Privacy notice
Last updated 8 October 2026
This notice explains what personal information Rota System collects, why, how long we keep it, and the rights you have over it. It applies to visitors to this website, to the people who run care home and care agency accounts, and to care workers who use the app.
1. Who we are
Rota System is run by Rota System.
For anything about your personal information, email hello@rotasystem.co.uk. Our registration number with the Information Commissioner's Office (ICO) is to be confirmed.
2. Your employer's data and ours
Rota System holds two kinds of personal information, and who is responsible for it depends on which kind it is.
- Information about care workers that their employer records: your job title, your shifts, and the documents your employer records for you (ID, DBS and Care Certificate details). Your care home or care agency decides what is recorded and why, so they are the controller of it. We store and process it for them, as their processor, under the data processing terms. If you have a question or request about this information, please contact your employer first. If you contact us, we'll pass your request on to them.
- Everything else: your login account, the details of care home and agency accounts, invoices, notifications, messages you send us and the security records we keep. We are the controller of this information, and the rest of this notice is mainly about it.
3. What we collect
If you visit the website
We don't use analytics, advertising or tracking. Like any website, our hosting provider receives technical information when your browser requests a page, such as your IP address, browser type and the page requested, which it uses to deliver the page and protect the service.
If you run a care home or care agency account
- The organisation's name, postcode, billing address and CQC registration number (care homes).
- The contact person's name, email address and phone number, and the email address used for invoices.
- Your login details. Your password is stored only in a scrambled (hashed) form that can't be read back.
- Invoices, payments received and the number of active workers each month, which we bill on.
- A record of changes made to shifts and documents in your account (the audit log).
If you're a care worker
- Your name and email address, given to us by the employer who invited you, and your login details.
- Which care homes and agencies you work for, and the notifications we show you.
- The times of all your shifts, across all your employers, so we can stop you being booked at two places at once (see section 4).
- The information your employer records about you, as explained in section 2.
We don't ask for or store health information, and we don't store the content or result of DBS certificates, only the certificate number and dates your employer enters. Passport, driving licence and DBS numbers are stored encrypted.
If you contact us
Your name, contact details and what you tell us.
4. Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Provide the service: accounts, logins, rotas, notifications and support | Contract with the care home or agency; for care workers, our legitimate interest in providing the service their employer has chosen |
| Check each new care home or agency before approving it | Legitimate interests: keeping the service for genuine care providers |
| Check a worker's shift times across all their employers to stop overlapping bookings and warn about too little rest. Employers only see "unavailable" or a warning, never who else the worker works for or where. | Legitimate interests: the safety of care workers and the people they care for |
| Invoice organisations and keep accounting records | Contract, and legal obligation (tax and company law) |
| Keep the service secure: lockout after failed logins, two-step verification, audit logs | Legitimate interests: protecting accounts and the information in them |
| Reply to messages and requests | Legitimate interests, or contract where it concerns your account |
We don't sell personal information, use it for advertising, or make decisions about people by automated means that have legal or similarly significant effects.
5. Cookies
We only use cookies that are needed for the site to work, so we don't ask for consent. We don't use analytics, advertising or third-party cookies.
| Name | What it does | How long |
|---|---|---|
.AspNetCore.Identity.Application | Keeps you logged in | Until you log out or close the browser; 14 days if you choose "Keep me logged in" |
.AspNetCore.Antiforgery.* | Protects forms against forgery from other websites | Until you close the browser |
.AspNetCore.Mvc.CookieTempDataProvider | Shows a confirmation message after you save something | Until the next page |
rs-unread (browser session storage) | Remembers the number of unread notifications, so the bell can show when new ones arrive. Never sent to us. | Until you close the browser tab |
rota-static-* (app cache) | Keeps the app's design files and the "you're offline" page on your device, so it loads faster and works as an installed app. It never contains pages or personal information. | Until the app is updated or removed |
6. Who we share it with
- Your employer or organisation, as the service is designed to work. A care worker's employers never see each other's information about them.
- Service providers who run parts of the service for us, under contracts that require them to protect it: hosting (SmarterASP.NET, in to be confirmed) and email delivery (Google (Gmail)).
- Professional advisers, such as our accountant, and authorities where the law requires it.
- If our business were sold, the buyer, who would have to continue protecting it as this notice describes.
We aim to keep personal information in the UK. If any of it is processed outside the UK, we make sure it is protected to UK standards, for example by using countries the UK recognises as adequate or the UK's approved data transfer agreements.
7. How long we keep it
- Care home and agency accounts: while the account is open, then deleted within 90 days of closing, except invoices.
- Invoices and payment records: 6 years after the end of the financial year they relate to, as the law requires.
- A care worker's records with an employer: when the employer deactivates a worker, their shifts, documents and audit entries are kept for the period the employer chooses, up to 6 years, then anonymised.
- Care worker logins: while you work for at least one organisation using Rota System. If you no longer do, you can ask us to delete your account.
- Notifications: for as long as the account they belong to.
- Messages you send us: up to 2 years after we last hear from you.
8. Keeping it safe
Each organisation can only ever see its own information. Passport, driving licence and DBS numbers are encrypted, passwords are hashed, accounts lock after repeated failed logins, and all traffic uses HTTPS. Changes to shifts and documents are recorded in an audit log. If our support team ever needs to view an organisation's account to help with a problem, that access is also logged.
If a security incident affected your personal information and put you at high risk, we would tell you promptly, and the ICO where required.
9. Your rights
Under UK data protection law you can ask us to:
- give you a copy of the personal information we hold about you;
- correct information that's wrong or incomplete;
- delete information, where there's no good reason for us to keep it;
- restrict how we use it, or object to our using it on the basis of legitimate interests;
- give you information you provided in a format you can take elsewhere.
Email hello@rotasystem.co.uk. There's no charge, and we'll reply within one month. For information your employer records about you, they are responsible for answering, and we'll help them do so.
10. Concerns and complaints
Please tell us first and we'll try to put it right. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes to this notice
If we change this notice, we'll update the date at the top, and tell account holders about significant changes by email.