Employee Notice Template
For employers using IzyShift. Under Articles 13 and 14 GDPR, you as the employer must tell your staff how their personal data is processed. Below is a short template you can copy, adapt and hand out with your other employment documents, or send by email or chat. Replace the text in [square brackets], and delete the lines for features you do not use. This template is not legal advice. Check it against your own setup and local employment law.
How we use IzyShift — information for staff
Who is responsible. [Company legal name, address] ("we") is the controller of your personal data in IzyShift. Contact for privacy questions: [name / email]. [Our data protection officer: … — if you have one.]
What IzyShift is. We use IzyShift, a service provided by BLACKBREAD LTD (Cyprus), to:
- plan shifts;
- record clock-ins and clock-outs;
- manage leave;
- prepare payroll;
- [pay your salary to your bank account (payroll payouts)];
- [collect short shift notes].
BLACKBREAD LTD processes your data only on our instructions, as our processor.
What we record:
- your name, work email, [phone], position, department and venue;
- your schedule, breaks and leave (including the type of absence, but no medical details);
- your clock-in and clock-out times and how you made them;
- your pay type and rates, and the hours and pay calculated from them;
- [your bank details (name on the account, IBAN, optionally BIC) and the net amounts we pay you — stored encrypted, visible only to the owner and administrators];
- notes our managers keep about scheduling;
- [shift notes you write, with photos] [and voice messages, which are converted to text automatically; the audio is not kept].
Depending on how we clock in:
- [Location: your phone's location is checked only at the moment you clock in or out, to confirm you are at [venue]. You are never tracked continuously.]
- [Wi-Fi: the network address of your device when you clock in, to confirm you are on the venue's network.]
- [Terminal: you clock in on a tablet at the venue with a personal 4-digit PIN.]
Why, and on what legal basis:
- to organise work and pay you correctly, which is necessary for your employment contract (Art. 6(1)(b) GDPR);
- to keep working-time and pay records required by law (Art. 6(1)(c));
- [to confirm that clock-ins happen at the workplace and to manage punctuality, which is our legitimate interest in accurate time records (Art. 6(1)(f)). You may object to processing based on legitimate interests.]
Who can see it:
- your managers and administrators, according to their access level;
- colleagues, who can see the shared schedule [only your department / the whole venue];
- only [owners/administrators], who can see pay.
Telegram. If you choose to link your Telegram account, you receive your schedule and reminders there. In that case your Telegram ID and those messages pass through Telegram. Linking is optional. You can use the IzyShift app or website instead.
Providers. IzyShift is hosted on Hetzner Online GmbH servers in the EU (Germany and Finland). Service emails are sent through Google. [Voice notes are transcribed by OpenAI.] Some providers may process data outside the EU under the European Commission's Standard Contractual Clauses. The full list is at izishift.cc/legal/subprocessors/.
How long we keep it. Schedules, time and pay records are kept for [period required by law, e.g. X years after the end of employment]. Your login is removed when you leave, or when you delete your account.
Your rights. You can ask us for access, correction, erasure, restriction or a copy of your data, and you can object as described above. You can delete your IzyShift login yourself in the app (Settings / More → Delete account). We will still keep the work records that the law requires us to keep. You may also complain to the data protection authority. In Cyprus this is the Commissioner for Personal Data Protection (www.dataprotection.gov.cy).
IzyShift's own Privacy Policy explains the provider's side in more detail.