Legal
Privacy Policy
Version 3.0 · September 2026
Your privacy is important to us. This Privacy Policy explains what personal data we collect when you use the FLEXSHFT Platform, how we use it, who we share it with, how long we keep it, and what rights you have. It applies to all FLEXSHFT users — Contractors and Business Clients — and to anyone who contacts us or visits our website.
We process your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who We Are
FLEXSHFT Limited is the data controller for personal data processed through the Platform.
FLEXSHFT Limited First Floor, Swan Buildings 20, Swan Street, Manchester, M4 5JW Company No. 16932031 ICO Registration: ZC157675 Email: info@flexshft.co.uk
If you have questions about how we handle your personal data, contact us at info@flexshft.co.uk.
You also have the right to contact the Information Commissioner’s Office (ICO) at any time: Website: www.ico.org.uk | Helpline: 0303 123 1113
2. Personal Data We Collect
2.1 Data You Provide
- Identity data: full name, date of birth, profile photograph or introduction video (optional).
- Contact data: email address, phone number, home address or postcode.
- Right-to-work data: we do not store copies of government-issued identity documents or document numbers. Identity verification is carried out by our third-party verification partner, Sumsub. Sumsub holds the underlying documents and biometric data. We store only: Sumsub applicant ID, verification status, verification level, any rejection information, and document expiry date (used for automated renewal alerts).
- Payment data:full card and bank account details are handled by Stripe and are not stored by FLEXSHFT. We store transaction IDs, payment amounts, and payment status only. Business Client identity verification documents are held by Stripe Connect — we store verification status and Stripe account information only.
- Profile data: work history, stated skills and role preferences, availability, SHFT history, ratings received, and attendance records.
- Professional credential data:qualifications, licences, and certifications voluntarily uploaded to your profile, including SIA licence numbers, food hygiene certificates, and similar credentials. These are self-declared and not independently verified by FLEXSHFT unless stated. Stored in encrypted cloud storage — viewable within the Platform only, with no download or export available.
- Business data (Business Clients): company name, type of venue, premises address, contact details of the account holder, and team member details.
- Communications: in-app messages, support tickets and attachments, and correspondence sent directly to us.
- SHFT engagement data: SHFTs posted, applied for, confirmed, completed, and cancelled, including check-in and check-out timestamps.
- Audit and compliance records: verification records, GDPR request records, and account-level compliance records.
- Technical data: account timestamps, short-lived one-time password (OTP) authentication data, IP address, device type, operating system, browser type, and app version.
2.2 Data Collected Automatically
- Usage data:how you interact with the Platform — SHFTs browsed, features used, pages visited.
- Location data: where you have granted location permission, used to surface nearby SHFTs. You can withdraw this permission at any time via your device settings.
- Attendance history: records of SHFTs accepted, completed, and cancelled, used to calculate and display the Reliability Score.
2.3 Data From Third Parties
Sumsub: verification status, verification level, rejection information, and document expiry date. Sumsub holds the underlying identity documents and biometric data and is a specialist identity verification provider compliant with SOC 2 Type II standards.
Stripe: payment confirmation, transaction status, payout status, and connected account verification status. Stripe holds full card, bank account, and business verification documents.
3. Why We Use Your Data and Our Legal Bases
3.1 Performance of Contract (Article 6(1)(b))
We process data because it is necessary to provide the Platform to you:
- Creating and managing your account
- Matching Contractors with SHFTs based on skills, availability, and location
- Processing SHFT confirmations, completions, and payments via Stripe
- Operating FlexScore and Reliability Score transparency tools
- Storing SHFT engagement records for both Contractors and Business Clients
- Facilitating Perfect Match permanent hire introductions
3.2 Legal Obligation (Article 6(1)(c))
We process data because we are required to by law:
- Identity and right-to-work verification under the Immigration, Asylum and Nationality Act 2006
- Document expiry tracking and automated renewal alerts
- Financial record-keeping for HMRC
- Responding to lawful requests from regulators, law enforcement, or courts
3.3 Legitimate Interests (Article 6(1)(f))
We process data where we have a legitimate business interest that does not override your rights:
- Reliability Score: displaying factual attendance history as a banded descriptor to enable informed Business Client decisions. A Legitimate Interests Assessment (LIA) has been conducted and is available on request. The Reliability Score has no impact on a Contractor’s Match Fit ranking, SHFT eligibility, or Platform access.
- FlexScore: aggregating and displaying Business Client ratings of Contractors. An LIA has been conducted and is available on request.
- Platform security and fraud prevention
- Platform improvement and analytics: aggregate and anonymised usage data
- Service-related communications: account notifications, SHFT confirmations, payment reminders
3.4 Consent (Article 6(1)(a))
We process data only with your explicit consent:
- Marketing communications
- Precise location data for SHFT matching
- Non-essential cookies (managed via our cookie preference tool)
You may withdraw consent at any time. Withdrawal does not affect processing already carried out.
3.5 Special Category Data (Article 9)
Right-to-work verification may involve nationality, immigration status, and biometric data, processed by Sumsub on our behalf. We store only the verification outcome and document expiry date. Legal basis: Article 9(2)(b) (legal obligation) and Article 9(2)(g) (substantial public interest). A data processing agreement is in place with Sumsub.
3.6 Automated Decision-Making — Match Fit Algorithm (Article 22 UK GDPR)
We use an automated matching algorithm (Match Fit) to surface relevant SHFTs to Contractors and relevant Contractor profiles to Business Clients. Match Fit uses: stated skills and role preferences, availability, location relative to SHFTs, and SHFT history.
Match Fit does not use: video presence, photo presence, qualification upload status, Reliability Score band, FlexScore rating, or any characteristic that could be a proxy for a protected characteristic under the Equality Act 2010.
Match Fit does not make final engagement decisions — all decisions are made independently by Business Clients and Contractors.
Your rights regarding Match Fit: you may request information about how your Match Fit score is calculated, request human review of any automated outcome you believe has significantly affected your access to SHFTs, and express your point of view and contest any outcome. Contact info@flexshft.co.uk.
5. International Data Transfers
We store and process data primarily within the UK and EEA. Where processors operate outside these regions, we ensure appropriate safeguards are in place including UK International Data Transfer Agreements (IDTAs) or EU Standard Contractual Clauses (SCCs).
6. How Long We Keep Your Data
We keep personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Where data is no longer needed, it is securely deleted or irreversibly anonymised.
| Data Category | Retention Period | Basis |
|---|---|---|
| Account data | Account duration plus 6 years from closure | Limitation Act 1980 |
| Verification data (status, expiry) | Account duration plus 2 years from last SHFT | Contractual and legal obligation |
| Payment records | 7 years from transaction date | HMRC requirements |
| SHFT engagement records and timestamps | 6 years from SHFT date | Limitation Act 1980 |
| Attendance history (Reliability Score display) | 12-month rolling window for display; underlying data 3 years | Legitimate interests |
| FlexScore ratings | 3 years from SHFT date | Legitimate interests |
| Professional credentials | Account duration or until deleted; 30 days post-closure | Data minimisation |
| Communications and support tickets | 2 years from last Platform use | Legitimate interests |
| Marketing consent records | Until withdrawn plus 1 year | PECR compliance |
| Inactive accounts | Accounts with no activity for 24 months will be flagged for deletion. You will be notified by email before deletion. | Data minimisation |
7. Your Rights
You have the following rights under UK GDPR. To exercise any of them, contact info@flexshft.co.uk. We will acknowledge your request within 5 working days and respond within one calendar month.
- Right of access (Article 15): request a copy of the personal data we hold about you.
- Right to rectification (Article 16): request correction of inaccurate or incomplete data.
- Right to erasure (Article 17): request deletion of your data where no compelling reason to continue processing it exists.
- Right to restriction (Article 18): request that we restrict processing in certain circumstances.
- Right to data portability (Article 20): receive your data in a structured, machine-readable format where processing is based on contract or consent.
- Right to object (Article 21): object to processing based on legitimate interests. We will stop unless we can demonstrate compelling legitimate grounds.
- Rights related to automated decision-making (Article 22): request human review of any solely automated decision that significantly affects you, including Match Fit outcomes.
- Right to withdraw consent: withdraw consent for marketing, location data, or non-essential cookies at any time via your account settings or by contacting info@flexshft.co.uk.
- Right to lodge a complaint: contact the ICO at www.ico.org.uk or 0303 123 1113 at any time.
8. Security
We implement appropriate technical and organisational security measures:
- All data transmitted between your device and our servers is encrypted using TLS
- Data stored on our servers and in cloud storage is encrypted at rest
- Bank and card details are transmitted directly to Stripe and are never stored in our systems
- Credential documents are view-only within the Platform — no download or export is available
- Access to personal data is restricted to authorised personnel on a need-to-know basis
- Our cloud infrastructure (AWS) is hosted in UK/EEA regions
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify affected individuals without undue delay.
10. Children
The Platform is not intended for anyone under 18. We do not knowingly collect personal data from anyone under 18. If you believe we have done so, contact info@flexshft.co.uk and we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Where we make material changes, we will notify you by email or in-platform notification at least 14 days before the changes take effect. The current version is always available on the Platform and at [INSERT URL].
12. Contact Us
FLEXSHFT Limited First Floor, Swan Buildings 20, Swan Street, Manchester, M4 5JW Email: info@flexshft.co.uk ICO Registration: ZC157675
Information Commissioner’s Office www.ico.org.uk | 0303 123 1113