it in responding. For data we hold as controller, write to hello@shifthive.co.ke. We may need to confirm your identity, and we aim to respond within 30 days.
11. Cookies and tracking
This website does not use advertising or analytics cookies and does not track you across other sites. It loads its fonts from Google Fonts, which means your browser makes a request to Google when the page opens.
The web app keeps you signed in using storage in your browser that is strictly necessary for it to work. It is not used for advertising.
12. Children
The Service is for businesses and their adult workers. It is not intended for anyone under 18, and we do not knowingly collect their personal data.
13. Changes to this policy
We may update this policy as the Service changes. We will post the new version on this page with a new date and, where a change is significant, tell Customers by email or in the app before it takes effect.
14. Contact and complaints
ShiftHive Ltd, Nairobi, Kenya
Email: hello@shifthive.co.ke
Phone: 0718 705 129
If you are not satisfied with how we have handled your request, you may complain to the Office of the Data Protection Commissioner of Kenya at odpc.go.ke.