Data retention policy
Rotamate is a product of Automation Bureau, a company registered in England and Wales, number 17479795 · Last updated 27 October 2026
How long things are kept, and what happens when someone asks to be removed. This describes what the software actually does today — not an intention.
While a company is a customer
| What | Kept for | Why |
|---|---|---|
| Staff profiles, availability replies, shifts, hours, miles and pay figures | As long as the company is a customer, then as below | It is the company's operating record and its evidence of who worked when |
| Client and booking records | Same | The company's own business record |
| Photographs | Until the person is removed or the photo is replaced | Identifying crew on site |
| Audit log entries (who approved, graded or stood someone down) | Same as the account | Accountability for sensitive actions |
| Sign-in attempt records used for rate limiting | Swept regularly; days, not months | Brute-force protection only |
| Backups | The most recent 14 | Recovery. A deletion reaches backups as they roll off. |
When someone leaves the company
Leaving a job does not delete a work record, and it should not: the company has its own obligations, including keeping pay records for several years. So a leaver is marked inactive and stops appearing in rotas, and their history stays as the company's record.
If they ask to be erased, see below.
When someone asks to be erased
We act within one month. By default erasure anonymises rather than deletes:
- Removed: name, mobile number, email address, date of birth, photograph (the file itself, not just the reference), any notes held about them, their personal pay rate, their sign-in link and their login.
- Kept: the shifts themselves, as the work of an unidentified former staff member, with no way to tell who they were.
This is deliberate. UK GDPR's right to erasure does not override the company's legal reasons to keep a pay and work record, and deleting the shifts would damage records the company is required to hold. If there is genuinely nothing to keep — a signup made in error, someone who never worked a shift — everything is removed outright instead, and we will do that on request.
Erasure does not reach backups immediately. Backups are not used for anything but recovery, and the erasure is reapplied if one is ever restored.
When a company stops being a customer
Nothing is deleted when a licence lapses. Rotamate becomes read-only and everything stays exactly where it is, so no one loses a record over an unpaid invoice.
When a company tells us it is leaving for good, we provide a full export and then delete their data within 90 days, unless they ask us to delete it sooner — which we will do straight away. Backups containing it roll off within the following 14 cycles.
How a request is actually carried out
By a person, using a tool built for it, not by hand in a database. Subject access produces a structured file of everything held about one person; erasure performs exactly the list above and is recorded in the audit log. We mention this because a retention policy that the software cannot carry out is not a policy, and this one can be carried out.
Questions about any of this: info@automationbureau.co.uk, or write to 17 Navigation Road, B38 9EF.