Data processing agreement

Rotamate is a product of Automation Bureau, a company registered in England and Wales, number 17479795 · Last updated 27 October 2026

Required by UK GDPR Article 28 wherever one organisation processes personal data on another's behalf. It forms part of the terms of service and applies to every company using Rotamate.

1. The parties and their roles

• Controller: the company using Rotamate ("you").
• Processor: Automation Bureau, registered in England and Wales, company number 17479795, of 17 Navigation Road, B38 9EF ("we"). Rotamate is a product of Automation Bureau rather than a company in its own right, so there is no further entity in this chain and no intra-group transfer of your data.

You decide what personal data goes into Rotamate and why. We process it only to provide Rotamate to you.

2. Subject matter, duration, nature and purpose

Subject matter: providing a staff rota, availability, scheduling and pay estimation system. Duration: for as long as you are a customer, plus the deletion period in clause 9. Nature and purpose: hosting, storing, organising, displaying and backing up the data you enter, and sending the notifications you configure.

3. Types of personal data

Names; mobile numbers; email addresses; dates of birth; photographs; on-site grade and job roles; availability responses; shift assignments, hours and mileage; pay rates and estimated pay; stand-down records; free-text notes you write; and the names and contact details of your own clients.

4. Categories of data subject

Your staff and crew, your rota managers, and contacts at your client organisations.

No special category data. Rotamate has no field for health, ethnicity, religion, union membership, biometrics or anything else under Article 9, and none should be entered into free-text notes.

5. Our obligations

• Process personal data only on your documented instructions. Your use of Rotamate is those instructions; anything else we would ask you about first. If we were ever required by law to process it otherwise, we would tell you first unless the law forbade it.
• Ensure everyone with access is under a duty of confidentiality.
• Keep the security measures in clause 6.
• Not engage another processor without the notice in clause 7.
• Help you respond to data-subject requests — see clause 8.
• Help you with security, breach notification and impact assessments, given what we know.
• Delete or return the data as you choose at the end — clause 9.
• Make available what you reasonably need to verify this, and allow audits on reasonable notice.

6. Security measures

Specific, because "appropriate technical and organisational measures" on its own tells you nothing:

• All traffic over HTTPS; HSTS on our own domain.
• Each company's data separated at the database level, with every query scoped to one company, and an automated test suite that asserts one company cannot read, change or delete another's records.
• Passwords hashed (PBKDF2); sign-in and join-code attempts rate-limited per address and per account.
• Photographs served only to an authenticated member of the same company — never from a public URL.
• A content security policy, secure cookies, and no third-party scripts, analytics or trackers of any kind.
• Daily integrity-checked backups, retained 14 deep, restore-tested.
• An audit log of sensitive actions, recording actor and subject but never credentials, tokens, photographs or phone numbers.
• Hosting on unprivileged, memory-capped containers in AWS London (eu-west-2).

One limitation stated plainly rather than buried: personal sign-in links are long-lived bearer tokens. Anyone holding one can sign in as that person. They are rate-limited, HTTPS-only and resettable per person in one tap, and suspending a company invalidates all of them at once — but they do not expire on their own. Treat them as credentials.

7. Sub-processors

You consent to these, each engaged under written terms no less protective than this agreement:

Your own email provider and, if connected, SumUp are engaged by you, not by us.

We will give at least 30 days' notice before adding or replacing a sub-processor. If you object on reasonable data-protection grounds you may cancel without penalty and receive a refund for any period not used.

8. Data subject requests

If one of your staff contacts us directly we will tell them to come to you, and tell you it happened, rather than acting on it ourselves. We will help you answer within the statutory month: we can produce a structured export of everything held about one person, and carry out erasure as set out in the retention policy. There is no charge for a reasonable number of these.

9. Deletion and return

At any time, and at the end, you can have a complete export. When you tell us you are finished we delete your data within 90 days, or sooner on request, with backups rolling off within the following 14 cycles. A lapsed licence is not the end: it makes Rotamate read-only and deletes nothing.

10. Personal data breaches

We will notify you without undue delay and within 24 hours of becoming aware of a breach affecting your data, with what we know, what we are doing, and what it means for you. Your 72-hour duty to the ICO is yours as controller; we will give you what you need to meet it.

11. International transfers

Your data is stored in the UK and we do not transfer it outside the UK. If that ever needed to change we would tell you first and put an appropriate transfer mechanism in place.

12. Liability and law

The liability provisions in the terms of service apply. This agreement is governed by the law of England and Wales.

Questions about any of this: info@automationbureau.co.uk, or write to 17 Navigation Road, B38 9EF.