ShiftCare — Cookie Policy (UK)

Appendix A

ShiftCare — Cookie Policy (UK)

Effective date: 12 September 2025
Owner: Data Protection Officer
Scope: All ShiftCare UK websites, web apps and mobile apps operated by ShiftCare group companies for UK users.

A1. Purpose of this policy

This Cookie Policy explains how ShiftCare uses cookies and similar technologies (collectively “cookies”) and how you can control them. It should be read together with our Privacy Notice.

A2. Who we are

For UK visitors, the controller for cookies set on our marketing properties is ShiftCare UK Ltd (company number TBC, registered office TBC). Until registration completes, ShiftCare group entities act as controllers as described in the Privacy Notice.

A3. What cookies are

Cookies are small text files stored on your device when you visit a site or use an app. We also use SDKs, pixels and local storage which function similarly.

A4. Types of cookies we use

• Strictly necessary (essential) — required for security, network management, authentication, load-balancing and core functions. These do not require consent under PECR.
• Performance/analytics — help us understand usage and improve our services (e.g. page performance, feature adoption). Set only with your consent.
• Functionality — remember choices (e.g. language, region) and improve your experience. Set only with your consent where non-essential.
• Advertising/marketing — measure campaigns and deliver relevant content. Used on our marketing sites only, and set only with your consent.

A5. Legal basis

• We rely on legitimate interests for strictly necessary cookies.
• We rely on your consent for all non-essential cookies. You can withdraw consent at any time (see A6).

A6. Managing your preferences

• Use the cookie banner to accept, reject or fine-tune categories. You can update choices any time via the “Cookie settings” link in the footer of our sites/apps.
• You can also control cookies via your browser settings. Blocking some cookies may impact core functionality.
• Non-essential cookies (such as analytics, functionality, and advertising cookies) will not be set on your device unless and until you provide your consent through the cookie banner or settings.

A7. Cookies we use

The exact cookies may vary over time and by region. A live, authoritative list is available via the cookie banner.

Provider: ShiftCare (first-party)
Typical purpose: Session management, auth, load balancing (e.g., session, csrf_token)
Category: Strictly necessary
Example retention: Session to 12 months

Provider: Tag manager/analytics platform
Typical purpose: Measure usage and improve content (event counts, device/browser stats)
Category: Performance/analytics
Example retention: 1–24 months

Provider: Payment processor (e.g., tokenised checkout)
Typical purpose: Remember payment session/token, fraud prevention
Category: Strictly necessary
Example retention: Session to 12 months

Provider: Customer support/chat
Typical purpose: Identify returning visitors for support and product tours
Category: Functionality/analytics
Example retention: 1–24 months

Note: Some third-party cookies are set only when you use related features (for example, starting a chat or opening a billing page).

A8. Third parties and international transfers

Some providers are located outside the UK. Where required, we use the UK IDTA/UK Addendum or the UK-US Data Bridge (for certified US recipients) and take additional safeguards. See the Privacy Notice for details.

A9. Changes to this policy

We may update this policy to reflect changes to cookies or applicable law. We will post the latest version on our website and indicate the effective date above.

A10. Contact

Questions about cookies? Email privacy@shiftcare.com or dpo@shiftcare.com. For your data rights, see the Privacy Notice.