Privacy Policy

RotaTeam is scheduling software for small businesses. This policy explains what we do with personal data — both the accounts of the managers who use RotaTeam, and the staff records they put into it.

Who we are

RotaTeam is operated by [LEGAL ENTITY NAME], [COMPANY NUMBER IF ANY], of [REGISTERED ADDRESS], United Kingdom. For questions about this policy or your data, contact [PRIVACY EMAIL].

The two kinds of people in RotaTeam, and why it matters

There is an important distinction that decides who is responsible for what.

Managers who sign up are our customers. We decide what to do with their account data, which makes us the controller of it.

Their staff never sign up and never agree to anything with us. Their employer puts their details into RotaTeam and decides what happens to them. For that data the employer is the controller and we are only the processor — we hold it and act on their instructions, and we do not use it for our own purposes. If you are an employee and want your records changed or removed, ask your employer; they can do it in RotaTeam, and we will help them if needed.

What we collect

From managers, to run their account: name, email address, business name, and an encrypted form of their password. We never store the password itself.

From managers, about their staff: name, job role, hourly pay, contracted and target weekly hours, availability, skills, holiday and shift requests, clock-in and clock-out times, punctuality records, and any notes the manager adds about which people should not be scheduled together.

Pay, punctuality and any note about keeping people apart are sensitive in practice even where the law does not class them as special category data. They are visible to whoever the business gives access to RotaTeam.

Automatically: the technical information any website receives — IP address, browser type, and the pages requested — used to keep the service running and to stop abuse. [ADD ANY ANALYTICS YOU ACTUALLY USE, OR SAY YOU USE NONE.]

Artificial intelligence

RotaTeam uses OpenAI to turn what a manager types into a schedule. When a rota is generated or edited, the business's staffing details — roles, hours, availability, pay and the manager's instructions — are sent to OpenAI to produce the plan. Staff names are included so the resulting rota is usable.

We use OpenAI's API, where data sent through it is not used to train their models. [CONFIRM THIS AGAINST YOUR CURRENT OPENAI AGREEMENT AND UPDATE IF IT CHANGES.] OpenAI processes data outside the UK; see “Where data is held” below.

No decision affecting anyone's employment is made automatically. RotaTeam proposes a rota; a manager reviews it and chooses whether to publish it.

Why we are allowed to hold it

For manager accounts, we rely on contract — we cannot provide the service without them — and legitimate interests for keeping the service secure and working.

For staff records, the employer decides the lawful basis. It is usually their legitimate interest in running a rota, or performance of the employment contract. We act on their instructions.

Where data is held

Accounts and business data are stored in a Postgres database hosted by Supabase in [REGION — CHOOSE UK OR EU]. The application runs on Vercel. AI processing is carried out by OpenAI, which involves transfers outside the UK; these rely on the UK International Data Transfer Addendum and the providers' standard contractual clauses.

How long we keep it

Business data is kept for as long as the account is open. If an account is closed, we delete its data within [30] days, except anything we must keep by law. A manager can delete individual staff records at any time.

Who else sees it

We do not sell personal data and we do not share it for advertising. It is shared only with the suppliers who make the service work — currently Supabase (hosting and database), Vercel (hosting) and OpenAI (rota generation) — and with anyone we are legally required to disclose it to.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, object to how we use it, or ask us to restrict it. Write to [PRIVACY EMAIL] and we will respond within one month. If you are an employee of a business using RotaTeam, please ask your employer first, as they control your records.

If you think we have handled your data badly, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you told us first so we can put it right.

Security

Data is encrypted in transit and at rest. Access is separated at the database level so one business cannot read another's data. Passwords are hashed and never visible to us. No system is perfectly secure, and we will tell affected customers and the ICO without undue delay if a breach puts anyone at risk.

Changes

If we change this policy in a way that matters, we will email account holders rather than quietly updating the date at the top.