Privacy Policy

Last updated: October 2026

Introduction

RotaRight ("we", "our", or "us") provides employee scheduling, payroll and workforce management services to businesses and their employees.

This Privacy Policy explains what information may be processed through RotaRight, how it is used, how it is protected, and your rights regarding your personal data.

For personal information provided by your employer or generated through your employment, your employer will generally be the data controller and RotaRight will process that information on your employer's behalf.

For certain information used to operate, secure, support and improve RotaRight, RotaRight may act as the data controller.

Information We Collect

Depending on how your employer uses RotaRight, we may process the following information.

Information may be provided directly by you, provided by your employer or organisation, or generated through your use of RotaRight.

Personal and employment information

• Name
• Email address
• Phone number
• Home address
• Date of birth
• Job role and employment information
• Assigned locations
• Groups or departments
• Shift schedules
• Availability and unavailability
• Leave requests
• Shift swaps and cover requests
• Payroll information
• Clock in/out history
• Account and authentication identifiers

Bank details

Where payroll features are used, your employer may store:

• Account holder name
• Bank name
• Sort code
• Account number

Bank details are stored securely and access is restricted to authorised users within your organisation.

Emergency contact information

Your employer may store:

• Emergency contact name
• Emergency contact phone number

Location data

If your employer enables location verification, RotaRight may collect your device's location only when you initiate a clock in or clock out.

Location information is used to verify the location of that clock-in or clock-out event.

RotaRight does not continuously track your location and does not access your location in the background.

Technical information

We may automatically collect or process:

• Device type
• Operating system
• App version
• Device or push notification tokens where notifications are enabled

How We Use Your Information

Information processed through RotaRight may be used to:

• Manage employee schedules and rotas
• Manage employee availability and shift requests
• Record attendance and hours worked
• Support payroll administration
• Verify clock-in/out location where enabled
• Send work-related emails and push notifications
• Maintain account security
• Diagnose technical problems
• Improve the reliability, performance and features of RotaRight

Legal Basis for Processing

Where RotaRight processes employee information on behalf of an organisation, the organisation is generally responsible for determining the appropriate legal basis for processing that information.

Depending on the circumstances, personal information may be processed because it is necessary for employment or contractual purposes, compliance with legal obligations, or legitimate business interests.

Where RotaRight acts as a data controller, we may process personal information where necessary to provide and operate the service, comply with legal obligations, or for legitimate interests such as maintaining the security and reliability of RotaRight, providing support, preventing misuse, and understanding and improving how the service performs. We consider these interests against the rights and interests of the people whose information is processed.

Sharing Information

We do not sell your personal information.

Information may be shared with:

• Your employer or organisation
• Authorised administrators and managers within your organisation
• Service providers that provide database hosting, authentication, email, notifications and other technical infrastructure necessary to operate RotaRight
• Professional advisers where necessary
• Legal or regulatory authorities where required by law

Service providers are only given access to information where necessary to provide their services.

International Data Transfers

Some of the service providers used to operate RotaRight may process information outside the United Kingdom.

Where personal information is transferred internationally, appropriate safeguards are used where required by applicable data protection law. Information about applicable safeguards can be requested by contacting us.

Data Security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration or loss.

Access to sensitive information, including bank details, is restricted to authorised users.

Data Retention

Personal information is generally retained for as long as your organisation requires it for employment, scheduling, payroll or other legitimate business purposes.

Your employer, as the organisation responsible for its employee information, may determine how long employment-related records need to be retained.

Certain information may also be retained where necessary to comply with legal, accounting, payroll, security or record-keeping requirements. Where RotaRight determines the retention period, information is kept only for as long as reasonably necessary for the purpose for which it is processed.

Your Rights

Depending on your location and the circumstances in which your information is processed, you may have rights to:

• Access your personal information
• Correct inaccurate information
• Request deletion of personal information
• Request a copy of your information
• Restrict or object to certain processing

Where your information is controlled by your employer, requests should normally be made through your employer or organisation administrator.

Where RotaRight is responsible for the processing, you can contact us at [email protected].

If you have concerns about how your personal information has been handled, you also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's data protection regulator.

Account Deletion

You may request deletion of your RotaRight account.

How to request deletion

Contact your organisation's administrator or email:

[email protected]

Please include enough information for us to identify the relevant account, such as:

• Your name
• Email address
• Organisation name

What may be deleted

Where appropriate, deletion may include:

• Login/account information
• Personal profile information
• Contact information
• Emergency contact details
• Bank details
• Device and push notification tokens

What may be retained

Deleting a RotaRight account does not necessarily mean that all employment records associated with that person can immediately be deleted.

Your organisation or RotaRight may need to retain certain information where there is a lawful or legitimate reason to do so, including:

• Payroll records
• Clock-in/out and attendance history
• Shift records
• Audit and activity records
• Records required for legal, accounting or employment purposes

Any retained information will only be kept for as long as reasonably necessary for those purposes.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time as RotaRight develops or where legal or regulatory requirements change.

The latest version will be made available through RotaRight or the RotaRight website.

Contact

If you have questions about this Privacy Policy or how personal information is handled, contact: