Privacy notice

Rotamate is a product of Automation Bureau, a company registered in England and Wales, number 17479795 · Last updated 27 October 2026

Who is responsible for what

Rotamate is used by catering and staffing companies to run their rotas. That makes two organisations responsible for different things:

• Your employer — the company whose join code you used — is the data controller. They decide what goes into Rotamate and why. If you want your details changed or removed, they are who to ask first.
• Automation Bureau is the data processor. Rotamate is its product, not a separate company, so Automation Bureau is the only organisation on this side of it. We built and run Rotamate and we act on your employer's instructions. We do not decide what to collect about you and we do not use it for anything of our own.

What is held about a staff member

• Name, mobile number and, if given, email address.
• Date of birth — used only to work out which minimum-wage band applies to you.
• Your photograph, if one has been added.
• What you can do: driver or not, the job roles you picked, your on-site grade.
• Your availability replies, the shifts you were booked on, the hours and miles you logged, and the pay those produce.
• If you stood down from a shift: that you did, and how much notice it carried.
• Notes your rota manager has written about you. You can ask to see these.

Clients of the company — the venues and customers it works for — have a name, contact details and booking history held in the same way.

What is never held

No bank details, no payroll numbers, no National Insurance numbers, no right-to-work documents, no location tracking, and nothing about you from anywhere else. Rotamate works out what you are owed; it does not pay you.

Cookies and tracking

Rotamate sets two cookies: one that keeps you signed in and one that protects forms from being submitted by another site. Both are strictly necessary, so there is no cookie banner to dismiss.

There is no analytics, no advertising, no tracking pixel and no third-party script of any kind — not on a single page. Nothing about your use of Rotamate is sent anywhere else, because there is nowhere else for it to go.

Who else can see it

Inside Rotamate, only your own company. Each company's data is separated at the database level and a staff member of one company cannot reach another's anything.

Outside Rotamate, these organisations are involved in running it:

• Amazon Web Services — the server and the database, hosted in London (eu-west-2). Your data does not leave the UK.
• Stripe — payments, but only your company's subscription to Rotamate. No staff member's details ever reach Stripe, and card details never touch Rotamate.
• Your company's own email provider, if they have connected one, which is how shift emails reach you.
• SumUp, if your company has connected it, for card takings.

We do not sell data, share it for advertising, or use it to train anything.

How it is protected

Everything travels over HTTPS. Passwords are stored hashed, never in a readable form. Photographs are not publicly reachable: every one is served only to someone signed in to the same company. Sign-in attempts are rate-limited. Sensitive actions — grade changes, approvals, someone being given manager access — are recorded with who did them.

One thing worth knowing plainly: your personal sign-in link is a key. Anyone holding that link can open your account, so treat it like a password and do not forward it. If it gets out, ask your rota manager to reset it — that takes one tap and the old link stops working immediately.

Your rights

You can ask for a copy of everything held about you, ask for it to be corrected, ask for it to be deleted, or object to how it is used. Ask your employer first, since they are the controller. If you would rather come to us, or they do not respond, write to info@automationbureau.co.uk and we will act within one month.

What happens on deletion, and what is kept and why, is set out in the retention policy.

If you are not satisfied you can complain to the Information Commissioner's Office at ico.org.uk, and you do not need our permission to do so.

Questions about any of this: info@automationbureau.co.uk, or write to 17 Navigation Road, B38 9EF.