RotaHero

Data Processing Agreement

Effective date: 20 October 2026 · Incorporated by reference into the Terms of Service

1. Parties and roles

This DPA forms part of the agreement between Amber Fox Labs Ltd, the company that provides RotaHero ("RotaHero", the "Processor"), and the Customer (the "Controller"). For the personal data of the Customer's staff entered into the service, the Customer is the controller and RotaHero is the processor under UK GDPR Article 28. For the account data of the Customer's owner and invited managers (their sign-in, security and account records), RotaHero is itself the controller; that processing is described in the Privacy Policy, not in this DPA.

RotaHero also acts as an independent controller, not as the Customer's processor, for the limited data it needs to keep the service secure and working: security counters, sign-in and security records, server logs and error reports. These can include incidental details of the Customer's staff. RotaHero uses that data only for security and to run and fix the service, as described in the Privacy Policy.

2. Subject matter, duration, nature and purpose

RotaHero hosts, stores, transmits, backs up, archives and displays staff scheduling data so the Customer can plan rotas, publish schedules, manage absence and leave, and record hours worked. This includes sending the notification emails the Customer turns on, keeping the Customer's statutory records and copying them into the records archive (section 10A). Processing lasts for the duration of the Customer's account and ends with its deletion (section 10).

3. Categories of data subjects and personal data

Data subjects: the Customer's staff (employees and workers), and the Customer's own managers where they appear in change history.

Personal data processed on the Customer's behalf, by category with examples. Which categories are processed depends on the features the Customer uses.

  • Identity and contact: name; email address (for the staff portal and rota emails); an optional payroll reference; for staff the Customer says are under 21, a date of birth, used only for the age-based working-time and minimum-wage rules. Only managers the Customer allows can see the full date of birth.
  • Scheduling: shifts, availability, weekly hours, roles, tags, day notes, published rotas, and whether a staff member has seen or acknowledged a published shift.
  • Working-time details: the school-leaving date and the dates of a 48-hour weekly opt-out, used for the working-time rules.
  • Hours worked: the hours a manager records each week, with breaks, corrections and their reasons, staff queries, and whether the staff member agreed.
  • Pay (optional): hourly rate or annual salary and its history, for labour-cost reporting and payroll exports. Only managers the Customer allows can see pay.
  • Absence and leave: absence dates and a reason chosen from a fixed list, with no free text, and leave allowances.
  • Staff portal activity: requests such as time off, shift claims, swaps and availability, answers to shift offers, and the manager's decisions.
  • Leaving: the leaving date and the Customer's answer to whether the person ever worked or was paid.
  • Certifications: qualifications the Customer chooses to record, such as a licence with its reference number and expiry date.
  • Change history: what changed in a record, when, and who changed it.
  • Access records: staff-portal links and when each was last used.

Not collected: the service does not ask for national identity numbers, home addresses or biometric data.

Special categories: the service does not ask for special-category data. Absence reasons are a fixed list so that no free-text health detail is entered, but some reasons (for example sickness) reveal something about health. The Customer treats those records as health data, relies on its own condition for processing them, and keeps any policy document the law requires. The Customer instructs its managers not to enter such detail in free-text fields such as notes, names and tags.

4. Instructions

RotaHero processes this data only on the Customer's documented instructions, namely to provide the service as the Customer configures it, including the records archive described in section 10A, unless the law requires otherwise. In that case RotaHero informs the Customer, unless the law forbids it. RotaHero tells the Customer if, in its opinion, an instruction infringes data protection law.

The staff notice. RotaHero supplies a short staff privacy notice, filled in from the Customer's account. Staff cannot be added until the Customer's account owner confirms that staff have been given the current version; RotaHero records who confirmed, when and which version. Staff can read the notice in the staff portal. The notice is the Customer's, as controller: the Customer decides its purposes, lawful bases and retention, and is responsible for what it says.

5. Confidentiality

Everyone authorised to process the data is bound by confidentiality. RotaHero staff access customer data only as support or incident resolution requires. They sign in to a Customer's account only to give support the Customer asked for, or to investigate a fault or security incident affecting it. Each such sign-in is time-limited and recorded, and every change made during it is recorded under the staff member's own identity. These records are kept for 12 months and are deleted with the Customer's account.

6. Security (Art. 32)

RotaHero protects the data against unauthorised access, loss and alteration. The main measures in force are:

  • Two-step sign-in for every owner and manager, and a fresh check before sensitive changes and downloads.
  • Encryption of data in transit and at rest, including backups and the records archive.
  • Passwords and access tokens stored only in protected, one-way form.
  • Each Customer's data kept apart from every other Customer's, on every path in and out.
  • Access within the Customer's account limited by the permissions the Customer sets.
  • Limits on sign-in attempts and on other actions that could be abused.
  • The copy of the data on a manager's device wiped at sign-out.
  • Staff-portal access ended for staff who leave, and a tool for the Customer to anonymise an individual.
  • Retention limits applied automatically by a daily job (section 10A and the Privacy Policy).
  • A change history of edits to the data.
  • Daily encrypted backups, kept about 30 days, with a documented restore procedure.
  • Records archive files sealed with checksums, so any alteration would show.

A fuller description is available to the Customer on reasonable request (section 11).

7. Sub-processors

The Customer gives general authorisation to the sub-processors listed at /legal/subprocessors.html: Cloudflare (hosting, database, backups and the records archive), Resend (email), Sentry (error monitoring) and Google (RotaHero's business email). RotaHero also uses Cloudflare's security counters and server logs, and Sentry's error reports, for the security and technical data it controls (section 1). RotaHero gives at least 30 days' email notice before adding a sub-processor. The Customer may object on reasonable data-protection grounds and, if no solution is found, may terminate and export its data. RotaHero passes the same data protection obligations on to each sub-processor and remains fully liable to the Customer for the performance of each sub-processor's obligations. The limits on liability in the Terms apply to that liability as they apply to RotaHero's own.

8. International transfers

The database, its backups and the records archive are stored at rest in the European Union, under Cloudflare's EU data jurisdiction. Requests are handled at the Cloudflare location nearest the user; temporary processing copies, and the security counters and server logs (kept 7 days) that RotaHero controls (section 1), may be handled elsewhere on Cloudflare's network, including in the United States. Emails are sent through Resend and stored by it in the United States. Error reports are stored in Sentry's EU (Germany) region. RotaHero's mailboxes (Google Workspace) are stored in Europe, with support access possible from outside Europe. Data sent to the EEA relies on the UK's adequacy regulations for the EEA. Each other transfer outside the UK is protected by the sub-processor's data processing agreement: standard contractual clauses with the UK International Data Transfer Addendum or, where the sub-processor is certified, the UK Extension to the EU-US Data Privacy Framework. The sub-processor page names the safeguard for each.

9. Assistance

  • Data-subject rights (Arts. 15 to 22): the product provides the tools: a self-service export of all of the Customer's data, correction in the app, anonymisation of an individual, and account deletion. RotaHero refers requests it receives directly from the Customer's staff to the Customer, and helps the Customer on request.
  • Breach notification (Arts. 33 and 34): RotaHero notifies the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data, with the information the Customer needs for its own assessment (the nature of the breach, the data and people concerned, the likely consequences and the measures taken).
  • DPIAs (Arts. 35 and 36): RotaHero gives reasonable assistance and makes its processing records available.

10. Deletion and return

  • Return. The Customer can export all of its data at any time, in a machine-readable format. This export is how RotaHero returns the data.
  • When the service ends. When the service ends for any reason, the account becomes read-only: 7 days after a trial ends without the Customer continuing, at the end of the paid period when a subscription is cancelled, or 14 days after a payment is missed and not made good. If RotaHero terminates for breach, it may close access at once and gives the account owner the export on request before deleting the data. While read-only, the Customer can still sign in, view and export everything, but not make changes. The data is kept until the Customer deletes the account, or until RotaHero deletes it after giving the account owner at least 30 days' notice by email.
  • The Customer's choice. The Customer chooses whether RotaHero returns the data, by the export, before deleting it, or deletes it without return. If it makes no choice, the export stays available until deletion. On request, RotaHero confirms deletion in writing.
  • Deletion. When the account is deleted, RotaHero removes the Customer's data from the live service at once. Copies in backups and in the records archive are deleted within about 30 days. Copies held by sub-processors expire on their own schedules, as set out in the Privacy Policy. RotaHero deletes existing copies unless the law requires them to be kept.
  • The Customer's own duty. RotaHero keeps no records for the Customer after deletion. Keeping the records the law requires an employer to keep (for example working-time, holiday and minimum-wage records) after that is the Customer's responsibility, using the export.

10A. Records kept while the account runs, and the records archive

  • Statutory records (such as shifts, absences, staff records, decided time-off requests, leave allowances, hours worked, published rotas, pay rates and their change history) are kept while the account exists. A record deleted in the app is kept, marked deleted, as evidence.
  • Staff who leave are kept, with portal access ended, normally until 6 years and 2 months after they leave, so the Customer can show what they worked and were paid. Changes to pay rates are kept at least 6 years. A person can be deleted permanently only if the Customer's owner confirms they never worked or were paid; nothing is deleted automatically on the leaving date.
  • The records archive. For each location with a pay period set, once a pay period is settled and its correction window has passed, RotaHero copies its statutory records into a sealed file in Cloudflare's storage under its EU data jurisdiction. The archive does not lock or delete anything in the live service; a later correction is kept as a new version beside the earlier one. Each file is kept for 6 years from the later of when its records were made and the end of the pay period that follows, or for 7 years from the end of its own pay period if that is later, and is then deleted. It is deleted sooner with the account (section 10).

11. Audit

RotaHero gives the Customer the information needed to show it meets this DPA, first by answering written questions and providing documents (such as this DPA, the sub-processor list and a description of its security measures). An inspection by the Customer, or by an auditor it appoints, is allowed only if that information is not enough, on 30 days' written notice, at the Customer's cost, and no more than once a year unless a regulator requires it or after a personal data breach.

12. Liability and precedence

Liability under this DPA is subject to the limitations in the Terms of Service. If this DPA conflicts with the Terms, this DPA prevails on data protection.

13. Contact

Data protection: privacy@rotahero.com · help: support@rotahero.com · Amber Fox Labs Ltd, 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ