Privacy Policy
Last updated: June 2026
This policy explains what personal data Pick a Shift collects, why we collect it, and what rights you have over it. It applies to all users of the platform — students, businesses, and visitors.
1. Who We Are
Pick a Shift ("we", "us", "our") is a marketplace platform connecting students with businesses offering short-term shifts in Madrid, Spain. Our registered company name is Pick a Shift S.L., operating under Spanish law.
For the purposes of the General Data Protection Regulation (EU) 2016/679 ("GDPR"), we act as the data controller for personal data processed through this platform.
Contact us about privacy matters at: privacy@pickashift.org
2. Data We Collect
We collect the following categories of personal data:
Account & Identity Data
Name, email address, profile photo, and account credentials. Collected when you register.
Profile Data (Students)
University, degree, year of study, skills, languages, availability preferences, Madrid district, bio, and optionally a CV document.
Profile Data (Businesses)
Business name, type, NIF/CIF, registered district, address, phone number, public email, website, and description.
Activity Data
Shift applications, accepted and completed shifts, messages exchanged on the platform, reviews and ratings left or received, and notifications.
Usage & Technical Data
IP address, browser type, device information, and pages visited. Collected automatically when you use the platform.
3. Legal Basis for Processing
We process your data under the following legal bases (GDPR Article 6):
- Contract performance (Art. 6(1)(b)): Processing necessary to provide the marketplace service — creating your account, matching you with shifts, processing applications, and facilitating messaging.
- Legitimate interests (Art. 6(1)(f)): Platform security, fraud prevention, improving our service, and sending operational communications about your account activity.
- Consent (Art. 6(1)(a)): Marketing communications and non-essential cookies. You may withdraw consent at any time.
- Legal obligation (Art. 6(1)(c)): Retaining records as required under Spanish commercial and tax law.
4. How We Use Your Data
We use your personal data to:
- •Create and manage your account
- •Match students with relevant open shifts
- •Enable businesses to review applicant profiles
- •Facilitate messaging between students and businesses
- •Calculate and display earnings and shift history
- •Send notifications about your applications, shifts, and account
- •Display public reviews and reliability scores
- •Detect and prevent fraud or misuse of the platform
- •Comply with legal and regulatory obligations in Spain
5. Third-Party Processors
We share data with trusted third-party processors who act under our instructions and are bound by data processing agreements:
| Processor | Purpose | Location |
|---|---|---|
| Clerk | User authentication and session management | USA (SCCs) |
| Supabase | Database storage and file storage | EU |
| Vercel | Platform hosting and edge delivery | USA (SCCs) |
Where data is transferred outside the EU, we ensure adequate safeguards via Standard Contractual Clauses (SCCs) approved by the European Commission.
6. Data Retention
We retain your data for the following periods:
- •Active account data: for as long as your account is open.
- •Shift and application history: 3 years after the shift date, for dispute resolution purposes.
- •Messages: 2 years from the date of the conversation.
- •After account deletion: anonymised aggregate data may be retained for analytics; identifiable data is deleted within 30 days.
- •Financial records: 7 years as required by Spanish tax law (Ley General Tributaria).
7. Your Rights Under GDPR
As a data subject in the EU/EEA, you have the following rights under the GDPR:
Right of Access (Art. 15)
Request a copy of the personal data we hold about you.
Right to Rectification (Art. 16)
Correct inaccurate or incomplete data.
Right to Erasure (Art. 17)
Request deletion of your data, subject to legal retention obligations.
Right to Restriction (Art. 18)
Limit how we process your data in certain circumstances.
Right to Portability (Art. 20)
Receive your data in a structured, machine-readable format.
Right to Object (Art. 21)
Object to processing based on legitimate interests or for direct marketing.
To exercise any of these rights, email us at privacy@pickashift.org. We will respond within 30 days. You also have the right to lodge a complaint with the Spanish data protection authority, Agencia Española de Protección de Datos (AEPD).
9. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, where changes are material, notify you by email. Your continued use of the platform after any change constitutes acceptance of the updated policy.