SHIFTFILLA PRIVACY POLICY

1. Introduction

ShiftFilla Limited (“ShiftFilla”, “we”, “us” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, disclose and protect personal information in accordance with the Privacy Act 2020 (New Zealand).

This policy applies to all users of the ShiftFilla platform, including Venues and Workers. For Workers, it also covers the personal information we hold as your employer.

2. What Information We Collect

We may collect the following types of personal information.

3. How Information Is Used

We collect and use personal information for purposes including:

• operating and maintaining the Platform
• facilitating shifts between Venues and Workers
• employing Workers, running payroll and paying PAYE, ACC and other amounts owed
• verifying identity and right to work
• processing payments and prepaid balances for Venues
• health and safety, injury management and ACC claims
• trust, safety and fraud prevention
• dispute and employment problem investigation
• customer support
• compliance with legal obligations

3A. Promotion Entries

When you enter a promotion, you may upload a photo of a receipt. We use it only to read text data from the image (such as the venue name, date, receipt number and total) to check that your entry is valid. We do not store the image. We keep the extracted text data and your entry details for 12 months after the draw, to run the draw, check for duplicate or fraudulent entries and resolve disputes. Please make sure your photo does not include personal information that isn't needed, such as card numbers.

If you win, we use your name and contact details to notify you and deliver the prize. Venues only see combined totals for their promotion, such as the number of receipts and total spend, not your individual entry.

We use Anthropic's Claude service to read the text from your receipt image. The image is processed in the United States and is not used to train AI models.

3B. Social Events

When you register for a social event that we organise, we collect your name, profile photo, contact details and payment status, so that we can run the event and keep attendees safe. Your name and profile photo may be shown to other Workers as attending the event. We may take photos or video at events and use them on the Platform and our social media. If you don't want to appear in them, tell us at the event or email admin@shiftfilla.com. We keep this information only for as long as we need it to run the event and for 12 months afterwards. Attending a social event is not work, and we do not use event information for employment decisions.

3C. Employment and Payroll Records

As your employer, we must collect and keep information about your employment, including your IRD number, tax code, bank details, hours, pay, leave and right to work. We use it to pay you correctly, file returns with Inland Revenue, deal with ACC and meet our legal obligations. We do not use your tax, bank or IRD information for any other purpose, and we do not share it with Venues.

If you are injured or unwell, we collect only the information we need, such as the date, what happened and any certificate from a health professional. You do not have to share private medical details to cancel a shift.

3D. Direct Offer Reports

If you tell us a Venue has offered you work directly, we collect the details you give, including the Venue, date, type of work and any screenshot or photo you upload. We use it to check the report, to pay any thank-you for reporting, and to confirm a direct engagement with the Venue if that happens. We keep these records for 12 months.

We do not share your screenshots or photos with the Venue. If you have not accepted the offer, we do not contact the Venue about your report. If you have accepted, we contact the Venue ourselves to confirm the engagement and tell them only what is needed to do that. We will not use a report to penalise you.

4. Information Shared with Other Users

4A. Information Shared with Service Providers and Agencies

We share personal information with:

• our payroll provider, to pay Workers and file with Inland Revenue
• our payment providers, such as Stripe, to take payments and process refunds
• Inland Revenue, for payday filing, PAYE and other tax obligations
• ACC, for injury claims and levies
• WorkSafe New Zealand, where we must notify a serious incident
• Immigration New Zealand, to check right to work
• banks, to pay Workers
• our lawyers, accountants, insurers and other advisers, where needed
• other agencies or people where the law requires or allows it

Some of these providers store or process information outside New Zealand. We take reasonable steps to make sure they protect it to a standard comparable to New Zealand law.

5. Responsibility for User-to-User Data Sharing

Once personal information is lawfully shared between Users via the Platform:

• ShiftFilla is not responsible for how that information is used, stored or disclosed by another User
• each User is independently responsible for complying with the Privacy Act 2020 and other applicable laws
• any misuse, unauthorised disclosure or privacy breach by a User is the responsibility of that User

6. ShiftFilla’s Access to Information

ShiftFilla may access, store, process and analyse all information provided by Users to:

• operate and improve the Platform
• employ Workers and administer payroll, payments and prepaid balances
• investigate disputes, employment problems, incidents, misuse or fraud
• enforce the Platform Terms and the Casual Employment Agreement
• comply with legal and regulatory obligations

7. Accuracy and Authority

Users are responsible for ensuring that:

• information provided is accurate, complete and current
• they have authority to upload and share documents or personal information
• information is promptly updated if circumstances change, including visa, tax code and bank details

ShiftFilla may rely on information provided, subject to its own right-to-work checks.

8. Storage and Security

ShiftFilla takes reasonable technical and organisational measures to protect personal information against loss, unauthorised access, misuse or disclosure. Tax, bank and identification information is held with restricted access. No system is completely secure, and we cannot guarantee absolute security.

9. Retention of Information

We keep personal information only for as long as reasonably necessary for:

• Platform operations
• legal and regulatory compliance
• dispute resolution
• record-keeping

Employment, wage, time and tax records are kept for at least 7 years after the employment ends, as the law requires. Receipts, social event details and direct offer reports are kept for the periods stated above.

10. Disclosure Required by Law

ShiftFilla may disclose personal information where required or permitted by law, including in response to lawful requests from courts, regulators or government agencies.

11. Your Rights

Under the Privacy Act 2020, you have the right to:

• request access to your personal information, including your employment records
• request correction of inaccurate information

Requests should be made in writing to the contact details below, and we will respond within the time the law allows.

12. Complaints

If you believe your privacy has been breached, you may contact us. If unresolved, you may complain to the Office of the Privacy Commissioner.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The most current version will always be available on the Platform. We will notify Users of material changes by email or on the Platform before they take effect.