We use account and organisation information to provide Rota Generator. Organisations control the workforce information they add. We do not sell workforce data or use it for advertising. Stripe handles card details, and security providers such as Cloudflare help protect forms from abuse.
1. Who we are
Rota Generator is a trading name operated by Malik Shaban, a sole trader in the United Kingdom. For personal information that Rota Generator determines how and why to use, Malik Shaban trading as Rota Generator is the data controller.
- Business correspondence address
- 192A, Stapelton Road, Easton, Bristol, United Kingdom
- Privacy contact
- [email protected]
2. When we are a controller and when we are a processor
We are generally a controller for information needed to run Rota Generator itself, including account registration, authentication, billing administration, support, security, service communications and our own legal records.
We are generally a processor when an organisation uses Rota Generator to store or manage information about its employees, workers, volunteers or other team members. In that situation, the organisation normally decides why the workforce information is used and is responsible for its own lawful basis, notices and employment or data-protection obligations.
The controller-processor terms required for customer organisations are included in the Data processing terms within our Terms of Service. There is no separate agreement to sign during normal self-service signup.
3. Personal information we may handle
Some information is provided directly by you. Other information may be entered by an organisation owner, manager or administrator, generated as you use the service, or received from providers that help us deliver a feature.
4. Why we use personal information
| Purpose | Typical lawful basis when we are controller |
|---|---|
| Create and operate accounts, authenticate users and provide requested product features. | Performance of a contract or steps requested before entering one. |
| Manage paid subscriptions, billing status and service-related communications. | Contract and, where relevant, legal obligations. |
| Protect accounts, prevent abuse, investigate incidents and keep the service reliable. | Legitimate interests in securing and operating the service; legal obligations where applicable. |
| Respond to support, contact and privacy requests. | Contract, legitimate interests and legal obligations depending on the request. |
| Maintain records needed for accounting, disputes, compliance and legal claims. | Legal obligations and legitimate interests. |
| Improve product usability using service feedback and operational information. | Legitimate interests, provided those interests are not overridden by individual rights. |
We do not currently use Rota Generator account or workforce data for behavioural advertising. If we introduce optional marketing or non-essential analytics that requires consent, we will ask for it where required.
5. Workforce data and health-related information
Rota Generator includes leave types such as “Sick”. A sickness label, a free-text leave note or similar information can reveal information about a person's health. Health data receives additional protection under UK data-protection law.
Rota Generator is a scheduling tool, not a medical-record system. Organisations should avoid storing diagnoses, medical documents or detailed health histories in free-text fields unless they have independently established that doing so is necessary and lawful.
Where an organisation enters health-related or other special-category information, the organisation is responsible for identifying an appropriate UK GDPR Article 6 lawful basis and, where required, an Article 9 condition. Rota Generator processes that information on the organisation's documented instructions under the data-processing terms in our Terms of Service.
6. Who we share information with
We use a small number of providers to run the service. We share only the information reasonably required for their role.
We may also disclose information if required by law, to respond to a valid legal process, to protect users or the service, or as part of a genuine business transfer where appropriate safeguards apply.
Customer organisations give general authorisation for the service providers needed to deliver Rota Generator, subject to the data-processing terms in our Terms.
7. International transfers
Some service providers operate internationally. This means personal information may be processed in countries outside the United Kingdom. Where UK data-protection law requires safeguards for a restricted transfer, we take steps appropriate to the provider and transfer, which may include relying on UK adequacy regulations or recognised contractual safeguards.
You can contact us if you need more information about the transfer safeguards relevant to your organisation's use of Rota Generator.
8. How long we keep information
We keep personal information only for as long as reasonably necessary for the purpose for which it is held, taking account of account status, legal requirements, security needs and the need to resolve disputes.
- Active account and organisation data: normally kept while the relevant account or organisation remains active and the data is needed to provide the service.
- Billing and transaction records: kept for the period needed for accounting, tax, fraud prevention and legal record-keeping obligations.
- Support and security records: kept for as long as reasonably needed to resolve the issue, protect the service, establish legal claims or meet legal requirements.
- Deleted or closed customer data: removed from active use following a valid deletion/termination request, subject to legal retention requirements and technically necessary backup rotation. Residual backup copies remain protected and are not restored for ordinary use.
Because different categories have different legal and operational requirements, we use retention criteria rather than pretending that every record has the same deletion date.
9. How we protect information
We use technical and organisational measures appropriate to the service, including account authentication, password hashing, email verification, role-based permissions, organisation-level data separation, audit logging, rate limiting, bot protection, secure-token links and HTTPS in production.
Payment-card details are handled through Stripe's hosted payment environment rather than stored by Rota Generator. No online service can promise absolute security, so we also maintain processes for responding to suspected incidents. More information is available on our Security page.
10. Your data-protection rights
Depending on the circumstances and lawful basis, you may have rights to request access to your personal information, correction, erasure, restriction, portability or to object to certain processing. Where processing relies on consent, you can withdraw that consent without affecting earlier lawful processing.
If your request relates to workforce information entered by your employer or another organisation, that organisation is usually the controller. You should normally contact them first. We will provide reasonable assistance to the organisation where our processor obligations require it.
To make a request about information for which Rota Generator is controller, email [email protected]. We may need to verify your identity before acting on a request.
Where we rely on legitimate interests, you can object to processing that relates to your particular situation. You can also object at any time to direct marketing if we ever send it.
You also have the right to complain to the UK Information Commissioner's Office (ICO). We would appreciate the opportunity to address your concern first, but you are not required to contact us before approaching the ICO.
11. Automated decision-making
Rota Generator can calculate scheduling conflicts, totals and suitability indicators, and may rank potential cover options using scheduling information. These features support a human manager's decision. Rota Generator does not use this functionality to make solely automated decisions that produce legal or similarly significant effects about employees.
12. Changes to this notice and how to contact us
We may update this notice when the service, providers or legal requirements change. Material changes will be highlighted on the service or communicated to account owners where appropriate. The version and effective date at the top show when this notice was last materially updated.
Privacy questions can be sent to [email protected] or by post to 192A, Stapelton Road, Easton, Bristol, United Kingdom.