Shiftray Privacy Notice
For authorised Shiftray users. This notice explains KP Strategic Collective’s role in providing the Shiftray rota and attendance service. Your employer must also give you its own workforce privacy information because it decides why your employment information is used.
Last reviewed: 30 September 2026
Service provider: KP Strategic Collective, an India-based sole-proprietor business
Address: Shop 3, Shree Lila Apartment, Pataliya Hanuman Road, Padra, Vadodara, Gujarat 391440, India
Privacy contact: kpstrategic23@gmail.com
Our role and your employer’s role
Your employer or workplace organisation normally acts as the controller for employee information in Shiftray. It chooses the employees, rota content, attendance purpose, access permissions and retention instructions. KP Strategic Collective normally acts as its processor, operating Shiftray under the client’s written instructions. KP Strategic Collective acts as a controller for its own client contacts, service security, legal compliance and business records.
Information processed in Shiftray
| Information | Purpose |
|---|---|
| Name, work email, account identifier, workplace and staff category | Create the account, authenticate the user and provide the correct company and role access. |
| Day and night rotas, shift times, instructions and workplace announcements | Plan work and communicate authorised workplace information. |
| Clock-in/out times, correction reasons, review status and audit information | Maintain workplace attendance records and allow authorised corrections. |
| Company logo, background image and uploaded paper rota | Configure the client’s private workplace and provide a paper reference where the employer chooses. |
| IP address, browser/device information, authentication events and security logs | Deliver, protect, troubleshoot and prevent misuse of the service. |
Employers should not enter health information, disciplinary details, biometric information or other special-category information in free-text fields unless they have confirmed a lawful need and appropriate safeguards.
Lawful basis
The employer is responsible for selecting and documenting its lawful basis for workforce processing. Depending on the circumstances, this may include employment-contract steps, legal obligations or legitimate interests. Employee consent is often unsuitable because of the imbalance in the employment relationship. KP Strategic Collective processes client-controlled data under contract and the employer’s documented instructions. For our own security and administration, we rely on legal obligations and legitimate interests where applicable.
Who receives information
Access is limited to authorised users of the relevant client workplace and service providers needed to operate Shiftray. Current core providers are listed in the Shiftray Sub-processor List. We do not sell employee information or use client rota and attendance data for advertising.
International processing
KP Strategic Collective is based in India and Shiftray uses international cloud providers. UK client information may therefore be accessed or processed outside the UK. The employer and KP Strategic Collective must document the relevant transfer route before live processing begins, including the UK International Data Transfer Agreement or UK Addendum and a transfer risk assessment where required. Transfers and remote access are limited to providing and supporting the service.
Retention and deletion
The employer controls the operational retention period for rota and attendance information. The agreed client schedule should state the required periods. When a client service ends, the client may request an export and KP Strategic Collective will delete live client data within 30 days after the agreed termination/export period, unless law requires continued storage. Residual encrypted or provider-managed backups are overwritten or deleted through the normal backup cycle, targeted within 90 days. Security logs may be retained for a limited period needed to protect the service and investigate incidents.
Security
Shiftray uses unique user accounts, role-based workplace access, database access controls, HTTPS, managed authentication, restricted administrative access, correction audit information and provider security controls. No internet service can guarantee absolute security. Clients must promptly remove leavers, protect employer accounts and report suspected access or disclosure.
Your rights and requests
Employees should normally contact their employer first because it controls the workplace data. Depending on applicable law, individuals may have rights of access, correction, deletion, restriction, objection and portability. KP Strategic Collective will assist the employer with valid requests. UK individuals may complain to the Information Commissioner’s Office. Requests concerning KP Strategic Collective’s own processing can be emailed to the privacy contact above.
UK representative
Before serving a UK client, KP Strategic Collective will assess whether Article 27 of the UK GDPR requires appointment of a UK representative. If required, the representative’s name and contact details will be added here and provided to affected users before processing begins.
India privacy law
KP Strategic Collective also reviews its obligations under India’s Digital Personal Data Protection Act 2023 and the Digital Personal Data Protection Rules 2025 as their provisions commence. Questions or grievances may be sent to the privacy contact above.
Changes
Material changes will be dated and communicated to clients. Employers are responsible for making the current notice available to their employees.