Privacy Policy
Last updated July 2026
This policy explains what personal data Rotasmith (“we”) processes when you use the service, why, and the rights you have. It is written for a UK audience and follows the UK GDPR and Data Protection Act 2018.
Who is the controller
For your account and the people you invite, your employer is the data controller and Rotasmith is the data processor acting on their instructions. For our own marketing and billing records, Rotasmith is the controller.
What we collect
- Identity & contact: name, work email, role, team, manager.
- Leave data: requests, dates, working patterns, balances, approvals, notes you add.
- Special-category data: sickness absence is health data. It is visible only to HR-role users in your organisation and is never shown to line managers.
- Technical: sign-in sessions and minimal server logs for security and reliability.
Legal basis
We process leave data to perform the contract with your employer and for their legitimate interest in managing staff leave. Sickness (health) data is processed for employment-law obligations under Article 9(2)(b) UK GDPR.
Cookies
We use a single, essential sign-in cookie. We do not use advertising or third-party tracking cookies, and analytics are collected without cookies.
Sub-processors & data location
We use a small number of infrastructure providers (hosting, database, transactional email) to run the service. Data is hosted in the UK/EU. A current list is available on request and in the Data Processing Agreement.
Retention
Your organisation controls retention and can set a retention period in Settings. On request we delete or anonymise personal data.
Your rights
You can request access, correction, export, or erasure of your personal data. HR admins can export all organisation data and erase an individual from within the app. To exercise a right, contact your HR team or email us at the address below.
Contact
Email: privacy@rotasmith.example — replace with your real contact address.