Privacy Policy

1. Who we are

ShiftMatch (ABN 20 180 671 031), trading as ShiftMatch (“ShiftMatch”, “we”, “us”), runs a shift scheduling service for staffing agencies, care providers and similar businesses (“agencies”). Our registered office is 12/37 Albion Road, Box Hill VIC 3128. Privacy questions and requests: our registered address (12/37 Albion Road, Box Hill VIC 3128).

2. Our role and your agency's role

There are three kinds of people whose information we handle:

• Agency staff (admins and managers) who sign up and log in. We collect your information directly and we are responsible for it.
• Workers who receive shift offers by text message. An agency adds you and decides what is recorded about you. The agency is your first point of contact, and it is responsible for telling you why it collects your details. We hold your information on the agency's behalf, to run the service, and we apply this policy to it.
• Clients and site contacts of an agency, such as a business name, site address or phone number an agency enters so it can run a shift or share a live status link.

If you are a worker or a client, please contact the agency first about your information. We will help the agency to respond, and you can also contact us directly at the address above.

3. What we collect

Agency staff

• Name, email address, role and login credentials (passwords are stored only in a hashed form by our authentication provider).
• Agency name, plan, billing status and the history of sign-in and account changes.
• Payment details are collected and held by Stripe. We receive the card brand, last four digits, billing name and address, tax details you enter, and invoice history. We do not see or store full card numbers.
• How you reached us (for example a link or campaign code) and how you use the service, so we can fix problems and improve it.

Workers (entered or confirmed by the agency or the worker)

• Name and mobile number.
• Shift offers, acceptances, declines, check-in and check-out times, hours worked and approved hours.
• Pay type, pay rate and, if the agency connects Xero, the identifiers that link the worker to their Xero record.
• Compliance documents the agency uploads or asks for, such as licence, first aid, white card or screening check details, with type, expiry date and the file.
• The device location at the moment of check-in (see section 9).
• A record of text messages sent to the worker and whether they were delivered.

Clients and sites

• Business or client name, site address, map coordinates, and optionally a contact phone number.

Technical information

• IP address, browser and device type, pages and actions, and error logs, collected automatically for security and reliability.

4. How we collect it

Mostly directly from you, or from the agency that adds you. Some comes automatically from your browser or phone. Payment and accounting details come from Stripe and Xero when you or your agency use them. We do not buy personal information or collect it from social media.

5. Why we use it

• To provide the service: create accounts, post and fill shifts, text workers, record check-ins, work out hours and send approved timesheets to Xero.
• To bill agencies, collect payment, issue tax invoices and meet tax and accounting obligations.
• To keep the service secure, prevent abuse and fraud, and fix faults.
• To contact you about your account, changes to the service and important notices.
• To improve the service, using usage statistics that do not identify individuals where we can.
• To comply with the law and respond to lawful requests.

We do not sell personal information. We do not use workers' information to advertise to them. We use agency staff email addresses to send service messages and, where permitted, news about ShiftMatch (you can opt out of the latter at any time with the unsubscribe link or by contacting us).

6. Who we share it with

We share personal information only as needed to run the service:

• The agency that holds your record, and its authorised staff.
• Service providers that help us deliver the service, listed in the table in section 7. They may use the information only to provide their service to us.
• Clients, where an agency shares a live status link: the client sees the shift, its status, each worker's first name and arrival time, and never worker phone numbers, documents or pay.
• Professional advisers, insurers and auditors under confidentiality.
• Authorities and others where the law requires or allows it, for example a court order or to prevent serious harm.
• A buyer or successor if our business is sold or merged, with the same protections.

7. Overseas storage and disclosure

Some of our providers store or process information outside Australia. Before disclosing personal information overseas we take reasonable steps to make sure the recipient handles it in a way consistent with the APPs, usually through contract terms and by choosing providers with strong security practices.

By using the service you understand that, for providers outside Australia, APP 8.2(b) may not apply and we may not be accountable under the Privacy Act for what they do. We will tell you if this list changes in a way that matters.

8. Sensitive information and screening checks

Some compliance documents, such as working-with-children, NDIS worker screening or police check results, can reveal criminal history or health-related information, which the Privacy Act treats as sensitive. We collect them only because the worker or the agency provides them for a shift requirement, we hold them in a private, access-controlled store visible to that agency's admins and managers, and we do not use them for any other purpose. Agencies must have the worker's consent to upload them. We do not ask for health or criminal-history details beyond what a document itself shows.

9. Your location

When a worker taps Check in, their phone is asked for its location once. The coordinates are saved with the check-in so the agency can confirm the worker was at the site. We do not track workers continuously or in the background, and your phone asks your permission first. If you decline, you can ask your agency to record your arrival another way. When an agency manager uses “use my current location” while posting a shift, the same one-time permission applies.

10. Text messages

We send shift offers and service alerts by SMS through Cellcast, on behalf of the agency that added you. Each message names ShiftMatch. We send them because you agreed with your agency to receive shift notifications. If you no longer want them, tell your agency, or reply STOP where your carrier supports it, and we will stop sending to your number. You may still need to be contacted another way about a shift you have already accepted.

11. Cookies and similar technology

We use only what the service needs: secure session cookies to keep you signed in, a short-lived cookie that remembers which link or campaign brought a visitor to us (up to 30 days), a cookie used during connection to Xero, and your light or dark display choice stored on your device. We do not use advertising or cross-site tracking cookies on the service at the date of this policy. If we add analytics or advertising tools, we will update this policy first and, where required, ask for consent.

12. Security

We protect information with encryption in transit, per-agency access controls in the database so one agency cannot see another's data, hashed passwords, hashed, expiring worker links, encrypted storage of Xero access tokens, private file storage, an authenticator-app step for our own administrators, and audit logs of administrator actions. No system is perfectly secure, so please use a strong, unique password and tell us straight away if you think your account has been misused.

13. How long we keep information

We keep an agency's data while its account is open. If a trial ends or a subscription is cancelled, the agency keeps read-only access and export for at least 90 days, after which we may delete the account's data after giving the agency at least 14 days' notice. We delete or de-identify personal information we no longer need, unless the law requires us to keep it (for example invoices and payment records, which tax and company law generally require us to keep for five to seven years). Backups are overwritten on a rolling cycle.

14. Your rights: access and correction

You can ask for a copy of the personal information we hold about you and ask us to correct it. Write to our registered address (12/37 Albion Road, Box Hill VIC 3128). We will respond within 30 days. We may need to confirm your identity first. If we hold your information on an agency's behalf, we may refer your request to the agency so it can decide what to release. If we refuse a request, we will tell you why in writing and how to complain. There is no charge for making a request.

15. Data breaches

If a data breach is likely to result in serious harm to you, we will tell you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme, and tell you what steps to take.

16. Complaints

If you think we have mishandled your information, write to our registered address (12/37 Albion Road, Box Hill VIC 3128). We will acknowledge your complaint within 7 days and aim to resolve it within 30 days. If you are not satisfied, you can complain to the OAIC at oaic.gov.au or on 1300 363 992.

17. Changes to this policy

We may update this policy as the service or the law changes. We will post the new version here with a new date and, for material changes, tell agency admins by email. See also our Terms of Service.