Privacy Policy

1. Who we are

NextShifts ("we", "us", "our") operates a platform connecting UK care facilities and staffing agencies with carers. This policy explains how we collect, use, and protect personal data under the UK GDPR and the Data Protection Act 2018.

2. Data we collect

• Account details for organisations: contact name, email, phone, organisation details, verification documents (e.g. CQC registration).
• Account details for carers: name, contact details, right-to-work status, and DBS check information.
• Usage data: shift postings, applications, messages exchanged through the platform.
• Payment information, processed securely by our payment provider (Stripe) — we do not store full card details. We keep a record of each subscription payment (amount, date and Stripe invoice reference).
• Security logs: when a verification document is opened, we record who opened it, when, and from which IP address.

3. How we use your data

• To verify organisations and carers before granting platform access.
• To match carers with available shifts and facilitate bookings.
• To process subscription payments.
• To send account, verification, and shift-related notifications.
• To meet our legal and regulatory obligations in the care sector.
• To keep an audit trail of access to verification documents, for security and to detect misuse.

4. Legal basis for processing

We process personal data under one or more of: performance of a contract with you, compliance with a legal obligation (including safeguarding and DBS requirements), and our legitimate interests in operating and improving the platform.

5. Sharing your data

We share data with the organisation or carer involved in a specific shift booking, our payment processor, and, where legally required, regulatory bodies. We do not sell personal data to third parties.

6. Data retention

We retain personal data for as long as your account is active, and afterwards only as long as necessary to meet legal, accounting, or safeguarding record-keeping obligations. Billing and payment records (invoice amounts, dates and Stripe references) are kept after an account is closed for as long as the law requires us to retain accounting records. Logs of access to verification documents, which include IP addresses, are kept for a limited period for security and audit purposes and are then deleted.

7. Your rights

Under UK GDPR you have the right to access, correct, erase, or restrict processing of your personal data, and to data portability and objection, subject to certain exemptions. To exercise these rights, contact us using the details below.

8. Cookies

We use essential cookies required for the platform to function (such as keeping you signed in). We do not use third-party advertising cookies.

9. Contact us

For any privacy questions or to exercise your data rights, email hello@nextshifts.co.uk.

10. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by an updated "Last updated" date above.