Privacy Policy — Shift / ALGT

1. Introduction

A Liusie General Trading LLC (“ALGT,” “we,” “us,” or “our”) is committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, process, and protect your personal data when you interact with our services, visit our facilities, use our websites, work for us, apply to work with us, or engage with our brands including ELC Toys and The Entertainer.

ALGT operates from Plot C22, International Media Production Zone, Dubai, United Arab Emirates, and serves customers across the Middle East region including the UAE, Qatar, Saudi Arabia, Oman, Bahrain, and Kuwait.

This policy complies with UAE Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data, the Executive Regulations issued under it, and other applicable data protection regulations in the jurisdictions where we operate.

Who this policy applies to

This policy covers the personal data of:

Customers and members of the public who shop in our stores or online
Suppliers, vendors, contractors, and business partners
Website and digital service users
Job applicants and candidates
Employees, workers, and former employees

2. Information We Collect

2.1 Customer, Supplier, and Website User Information

We may collect the following types of personal information:

Contact Information:

Full name
Email address
Phone numbers
Mailing address
Emirate and nationality

Business Information:

Company name and details
Job title and department
Business contact information
Professional relationship with ALGT

Transaction Information:

Purchase history
Payment information
Billing and shipping addresses
Product preferences

Digital Information:

Website usage data
IP address and device information
Browser type and operating system
Cookies and tracking technologies

Communication Records:

Customer service interactions
Email correspondence
Survey responses and feedback
Marketing communications preferences

2.2 Employee, Worker, and Job Applicant Information

Where you apply to work with us or are employed or engaged by us, we collect and process personal data necessary to manage the recruitment process and the employment relationship. This may include:

Identity and Contact Information:

Full name, date of birth, and gender
Passport, Emirates ID, and visa or residency details
Nationality and immigration status
Home address, personal email, and telephone numbers
Emergency contact and next-of-kin details
Photographs for identification and access purposes

Recruitment Information:

CV, application form, and cover letter
Qualifications, references, and employment history
Interview notes and assessment results
Right-to-work and visa eligibility documentation

Employment and Payroll Information:

Job title, department, store location, and reporting line
Contract of employment and terms and conditions
Salary, allowances, bank account, and payment records
Working hours, attendance, leave, and absence records
Performance reviews, training, and disciplinary records
End-of-service and gratuity calculations

Workplace and Systems Information:

System login, access, and device usage records
CCTV and store security footage
Records held in operational systems used to manage stores and staff

2.3 Special Category and Sensitive Information

In limited circumstances, and only where permitted or required by law, we may process more sensitive information such as health and medical information (for sickness absence, fitness to work, insurance, and workplace adjustments), and information relating to workplace incidents or investigations. We apply additional safeguards to this information and access is restricted to those who need it.

2.4 Information Collection Methods

We collect information through:

Direct interactions (forms, applications, communications)
Website visits and online activities
Recruitment, onboarding, and employment processes
Third-party sources (business partners, vendors, recruitment agencies, references)
Public sources where legally permissible
Automated technologies (cookies, analytics tools)
Store security and monitoring systems (CCTV)

3. How We Use Your Information

3.1 Primary Purposes

We use your personal information for:

Business Operations:

Processing orders and transactions
Providing customer service and support
Managing supplier and vendor relationships
Conducting business communications

Service Delivery:

Product distribution and logistics
Warranty and after-sales service
Technical support and maintenance
Account management

Legal and Compliance:

Complying with UAE and regional laws
Meeting regulatory requirements
Conducting internal audits
Resolving disputes and legal proceedings

Marketing and Communications:

Sending promotional materials (with consent)
Market research and analysis
Product development
Managing communication preferences

3.2 Employment Purposes

Where you are a job applicant, employee, or worker, we use your information to:

Assess applications and manage recruitment and selection
Verify identity, right to work, and visa eligibility
Administer contracts, payroll, benefits, and end-of-service entitlements
Manage attendance, leave, scheduling, and store operations
Support training, performance management, and career development
Manage health, safety, and welfare at work
Conduct disciplinary, grievance, and investigation processes
Maintain security of premises, stock, and systems
Meet legal, regulatory, immigration, and tax obligations

3.3 Legal Basis for Processing

We only process personal data where we have a lawful basis to do so. Depending on the circumstances, this will be one or more of the following:

Performance of a contract with you, or to take steps before entering a contract
Compliance with a legal or regulatory obligation
Our legitimate business interests, where these are not overridden by your rights
Your consent, which you may withdraw at any time
Protection of vital interests in an emergency

4. CCTV and Workplace Monitoring

We operate CCTV cameras in till and customer areas of our stores, and at our facilities, where installed. CCTV is used for the safety of staff and customers, the prevention and detection of crime, and the protection of stock and property. Access to footage is restricted to authorised personnel, including authorised remote monitoring, and footage is retained for a limited period before secure deletion unless required for an investigation or legal proceedings.

Company IT equipment, systems, accounts, and internet access are provided for work purposes. As set out in our IT Equipment Policy, we may monitor their use to protect security, ensure appropriate use, and meet legal and regulatory obligations. Monitoring is proportionate, and staff are informed of it through this policy and related employment policies. We do not place CCTV in private areas such as changing or rest rooms.

About the Shift app (operational note)

The Shift staff & manager app is one of the operational systems referred to in sections 2.2 and 4. On ALGT's behalf it records:

Work scheduling and pay data — clock-in / clock-out times, the 6-digit PIN you use to sign in, holiday / sick / TOIL balances, and store checklists and logs.
Where you clock in: when you clock in, clock out, or undo a clock-out, the app asks your phone or till for its position. Breaks do not. It records the exact position (latitude and longitude), how accurate it was in metres, and a place name such as "Dubai Mall, Financial Centre Road". To get that place name, your phone or till sends the exact position to OpenStreetMap (see section 5), which also sees the device's internet address. Each shift keeps one position: clocking out replaces the clock-in position. If location is switched off or refused you can still clock in; the entry is marked "location denied" and no position is kept. The clock screen tells you that the app records where you clock in.
Who can see it: Head Office, for every store, and area managers, for the stores in their area, on the clock review screen. The staff app and store tills never show it. A manager can open the position on Google Maps; Google only receives it if they do.
How long: the exact position (latitude and longitude, its accuracy and the place name) is erased after 12 months; the clock times are kept, and so is the "location denied" mark. Your clock records themselves are kept for 7 years (section 8, payroll records). The app's backup copies of the database are kept for up to 13 months, so a position can remain in a backup for up to about two years before that backup is deleted. If a clock entry cannot be sent straight away (no signal), it waits on the device, position included, until it can.
Messages you send in the app — store, area, and company channels, and direct messages between stores or with Head Office. Head Office can read store and group channels. The app is not a private personal messenger. Message text, including direct messages, can be summarised by AI for Head Office and managers, without sender names (section 5).
Store email — mail sent to and from your store's address through the app's Email tab.
Virtual Store training game (v132.117): your scores, and how long you spend in the game (counted only while you are actively using it, after you have entered your PIN). The game's leaderboard shows them with your first name and surname initial. Guests' play is never recorded.
Things you choose to add — a profile photo, and reports or feedback you submit, including any screenshots you attach.
Video calls started from the app. Call rooms are generated for each call and the conversation itself is not recorded by the app.
Store-visit location — for area managers only, and only at the moment you submit a store-visit report. Your browser asks for permission first, and the report submits whether or not you allow it. The position is saved with the report and shown on it, with a map link, to Head Office, the area manager and the team at the store that was visited. It is kept with the report. No place name is looked up.
Customer survey location (v131.72) — on the public feedback site, if you tap 📍 Find my store and allow it. Your location is never sent to us. Your browser compares it to the list of shop addresses on your own device and selects the nearest one; all that is submitted is the store name, exactly as the dropdown submits it. Nothing is transmitted, stored or logged, so there is nothing for us to keep or disclose. You can ignore the button entirely and pick your store from the list.

This information is held within ALGT's systems and used to run rotas, pay, and compliance — it is governed by the policy on this page. The box under section 5 names the outside companies involved in providing it.

5. Data Sharing and Disclosure

We do not sell your personal data. We may share it with:

Group companies and franchise partners, including TEAL Group (The Entertainer), for legitimate business purposes
Service providers who process data on our behalf (for example payroll, IT, insurance, logistics, and banking partners), under written contracts
Government authorities, regulators, and law enforcement where required by law
Professional advisers such as lawyers, auditors, and insurers
Parties involved in a business sale, merger, or reorganisation

Where we use processors, we require them to keep personal data secure and to process it only on our documented instructions.

The companies behind the Shift app (operational note)

This box names the service providers referred to above, for the Shift staff & manager app specifically. It is an operational transparency note, not additional policy. These companies process data on ALGT's instructions only, and are listed here because they handle information about the staff who use the app.

Company	What it does for Shift
Supabase	Stores the app's database — rotas, clock-in and clock-out times and where they happened, holiday / sick / TOIL balances, checklists and store logs, messages, and store email.
Cloudflare	Runs the app's server. Every request you make in the app passes through it. It also keeps a backup copy of the database, and serves two code libraries some pages load (for spreadsheets in the managers app, and for the Virtual Store training game).
Netlify	Hosts the app's web pages (the screens themselves).
Anthropic (Claude)	Powers the app's AI features, including the advice and letter drafts for disciplinary and grievance cases and the summaries of exit interviews. Information included in those requests, including free text somebody has written about their manager or their store, is processed by Anthropic. Anthropic processes it on ALGT's behalf and does not use it to train its AI. The AI only ever advises — decisions are made by people. Each feature, and exactly what it sends, is listed under the table.
ElevenLabs	Turns text into the assistant's spoken voice, and turns a manager's spoken words into text, in the manager tools. Also gives Jack his voice in the Virtual Store training game, only when the player turns the voice on: the words sent are the game's own lines and Jack's answers, never anything about the player. It is not used on the staff clock-in screens.
Resend	Sends and receives the store email that appears in the app's Email tab. Also sends Shift's report emails, including the store overview, which goes only to the manager who asked for it and can include staff names. Other report emails to managers can name staff too (for example recognition in the weekly sales email, and leave and balance reminders). When you ask for leave in Shift, the request carries what ALGT's Leave Application Form asks for: the type of leave and dates, your reason for leave, contact numbers while you are on leave (your local number is filled in from your staff record), any air ticket request and the company property you will return. When your area manager gives it the OK, when HR approves or declines it, and when approved leave is cancelled, Shift emails this application, with your name, employee code, position and store, to ALGT's HR team and the area manager, so HR can approve it and record it. Your contact numbers, reason and property list are never shown on the shared store till. Head Office's replies to customers who asked for one go through it.
Jitsi Meet and 8x8	Provide the video calls that can be started from the app: the free Jitsi Meet service, or 8x8's paid service once it is set up. The call's sound and video pass through their servers, with the name shown in the call (your store's name, or your own name for a manager or a call started from Chat). On the free service the person who starts the call may be asked by Jitsi to sign in with a Google or Microsoft account. Calls are not recorded by the app.
Google, Apple, and Mozilla	Deliver push notifications to your device. Which one is used depends on the browser or phone you use — the app sends the notification to whichever service your device is registered with. The words of a notification (for example a colleague's name and the start of a message) are encrypted, so the push service cannot read them.
GitHub	When a manager sends a staff-submitted bug report to the developer, the wording of that report (what you were doing, what you expected and what happened) travels to GitHub as a development ticket, with system details: the store, country, screen, app version, date and the device's browser type. The name of the person who reported it is never sent (a name somebody typed into the report itself does travel), and screenshots attached to a report never leave ALGT's systems. Anthropic's Claude reads the ticket in GitHub to propose a fix.
OpenStreetMap (Nominatim)	Turns a clock-in position into a place name. When you clock in or out with location on, your phone or till sends the exact position to OpenStreetMap's free place-name service, which also sees the device's internet address. Nothing else about you is sent.
ELC Jack (ALGT's own assistant app)	A separate ALGT system, not an outside company. Questions you put to Ask Jack in Shift's Chat go to ELC Jack with your name, your store and your recent conversation with Jack; ELC Jack uses Anthropic to answer and keeps a log of questions and who asked them. The Jack tab opens ELC Jack inside Shift. Questions asked from the policy library and the Virtual Store game go without a name.
Google Fonts	Most Shift pages load their lettering from Google Fonts, so Google sees your device's internet address and browser type when a page opens. Nothing else is sent.
Google Places	Shift asks Google for each store's public Google review rating and count, using the store's Google listing number. Nothing about staff is sent.
QuickChart	Draws the charts in the weekly sales email. The store names and sales figures are written into the chart's web address, which the reader's email program fetches. No staff names.

The AI features, and what each one sends to Anthropic

Unless a feature below says otherwise, the request goes straight from Shift's server to Anthropic, and Shift does not keep what was sent.

Clock review (managers): looks for patterns in clock-in records. It sends the names of staff who were late or did not clock out, with the dates and how late, and the totals. The answer is shown on screen and not kept.
Leave and TOIL overview (Head Office and area managers): sends each person's first name, store, TOIL hours, and holiday and sick days left. Not kept.
AI rota drafting (whoever plans the rota): sends the store, the week, staff first names, days off, who is away and why (for example on holiday or off sick), the last three weeks' shift patterns, the manager's own notes, and the store's hours and trading figures. The draft only becomes the rota if a manager publishes it. The rota and checklist analysis buttons send store figures only, no names.
Chat digest and chat summary (Head Office): a weekly digest, when Head Office has switched it on, and a summary Head Office can ask for at any time. Each sends up to 400 recent messages from every channel, including direct messages: the first 200 characters of each message, the channel, and the store it came from (messages from Head Office or area managers are marked as such). Sender names are not sent, but a name written in a message is. The AI is told never to name anybody. The digest is emailed to a list of managers Head Office sets; the summary is shown on screen and not kept.
Weekly training: built from the policy library and Head Office's notes. Recent messages are counted inside Shift to choose a topic, but none of them is sent.
Disciplinary and grievance advice and letters (Head Office and area managers allowed to see the case): sends the case details (the name and store of the person the case is about, the type, stage and category, the incident date, the investigator, and the latest case notes), the question or letter being drafted, and the relevant disciplinary and grievance policies. Since 17/10/2026 this goes straight to Anthropic, not through ELC Jack. The question and the answer are saved on the case file, which follows the case file's own retention.
Exit interviews (Head Office): the answers, including free text and the reason for leaving, with the store, but never the leaver's name. A single summary is kept with the interview and deleted with it after 365 days.
Promotion advice (Head Office, and area managers for their own stores): sends the person's name, role and store, their attendance and lateness, leave counts including sick days, reviews (with reviewers' names), recognition and objectives, and the manager's questions. The conversation is not kept.
Head Office assistant (JACK): Head Office's own assistant reads Shift's reports when asked, for example rota problems (which can name staff who are double-booked, have no shifts, or have a negative allowance), staff still in induction, and area managers' compliance counts. Its overnight check saves short findings inside Shift.
Bug reports: when a staff member files a report, the AI may ask a clarifying question; it is sent what was typed, with the store, screen and app version. When Head Office asks the AI to investigate a report, it is sent the report with its store, screen, role, device and app version, but never the name of the person who filed it (a name somebody typed into the report itself does travel). If a report is sent to GitHub (see the table), Anthropic's Claude reads it there to propose a fix.
Customer comments (when Head Office has switched it on): summaries of customers' comments for managers, and a weekly check of the kind comments for staff praised by name, which awards a "Customer Service Heart" with the customer's words. Only the store, score and comment are sent, never a customer's contact details; a comment can name a member of staff.
Report emails and briefs: the weekly sales email's AI note (names and stores of staff who received hearts or stars, and store-visit details with the area manager's name), the monthly store-visit email (the area manager's name, ratings and comments), the daily store brief (the area manager's first name and the visit action plan), the area manager brief and the KPI summary (store figures and the store's own daily notes), and the tidying of a store's reply to a visit report (the reply text only).
Store and product summaries with no personal data: the Top 50 product review, the customer requests email (items customers asked for, with the store's own note), and the weekly toy news (a web search of news sites).
Scan photos (a product or shelf in a store bay) are sent to Anthropic to read the label and the pack, and are never stored by the app; staff are asked to point at products, not people.
For the store overview a manager can ask for before a store visit, Anthropic receives the store's numbers only (sales, percentages and counts), never anybody's name or anything somebody has written. Some counts are per person without a name (for example the most late clock-ins by one person), which in a small team could point to somebody.
Ask Jack goes to ELC Jack, ALGT's own assistant app (see the table), which uses Anthropic. Jack's weekly summary of the questions staff asked, tagged by store, is written by Anthropic and emailed to a list of managers Head Office sets.

These companies operate internationally, so personal data may be processed outside the UAE — section 6 above explains the safeguards that apply. Companies that never see staff data are deliberately not listed here; for example, the service that checks whether the app is online only tests public web addresses.

6. International Data Transfers

As a regional business operating across the GCC and working with international partners, your personal data may be transferred to and stored in countries outside the UAE. Where we transfer personal data internationally, we take steps to ensure an adequate level of protection in line with UAE Federal Decree-Law No. 45 of 2021, including appropriate contractual safeguards and, where required, your consent.

7. Data Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or disclosure. These include access controls, restricted system permissions, secure storage, staff confidentiality obligations, and ongoing review of our security practices. In the event of a personal data breach that poses a risk to individuals, we will notify the relevant authority and affected individuals in line with our legal obligations.

8. Data Retention

We keep personal data only for as long as necessary for the purposes set out in this policy, and to meet legal, regulatory, tax, and accounting requirements. When data is no longer needed, it is securely deleted or anonymised. The periods below reflect current UAE legal requirements and should be confirmed for Qatar and any other market in which we operate:

Data category	Typical retention period	Reason
Customer transaction and accounting records	Minimum 7 years	Corporate Tax Law (5 years under VAT Law)
Marketing contact data	Until consent is withdrawn	Consent-based
Unsuccessful job applicants	Up to 12 months	Recruitment and recordkeeping
Employee records (during employment)	Duration of employment	Managing the employment relationship
Employee records (after leaving)	At least 2 years after end of service	UAE Labour Law (Federal Decree-Law No. 33 of 2021)
Payroll and end-of-service records	Minimum 7 years	Corporate Tax, audit, and gratuity claims
CCTV footage	Limited period, then deleted	Security; retained longer only if needed for an investigation

Note: periods reflect current UAE law (employment records under Federal Decree-Law No. 33 of 2021; tax records under Federal Decree-Law No. 47 of 2022 and Federal Decree-Law No. 8 of 2017). Equivalent Qatar requirements should be confirmed. Where more than one rule applies to the same record, the longer period governs.

9. Your Privacy Rights

Subject to applicable law, you have the right to:

Be informed about how your personal data is used
Access the personal data we hold about you
Request correction of inaccurate or incomplete data
Request deletion of your data in certain circumstances
Restrict or object to certain processing
Request transfer of your data to another party where applicable
Withdraw consent at any time, where processing is based on consent
Lodge a complaint with the UAE Data Office

To exercise any of these rights, please contact us using the details below. We may need to verify your identity before responding. We will respond within the timeframes required by law. Note that some rights, particularly the right to deletion, are limited where we are required to retain data to meet legal, employment, tax, or contractual obligations.

10. Cookies and Tracking Technologies

Our websites and digital services use cookies and similar technologies to operate the site, remember your preferences, analyse usage, and support marketing. You can manage cookies through your browser settings. Disabling some cookies may affect how parts of our sites function. Non-essential cookies are used only with your consent.

11. Children's Privacy

As a retailer of toys and children's products through ELC and The Entertainer, we recognise our responsibility towards children. Our services are directed at parents, guardians, and adult customers. We do not knowingly collect personal data directly from children without parental or guardian consent. Where we become aware that we hold a child's data without an appropriate basis, we will delete it. Any data relating to children is handled with particular care and is not used for behavioural marketing.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. The latest version will be made available to customers and staff, and the Last Updated date at the top of this document will be revised. Material changes affecting employees will be communicated through our internal channels.

13. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your rights, or want to raise a concern about how we handle personal data, please contact us:

A Liusie General Trading LLC (ALGT)

Plot C22, International Media Production Zone, Dubai, United Arab Emirates
Data protection contact: info@algt-me.com

If you are not satisfied with our response, you have the right to contact the UAE Data Office.

14. Trademarks

A Liusie General Trading LLC (ALGT), Plot #IMPZ C.22, Dubai Production City, Dubai, UAE, operates The Entertainer and Early Learning Centre stores in the region, this website and the Shift staff app. ALGT is a franchisee of TEAL and uses these trademarks under licence.

All The Entertainer trademarks belong to The Entertainer (Amersham) Ltd, TEAL House, Anglo Office Park, 67 White Lion Road, Amersham, Buckinghamshire, HP7 9FB.
All Early Learning Centre trademarks belong to TEAL Brands Ltd, TEAL House, Anglo Office Park, 67 White Lion Road, Amersham, Buckinghamshire, HP7 9FB.

← Back