Privacy Policy
Last updated 27 October 2026
This policy explains what personal information Rotabase holds, why, who sees it, how long we keep it, and your rights.
1. Who we are
Rotabase is run by Rotabase Ltd, registered in England and Wales, company number 17543641.
- Registered office: 70 Bingham Road, Larkhill, Salisbury, SP4 8PQ
- Contact for privacy questions: support@rotabase.co
- ICO registration number: [add ZA/ZB number when it arrives]
We aren't required to appoint a Data Protection Officer. Aaron Murray, our director, is responsible for data protection.
Our two roles
- We decide how your data is used (we are the "controller") for your account, billing, security, support and our own records.
- A business decides how its staff data is used (it is the controller, and we are its "processor") for the records it keeps in Rotabase about its staff: shifts, timesheets, pay, invoices, reports, qualifications, right to work checks, reviews and messages. If you're a staff user, the business you work for is responsible for that data, and you can ask them about it too.
2. What we collect and why
| Information | Examples | Why we use it | Lawful basis |
|---|---|---|---|
| Account details | Name, email, password (scrambled), account type | To create your account and let you sign in | Contract |
| Profile | Photo, phone, bio, work preferences, availability, uniform sizes | So businesses you join can offer you work | Contract |
| Personal details | Date of birth, address, next of kin | For the businesses you join, to keep you safe and meet employer duties | Contract; the business's legal duties |
| Invoicing details | Trading name, UTR, bank sort code and account number | So your invoices to a business are correct and paid | Contract |
| Work records | Shifts, sign-in and out times, timesheets, mileage, invoices, rewards, reviews | To run rotas, pay and HR for the business | Contract; the business's legitimate interests |
| Reports | Incident, accident, near-miss and equipment reports, with your signature | To record what happened at work | The business's legal duties and legitimate interests |
| Messages and feed | Chats, posts, photos, comments | To let teams talk to each other | Contract |
| Documents | CV, qualifications and licences, ID and right to work copies | To check you can do the job and can work in the UK | The business's legal duties |
| Business and billing | Business name, contact details, plan, Stripe customer number, invoices | To provide and charge for a plan | Contract; our legal duties (tax records) |
| Trial records | A one-way scrambled code made from an HR email | To stop the same person taking more than one free trial | Our legitimate interests (preventing misuse) |
| Security and usage | Sign-in times, the HR log, device and browser details, IP address | To keep accounts safe and fix problems | Our legitimate interests |
| Support | Emails you send us | To answer you | Legitimate interests |
We don't sell your information. We don't use it for advertising, and we don't make automated decisions about you that have legal or similar effects.
3. Sensitive information
Some records need extra care, so we limit who can see them.
- Right to work and ID documents can show nationality and immigration status. Only HR at the business you joined can open them, every viewing is recorded in that business's HR log, and copies are kept in a private store.
- Accident and incident reports may include health details, such as an injury. Only you and HR at that business can read your reports.
- Bank details are hidden from HR until they choose to view them, and each viewing is recorded.
Businesses use this information to meet their legal duties as employers, for example right to work checks under immigration law, and health and safety records. We only process it for them, as their processor.
4. Who we share it with
Businesses you join. When a business approves you, its HR team can see what it needs to manage your work. Colleagues see only your public profile card, such as your name, photo, headline and badges. You can leave a business at any time.
Our suppliers. These companies help us run Rotabase. They may only use your data to provide their service to us.
| Supplier | What they do for us | Where |
|---|---|---|
| Supabase | Database, file storage and sign-in | UK (London) |
| Netlify | Hosts the Rotabase app | USA |
| Stripe | Takes card payments and stores card details | UK, EU and USA |
| Google Workspace | Our email | UK, EU and USA |
| Google Fonts and jsDelivr | Deliver fonts and app code to your browser, which shares your IP address | Worldwide |
| postcodes.io | Works out mileage from the postcodes you enter (postcodes only) | UK |
Where data leaves the UK, we rely on UK adequacy regulations or the UK International Data Transfer Addendum, as the law allows.
When the law requires. We may share information with the police, HMRC, the Home Office or a court where we're legally required to, or to protect someone's safety.
If Rotabase is sold. If another company takes over Rotabase, your information would pass to them under this policy, and we'd tell you first.
5. How long we keep it
| Information | How long |
|---|---|
| Your account and profile | Until you delete your account, then removed within 30 days |
| A business's records (shifts, timesheets, reports, invoices) | While the business is on Rotabase, including while read-only. Deleted within 30 days of the owner closing it |
| Right to work copies | Decided by the business. The law expects them for the whole time you work there plus 2 years |
| Billing and payment records | 6 years, for tax law |
| Trial records (scrambled email codes) | 3 years after the trial, to stop repeat trials. These can't be turned back into an email address |
| Security logs | Up to 12 months |
| Support emails | 2 years after the last message |
| Backups | Overwritten within 30 days |
When you delete your staff account, a business you worked for may keep its own copies of records it must keep by law, such as invoices you sent it.
6. Your rights
Under UK data protection law, you can ask to:
- see the information we hold about you, and get a copy
- correct anything wrong (much of it you can change yourself in your profile)
- delete your information (you can delete your account in Account settings)
- limit or object to how we use it, where we rely on legitimate interests
- move it to another service, in a common format
Email support@rotabase.co. We'll reply within one month, and it's free. For records a business keeps about you, we may pass your request to that business, as it is the controller, and help it reply.
Complaints. If you're unhappy, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
7. Security, cookies, children and changes
Security. Data is encrypted between your device and Rotabase. Each business's data is kept separate by database rules, so one business can't see another's. Passwords are stored scrambled. Sensitive files are kept in private storage and opened only through short-lived links. If a breach puts you at risk, we'll tell you and the ICO as the law requires.
Cookies and storage. Rotabase uses no advertising or tracking cookies. Your browser stores a sign-in token and small settings, such as which business you last opened, so the app works. Stripe uses its own cookies on its payment pages to prevent fraud.
Children. Staff accounts are for people aged 16 or over, and business accounts for 18 or over. If a business employs young workers, it is responsible for the extra care the law requires.
Changes to this policy. We'll tell you about important changes by email or in the app before they apply. The date at the top shows the latest version.
Contact. support@rotabase.co, or write to Rotabase Ltd at 70 Bingham Road, Larkhill, Salisbury, SP4 8PQ.