Privacy notice

Privacy notice

Last updated 30 September 2026. This notice explains how NextShift collects and uses your personal information, as required by the Protection of Personal Information Act, 2013 (POPIA).

The short version

• We collect what we need to match you with hospitality work near you, and we say below exactly what that is.
• Employers never see your phone number, your address, your ID or your documents until you and they have both agreed to a shift.
• Your identity documents are private to NextShift staff. No employer can open them, ever.
• Our ranking and our reliability penalties are partly automatic. You can always ask a person to look again.
• You can ask us for a copy of your information, ask us to correct it, or ask us to delete your profile. It is free and we will not penalise you for asking.

1. Who is responsible for your information

The responsible party is [Registered company name and registration number — to be completed], trading as NextShift, at [Registered business address — to be completed].

Our Information Officer is [Information Officer name — to be completed], who you can reach at [Information Officer email — to be completed]. The Information Officer is responsible for how we handle personal information and for answering the requests described in section 10 below.

2. What we collect, why, and whether you have to give it

POPIA requires us to tell you whether giving us something is voluntary or required, and what happens if you do not. This is that list.

If you are a worker

• Your name and mobile number — required. Without them we cannot create an account or let an employer contact you about a confirmed shift.
• A password — required. To keep your account yours.
• Email address — optional. Used only to send you notices about your shifts. If you do not give one, we contact you by phone or WhatsApp instead.
• The roles you do, your skills and your experience — required to be matched. This is what employers search on. Without it you will not appear in results.
• The area you are based in — required to be matched. We show employers an approximate distance, never your address.
• Your exact location coordinates — optional. Only captured if you tap "use my current location". It makes distance matching more accurate. We never show it to anyone.
• How you travel, how far you will go, whether you can work late — required to be matched, so we only send you shifts you can actually reach.
• A profile photo, an "about me", previous employers, qualifications — optional. They make you more likely to be booked. We do not use your photo for facial recognition or any biometric matching.
• Your right to work in South Africa, and supporting documents — required before we can mark you verified. Employers are obliged by law to check this. You can use the rest of NextShift without submitting documents, but you will not carry the verified badge and some employers will not book unverified workers.
• Your SARS tax number — optional. Employers often need it. We record it as provided. We only record it as verified if we have actually checked supporting confirmation from SARS. A number that merely looks valid is never treated as verified.
• Your availability, the shifts you accept, whether you arrived, and employer feedback — created as you use NextShift. This is what builds your reputation.

If you are an employer

• Your business name, your name, your mobile number and email address, and your venue address. All required — workers need to know who is booking them and where to go.
• The shifts you post and the feedback you give.

Everyone

• Basic technical information when you use the site: your IP address, and which pages and actions you used. We keep this to operate the service, prevent abuse, and understand where people get stuck.

3. Our lawful basis for using it

• Your consent — for creating your profile, showing you to employers, and storing the documents you upload. You give this when you register and you can withdraw it at any time by asking us to delete your profile.
• Performance of a contract — once you accept a shift, we process what is needed to make that booking work.
• Our legitimate interests — keeping the marketplace trustworthy: preventing fraud, recording attendance, and maintaining reliability records.
• Legal obligation — where a law requires us or an employer to check the right to work.

Withdrawing consent does not undo anything we did lawfully before you withdrew it. Some records of completed bookings are kept even after you leave, as described in section 8.

4. Identity and right-to-work documents

Documents you upload — your ID, passport, permit, visa or SARS confirmation — are treated differently from the rest of your profile:

• They are stored outside the ordinary website media library, in a folder that refuses direct web access.
• They can only be opened through an authenticated, single-use link by NextShift staff, or by you.
• Employers cannot open them under any circumstances. An employer only ever sees whether you are verified, not the documents behind it.
• Every time a document is opened, we record who opened it and when.

"NextShift Verified" means a person at NextShift has looked at your documents and satisfied themselves they are genuine and yours. It is not a rating and it says nothing about how good you are at your job.

5. Age

NextShift is for people aged 18 and over. We do not knowingly create profiles for children. POPIA places strict conditions on processing a child's personal information, and hospitality shifts frequently involve alcohol. If we learn that an account belongs to someone under 18, we will remove it.

6. What employers can see about you

This is the part most workers ask about, so it is set out precisely.

Before you have agreed to a shift together, an employer searching NextShift sees: your first name and the initial of your surname, your photo if you added one, the roles and skills you listed, roughly how far you are from their venue, whether you are available, your years of experience, your transport, your verified status, and your reputation figures — shifts completed, reliability, and the percentage of employers who would book you again.

They do not see: your surname, phone number, WhatsApp number, email address, home address, exact coordinates, date of birth, ID or passport number, tax number, or any document.

Once you and an employer have both confirmed a shift, that employer additionally sees your phone number so they can reach you about the work. Nothing else is released.

7. Automatic decisions, and your right to a human

POPIA gives you the right not to be subject to a decision made only by a machine where it significantly affects you. Two things on NextShift are partly automatic, so you should know how they work:

• Your NextShift Score and where you rank in search. This is calculated from your completed shifts, attendance, cancellations, employer feedback, verification status, profile completeness and experience. It affects how often employers see you. It does not, on its own, stop anyone from booking you.
• Reliability holds. If you cancel very late repeatedly, or an employer reports that you did not arrive, your account can be placed on hold, which stops you accepting shifts for a period.

No hold is ever applied by an employer's click alone. When an employer reports a no-show, nothing happens to your record for 48 hours. In that window you can tell us what happened, and a person at NextShift decides. If we find in your favour, the report is removed entirely and your completed shift is restored.

You can ask for any score, ranking or hold to be reviewed by a person at any time, by writing to hello@nextshift.co.za. We will tell you the reason and you can give us your side.

8. How long we keep it

• Your profile — while your account is open, and for 12 months after you last used it, so you can come back without starting again. After that we delete or de-identify it.
• Identity and right-to-work documents — until they expire or are replaced, and no more than 12 months after your account closes.
• Booking records — 5 years, because they are records of work performed and payment agreed, and both sides may need them in a dispute. After your account closes these are de-identified where we can.
• Technical and audit logs — 12 months.

We keep information longer only where a law requires it or where it is needed for a live dispute.

9. Who else sees your information

• Our hosting provider, which stores the site and its database on servers in South Africa.
• Google Analytics, which we use to understand how people move through the site. This sends limited technical information to servers outside South Africa, including in the United States. We have turned off advertising features, advertising profiles and ad personalisation, and your IP address is anonymised. We do not send Google your name, number, documents or profile.
• Our email provider, to deliver notices to you.

This is a cross-border transfer under section 72 of POPIA. We rely on the safeguards offered by these providers and we keep what leaves South Africa to the technical minimum. We do not sell your personal information to anybody, and we do not share your profile with recruiters or other marketplaces.

10. Cookies and analytics

We use a cookie to keep you signed in, which the site cannot work without. Google Analytics sets cookies to count visits. Advertising and personalisation storage are switched off by default, before the tag loads.

11. How we protect it

The site runs over an encrypted connection. Passwords are stored hashed, never in plain text. Identity documents sit in a protected folder and are served only through authenticated links. Administrative access is limited, protected against repeated login attempts, and sits behind a firewall. Sensitive actions — opening a document, approving verification, placing a hold — are written to an audit log with the person and the time.

12. If something goes wrong

If personal information is accessed by someone who should not have it, section 22 of POPIA requires us to notify the Information Regulator and to notify you, as soon as reasonably possible after we establish what happened. We will tell you what was affected and what to do about it.

13. Your rights

Under POPIA you may:

• ask what personal information we hold about you, and get a copy;
• ask us to correct anything that is wrong or incomplete;
• ask us to delete information we no longer have a reason to keep;
• object to us using your information in a particular way;
• withdraw your consent, which means closing your profile;
• ask for a human to review any automatic decision, as set out in section 7;
• complain to us, and to the Information Regulator.

Write to hello@nextshift.co.za and we will respond within 30 days. We will not charge you and we will not treat you differently for asking.

14. Marketing

We will send you messages about shifts, bookings and your account because that is what you signed up for. We will only send you marketing that is not about your own work if you have asked for it, and every such message will let you stop it.

15. Complaining to the Information Regulator

If you are not satisfied with how we have handled your information, you can complain to the Information Regulator of South Africa:

• Complaints are lodged through the Regulator's eServices portal at eservices.inforegulator.org.za
• General enquiries: enquiries@inforegulator.org.za
• Toll free 0800 017 160, or 010 023 5200

16. Changes

If we change how we use your information in a way that affects you, we will tell you on the site and, where it matters, by message. The date at the top shows when this notice last changed.