Data protection and processing terms
For care homes and care agencies ยท Last updated 8 October 2026
When you use Rota System to manage your workers, you are responsible for their information and we process it on your behalf. This page explains how we do that. Part B forms the data processing agreement required by Article 28 of the UK GDPR, and is part of our Terms of Service, which you accept when you register.
Part A: In summary
| Your role | Controller of your workers' information: you decide what is recorded and why. |
|---|---|
| Our role | Processor: we store and process it only to provide Rota System to you. |
| Where it's held | to be confirmed |
| Who else can see it | Nobody outside your organisation, apart from our support team when you ask for help (and that access is logged). |
| Breaches | We'll tell you without undue delay, aiming for within 48 hours of becoming aware. |
| Retention | Former workers' records are anonymised after the period you set in Settings (1 to 6 years). |
| When you leave | Export what you need, then we delete your data within 90 days. |
What you're responsible for
- Having a lawful basis for recording your workers' information, and telling them about it in your own privacy notice.
- Keeping it accurate, and only recording what you need.
- Your own legal duties as an employer and care provider. Rota System helps you track documents and plan shifts, but checks such as right to work, the content of DBS certificates and safe staffing levels remain your responsibility.
- Keeping your login secure and turning on two-step verification.
One thing we do as a controller
Care workers often work for more than one organisation. To stop a worker being booked at two places at once, and to warn about too little rest, we compare the times of their shifts across all their employers. You only ever see "unavailable" or a warning, never which other organisation the worker works for or where. We decide how this check works, so we are responsible for it, as explained in our privacy notice.
Part B: Processing terms
These terms are between you (the controller) and Rota System (the processor). If they conflict with the Terms of Service on data protection, these terms apply. We will:
- Follow your instructions. Process personal data only on your documented instructions, which are your use of Rota System and these terms, unless the law requires otherwise. If we think an instruction breaks data protection law, we'll tell you.
- Keep it confidential. Make sure anyone we authorise to access the data is bound by confidentiality.
- Keep it secure. Maintain appropriate technical and organisational measures, including those listed below.
- Use sub-processors carefully. Only use the sub-processors listed below. We'll give you at least 30 days' notice by email of any new one, so you can object. Each is bound by data protection terms at least as protective as these, and we remain responsible for them.
- Help with workers' rights. Help you respond to requests from workers exercising their rights, and pass on any request we receive directly.
- Help with your obligations. Help you with security, breach notification, data protection impact assessments and consultation with the ICO, taking into account the information available to us.
- Report breaches. Tell you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations.
- Delete or return it. At the end of the service, delete or return the data as described below, unless the law requires us to keep it.
- Show we're complying. Make available the information you reasonably need to show these obligations are met, and allow and contribute to reasonable audits, with reasonable notice and at most once a year unless there's been a breach.
- Protect transfers. Not transfer the data outside the UK without appropriate safeguards under UK law.
The processing
| Subject matter | Providing the Rota System shift rota service. |
|---|---|
| Duration | For as long as you use Rota System, then until deletion as described below. |
| Nature and purpose | Storing and displaying worker, document and shift information; allocating shifts and checking clashes and rest; sending notifications and invitations; producing reports; enforcing compliance rules you set. |
| People | Your care workers, including people you've invited who haven't yet joined. |
| Information | Name, email address, worker code, job title; shift dates, times and places; ID document type, number and dates; DBS certificate number and dates; Care Certificate standards and dates; other certificates you record; status (green, amber, red); and a log of changes. No special category data is required, and the outcome or content of DBS checks is never stored. |
Security measures
- Each organisation's information is separated at the database level, and every page and report only ever reads the signed-in organisation's records.
- Passport, driving licence and DBS numbers are encrypted at rest. Duplicate checks use a keyed fingerprint, so the number never has to be decrypted to compare it.
- Passwords are hashed; invitation links are single-use, expire after 24 hours, and only a fingerprint of them is stored.
- Accounts lock for 15 minutes after 5 failed logins. Two-step verification is available for every account.
- All traffic is encrypted with HTTPS.
- Changes to shifts and documents are recorded in an audit log, with old and new values (document numbers masked). Shifts that have started can't be changed.
- Support access to an organisation's account is recorded in the audit log.
- Backups are taken regularly and kept for to be confirmed.
Sub-processors
| Provider | What they do | Location |
|---|---|---|
| SmarterASP.NET | Hosting the application and database | to be confirmed |
| Google (Gmail) | Sending invitation, notification and invoice emails | to be confirmed |
When you leave
Before closing your account, you can download your rota and reports as CSV or PDF from Reports. After the account closes, we delete your organisation's data within 90 days, except invoices, which we must keep for 6 years. A care worker who also works for another organisation keeps their login, but the information you recorded about them is deleted.
Questions
Email hello@rotasystem.co.uk. We're happy to complete supplier questionnaires and provide a signed copy of these terms on request.