A quick summary of this update, for anyone who has read an earlier version.
2.7 Workplace & Commitments location and travel times (optional).
2.7.1 If you choose to, you can add a location for a workplace: its address and a position on a map (latitude and longitude). You can also enter how long it takes you to travel between your workplaces. We use this only to estimate public-transport travel times between your workplaces, so the Week Optimizer suggests only shifts you can realistically reach, and to show maps and directions. A workplace location is the location of the place you work, not of you: we do not track or store your device's location. If you use "Use my current location", your browser shares your position once, only to place the pin on the map, and it is saved only if you save the form. The location of a workplace managed by an agency or a workplace manager is visible to everyone who works there.
2.7.2 You can also pin the location of a commitment, such as a class. We use it only to work out whether you can travel between your commitments and shifts in time. It's visible only to you and our administrators."
Address searches for commitment locations also go to OpenStreetMap. Commitment locations are never sent to Google; travel times to and from commitments are estimated on our own servers.
Workplace location and Commitment locations and travel times (address, map pin, travel times you enter, travel times from Google) | Until you remove them, delete the workplace, or delete your account. Travel times from Google are reused for up to 30 days before being looked up again, and are deleted when either workplace is deleted. deleted.A commitment's location is deleted when you clear it or delete the commitment. | Needed to estimate travel times between your workplaces and show directions. Optional, and you can remove it at any time.
Tildai Tech (trading name, registration pending)
Nairobi, Kenya
Email: privacy@tildaitech.com
Website: https://shift.tildaitech.com
Matilda Migwi Wanjiru
Budapest, Hungary
Email: eu-privacy@tildaitech.com
Tildai Tech has not appointed a Data Protection Officer (DPO) as we do not currently meet the thresholds requiring one under Article 37 GDPR or Section 24 of the Kenya Data Protection Act, 2019. Specifically, our core activities do not involve large-scale regular and systematic monitoring of individuals, nor large-scale processing of special categories of data.
For all data protection enquiries, please contact us at privacy@tildaitech.com. We will appoint a DPO and update this policy if our processing activities change in a way that triggers the requirement.
Tildai Tech ("we," "our," or "us") operates ShiftManager, a platform that helps individuals manage work shifts and track earnings across multiple workplaces. This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use our platform, in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Kenya Data Protection Act No. 24 of 2019 ("DPA"), and applicable data protection laws.
This policy applies to all users of ShiftManager. Specific provisions for users in the European Economic Area (EEA) and Kenya are noted where applicable. If you are under 18 years of age, you may not use this service.
When you create an account and use ShiftManager, we collect the following:
| Data | Required or Optional | What happens if not provided |
|---|---|---|
| Full name | Required | Cannot create account |
| Email address | Required | Cannot create account or receive notifications |
| Password | Required | Cannot secure account (stored in hashed form using bcrypt; we never store or see your plaintext password) |
| Phone number | Optional | You will not receive SMS notifications |
| Preferred currency | Required | Cannot calculate earnings accurately |
When you contact us via email or our contact form, we also collect the content of your message and any attachments you provide.
Nature of data provision (Art. 13(2)(e) GDPR): The provision of your personal data is not a statutory (legal) requirement. It is a contractual requirement necessary to enter into and perform our service agreement with you. You are not legally obliged to provide your personal data, but if you do not provide the fields marked "Required" in the table above, we will be unable to create your account or deliver the ShiftManager service to you. Optional fields (such as phone number) enhance your experience but are not necessary to use the core service.
To provide our core service, you enter the following data into ShiftManager:
Sensitivity notice: Pay rates and earnings data is financially sensitive information. We treat this data with heightened care and offer optional field-level encryption at rest (see Section 7: Data Security).
If you subscribe to a paid plan, payments are processed by Stripe and/or M-Pesa (Safaricom). These providers collect your payment details (card number, mobile money account, billing information) directly. ShiftManager does not store your full payment card number or M-Pesa PIN. We receive only:
For details on how these processors handle your data, see:
When you use ShiftManager, the following data is collected automatically:
| Data | Collected by | Purpose |
|---|---|---|
| IP address | ShiftManager servers, StatCounter | Security, approximate geolocation |
| Approximate location (country/city) | StatCounter (IP-based, not GPS) | Usage analytics, service improvement |
| Browser type and version | StatCounter | Compatibility and analytics |
| Device type and operating system | StatCounter | Compatibility and analytics |
| Pages visited and visit duration | StatCounter | Usage analytics |
| Referring URL | StatCounter | Understanding how users find us |
| Login timestamps and session data | ShiftManager servers | Security and service delivery |
| Cookies and similar technologies | ShiftManager, StatCounter | See Section 9: Cookies and Tracking |
We do not collect precise GPS location data.
StatCounter is a third-party web analytics service. For details: https://statcounter.com/about/legal/
ShiftManager does not collect: special category data (racial or ethnic origin, political opinions, religious beliefs, trade union membership, health data, biometric data, sexual orientation); government-issued ID numbers; or data from children under 18.
You directly provide Tildai Tech with most of the data we collect. We collect and process personal data when you:
We collect data automatically when you:
We do not collect personal data about you from third-party sources. All personal data we process is either provided by you directly or generated by your use of the platform.
2.7 Workplace & Commitments location and travel times (optional).
2.7.1 If you choose to, you can add a location for a workplace: its address and a position on a map (latitude and longitude). You can also enter how long it takes you to travel between your workplaces. We use this only to estimate public-transport travel times between your workplaces, so the Week Optimizer suggests only shifts you can realistically reach, and to show maps and directions. A workplace location is the location of the place you work, not of you: we do not track or store your device's location. If you use "Use my current location", your browser shares your position once, only to place the pin on the map, and it is saved only if you save the form. The location of a workplace managed by an agency or a workplace manager is visible to everyone who works there.
2.7.2 You can also pin the location of a commitment, such as a class. We use it only to work out whether you can travel between your commitments and shifts in time. It's visible only to you and our administrators."
Under the GDPR and Kenya DPA, we must have a lawful basis for each way we use your personal data. The table below sets out our purposes, the data involved, and the legal basis we rely on.
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and manage your account | Name, email, password, currency | Contract performance (Art. 6(1)(b) GDPR) |
| Calculate and display earnings | Shift times, pay rates, workplace details | Contract performance (Art. 6(1)(b)) |
| Store and organise shift schedules | Shift data, templates, notes | Contract performance (Art. 6(1)(b)) |
| Service notifications (password resets, account alerts, shift reminders) | Email, phone number | Contract performance (Art. 6(1)(b)) |
| Process subscription payments | Transaction IDs, billing cycle (via Stripe/M-Pesa) | Contract performance (Art. 6(1)(b)) |
| Provide customer support | Name, email, message content | Contract performance (Art. 6(1)(b)) |
| Improve and optimise the platform | Usage analytics, device/browser info (via StatCounter) | Legitimate interest (Art. 6(1)(f)) — improving service and UX |
| Prevent fraud and unauthorised access | IP address, login timestamps, session data | Legitimate interest (Art. 6(1)(f)) — platform security |
| Analyse traffic and user behaviour | Referring URLs, visit duration, country-level location | Legitimate interest (Art. 6(1)(f)) — understanding usage |
| Marketing communications | Consent (Art. 6(1)(a)) — explicit opt-in only | |
| Comply with legal obligations | Any relevant personal data | Legal obligation (Art. 6(1)(c)) |
Your right to object: Where we rely on legitimate interest, you have the right to object to that processing. If you do, we will stop unless we can demonstrate compelling legitimate grounds that override your interests. See Section 8 for how to exercise this right.
Automated decision-making: We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects on you (Article 22 GDPR). All shift calculations and earnings reports are mechanical computations based on data you enter — no algorithmic scoring, risk profiling, or automated employment decisions are made.
We do not sell, rent, or trade your personal data. We never have, and we will not do so without your explicit consent.
We share your data only in the limited circumstances described below. In each case, we share only the minimum data necessary for the stated purpose.
We use the following third-party service providers who process data on our behalf, under written Data Processing Agreements that require them to protect your data in accordance with the GDPR and Kenya DPA:
| Provider | Purpose | Data shared | Location |
|---|---|---|---|
| Truehost | Web hosting and server infrastructure | All data stored on the platform | Kenya |
| StatCounter | Web analytics | IP address, browser/device info, pages visited, approximate location | EU (Ireland) |
When you subscribe to a paid plan, your payment is handled directly by the following providers, who act as independent data controllers for your payment information:
| Provider | Purpose | Data they collect directly from you |
|---|---|---|
| Stripe | Card payments | Card number, billing address, transaction details |
| M-Pesa (Safaricom) | Mobile money payments | M-Pesa phone number, transaction details |
We do not receive or store your full card number or M-Pesa PIN. We receive only payment confirmations and transaction reference IDs.
We will disclose your personal data only when required to do so:
Where legally permitted, we will notify you before disclosing your data in response to a legal request.
If Tildai Tech is involved in a merger, acquisition, or sale of assets, your personal data may be transferred to the successor entity. We will notify you via email and/or a prominent notice on our platform before your data is transferred and becomes subject to a different privacy policy. You will have the right to request deletion of your data before such transfer takes effect.
We will share your data with third parties not listed above only if you provide specific, informed, and freely given consent for that particular sharing. You can withdraw such consent at any time.
4.6 Map and route services.
ShiftManager is operated by Tildai Tech, based in Kenya. If you are located in the European Economic Area (EEA), your personal data will be transferred to and processed in countries outside the EEA that may not provide the same level of data protection as your home country.
Map, address search and route requests described in Section 4 may be processed on servers outside Kenya, including in the United Kingdom, the European Union and the United States.
| Data | Stored/processed in | Provider | Adequacy decision? |
|---|---|---|---|
| Account data, shift data, earnings, notes | Kenya | Truehost | No — Kenya is not recognised as providing adequate data protection by the European Commission |
| Web analytics (IP, browser, pages visited) | Ireland (EU) | StatCounter | N/A — data remains within the EEA |
| Card payment data | EU / United States | Stripe | Stripe relies on its own SCCs and the EU-U.S. Data Privacy Framework |
| Mobile money payment data | Kenya | M-Pesa (Safaricom) | No |
For transfers of your personal data to Kenya, where no adequacy decision exists, we rely on your explicit consent under Article 49(1)(a) GDPR.
Before your account is created, we will clearly inform you that:
You will be asked to actively confirm your consent to this transfer during the registration process. This consent is separate from your acceptance of the Terms of Service and can be withdrawn independently.
What happens if you withdraw transfer consent:
During the grace period, we will continue to process your data on our Kenyan servers solely to allow you to access and export it. Once the grace period ends, processing ceases entirely.
Even in the absence of an adequacy decision, we apply the following protections to all data transferred to Kenya:
We are actively working to implement Standard Contractual Clauses (SCCs) approved by the European Commission (Commission Implementing Decision (EU) 2021/914) as an additional transfer mechanism alongside consent. Our target is to have SCCs executed with Truehost within 12 months of launch, at which point international transfers will be covered by both consent and SCCs. We will update this policy when SCCs are in place and notify users of the change.
In the interim, we consider explicit, informed consent under Art. 49(1)(a) to be appropriate given our current scale of processing, and we apply the supplementary safeguards described in Section 5.3 to mitigate the risks arising from the absence of an adequacy decision.
Where Stripe or Safaricom transfer your payment data internationally, they do so under their own legal mechanisms and privacy policies. We are not the controller for those transfers.
We keep your personal data only for as long as necessary to fulfil the purposes described in this policy, or as required by law.
| Data category | Retention period | Reason |
|---|---|---|
| Account data (name, email, password hash, phone, currency) | Duration of account + 30 days after deletion request | Needed to provide the service; 30-day buffer for processing |
| Shift and work data (schedules, pay rates, earnings, notes) | Duration of account + 30 days after deletion request | Core service data; deleted when account is deleted |
| Payment records (transaction IDs, billing cycle, subscription tier) | 5 years after the transaction | Required under Kenyan tax law (Tax Procedures Act) and applicable financial record-keeping obligations |
| Support communications (emails, contact form messages) | 12 months after issue is resolved | Maintain support quality and resolve recurring issues |
| Automatically collected data (IP, browser info, login timestamps) | 12 months from collection | Security monitoring and analytics |
| StatCounter analytics data | Governed by StatCounter's retention policy | We do not control StatCounter's retention |
Workplace and Commitment locations and travel times (address, map pin, travel times you enter, travel times from Google) |
| Needed to estimate travel times between your workplaces and show directions. Optional, and you can remove it at any time. |
If you do not log in to ShiftManager for 24 consecutive months, we will:
You may reactivate your account at any time during the 30-day notice period by simply logging in.
When you request account deletion or your account is deleted due to inactivity:
We do not currently operate an automated backup system. If we implement one in the future, this policy will be updated to state the backup retention period and the process for ensuring deleted data is also removed from backups.
You do not have to wait for these periods to expire. You may request deletion of your account and data at any time by contacting privacy@tildaitech.com. See Section 8 (Your Rights) for full details.
We take the security of your personal data seriously and implement appropriate technical and organisational measures in accordance with Article 32 of the GDPR and Section 41 of the Kenya DPA to protect against unauthorised access, alteration, disclosure, or destruction.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:
Your rights depend on where you are located. ShiftManager respects the data protection rights of all its users under the applicable laws of their jurisdiction.
Regardless of your location, you have the following rights, recognised under both the GDPR and the Kenya Data Protection Act, 2019:
Right to be informed — You have the right to clear, transparent information about how your personal data is collected and used. This privacy policy fulfils that obligation.
Right of access — You have the right to request a copy of all personal data we hold about you, in a commonly used electronic format (JSON or CSV).
Right to rectification — You have the right to request correction of inaccurate personal data, or completion of incomplete data. You can also update most information through your account settings.
Right to erasure ("right to be forgotten") — You have the right to request deletion of your personal data. Upon request, we will delete your account and associated data within 30 days, except where retention is required by law.
Right to restriction of processing — You have the right to request that we temporarily stop processing your data (while still storing it) in certain circumstances.
Right to data portability — You have the right to receive your personal data in a structured, commonly used, and machine-readable format (JSON or CSV), and to transmit it to another service.
Right to object — You have the right to object to processing based on legitimate interest. You have an absolute right to object to processing for direct marketing purposes at any time.
Right regarding automated decision-making — You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. ShiftManager does not engage in such processing.
Right to withdraw consent — Where we rely on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Methods: unsubscribe link for marketing emails; email to privacy@tildaitech.com for data transfer consent.
Your rights are protected under the General Data Protection Regulation (EU) 2016/679.
Right to lodge a complaint (EEA):
Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
Falk Miksa utca 9-11, 1055 Budapest, Hungary
Website: https://naih.hu | Email: ugyfelszolgalat@naih.hu
Your rights are protected under the Data Protection Act No. 24 of 2019 and the Data Protection (General) Regulations, 2021.
Right to lodge a complaint (Kenya):
Office of the Data Protection Commissioner (ODPC)
Britam Towers, 12th Floor, Hospital Road, Upper Hill, Nairobi, Kenya
Website: https://www.odpc.go.ke | Email: info@odpc.go.ke
If you are located outside the EEA and Kenya, we will endeavour to respect the data protection rights granted to you by your local laws. Please contact us at privacy@tildaitech.com, and we will respond within 30 days.
Some rights can be exercised directly through your ShiftManager account:
For all other rights — including erasure, restriction, objection, access requests, or withdrawal of transfer consent — contact us at privacy@tildaitech.com with the subject line "Data Rights Request." Please include your full name, the email associated with your account, and which right you wish to exercise.
We are committed to ensuring all rights listed in this policy are technically exercisable through our platform. If any self-service feature described above is not yet available at the time of your request, we will fulfil the request manually within the applicable legal timeframe.
Identity verification: We will need to verify your identity before processing your request. We will never ask for your password.
Cost: Exercising your rights is free under both GDPR and the Kenya DPA.
This section explains what cookies we use, why, and how you can control them.
These cookies are essential for ShiftManager to function and are exempt from consent requirements under the ePrivacy Directive.
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
| sessionid | ShiftManager (Django) | Maintains your logged-in session | 2 weeks (or until logout) |
| csrftoken | ShiftManager (Django) | Protects against cross-site request forgery attacks | 1 year |
| remember_me | ShiftManager (Django) | Keeps you logged in between browser sessions | Up to 30 days |
These cookies help us understand how users interact with ShiftManager. They are not loaded until you give explicit consent through our cookie banner.
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
| is_unique | StatCounter | Determines if you are a first-time or returning visitor | Up to 5 years |
| Various __sc_* cookies | StatCounter | Tracks page views, visit duration, referring URLs, and approximate location | Varies |
We do not use advertising or marketing cookies.
When you first visit ShiftManager, a cookie consent banner will clearly explain analytics cookies, give you the option to accept or reject them, will not pre-check any boxes, and will not load StatCounter until you actively consent. You may continue using ShiftManager with only essential cookies.
You may change your cookie preferences at any time by clicking the "Cookie Settings" link in the website footer or by clearing your cookies through your browser settings.
ShiftManager treats a DNT browser signal as equivalent to declining analytics cookies. If your browser sends a DNT header, we will not load StatCounter.
ShiftManager contains links to external websites and services that are not operated by us, including Stripe, Safaricom (M-Pesa), and StatCounter. If you follow a link to any third-party website, please note that those websites have their own privacy policies and data practices.
We do not accept any responsibility or liability for the privacy practices of third-party websites or services. We encourage you to read the privacy policy of every website you visit or service you use.
Links to our third-party service providers' privacy policies:
ShiftManager is a workplace shift management and income tracking platform designed exclusively for individuals aged 18 and older. The nature of the service — managing employment schedules, hourly pay rates, and earnings — makes it inherently intended for adults of legal working age.
Under both the GDPR (Article 8) and the Kenya Data Protection Act, 2019 (Section 2), we recognise our heightened obligations regarding the personal data of minors.
We do not knowingly collect, process, or store personal data from anyone under the age of 18.
During account registration, users are required to provide their date of birth. The system will automatically reject registrations where the calculated age is under 18. While this is not independent age verification technology (such as ID document checking), it provides a stronger safeguard than a simple checkbox. We will terminate accounts where we subsequently discover or have reasonable grounds to believe the user is under 18.
If we discover that we have collected data from a minor:
If you believe a minor is using ShiftManager, please contact us immediately at privacy@tildaitech.com.
We update this Privacy Policy when necessary to reflect changes in our practices, services, legal requirements, or regulatory guidance. When we do, we will update the "Last updated" date at the top of this page.
Corrections, clarifications, formatting, or changes that do not affect your rights or how your data is processed: We will update the policy on this page. No separate notification will be sent.
New categories of data collected, new third-party processors, changes to your rights, changes to the legal basis for processing, or new international transfers: We will:
If you do not agree with a material change, you may contact us to discuss your concerns or request deletion of your account before the changes take effect.
Continued use of ShiftManager after the effective date of a material change indicates your acceptance of the updated policy, except where the change requires renewed consent — in those cases, we will not proceed with the new processing until you have actively consented.
This Privacy Policy and any disputes arising from or in connection with it shall be governed by and construed in accordance with the laws of the Republic of Kenya, including the Data Protection Act No. 24 of 2019.
For users in the European Economic Area: Nothing in this section limits your rights under the GDPR or the laws of your EU/EEA Member State. You retain the right to lodge a complaint with your local supervisory authority and to bring proceedings in the courts of the Member State where you reside, regardless of this governing law clause.
For users in Kenya: Disputes shall be subject to the jurisdiction of the courts of Kenya and the oversight of the Office of the Data Protection Commissioner (ODPC).
For users in other jurisdictions: We will comply with the mandatory data protection provisions of your local law to the extent they apply to our processing of your data.
We encourage you to contact us at privacy@tildaitech.com to resolve any concerns informally before pursuing formal proceedings.
If you have any questions, concerns, or requests relating to this Privacy Policy or your personal data, we are here to help.
Email: privacy@tildaitech.com
Contact form: https://shift.tildaitech.com/contact/
Response time: We aim to respond within 7 business days.
Email: privacy@tildaitech.com (subject line: "Data Rights Request")
Response time: Within 7 days (Kenya DPA) or one month (GDPR), depending on your location.
Matilda Migwi Wanjiru
Budapest, Hungary
Email: eu-privacy@tildaitech.com
Tildai Tech (trading name, registration pending)
Nairobi, Kenya
Email: privacy@tildaitech.com
Kenya — Office of the Data Protection Commissioner (ODPC)
Britam Towers, 12th Floor, Hospital Road, Upper Hill, Nairobi, Kenya
Website: https://www.odpc.go.ke | Email: info@odpc.go.ke
EU — Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
Falk Miksa utca 9-11, 1055 Budapest, Hungary
Website: https://naih.hu | Email: ugyfelszolgalat@naih.hu
We can handle enquiries in English. If you write in another language, we will make reasonable efforts to respond, but may need to correspond in English.