Privacy Policy

The data controller for personal data processed through the Service is ProSuite Inc. For employees whose organizations use proShift, the employer acts as the data controller for workforce data, and proShift processes that data on the organization's behalf as a data processor.

Account data: name, work email, phone number, password (hashed), role and permissions.

Organization and scheduling data: organization name, departments, locations, shift schedules, shift assignments, clock-in/out records, leave requests, swap requests, and announcements.

Usage data: pages visited, features used, device and browser information, and approximate location derived from IP address.

Support data: messages you send to our support team.

To provide the Service: operating scheduling, attendance, timesheets, notifications, and reporting features.

To secure the Service: authentication, fraud and abuse prevention, and maintaining audit logs.

To communicate: transactional emails and push notifications about schedules, requests, and account changes; service updates.

To improve the Service: aggregated, de-identified analytics about feature usage.

Where the EU General Data Protection Regulation applies, we process personal data on the following bases: performance of a contract (providing the Service); legitimate interests (security, fraud prevention, product improvement); and consent where required (e.g., optional marketing communications).

Under Turkish Personal Data Protection Law No. 6698 (KVKK), personal data is processed for the purposes described in this Policy, shared only with the processors listed below and public authorities where legally required, transferred abroad only to countries with adequate protection or with explicit consent, and retained for the period necessary for the purposes of processing.

Data subjects may exercise their rights under Article 11 of the KVKK — including access, rectification, erasure, and objection — by contacting us at legal@proshift.io.

We do not sell personal data. We share data only with: cloud hosting providers (Hetzner Online GmbH, European Union data centers); payment processors (Stripe Payments Europe); email and push delivery providers; and translation service providers where enabled by the customer. A current list of sub-processors is available on request.

Primary hosting is in the European Union. Where data is transferred outside the EU/EEA, we rely on adequate safeguards such as the European Commission's Standard Contractual Clauses.

Account and scheduling data are retained while an organization's subscription is active. After termination, organizational data can be exported by the customer and is deleted from production systems within 90 days, unless longer retention is required by Turkish commercial and labor law (e.g., attendance and payroll records). Backups are purged on a rolling schedule.

We apply industry-standard safeguards: TLS encryption in transit, encryption at rest for sensitive fields, hashed passwords, role-based access control, audit logging of administrative actions, and regular security reviews. We notify affected customers and authorities of personal data breaches as required by law.

The Service uses strictly necessary cookies for authentication and session management, and optional product analytics. Marketing pages may use aggregate analytics to measure page performance. No third-party advertising trackers are used.

Subject to applicable law, you may request access, correction, deletion, restriction of or objection to processing, and data portability. Administrators can manage staff data directly in the platform. To exercise rights, contact legal@proshift.io; we respond within 30 days.

We will notify customers of material changes by email or in-product notice at least 14 days before they take effect. The "Last updated" date above reflects the current version.