Privacy Policy

This policy explains what personal data Rotasmith (“we”) processes when you use the service, why, and the rights you have. It is written for a UK audience and follows the UK GDPR and Data Protection Act 2018.

Who is the controller

For your account and the people you invite, your employer is the data controller and Rotasmith is the data processor acting on their instructions. For our own marketing and billing records, Rotasmith is the controller.

What we collect

• Identity & contact: name, work email, role, team, manager.
• Leave data: requests, dates, working patterns, balances, approvals, notes you add.
• Rota and attendance data: the shifts you are scheduled for, the times you clock in and out, hours worked and overtime. Where your employer uses a shared clocking-in device, we hold a four-digit PIN for you, stored scrambled so nobody — including us — can read it back.
• Special-category data: sickness absence is health data. It is visible only to HR-role users in your organisation and is never shown to line managers.
• Technical: sign-in sessions and minimal server logs for security and reliability.

We do not use biometrics, location tracking or photographs to record attendance, and we never build a picture of where you are when you are not at work.

Legal basis

We process leave, rota and attendance data to perform the contract with your employer and for their legitimate interest in scheduling staff and paying them correctly. Sickness (health) data is processed for employment-law obligations under Article 9(2)(b) UK GDPR. Recording working time is also how your employer meets its obligations under the Working Time Regulations 1998.

Cookies

We use a single, essential sign-in cookie. We do not use advertising or third-party tracking cookies, and analytics are collected without cookies.

Sub-processors & data location

The application and database are hosted in London, and transactional email is sent from within the EU. We name every sub-processor we use, and the current list is in the Data Processing Agreement.

Retention

Your organisation controls retention and can set a retention period in Settings. On request we delete or anonymise personal data.

Your rights

You can request access, correction, export, or erasure of your personal data. HR admins can export all organisation data and erase an individual from within the app. To exercise a right, contact your HR team or email us at the address below.

Contact

Email mehceh3690@gmail.com. If you are not satisfied with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk.