Data processing agreement

Last updated 1 October 2026

In short

Your company decides what happens to your workers' data. In data protection law you are the controller.
RotaProof stores and processes that data for you, only to provide the service. We are the processor.
We keep it secure, only use the companies listed in Annex 3, tell you quickly about any breach, help you with requests, and delete the data when you leave.

The rest of this page is the formal agreement. If anything in the summary and the agreement differ, the agreement applies.

1. Who this agreement is between

This agreement is between:

Design Plus Media Limited (company number 06584138), of 75 Spring Hill, Kingswood, Bristol, BS15 1XW, which runs RotaProof (“we”, “us”, the processor); and
the business that has a RotaProof account (“you”, the customer, the controller).

It forms part of our terms of service and applies automatically whenever you use RotaProof. You don't need to sign it separately. If you'd like a signed copy for your records, email hello@rotaproof.co.uk.

2. Words used in this agreement

Data protection law means the UK GDPR, the Data Protection Act 2018 and any other UK law about personal data that applies.
Customer data means personal data that you or your users put into RotaProof, or that RotaProof records for you (such as clock-in times), which we process for you.
Personal data, processing, controller, processor, data subject and personal data breach have the meanings given in the UK GDPR.
Sub-processor means another company we use that processes customer data.

3. What we process and why

The subject matter, duration, nature and purpose of the processing, the types of personal data and the people it's about are set out in Annex 1.

This agreement doesn't cover personal data we decide about ourselves, such as your users' login details used to run their accounts, billing information or our sales contacts. Our privacy notice covers those.

4. We only act on your instructions

We process customer data only on your documented instructions. Your instructions are:

these terms and this agreement;
how you and your users set up and use RotaProof, including the records you add, change and delete; and
any other reasonable instructions you give us in writing, for example by email.

The only exception is if UK law requires us to process the data in another way. If that happens, we'll tell you first, unless the law forbids it.

If we think an instruction breaks data protection law, we'll tell you straight away. We don't have to follow that instruction until it's been clarified.

5. Confidentiality

Only people who need access to provide or support RotaProof can reach customer data. Everyone who can is bound by a duty of confidentiality, either in their contract or by law. Our admin staff only open your records when that's needed to run the service, fix a problem or help you, and those actions are logged.

6. Security

We use appropriate technical and organisational measures to protect customer data, as required by Article 32 of the UK GDPR. The measures in place today are listed in Annex 2. We may change them over time, but we won't make them less protective overall.

7. Other companies we use (sub-processors)

You give us general permission to use the sub-processors listed in Annex 3.
We'll give at least 14 days' notice before adding or replacing a sub-processor, by updating Annex 3 on this page and emailing your company's admins.
If you have a reasonable data protection objection to a change, tell us within those 14 days. We'll try to find a solution. If we can't, you can close your account before the change takes effect, without any penalty, and we'll refund anything you've paid for time you won't use.
Each sub-processor is bound by a written contract with data protection duties that give at least the same protection as this agreement.
We remain responsible to you for what our sub-processors do.

8. Where data goes

Customer data is stored on a server in the UK. Our current sub-processors are in the UK or the European Economic Area, which the UK recognises as giving adequate protection for personal data. We won't transfer customer data to any other country unless the transfer meets the requirements of data protection law, for example with the UK International Data Transfer Agreement or Addendum in place, and we'll tell you before we do.

9. Helping with requests from individuals

Workers and other people have rights over their data, such as the right to see a copy of it or have it corrected. As the controller, you decide how to answer those requests. We will:

pass on any request we receive about customer data to you within 5 working days, and not answer it ourselves unless you ask us to;
help you answer requests, as far as we reasonably can. Most of the time you can do this yourself in RotaProof, for example by downloading a worker's inspection pack or correcting their details. Your admins can also delete a worker's records in RotaProof.

10. Helping you meet your other duties

Taking into account what we do and the information we have, we'll help you with:

keeping customer data secure;
dealing with a personal data breach, including telling the Information Commissioner's Office (ICO) and the people affected;
data protection impact assessments about your use of RotaProof; and
any consultation with the ICO that follows one.

If the help you need goes well beyond what's normal, we may ask you to cover our reasonable costs. We'll agree this with you first.

11. If something goes wrong (personal data breaches)

If we become aware of a personal data breach affecting customer data, we'll tell you without undue delay, and in any case within 48 hours. That gives you time to decide whether to report it to the ICO, which must normally happen within 72 hours.

We'll tell you as much of the following as we know, and send the rest as soon as we find it out:

what happened, and roughly how many people and records are affected, and which types;
who you can contact at RotaProof for more information;
the likely consequences; and
what we've done, or plan to do, to deal with it and reduce any harm.

We'll email your company's admins. Telling you about a breach doesn't mean we accept that we were at fault.

12. When you leave: getting your data back and deleting it

Before you close your account, you can download your records and documents at any time using the inspection pack download, or ask us for a copy.
When your account is closed, we delete customer data from RotaProof within 30 days.
Copies in our encrypted backups are deleted automatically as the backups expire, within a further 30 days.
We only keep customer data for longer if UK law requires us to, and it stays protected by this agreement while we do.

Remember that you may have to keep right-to-work records yourself: normally while someone works for you and for 2 years after they stop. Download what you need before you leave.

13. Showing we keep to this agreement

We'll give you the information you reasonably need to show that we meet our duties under this agreement and Article 28 of the UK GDPR.
Once a year, we'll answer a reasonable security questionnaire from you.
If that isn't enough, you can have an independent auditor check our compliance. Give us at least 30 days' notice. The auditor must agree to keep what they see confidential, the audit should take place during working hours and avoid disrupting the service or other customers' data, and you pay for it.
You can also audit sooner if the ICO requires it, or after a personal data breach affecting your data.

14. Your responsibilities

As the controller, you are responsible for:

having a lawful basis for the data you put into RotaProof and for the instructions you give us;
telling your workers how their data is used, including clock-in locations. We've written wording you can use;
keeping records accurate and deleting ones you no longer need;
not putting in special category data, such as health details, unless you really need to.

15. Liability

Each of our liability under this agreement is subject to the limits and exclusions in the terms of service. Nothing in this agreement limits either of us in a way that data protection law doesn't allow.

16. How long this agreement lasts

This agreement lasts for as long as we process customer data for you, including after your account closes until the deletion in section 12 is complete.

17. If documents disagree

If this agreement and the terms of service disagree about personal data, this agreement applies.

18. Changes

We may update this agreement, for example if the law changes. We'll give you at least 30 days' notice of any change that affects you, except changes the law requires sooner. Changes to the sub-processor list follow section 7.

19. Law

This agreement is governed by the law of England and Wales, and the courts of England and Wales can decide any dispute about it.

Contact

Data protection questions: Sam Brown, hello@rotaproof.co.uk.

Annex 1: Details of the processing

Subject matter	Providing RotaProof, an online service for keeping right-to-work records, rotas, clocking in and out and timesheets.
Duration	While you have an account, and until deletion is complete after it closes (section 12).
Nature of the processing	Hosting and storing data; encrypting documents; making backups; showing records to your users; working out check statuses, reminders and whether someone can be put on a shift; recording clock-in and clock-out times; producing inspection packs and payroll exports; on the Assured plan, working out hours worked over a reference period, logging shift changes and the notice given, working out cancellation pay, and showing shift and attendance information to the clients you choose through client portal links; sending account emails to your users.
Purpose	Helping you meet your duties under the rules on preventing illegal working and, on the Assured plan, under the Employment Rights Act 2025 on guaranteed hours and shift notice; and run your rotas, clocking in and timesheets.
People the data is about	Your employees Casual and zero-hours workers Self-employed subcontractors Workers supplied by agencies or apps and platforms Your managers and admins who use RotaProof Contacts at agencies and platforms you record Clients named against your sites, and clients you give a client portal link to
Types of personal data	Workers: name, type of worker, start and leaving dates, payroll number, agency or platform Right-to-work checks: check date and method, description of the document seen, share code, type of permission and when it ends, name of the person who did the check, checklist confirmations, notes Uploaded documents: copies of identity and immigration documents and check results. These usually show nationality, date of birth, a photograph and immigration status Sites and rotas: site names and addresses, client names, shift dates and times, who is on each shift Clocking in and out: clock-in and clock-out times, and, only if the cleaner allows it on their phone, their location at that moment (latitude, longitude, how accurate it was and the distance from the site) Timesheets: changes to hours, the reason given, who approved them and when Guaranteed hours and shift notice (Assured plan): guaranteed hours a week, hourly pay, hours worked each week, offers of guaranteed hours and the answers, changes to shifts with the notice given, cancellation pay due and whether it was paid, and notes Client portal (Assured plan): the client's name, which sites they can see, when their link was last opened. What the client sees is set out in our help centre: shift times, attendance, whether the cleaner's check is in order and, if you choose, the cleaner's first name, surname initial and clock-in times Agencies and platforms: names, contact details, notes Your users: the name of whoever recorded or changed each record (their login details are covered by our privacy notice)
Special category data	None is needed. Documents may reveal information such as a photograph or nationality, but RotaProof doesn't use it to identify people or make decisions about them. Don't add health or other special category details in notes.
Criminal offence data	None.
How long it's kept	You decide, by adding and deleting records. Everything is deleted when your account closes (section 12).

Annex 2: Security measures

These are the measures in place on 1 October 2026. There's more detail in plain English on our security page.

Logging in and access

RotaProof only works over an encrypted connection (HTTPS), and browsers are told never to use an unencrypted one (HSTS).
Passwords must be at least 12 characters and are stored scrambled (hashed), never as plain text.
Two-step login with an authenticator app is available to every user. RotaProof's own admin staff must use it, and must enter a code in each session before they can use the admin panel.
Wrong passwords are limited to 10 per account and 50 per network address every 15 minutes. Sign-ups, two-step codes, emails and downloads are limited too.
You're logged out after 8 hours, or after 2 hours without using RotaProof.
Every page and every file checks that it belongs to the logged-in user's company before anything is shown.
Your company's admins control who in your company has a login.

Documents and records

Uploaded documents are encrypted before they're stored (Fernet: AES encryption with a tamper check). On the server, the key is kept separately from the files. Backups contain both, so each backup is encrypted as a whole with a separate backup key that isn't stored with the copies.
Documents are only given to logged-in users from the company that owns them, as downloads.
Only PDF, JPG and PNG files up to 10 MB are accepted, each file is checked to be what it claims, and each company has a storage limit.
Each file gets a SHA-256 fingerprint when it's uploaded, so inspection packs can show it hasn't been changed.
A saved right-to-work check can't be edited, so the history stays a true record.
When RotaProof admin staff change a record or open a document to help a customer, it's logged with who did it and when.
The website sends security headers, including a content security policy, to reduce the risk of attacks through the browser.

Backups

Everything is backed up every night, encrypted (GPG), and kept for 14 days.
Every week a backup is automatically restored to prove it works.
An encrypted copy of each backup is kept for 30 days with a different hosting company. That company can't open it: the backup key is kept separately and isn't stored with the copies.

The server

The server is in the UK. Remote access needs a security key; password logins are switched off.
Security updates are applied to the server.
A security review of the code and the server, with an end-to-end test of the live site, was carried out on 14 September 2026, and the issues it found were fixed.
An independent external vulnerability scan of the website and server was carried out on 15 September 2026. It found no high-risk issues, and the website findings it raised were fixed.
Work towards Cyber Essentials certification is in progress.

What isn't in place yet

RotaProof hasn't yet had a penetration test by an outside firm.
It doesn't yet hold a certification such as Cyber Essentials or ISO 27001.

We'll update this annex as these change.

Annex 3: Sub-processors

These companies process customer data for us.

Company	What they do for us	What data	Where
Contabo GmbH	Hosts the server RotaProof runs on	All customer data	Server in Portsmouth, UK (company based in Germany)
OVH SAS	Stores the off-site copy of our backups	Encrypted backup files only. They can't open them	France
Brevo SAS	Sends account emails, such as email confirmation, password resets and trial reminders	The recipient's email address and the content of the email	France (EU)
Unity Tech (unity-tech.co.uk)	Hosts our email inboxes, including hello@rotaproof.co.uk, and sends our sales emails	Anything people include in emails they send us; the business contact details of companies we email about RotaProof	UK

Cloudflare provides the domain name service (DNS) for rotaproof.co.uk only. Website traffic doesn't pass through Cloudflare, so it doesn't see customer data.

Changes to this list

15 September 2026: list first published.
1 October 2026: Unity Tech replaces Namesco Ltd for our email inboxes, and also sends our sales emails.