Privacy Policy

By accessing or using NextRota, you acknowledge that you have read and understood this Privacy Policy.

Information We Collect

Information You Provide

We may collect information that you voluntarily provide, including:

• Name
• Email address
• Phone number
• Username
• Password
• Job title
• Company name
• Billing information
• Contact preferences
• Availability information
• Shift preferences
• Employee scheduling information
• Leave and absence information
• Messages and communications sent through our platform
• Information submitted through contact forms or support requests

Account Information

When you register for an account, we may collect information necessary to create and maintain your account and provide our services.

Payment Information

If you purchase a subscription or make a payment through NextRota, payment processing is handled by third-party payment processors such as Stripe. We do not store full payment card numbers on our systems.

Information Collected Automatically

When you use our website or services, we may automatically collect:

• IP address
• Browser type and version
• Device information
• Operating system
• Login activity
• Usage information
• Error logs
• Diagnostic information
• Session information
• Website interaction data

Cookies and Similar Technologies

We use cookies and similar technologies to:

• Keep users logged in
• Maintain security
• Remember preferences
• Improve functionality
• Analyse service performance

Further details are available in our Cookie Policy.

How We Use Information

We may use personal information to:

• Provide and operate our services
• Create and manage user accounts
• Deliver workforce scheduling functionality
• Facilitate employee and manager communications
• Process subscriptions and payments
• Respond to enquiries and support requests
• Send administrative communications
• Improve our services
• Monitor platform performance
• Detect, prevent, and investigate fraud or security incidents
• Comply with legal obligations
• Enforce our terms and policies

Legal Bases for Processing (EEA and UK Users)

Where applicable, we rely on the following legal bases:

Performance of a Contract

We process information where necessary to provide our services and fulfil our contractual obligations.

Legitimate Interests

We process information where necessary for our legitimate business interests, including:

• Improving our services
• Analysing usage trends
• Protecting our platform
• Preventing fraud
• Responding to user feedback

Consent

Where required by law, we rely on consent for specific processing activities.

Legal Obligation

We may process information to comply with applicable laws and regulatory requirements.

Vital Interests

In limited circumstances, we may process information to protect the safety or vital interests of an individual.

Sharing of Information

We may disclose personal information to:

• Cloud hosting providers
• Data storage providers
• Authentication providers
• Payment processors
• AI service providers
• Communication and collaboration service providers
• Customer support providers
• Professional advisers
• Regulatory authorities when required by law

We do not sell personal information to data brokers.

International Transfers

Personal information may be transferred to and processed in countries outside the United Kingdom or European Economic Area. Where required, we implement appropriate safeguards, including Standard Contractual Clauses approved by the European Commission or other lawful transfer mechanisms.

Data Retention

We retain personal information for as long as necessary to provide our services, comply with legal obligations, resolve disputes, enforce agreements, and maintain business records. In most cases, personal information will be retained while a user maintains an active account with NextRota. Following account closure, certain information may be retained where required by law, regulatory obligations, fraud prevention, accounting requirements, or legitimate business interests.

Data Security

We implement reasonable technical and organisational measures designed to protect personal information from unauthorised access, loss, misuse, disclosure, alteration, or destruction. However, no method of electronic transmission or storage is completely secure. While we strive to protect personal information, we cannot guarantee absolute security.

Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal information.

Rights for UK and EEA Users

Subject to applicable law, you may have the right to:

• Access your personal information
• Correct inaccurate information
• Request deletion of personal information
• Restrict processing
• Object to processing
• Withdraw consent where consent is the legal basis
• Request portability of your information
• Lodge a complaint with a supervisory authority

Rights for US Residents

Residents of certain US states may have rights including:

• Accessing personal information
• Correcting personal information
• Deleting personal information
• Obtaining a copy of personal information
• Opting out of certain forms of processing where applicable
• Appealing decisions relating to privacy requests

To exercise any privacy rights, please contact us using the contact information provided below.

California Privacy Rights

California residents may have additional rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). We may collect categories of personal information including:

• Identifiers
• Customer records information
• Internet or network activity information
• Professional or employment-related information
• Commercial information relating to subscriptions and purchases

We do not knowingly sell personal information. California residents may request information regarding the collection, use, disclosure, and deletion of their personal information, subject to applicable legal limitations.

Marketing Communications

Where permitted by law, we may send marketing communications regarding our services, features, updates, and promotions. Users may opt out of marketing communications at any time by:

• Using the unsubscribe link included in marketing emails
• Contacting us directly

Administrative and service-related communications may still be sent where necessary.

Artificial Intelligence Features

NextRota may use artificial intelligence and automated technologies to support workforce scheduling, resource planning, reporting, forecasting, recommendations, and related operational functions. Where AI features are provided, we will take reasonable steps to ensure their responsible use and compliance with applicable privacy laws.

Third-Party Websites

Our website and services may contain links to third-party websites or services. We are not responsible for the privacy practices, content, or policies of third-party websites. Users should review the privacy policies of any external sites they visit.

Children’s Privacy

NextRota is not directed to children under the age of 18. We do not knowingly collect personal information from children. If we become aware that personal information has been collected from a child in violation of applicable laws, we will take reasonable steps to delete such information.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When material changes are made, we may update the “Last Updated” date and, where required by law, provide additional notice to users. Continued use of the services following publication of an updated Privacy Policy constitutes acceptance of the revised policy.

Contact Us

If you have questions regarding this Privacy Policy, your personal information, or your privacy rights, please contact:

NextRota
Email: privacy@nextrota.com
Website: https://nextrota.com

For privacy requests, including access, correction, deletion, or appeals relating to privacy requests, please contact us using the email address above.

Complaints

If you are located in the United Kingdom, European Union, or another jurisdiction that provides regulatory complaint rights, you may have the right to lodge a complaint with the relevant supervisory authority if you believe your privacy rights have been violated. We encourage users to contact us first so we can attempt to resolve any concerns directly.