Privacy Policy

Who we are

Rotaline is provided by Ease IT (“we”, “us”).

There are two relationships, and the law treats them differently:

• Businesses who sign up, and the people who log in for them. For their account details we decide how Rotaline works, so we are the controller.
• The team a business puts on its rota. The business decides whose details go in and why, so it is the controller and we process that data for it as its processor. If you work for a business that uses Rotaline, ask that business first about your data.

What we hold

For businesses and their logins

• Business name and settings, and each login’s name, email and password (stored only as a secure hash).
• Sign-in and security records: when someone signs in, signs up or changes a password we record the email used, the IP address and the browser, to protect accounts. These are deleted after 90 days.
• An activity log of changes made in the business’s account, which the business can see.

For people on a rota (held for the business)

• Name, job title, a photo if one is added, and optionally email and phone.
• Shifts, positions, locations, contracted hours and, if the owner adds them, hourly pay rates. Pay rates are only shown to the business’s owner.

Why, and on what basis

• To provide the service a business has signed up for (contract).
• To keep accounts and the service secure, and to prevent abuse (legitimate interests).
• To keep records the law requires of us (legal obligation).

We never sell personal data and never use it for advertising.

Who else handles it

We use a small number of providers to run Rotaline, each only on our instructions and under a written agreement: hosting (Vercel), the database, and email delivery (Resend) for invitations and password resets. Some may process data outside the UK, protected by the UK’s approved safeguards.

Cookies

Only the ones needed to work: one that keeps you signed in, and one that remembers light or dark mode. No tracking or advertising cookies.

How long we keep it

Business data is kept while the account is open. When a business closes its account we delete its data within 90 days, unless the law requires us to keep something longer. Security records go after 90 days.

Your rights

You can ask for a copy of your data, to have it corrected or deleted, to object to or restrict how it is used, and to move it elsewhere. For your own login, email hello@ease-it.co.uk. For details a business holds about you as a member of its team, ask the business; we’ll help it answer.

If you’re unhappy with how we handle your data you can complain to the Information Commissioner’s Office at ico.org.uk.