1. Who we are
Rotabee Ltd ("Rotabee", "we") runs the Rotabee website and app. For your own account details, we are the data controller.
For your staff's details, you (the business) are the controller and we are your processor: we only use that data to run Rotabee for you, under the data processing terms in section 8.
Questions about privacy go to hello@rotabee.example, and we reply within 5 working days.
2. What we collect
From you, the account owner:
- Name, email address, phone number and business name
- Business sites, opening hours and the staff roles you set up
- Billing details: Stripe holds your card, and we only see the card brand, the last 4 digits and the expiry date
- Messages you send us, and notes from demo calls
About your staff, entered by you or by them in the app:
- Name, mobile number or email, and job role
- Shifts, availability, holiday requests and shift swaps
- Hourly rate, if you choose to track labour cost (only you and the managers you choose can see it)
Automatically, when anyone uses the site or app:
- Device type, browser, IP address and pages visited, kept for security and to fix errors
- One essential cookie that keeps you signed in. We don't use advertising or tracking cookies.
3. Why we use it
- To run your account and send rotas, reminders and swap requests to your staff (contract)
- To take payment and send receipts (contract and legal obligation)
- To keep the service secure and fix problems (legitimate interest)
- To answer your questions and run demo calls (legitimate interest)
- To send product news, only if you opt in, and you can opt out in one click (consent)
We never sell personal data, and we never use your staff's data to market to them.
5. Where it's stored
Data is stored in the European Union (Frankfurt and Dublin). When a provider handles data outside the UK or EU, we use the standard contractual clauses approved by the UK and the EU.
6. How long we keep it
- Account and rota data: while your account is open, plus 30 days after you close it, so you can change your mind
- Invoices and payment records: 6 years, because tax law requires it
- Security logs: 90 days
- Contact form messages: 2 years, unless you become a customer
After that, the data is deleted from our systems and from backups within a further 35 days.
7. Your rights
You can ask us to:
- Give you a copy of your data (we send a CSV within 30 days)
- Correct anything that's wrong
- Delete your data, unless we must keep it by law
- Stop or limit how we use it
- Move it to another service
Email hello@rotabee.example with your request. If you're unhappy with our answer, you can complain to the Information Commissioner's Office (ico.org.uk).
Staff members who want to use these rights should usually ask their employer first. If they come to us, we pass the request on to the employer.
8. Staff data: our promises to you
When we process your staff's data for you, we:
- Only use it to run Rotabee for you
- Make sure everyone at Rotabee who can see it is bound by confidentiality
- Tell you within 48 hours if we learn of a breach that affects it
- Help you answer your staff's requests about their data
- Delete or return it when you close your account
9. Security
- All traffic is encrypted (HTTPS), and data is encrypted at rest
- Staff at Rotabee only get access to customer data when they need it for support, and every access is logged
- Passwords are hashed, and two-factor sign-in is available for every account
- We test our backups every month
10. Children
Rotabee is for businesses. Staff under 16 can only be added by their employer, and their details are used only to manage their shifts.
11. Changes to this policy
If we change this policy in a way that affects you, we email account owners at least 30 days before the change takes effect. Earlier versions are available on request.