Onward Shift Limited - Privacy Policy

Last updated: 01/November/2025

1. INTRODUCTION

1.1. Onward Shift Limited (“we”, “our”, “us”, the “Company”) is committed to protecting the privacy, confidentiality and security of all individuals who engage with our services. This Privacy Policy explains how we collect, use, store, disclose and safeguard your personal data across all areas of the Onward Shift ecosystem.

1.2. This policy applies to all users of our services, including but not limited to coaching and counselling clients, corporate partners, Check-In Buddy users, event participants, online shoppers, website visitors and individuals engaging with our content.

1.3. By using our services or accessing our website, you agree to the terms set out in this Privacy Policy.

2. THE DATA WE COLLECT

We may collect and process the following types of data:

2.1. Personal Identification Data

• Name

• Email address

• Phone number

• Job title (where relevant)

• Emergency contact (for events or safety-critical services)

• Business contact information (for corporate clients)

2.2. Wellbeing & Special Category Health Data

This includes information voluntarily provided through:

• Coaching or counselling

• Wellbeing conversations

• Check-In Buddy WhatsApp check-ins (mood, stress levels, reflective answers)

• Event forms (e.g., accessibility or health considerations)

Special category data is only processed with your explicit consent or where permitted by safeguarding or legal requirements.

2.3. Check-In Buddy–Specific Data

When using Check-In Buddy, we collect:

• Your phone number

• Your WhatsApp interactions with the service

• Message content you provide (wellbeing check-ins, mood indicators, etc.)

• Message timestamps

• Automated system logs

This data flows through:

• WhatsApp Cloud API (Meta)

• Make.com (automation platform)

• Google Sheets (long-term storage)

2.4. Technical & Usage Data

• IP address

• Browser type/version

• Device data

• Time zone settings

• Analytics data (page views, behaviour patterns)

• Cookie information

2.5. Marketing & Communications Data

• Your marketing preferences

• Email interactions

• Newsletter sign-up information

2.6. E-commerce Data

If you purchase products, we collect:

• Delivery address

• Payment confirmation

• Order history

Payment card details are processed securely by our third-party payment providers; we do not store card details.

3. HOW WE COLLECT YOUR DATA

We collect data through:

3.1. Direct Interactions

• Completing online forms

• Joining Check-In Buddy

• Booking services

• Attending events

• Email, WhatsApp, and phone communications

• Corporate onboarding processes

3.2. Automated Interactions

• WhatsApp Cloud API message handling

• Make.com automation routing

• Website analytics and cookies

• System logs

3.3. Third-Party Providers

We may receive personal data from:

• Corporate clients (e.g., employee contact lists for training)

• Event registration platforms

• Payment processors

• Social media integrations

4. HOW WE USE YOUR DATA

We will only use your data when legally allowed to do so. Uses include:

4.1. Service Delivery

• Providing coaching, counselling and wellbeing support

• Delivering Check-In Buddy messages and tracking engagement

• Administering event registrations

• Fulfilling product orders

• Managing corporate training and keynote speaking

4.2. Communication

• Responding to enquiries

• Sending session updates

• Providing service notifications

• Contacting you if safeguarding concerns arise

4.3. Service Improvement & Research

• Analysing trends and engagement

• Improving automation flows

• Identifying wellbeing patterns

• Long-term anonymised research to improve mental-health support in construction

• Statistical reporting (non-identifiable)

4.4. Legal Obligations

• Maintaining tax and accounting records

• Safeguarding duties

• Compliance with regulatory requirements

4.5. Marketing

• Sending newsletters, updates and promotional content if you have opted in

• You may opt out at any time

5. LEGAL BASES FOR PROCESSING

We rely on the following lawful bases:

5.1. Contract

To deliver the services you have requested.

5.2. Consent

Required for:

• Processing special category health data

• Check-In Buddy participation

• Marketing communications

You can withdraw consent at any time.

5.3. Legitimate Interests

For:

• Improving services

• Website analytics

• Preventing misuse

5.4. Legal Obligation

Where required by law, safeguarding, or regulatory bodies.

5.5. Vital Interests

Where information suggests a risk of serious harm to yourself or others.

6. CHECK-IN BUDDY DISCLOSURE

6.1. Check-In Buddy uses WhatsApp Cloud API to send automated check-ins.
6.2. Message content you send is processed through Make.com and stored in Google Sheets.
6.3. Identifiable wellbeing data is kept until you opt out, after which it is deleted within 30 days.
6.4. We may anonymise data and retain it indefinitely for research and statistical purposes.
6.5. The service is not a crisis tool. If you are in immediate danger, contact 999 or Samaritans at 116 123.
6.6. Automated messages may fail or be delayed.
6.7. Misuse (abusive, harmful, inappropriate messages) may result in removal from the service.

7. DISCLOSURE OF DATA

We may share data with:

7.1. Service Providers

Including:

• Meta (WhatsApp Cloud API)

• Make.com

• Google (Google Sheets & Drive)

• Email hosting services

• Website hosting providers

• Payment processors

• Delivery partners (for product orders)

7.2. Professional Advisors

Legal, accounting, IT and insurance advisors.

7.3. Safeguarding & Legal Bodies

Only where required to protect vital interests or comply with the law.

We do not sell your data.

8. INTERNATIONAL TRANSFERS

Some processors (including Meta, Google, Make.com) may store data outside the UK.

We ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs)

• Data Processing Agreements

• Security controls consistent with UK GDPR

9. DATA SECURITY

We use appropriate technical and organisational measures to protect personal data, including:

• Encrypted transport layers

• Access controls

• Secure cloud storage

• Staff confidentiality commitments

• Regular system reviews

10. DATA RETENTION

10.1. Check-In Buddy identifiable data

Retained until you opt out, withdraw consent, or request deletion.
Deleted within 30 days.

10.2. Anonymised data

Retained indefinitely for research, analysis and statistical reporting.

10.3. Coaching/counselling records

Up to 6 years (industry standard).

10.4. Event registration data

Up to 12 months after the event.

10.5. Marketing data

Until you unsubscribe.

10.6. Website analytics

Up to 26 months.

10.7. E-commerce records

6 years (legal requirement).

11. YOUR RIGHTS

You have the right to:

• Access your data

• Request correction

• Request deletion

• Withdraw consent

• Object to processing

• Request restriction

• Request data portability

For all requests, contact: jo*****@*********ft.com

We may need to verify your identity before fulfilling your request.

12. COOKIES

Our website uses cookies for:

• Essential site functionality

• Analytics

• Performance improvements

• Marketing (if applicable)

You can manage cookies through your browser settings.

13. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. Updates will be posted on this page with an amended “Last updated” date. In certain cases, we may notify you directly.

14. CONTACT US

For questions or data requests:

Onward Shift Limited
Email: jo*****@*********ft.com
Website: onwardshift.com