Privacy policy
Version 2026-10-28.2, effective 28 October 2026.
Template draft: review before launch.
1. Who we are
[COMPANY LEGAL NAME] Ltd, trading as RotaRound, registered in England and Wales, runs rotaround.com and the RotaRound application. We are the controller of the personal data this policy describes, except where section 2 says otherwise.
For anything about personal data, including your rights, email [email protected].
2. Whose data this covers
- Visitors to rotaround.com, including people who use the contact form.
- Account holders: the businesses that use RotaRound and the people who sign in for them.
- Partners who share a RotaRound partner link.
- Companies we may contact. Our separate notice, How we use your details, covers them.
If you are a customer or team member of a business that uses RotaRound, that business holds your details and decides how they are used. It is the controller and we are its processor. To see, correct or delete your details, ask that business. If you write to us, we pass your request to it and help it answer.
3. What we collect, why, and our lawful basis
| Data | Whose | Why | Lawful basis |
|---|---|---|---|
| Your name, email address, optional phone number and business type, and your message, when you use the contact form | Visitors | Replying to you | Legitimate interests |
| Your help chat questions and our answers, the page you asked from, and your rating | Account holders | Answering your questions about the Service, and improving the help | Contract with you |
| Support requests: your message, your name, email and business name, the page you were on, any picture you add, and our replies | Account holders | Answering your request | Contract with you |
| Analytics: pages viewed, device type and approximate location | Visitors | Understanding how the site is used | Consent, given in the cookie banner |
| Your account: email address, password (stored so no one can read it), sign in codes, business details, trade and logo | Account holders | Running your account and keeping it secure | Contract with you |
| Records you enter about your customers, their properties, your agreements and your team | Your customers and team (we are the processor) | Providing the Service to you | Your instructions under our terms |
| Text you send to writing help when you ask for it | Your customers and team (we are the processor) | Making the suggestion you asked for | Your instructions under our terms |
| Emails the Service sends for you: who they go to and whether they were delivered | Your customers and team (we are the processor) | Sending the emails you set up | Your instructions under our terms |
| Email check and password reset links | Account holders | Checking your email address and helping you back into your account | Contract with you; legitimate interests (security) |
| A record of when you accepted our terms, and which version | Account holders | Showing what was agreed | Contract with you; legitimate interests (keeping records) |
| Payment records: the amount, the date and our payment provider's references | Account holders | Taking payments and keeping the records the law requires | Contract with you; legal obligation |
| The card on your account: its brand, last four digits, expiry and our payment provider's references for it. Never the card number | Account holders | Taking payments, showing which card pays, and preventing misuse (section 5) | Contract with you; legitimate interests (preventing fraud) |
| The link or page that brought you to sign up | Visitors and account holders | Understanding which pages and links bring people to RotaRound | Legitimate interests |
| A referral link or code you used | Account holders | Giving what the offer gives | Contract with you; legitimate interests (running the offer) |
| Information about your device, network and card, kept for sign up checks | Account holders | Preventing misuse of free offers (section 5) | Legitimate interests (preventing fraud) |
| Your marketing email choice, and each time it changed | Account holders | Sending product news only to people who asked for it | Consent, which you can withdraw at any time |
| Sign in records: the time and the network address | Account holders | Spotting and investigating unauthorised access | Legitimate interests (security) |
| The emails we send you, and who received them | Account holders | Knowing what we told you and when | Contract with you; legitimate interests (keeping records) |
| A record of actions on your account, with the time and network address | Account holders | Security, support and keeping records | Legitimate interests (security and keeping records) |
| Browsers you chose to be remembered on, and devices that asked for notifications | Account holders | Keeping your account secure and sending the notifications you asked for | Contract with you; legitimate interests (security) |
| Records of data requests and security incidents | Everyone | Handling them as the law requires | Legal obligation |
| A partner's name, contact name and email address, sign in times, acceptances, numbered sign ups, commissions and statements, our notes, and their own RotaRound account if they have one. No bank details | Partners | Running the partner agreement and paying the partner | Contract with the partner |
| Which source a sign up was credited to | Account holders | Giving one reward or commission for each sign up | Legitimate interests (running our offers) |
| Companies we may contact | Companies and their directors | Set out in How we use your details | Legitimate interests |
You must give the account details the sign up form asks for. Without them we cannot provide the Service.
4. Where your data comes from
- From you, when you use the site or the Service.
- From your device, through the cookies in our Cookie policy.
- From our payment provider, about your card and payments.
- From the business you work with, if you are its customer or team member (section 2).
- From public sources, for companies we may contact.
5. Checks to prevent misuse
Free months, codes, referral rewards and partner commissions have value, so we check sign ups for misuse, such as one business claiming an offer more than once. To do this we keep some information about the device, network and card used, and compare it with other accounts and with the account or partner whose link was used. We do this under our legitimate interest in preventing fraud, and use what we keep for these checks only.
Some checks are automatic. For example, a throwaway email address is refused at sign up, and an offer past its limit is refused. Others are decided by a person. You can object to these checks, or ask about a decision, by emailing [email protected].
6. Names we show to others
- If a business joins through your referral link and pays, we may tell you the name of the business that joined.
- If someone opens your referral link, the sign up page shows your business name to them.
- If someone opens a partner's link, the sign up page shows the partner's name.
- A partner sees only counts and numbered sign ups, never a business's name or details.
7. Who we share data with
We use service providers to run RotaRound. Each one handles personal data only on our instructions and under a written agreement.
| Type of service | What it does |
|---|---|
| Hosting | Runs the application and keeps its data |
| Network and security | Delivers and protects the website and the application |
| Email delivery | Sends the emails the Service sends, and receives replies |
| Payments | Takes card payments. You enter your card on our payment provider's own pages |
| Address lookup and maps | Finds an address from a postcode, and places it on a map |
| Push notifications | Delivers a notification to a device that asked for them (your browser's own service) |
| Writing assistance (AI) | The writing help and help chat in the Service, and help with our own writing (section 8) |
| Business email | Our own mailbox |
| Analytics | Website analytics, only with your consent |
| Review invitations | Invitations to review RotaRound, only to owners who agreed to marketing emails |
| Marketing services | Finding and checking business contact details, and posting our own updates, for our own marketing |
We may also share personal data with our professional advisers, with authorities when the law requires, and with anyone who takes over our business or part of it.
When you open a route or an address in a map from the Service, your own browser sends the address to the map you choose. We send nothing.
8. AI features
When you use a feature that uses AI, only the text that task needs is sent to our writing assistance provider: for the help chat, your question and the page you are on; for Write it for me, your notes and your trade; for the Import helper, part of the spreadsheet you upload. What comes back is a suggestion. Nothing is used until you choose to use it.
9. Outside the UK
Your records are kept in the European Union. Some providers handle data outside the UK. When they do, we use the safeguards UK law requires, such as UK adequacy regulations or the UK's approved transfer terms. Email [email protected] for details of the safeguards.
10. How long we keep data
| Data | How long |
|---|---|
| Contact messages | A message about signing up, your account or becoming a partner is kept as a support request (below). Others are kept for 24 months, then deleted |
| Help chat | 12 months from the chat's last message, then deleted. A count of questions by page is kept, with nothing about who asked |
| Support requests and replies | 2 years from the last message, then deleted |
| A picture sent with a support request | 6 months, then deleted; the request's words stay |
| Text you send to writing help | Not kept by us. Only the suggestion you choose to save is kept, as part of your records |
| A count of your uses of writing help and the help chat | 13 months, then deleted |
| Sign in records | 90 days, then kept only as a daily count |
| Sign up checks | 90 days, then deleted. The card information is kept with your card details while the card is on the account |
| Referrals, codes, free months and misuse decisions | While the account is open, and deleted with it |
| A partner's details, sign in records and acceptances | While the partner agreement runs, then deleted once nothing is owed. Sign in records: 30 days |
| A partner's commissions and statements | As long as UK tax law requires, then deleted |
| Emails we send you, and who received them | 6 years |
| Your Download history and the notifications in your account | 6 years from the day each was made, then deleted |
| Payment records | As long as UK tax law requires, then deleted |
| Records of actions on your account, data requests and security incidents | 6 years |
| Your account and the records in it | While the account is open. After it closes, 30 days in which you can restore it, then deleted |
| A customer's or team member's record that the business has removed | Deleted automatically six years after the latest of: for a customer, the last invoice, the end of the last agreement, the last visit and the day the details were removed; for a team member, the leaving date, or the day the details were removed when there is none |
| Records the law requires for tax and accounting, such as payment records | As long as the law requires, even after the account is deleted |
| Sign in codes and email links | They stop working within hours. The record is deleted 30 days after it expired or was used |
| Technical logs | A short time, then deleted |
| Copies of emails held by our email delivery provider | A short time, then deleted |
| Analytics data | As short as our analytics settings allow |
| Backups | A limited time, then replaced. Deleted data may remain in a backup until then |
Companies we may contact: see How we use your details.
11. Your rights
You have the right to see the personal data we hold about you, to have it corrected or deleted, to restrict or object to how we use it, and to receive a copy to take elsewhere. Where we rely on your consent, you can withdraw it at any time, for analytics with the Change your cookie choices button in the Cookie policy.
To use any of these rights, email [email protected]. We answer within the time the law allows. If your data was entered by a business you deal with, we pass your request to that business (section 2).
You can complain to the Information Commissioner's Office at ico.org.uk.
12. Marketing emails
We send product news only to account holders who asked for it. Every marketing email has a link to stop them. Emails about your account are not marketing.
13. Security
We use appropriate technical and organisational measures to protect personal data. No system is completely secure. If a breach is likely to put you at high risk, we tell you as the law requires. To report a security concern, email [email protected].
14. Children
RotaRound is for businesses and is not meant for children. We do not open accounts for anyone under 18. A business that enters details of the people it serves is responsible for them as controller.
15. What we do not do
We do not sell personal data. We do not use the records businesses keep in RotaRound to advertise to anyone, or to train AI models.
16. Changes to this policy
We may change this policy. The version and date at the top show which version applies. Where the law requires, we tell you before a change applies.