Privacy Policy

(1.1) This Privacy Policy explains how Shift ("we," "us," or "our") collects, uses, stores, shares, and protects your personal data when you interact with our website, contact us to request a quote, subscribe to our newsletter, or otherwise use our services.

(1.2) Your personal data belongs to you, and we are committed to keeping it in a secure environment. We do not share your information with third parties without a lawful basis and, where required, without notifying you in advance.

(1.3) By using our website at shiftmade.com, interacting with us, or subscribing to our newsletter, you acknowledge that you have read and understood this Privacy Policy.

(1.4) Where we rely on your consent to process your data, we will always ask for it separately and clearly rather than treating your use of the site as consent.

(2.1) The entity responsible for processing your personal data (the "Data Controller") is:
Company name: SHIFT MADE S.R.L
Phone: +40 759 303 145
Email: office@shiftmade.com

(2.2) If you have any questions about this policy or about how we handle your data, you can reach us using the contact details above.

(3.1) GDPR. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

(3.2) Personal Data. Any information relating to an identified or identifiable natural person (the "data subject"). An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to that person.

(3.3) Processing. Any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, restriction, erasure, or destruction.

(3.4) Consent. Any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which they signify agreement to the processing of their personal data, through a clear affirmative action.

(3.5) Processor. A third party that processes personal data on our behalf and under our instructions.

(3.6) Supervisory Authority. In Romania, the National Supervisory Authority for Personal Data Processing (ANSPDCP).

(4.1) We only collect the personal data we need for the purposes described in this policy. Depending on how you interact with us, this may include the categories below.

(4.2) Information you provide directly:

(4.2.1) Identity and contact details: first name, last name, email address, county of residence, and phone number, typically when you use our quote-request forms, contact us by phone or email, or otherwise get in touch.

(4.2.2) Newsletter data: your email address, if you choose to subscribe. This is used solely to send you marketing messages.

(4.2.3) Any other information you voluntarily include in your messages to us.

(4.3) Information collected automatically:

(4.3.1) Technical and usage data such as your IP address, browser type, device information, and pages visited, collected through cookies and similar technologies (see Section 6).

(4.4) We do not intentionally collect special categories of personal data (such as health, religious, or biometric data). Please do not send us this type of information unless we specifically ask for it.

(5.1) We process your personal data in accordance with the GDPR, relying on one or more of the legal bases set out below.

(5.2) Your consent (Art. 6(1)(a) GDPR). When you voluntarily submit information through our forms or subscribe to our newsletter, you consent to us processing your data for the specific purposes described at the point of collection. You can withdraw consent at any time (see clause 8.1).

(5.3) Performance of a contract (Art. 6(1)(b) GDPR). Where you are entering into or have entered into a contract with us, we process your data as necessary to fulfil our contractual obligations and to respond to your requests.

(5.4) Legal obligations (Art. 6(1)(c) GDPR). Where processing is necessary to comply with legal obligations that apply to us, such as accounting, tax, or record-keeping requirements.

(5.5) Legitimate interests (Art. 6(1)(f) GDPR). Where processing is necessary for our legitimate interests, such as securing our website, preventing fraud, and improving our services, provided these interests are not overridden by your rights and freedoms.

(6.1) Our website may use cookies and similar technologies to help it function, remember your preferences, analyze traffic, and improve your experience.

(6.2) Strictly necessary cookies are required for the website to work and do not require consent.

(6.3) Analytics and marketing cookies are only used with your consent, which you can give or refuse through our cookie banner and can change at any time in your browser settings.

(6.4) For details on the specific cookies we use, please see our Cookie Policy or the cookie banner displayed when you first visit the site.

(7.1) We keep your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law.

(7.2) Information you provide voluntarily (name, email address, phone number, etc.) is stored so we can respond effectively to your requests and meet our contractual obligations, and is deleted once it is no longer needed for those purposes.

(7.3) Newsletter subscription data (your email address) is kept for as long as you remain subscribed, and is deleted when you unsubscribe.

(7.4) Where processing is based on your consent, we keep the data until you withdraw that consent or until the original purpose has been fulfilled, whichever comes first.

(7.5) Where we are required to retain certain data by law (for example, invoicing and accounting records), we keep it for the legally mandated period.

(8.1) We do not sell your personal data. We may share it only in the limited circumstances set out below.

(8.2) Service providers (processors). We may disclose your information to companies that provide services on our behalf and act as processors, such as billing partners or email-marketing providers. These parties are carefully selected to ensure they meet data-protection standards, and they may only use your information to provide the services we have requested.

(8.3) Legal authorities. Where required by law or in response to binding legal process (such as court orders or lawful requests from public authorities), we may disclose your information to courts, prosecutors, or other public bodies.

(8.4) Other third parties with your consent or instructions. Outside the circumstances described in this policy, we will only share your information with other third parties with your explicit consent or in line with your instructions.

(9.1) We aim to store and process your data within the European Economic Area (EEA).

(9.2) If any of our service providers process data outside the EEA, we ensure appropriate safeguards are in place, such as an adequacy decision by the European Commission or Standard Contractual Clauses, so your data receives an equivalent level of protection.

(10.1) We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, or disclosure.

(10.2) These measures include access controls, secure storage, and limiting access to your data to personnel who need it to perform their duties.

(10.3) While no method of transmission or storage is completely secure, we continually review and improve our safeguards.

(11.1) We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing, including profiling.

(11.2) If this changes, we will update this policy and inform you of your rights.

(12.1) Our website and services are not directed at children under the age of 16, and we do not knowingly collect their personal data.

(12.2) If you believe a child has provided us with personal data, please contact us and we will delete it.

(13.1) Under the GDPR, you have the rights set out below in relation to your personal data.

(13.2) Right to withdraw consent. Where processing is based on consent, you may withdraw it at any time, free of charge, by emailing us at office@shiftmade.com with the subject line "Withdraw Consent." Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

(13.3) Right of access. You have the right to be told whether we process your personal data and, if so, to access that data and information about how it is processed.

(13.4) Right to rectification. You have the right to have inaccurate data corrected without undue delay and to have incomplete data completed.

(13.5) Right to erasure ("right to be forgotten"). You have the right to have your personal data deleted where it is no longer necessary, or in other circumstances provided by law.

(13.6) Right to restriction of processing. You may request that we restrict processing in certain situations, for example while you contest the accuracy of your data or believe the processing is unlawful but do not want the data erased. In such cases we will only store the data, or use it to establish, exercise, or defend legal claims.

(13.7) Right to data portability. Where processing is based on consent or a contract and carried out by automated means, you have the right to receive your data in a structured, commonly used, machine-readable format and to transmit it to another controller without hindrance from us.

(13.8) Right to object. You may object at any time to processing based on our legitimate interests. You may also object at any time to processing for direct-marketing purposes, including profiling related to direct marketing, in which case we will stop processing your data for that purpose.

(13.9) Right to lodge a complaint. You have the right to lodge a complaint with a supervisory authority (see Section 14).

(13.10) We will respond to any rights request within one month, as required by the GDPR. This period may be extended by up to two further months for complex or numerous requests, in which case we will let you know.

(14.1) To exercise any of the rights above, please contact us at office@shiftmade.com. We may need to verify your identity before acting on your request.

(14.2) You may also lodge a complaint with the supervisory authority in your country of residence.

(15.1) We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements.

(15.2) When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you.

(15.3) We encourage you to review this page periodically.