Personal data protection

 

1. RGPD information & contact

SHYFTER SA, hereinafter referred to as SHYFTER, is a company operating in the HR and planning management sector, offering a service involving the processing of personal data on behalf of another organization (company, enterprise and/or firm). Our services are used to collect information for commercial and marketing purposes by the organization itself and/or by SHYFTER at the request of this organization, in accordance with the GCS (General Terms and Conditions of Sale) included in the commercial contract between us and this organization. The data is essential and directly related to our services. However, our most precious asset is our customers’ trust.

The protection of customer data and its use in accordance with customer expectations are of the highest priority to us. For this reason, the following notes on data protection have been drawn up to inform you about the processing of your personal data and your rights with regard to such processing, in accordance with current regulations applicable to the processing of Data and, in particular, the General Data Protection Regulation (“RGPD”) and the law on the protection of individuals with regard to the processing of personal data of July 30, 2018.

2. Responsible for data protection

You share personal data with us, directly or indirectly, explicitly or automatically.

SHYFTER, whose registered office is at Boulevard de Waterloo 30, 1000 Brussels (Belgium) and registered with the Banque-Carrefour des Entreprises under number (BE) 0720.922.212, acts as :

 

  • Responsible for the processing of Data collected in the context of data processing implemented by Shyfter ;
  • Subcontractor of Data collected by SHYFTER on behalf of its Customers, as part of the use of the SHYFTER solution.

 

When SHYTER acts as a subcontractor, the Customer is therefore the Data Controller with regard to all Data processing entrusted to SHYFTER. We therefore also refer you to the Privacy Policy of each of our Customers for further information on these Data Processings.

3. SHYFTER’s treatment of your data

This is Data that you communicate to us via various channels, such as the forms on our website, our SHYFTER application or our web platform, the cookies used or by e-mail.

We only use this Data for the processing purposes described below and we only collect Data that is strictly necessary for these purposes.

3.1 Processing relating to the website

These are processing activities for which SHYFTER acts as Data Controller.

3.1.1. Contact form

You can use the contact form on our website (https://shyfter.be/fr/contact/) to contact us with any questions you may have. The personal data you enter on the contact form will only be processed for the purpose of responding to your request.
This processing is based on the execution of a pre-contractual measure.

In this respect, we collect your company name, your first and last name, your email address, your telephone number and a free message.
We keep your Data for as long as is necessary to respond to your request.

3.1.2. Demo request form

You can use the demo request form on our website (https://shyfter.be/fr/demo-shyfter/) to request a customized online demo of Shyfter’s features for your business. The personal data you enter on this form will be processed solely for the purpose of responding to your request.
This processing is based on the execution of a pre-contractual measure.
In this respect, we collect your first and last name, your e-mail address, your telephone number, your country, your job title, information relating to your company (company name, number of employees, sector of activity, software already used if applicable), your requirements in relation to Shyfter and a free comment.

We keep your Data for as long as is necessary to respond to your request.

3.1.3. Creating a SHYFTER account

You can use the registration form on our website (https://try.shyfter.co/fr) to create an account and use our services. The personal data you enter on this form will only be processed for this purpose.
This processing is based on the performance of the contract between us.

In this respect, we collect your first and last name, your e-mail address, your telephone number, your job title, your address, information about your company (company name, number of employees, sector of activity, software already used, if applicable), your needs related to Shyfter and your connection data (login, password, IP address, browser, last visits, log data (date, time of connection…)…).
We retain your Data for as long as you use our services.

3.1.4. Recruitment

We collect your Data in order to process the applications sent, in particular via the form available on the website. Personal data will only be processed for the purpose of processing your application.

This processing is based on the execution of a pre-contractual measure.
In this respect, we collect your first and last name, your email address, your CV and cover letter.
We keep your Data for 6 months from the date we receive your application.

3.1.5. Building up a recruitment reserve

We process your Data in order to build up a recruitment reserve and to be able to contact you again in the event of new opportunities. Personal data will only be processed for this purpose.

This processing is based on your consent.
In this respect, we process your first and last name, your e-mail address, your CV and cover letter.
We keep your Data for 2 years from the date of our last contact.

3.2 Managing Cookies

The SHYFTER.CO website uses cookies.
A cookie is a small file sent with the pages of a website and stored by the browser on the hard disk of your computer, tablet or telephone. The information it contains may be sent back to the site’s servers during a subsequent visit, enabling the site’s author to track the user’s activity.

3.3. General treatments

These are processing activities for which SHYFTER acts as Data Controller.

3.3.1 License management

We process your Data to enable us to manage the purchase of licenses granted to users. Personal data will only be processed for this purpose.

This processing is based on the performance of the contract between us.

In this respect, we process your first and last name, your e-mail address, your telephone number, your job title, your address, information relating to your company (company name, company number, number of employees, sector of activity, software already used, if applicable), the Shyfter functionalities used and your billing information (bank account number, VAT number, means of payment, billing address, etc.).

We keep your Data for 7 years from the end of the contract.

3.3.2. Billing management

We process your Data in order to manage invoices and payments related to the use of the Service. Personal Data will only be processed for this purpose.
This processing is based on the performance of the contract between us.

In this respect, we process your first and last name, your e-mail address, your telephone number, your job title, your address, information relating to your company (company name, number of employees, sector of activity, software already used, if applicable), the Shyfter functionalities used and your billing information (bank account number, VAT number, means of payment, billing address, etc.).
We keep your Data for 7 years from the end of the contract.

3.3.3. Accounting

We process your Data to enable us to comply with the legal accounting or tax obligations to which we are subject. Personal Data will only be processed for this purpose.

This processing is based on compliance with our legal obligations.

In this respect, we process your first and last name, your e-mail address, your telephone number, your job title, your address, information about your company (company name, number of employees, sector of activity, software already used, if applicable), the Shyfter features used, your billing information (bank account number, means of payment, etc.) and your billing address.

We keep your Data for 7 years from the end of the performance of the contract.

3.4. Solution processing

3.4.1. Data processing carried out as data controller

3.4.1.1. User account maintenance

We process your Data to enable us to manage user accounts, guarantee security, prevent fraud and abuse of our services, etc. Personal Data will only be processed for this purpose.

This processing is based on our legitimate interests.

In the context of this processing, the Data concerned are your surname, first name, address, telephone number, e-mail address, National Register identification number, date and place of birth, marital status, gender, country of birth, language, financial identification data (IBAN, BIC), access level granted to you, profile photo and all information related to your user account.

We keep your Data for the period during which your registration is effective.

3.4.1.2. Support

We process all information related to your user account as well as the content and date of your request in order to provide you with service-related assistance, answer questions and process requests. Personal data will only be processed for this purpose.
This processing is based on our legitimate interest.
We keep your Data for the time necessary to respond to the request.

3.4.1.3. Customized use of the service

We process your Data in order to customize the use of the service to your needs when you configure your account settings. Personal Data will only be processed for this purpose.
This processing is based on our legitimate interests.

In the context of this processing, the Data concerned are your surname, first name, address, telephone number, e-mail address, National Register identification number, date and place of birth, marital status, gender, country of birth, language, financial identification data (IBAN, BIC), access level granted to you, profile photo and all information related to your user account.

We keep your Data for as long as you use our services.

3.4.2. Data processing carried out as a subcontractor

3.4.2.1. Which categories of processing and which personal data?

SHYFTER processes on behalf of the Customer the Data required to provide the services subscribed to under the Contract.

The purposes of the Processing are determined by the Customer, being the Data Controller. As a subcontractor, SHYFTER undertakes to process the Data, only and to the extent necessary, in accordance with the processing purposes determined by the Customer and in accordance with the latter’s documented instructions, unless otherwise provided by law. SHYFTER undertakes to comply with its obligations as described in Appendix 1 of the General Terms and Conditions of Sale.

For further information on the implementation of these processing operations, and in particular on data retention periods, we refer you to the privacy policies of our Customers and to the service contracts binding us to them.

The categories of processing for which we act as processor are the following:

 

  • Personnel management
  • Customer management
  • Colleague management
  • Schedule management
  • Time and attendance data collection and management
  • Managing the collection of medical certificates
  • Performance control
  • Activity reports
  • Vacation reports
  • Service data sheets
  • Attendance sheets
  • Messaging
  • Contract creation and management
  • Signatory management
  • Document creation and management
  • Managing Dimona declarations
  • Logging
  • User account management
  • Contact management

 


The Personal Data concerned by this processing are the following:

 

  • Personal identification data ;
  • Electronic identification data ;
  • Worker ID ;
  • National Register identification number ;
  • Personal details;
  • Professional activities ;
  • Job information ;
  • Medical certificates ;
  • Financial identification data ;
  • Salary data ;
  • Safety data ;
  • Images and/or video ;
  • Dimona status and default Dimona times ;
  • Social secretariat reference ;
  • Skills and attributes assigned in the solution, section ;
  • Alert and notification preferences ;
  • Date sent and message time ;
  • Log data /logs.

 

The categories of Persons concerned by Data Processing are: Customers and service users.

3.4.2.2. How long does Shyfter store personal data?

For processing activities carried out by SHYFTER as a subcontractor, data is kept by SHYFTER for the duration necessary for the Services.

The Customer, as data controller, determines the retention period applicable to the Data, on its own media, and in accordance with applicable regulations. We invite you to consult each Customer’s Privacy Policy for further information on these retention periods.

At the end of the service relationship, the Data is kept available to the Customer on the Web Platform or, as the case may be, on the Application for a period of two years from the end of the contractual relationship. At the end of this period, the Data is anonymized in SHYFTER’s IT systems, unless European Union or Belgian law requires the retention of personal data.

To this end, SHYFTER will confirm in writing to the Customer that the activities referred to in this point have been carried out, also mentioning the possible conservation of the personal data concerned, as required by the applicable legislation.

It is therefore the Customer’s responsibility to take all necessary steps to ensure the integrity and backup of the Data that SHYFTER will have communicated to it during the performance of the Contract and upon its expiry.

4. Does SHYFTER transfer personal data?

SHYFTER, through its services, collects information on behalf of another organization (company, enterprise and/or firm). In accordance with the GTC (General Terms and Conditions) – “7. Database: The database generated by SHYFTER and its services will be made available exclusively to the signatory of the contract, who will be solely responsible for it”.

We only share the personal data you have explicitly communicated to us and other non-automated data with other parties if we have obtained your explicit consent to do so, unless we are obliged to do so by virtue of a legal provision, a request from a public authority or a court order.

In the course of providing our services, we may also subcontract some or all of our tasks to technical subcontractors under contract with us.

SHYFTER requires its subcontractors to comply with data protection legislation and to provide sufficient guarantees regarding the implementation of appropriate technical and organizational measures, so that processing meets the requirements of applicable data protection legislation and guarantees the protection of your rights.

We do not sell or otherwise disclose the Data we collect about you to third parties.

5. Your rights regarding your personal data

As data subjects, you have the following rights in accordance with the RGPD:

 

  • The right to obtain information relating to the processing of Data, to have access at any time and free of charge to your Data and to obtain a copy of your processed Data (right of access, art. 15 RGPD).
  • The right to demand a rectification of your incorrect Data or to complete your incomplete Data (right of rectification, art. 16 RGPD). We draw your attention to the fact that you are obliged at all times to check the accuracy of the Data you provide to us.
  • The right to demand the erasure of your Data when you find yourself in the conditions provided for by the regulations (right to erasure, art. 17 RGPD).
  • The right to demand the limitation of data processing, in accordance with the applicable data protection legislation (right to limit processing, art. 18 RGPD).
  • The right to obtain personal data that you yourself have provided, in a structured, commonly used and computer-readable format and the right, where technically possible, to request the transmission of this data to another data controller (right to data portability, art. 20 RGPD).
  • The right to object to data processing where processing is based on SHYFTER’s legitimate interests (right to object, art. 21 RGPD).
  • The right to withdraw your consent at any time and terminate data processing based on your consent. Withdrawal will not affect the lawfulness of processing based on consent prior to withdrawal (right to withdraw consent, art. 7 RGPD).

 

6. How to assert your rights

You can contact our data protection officer at any time by e-mail at rgpd@shyfter.co or by post at

SHYFTER
Boulevard de Waterloo 30
1000 Brussels
(Belgium)

If you feel that we are in breach of any of our legal and/or contractual obligations, please contact us via the above-mentioned email address and we will do our utmost to follow up with you as soon as possible.

All claims, complaints or grievances should be addressed to SHYFTER’s head office.

If you are not satisfied with our response, you have the right to lodge a complaint with a supervisory authority.

The Belgian supervisory authority is

DATA PROTECTION AUTHORITY
Rue de la Presse 35
1000 Brussels
Mail : CONTACT@APD-GBA.BE

7. Safety measures

Taking into account the state of the art, SHYFTER undertakes, under the conditions of Article 32 of the RGPD, to take all appropriate Technical and Organizational Measures to secure the Personal Data and to maintain their security adequately – including securing against any form of careless, non-expert, incompetent or unlawful use and/or Processing, and securing against loss, destruction or damage – as well as for the protection of the confidentiality and integrity of the Data.

8. Applicable law and jurisdiction

These provisions shall be governed, interpreted and enforced in accordance with Belgian law, which shall be the sole applicable law in the event of a dispute.

Any dispute which cannot be settled amicably within a period not exceeding one month from the date of its occurrence, which period may be extended by mutual agreement, may be brought by the most diligent party before the French-speaking Courts and Tribunals of the judicial district of Brussels, which shall have sole jurisdiction.

9. Effective date

This policy was created and came into effect on 01.12.2022. We reserve the right, at our sole discretion, to change, modify, add or remove portions of this policy at any time.