Privacy Policy

2. Our role

Shiftly's role depends on the processing activity. Shiftly is an independent controller for Talent accounts and profiles, the Talent Pool, platform-wide candidate discovery and matching, security and fraud prevention, billing, and its own service operations. Shiftly acts as a processor when it handles candidate data that an Employer or Institution (the "Customer") uploads or manages within its own hiring pipeline, such as pipeline notes and Customer-directed messaging, in which case Shiftly follows the Customer's documented instructions.

3. Personal data we process

Shiftly processes identification and contact data such as name, email, phone, nationality, location and profile photo; professional data such as CV, education, work history, skills, languages, availability and preferences; account and technical data such as login credentials, IP address, device identifiers, logs and cookies; communications sent through the Platform; automated matching results, rankings and analytical insights, which are distinguished from information a Talent has declared or that has been verified; and, where optional assessment or interview functionality is used, limited outputs imported into Shiftly.

Some of this data may be sensitive personal data under applicable law. Shiftly processes sensitive data only where necessary and on a lawful basis. Shiftly does not perform facial-recognition identification, voiceprinting or biometric categorisation, and does not use AI to infer race, ethnicity, religion, sexual orientation, health status or political beliefs. The AI and Responsible Hiring Policy sets out the prohibited practices in full, and they apply regardless of any consent given for a related feature.

4. Where we get personal data

Shiftly collects personal data directly from Talents, Employers and Institutions; from assessment or interview functionality a User chooses to use; from support interactions; and from the Platform's own security and analytics systems. Shiftly does not buy personal data from data brokers.

5. Why we process personal data

Shiftly processes personal data to operate the Platform, enable candidate discovery and matching, provide analysis as a decision-support tool, allow Employers and Talents to communicate, maintain security and prevent fraud, process payments, provide support, and, where lawful, improve the service and carry out marketing.

6. Legal bases

Depending on the context and the law that applies to you, Shiftly relies on your consent, the performance of a contract with you, the legitimate interests of Shiftly or a Customer where recognised by applicable law and balanced against your rights, and compliance with a legal obligation.

7. Automated processing and AI

Shiftly uses automated matching and ranking, and uses AI to assist with tasks such as CV parsing, profile analysis and analytical insights. These are decision-support tools. Shiftly does not use AI to make hiring decisions with legal or similarly significant effect on individuals; the Employer's human judgement remains necessary for hiring. Automated and AI outputs may be incomplete or inaccurate. Where applicable law gives you the right to obtain human review of an outcome informed by such processing, Shiftly and the relevant Employer will honour it. The AI and Responsible Hiring Policy gives further detail.

8. Optional interview and assessment functionality

When optional interview or assessment functionality is used, the relevant service may process source information, including a recording where an interview is recorded, directly on its own systems. Shiftly does not store the original interview recording on its own systems, and receives only the information needed to provide the relevant Platform functionality. A specific notice is shown to the Talent before the functionality is used.

9. Sharing

Shiftly shares personal data with the Employers, recruiters or Institutions to whom you apply or who search the Talent Pool, with service providers used to deliver optional assessment or interview functionality that you or an Employer chooses to use, and with competent authorities where the law requires. Shiftly may use service providers to support the operation and delivery of the Platform. Where those providers process personal data, appropriate contractual and data-protection safeguards apply, and further information is available to business Customers through Shiftly's contractual documentation and where required by law.

10. International transfers

Shiftly uses cloud-based infrastructure, so personal data may be processed, stored or backed up inside or outside the UAE. Where personal data is transferred internationally and applicable law requires a transfer mechanism, Shiftly puts an appropriate one in place. Shiftly does not use consent as its default transfer mechanism.

11. Retention

Shiftly keeps personal data only for as long as needed for the purposes in this Policy, or as required for legal, regulatory, accounting or dispute purposes, after which it is deleted or anonymised. Account and profile data is kept while your account is active or until you delete or replace it. When an account is deleted, personal data in Shiftly's active systems is deleted or anonymised within a reasonable operational period, subject to lawful exceptions, and data in encrypted backups is removed through routine rotation. Recruitment records are kept for a limited period after the relevant activity. Security, legal and accounting records may be kept longer where necessary.

12. Security

Shiftly uses technical and organisational measures designed to protect personal data, including appropriate access controls, encryption and monitoring. Shiftly does not claim any security certification it does not hold.

13. Your rights

Subject to the law that applies to you, you may request access to, correction, deletion or restriction of your personal data, object to certain processing, withdraw consent, and ask for a human review of an outcome informed by automated processing. You may ask Shiftly to correct a factual error in your profile or in data derived about you. This route concerns the accuracy of the underlying data and does not decide the merits of an Employer's hiring decision. To exercise these rights, contact privacy@shiftly.ae.

14. Minors

The Platform is for individuals aged 18 or over. Where it is used in connection with students or minors under an Institution and Minors Addendum, the Institution is responsible for lawful consent or guardian authorisation, and Shiftly applies additional data-minimisation and AI-use restrictions. Any AI profiling of a person under 18 requires a separate legal review before it is enabled.

15. Cookies

Shiftly uses cookies for authentication, security and preferences, as described in the Cookie Policy. Where non-essential cookies are used and the law requires consent, they are set only with your consent, which you may withdraw at any time.

16. Marketing

Shiftly separates service communications, which are needed to run your account, from marketing communications, which are sent only where permitted by law and which you may opt out of at any time.

17. Privacy contact and changes

For questions about this Policy or Shiftly's processing of personal data, or to exercise your rights, contact privacy@shiftly.ae. Shiftly maintains privacy-governance arrangements appropriate to the nature, scale and risk of its processing. Where applicable law requires Shiftly to appoint a Data Protection Officer or another representative, the relevant details will be made available as required by law. Shiftly may update this Policy from time to time, and will notify material changes by email or in-app notice.