iRota Privacy and Consent Statement (GDPR)

We provide this information so that you are informed about the data held within iRota and how we treat it.

Within the statement:

'iRota' means the cloud based service and data storage.

'Data' means the Organisation’s data stored within iRota.

'Organisation' means the Organisation using the Service, or any representative acting on behalf of the organisation. The Organisation is the Data Controller.

'We' and 'us' means the iRota Service Provider - Gillett Limited. We are the Data Processor processing data on behalf of the Organisation.

'Employee/s' means employees whose information is held within iRota. 'End User' means a person authorised by the Organisation to use iRota. Information may also relate to other individuals, such as emergency contacts or next of kin.

End users should read this statement in conjunction with the Organisation’s own policies, to understand our practices regarding the information stored in iRota.

INTRODUCTION

This statement refers specifically to the iRota service and is in addition to our Company Privacy Statement.

We respect data privacy and are committed to protecting personal information in accordance with the UK GDPR and the Data Protection Act 2018.

All parties within our team are fully aware of the importance of data protection, privacy and consent, and the UK GDPR (General Data Protection Regulation).

The latest revision of this statement is available to all at any time. This statement may change from time to time. Please check the statement periodically for updates.

PRIVACY INFORMATION

Personal information is entered and stored within iRota by the Organisation and its authorised users. We process this service data on the Organisation's behalf to provide and support iRota under the applicable service agreement and Data Processing Addendum.

We do not use service data for our own sales or marketing. iRota does not use analytics services or embed advertisements. Service login records and audit trails support the operation and security of iRota.

We only process and report on data within iRota to provide the service required by the Organisation.

We never sell data held within iRota.

We are the developers and service provider of iRota — Gillett Limited, Aizlewood’s Mill, Nursery Street, Sheffield S3 8GG, UK.

Our service is cloud based and hosted on Microsoft Azure, with service data stored in the UK. Microsoft provides hosting infrastructure and acts as a sub-processor for that hosting. Our supplier arrangements include confidentiality, security and data protection requirements. Use of sub-processors is subject to the applicable Data Processing Addendum and the Organisation's authorisation.

Where a restricted international transfer is required, including overseas access that constitutes such a transfer, applicable safeguards under UK data protection law must be in place. These may include appropriate standard contractual clauses where relevant. Contact privacy@gillett.co.uk for information about the safeguards applicable to your data.

Our Company Privacy Statement explains the separate processing of business contact, sales and administration information by Gillett Limited.

DATA PROTECTION BY DESIGN

The service has several levels of data protection by design.

The Organisation and its users access service data through the functionality provided by iRota, rather than by direct access to the underlying database.

Access to iRota is only via accounts configured by the Organisation or by us on behalf of the Organisation.

Access to the service requires a password, initially configured by an internal (or authorised) email account. The password is hashed (not stored as plain text) for further protection.

Browser verification can be implemented on iRota, by the Organisation, to restrict access on new devices until further security is checked.

Two Factor Authentication can be enabled, by the end user, to further protect access.

INFORMATION HELD WITHIN IROTA

We provide iRota for Staff Scheduling and Management within the Organisation.

In the usual course of communicating and conducting our business with the Organisation we will receive and send information including email, text and other electronic messages.

Information the Organisation may choose to store in the service includes:

Name, email address and log in details, Login time and IP address, Role within the organisation, Typical contracted hours, Rota information, shifts worked on a day to day basis, annual leave taken, other leave taken, and any other type of work related to employment, Annual leave / bank holiday allowance, Sickness episodes and reason, Contractual or preferential agreements, Working patterns, Telephone numbers, Address, Training information, Performance review dates, Free text notes, Payroll number, Date of birth, Emergency contact / next of kin details, Passports / Visas / Permits, Licences and Memberships, Education and Qualifications, Personal Skills, Previous employment history and work experience, Spoken languages, Audit Trail.

iRota records staff attendance and absence, including brief reasons for sickness absence, such as headache, fracture or cold. These reasons are used to manage attendance and absence, not to diagnose, treat or manage health conditions. Where they reveal information about an individual's health, they are treated as special category personal information. The described sickness-absence record is not intended for detailed medical information or additional HR case-management actions.

The Organisation is responsible for ensuring that the information it enters, including free-text notes, is relevant and limited to what is necessary. We will update this statement where changes to functionality affect the information processed.

HOW THE DATA IS COLLECTED

The Organisation may supply the initial data which enables iRota to be configured.

After initial configuration, service data is entered and amended by the Organisation and its authorised users. The service also records login information and audit-trail events as part of its operation.

We do not access or interact with the data on the service under normal circumstances.

We may access service data to configure, provide, maintain or support iRota under the applicable service agreement and Data Processing Addendum, for example to respond to a support request, investigate a fault or implement an update, or where required by law.

The Organisation is responsible for the accuracy of information it supplies or enters and for correcting inaccuracies. We assist with corrections where necessary under the applicable service agreement and Data Processing Addendum and remain responsible for our own obligations as processor.

LAWFUL BASIS AND CONSENT

The Organisation is responsible for identifying the lawful basis for personal information it enters into iRota and, where relevant, an additional condition for special category personal information. We process this service data on the Organisation's behalf to provide and support the service under the applicable service agreement and Data Processing Addendum. Entering information into the service does not, by itself, establish consent from the individuals concerned.

The Organisation's own privacy information should explain its purposes, lawful bases and retention arrangements. Where it relies on consent, it is responsible for ensuring that consent is valid and can be withdrawn.

The information stored in iRota is viewable by authorised users according to their access permissions. The Organisation manages these permissions within the service. Access by Gillett Limited and hosting providers is governed by the service and processing arrangements described above.

Questions and requests to exercise data protection rights concerning service data should normally be raised with the Organisation. We assist the Organisation in responding to requests and refer any such request received directly by us to it without undue delay. You may contact us at privacy@gillett.co.uk.

For a complaint about how Gillett Limited handles personal information, contact privacy@gillett.co.uk use our website contact form or write to our address above. We also accept complaints through other communication channels. We will acknowledge your complaint within 30 days, make appropriate enquiries, keep you informed and explain the outcome without undue delay. Where a complaint concerns processing controlled by the Organisation, we will refer it to the Organisation and assist it as appropriate.

You also have the right to complain to the ICO. The ICO normally expects you to raise your concern with the organisation concerned first. Further information about rights and Gillett Limited's handling of its own business records is available in our Company Privacy Statement.

CHILDREN

iRota is designed for staff scheduling and management and is supplied to Organisations. It is not directed at children under 16. The Organisation is responsible for considering the needs and rights of any young workers whose information it records.

The Organisation may enter emergency contact or next-of-kin details relating to a child. It is responsible for ensuring this information is necessary and lawfully collected. We process it on the Organisation's behalf under the applicable Data Processing Addendum.

DATA BREACH

On becoming aware of a personal data breach affecting service data, we will notify the Organisation without undue delay, investigate and take appropriate steps to contain the breach and minimise its effects. We will provide available information and assistance, with updates as our investigation progresses.

The Organisation, as controller, is responsible for assessing whether notification to the ICO or affected individuals is required, with our assistance. For personal information that Gillett Limited controls for its own business purposes, we assess and meet our own notification obligations as explained in our Company Privacy Statement.

RETENTION OF DATA

Service data is accessible during the Organisation's use of iRota, subject to its user permissions and applicable service arrangements. The Organisation determines how long information needs to be retained for its purposes.

When the Organisation stops using iRota, we contact it to confirm its arrangements for deletion of service data. Data is deleted in accordance with the Organisation's instructions and the applicable Data Processing Addendum, unless retention is required by law. We delete live service data as soon as reasonably practicable and within 30 days of receiving an authorised deletion request, or within 30 days of a future deletion date agreed with the Organisation. Any earlier contractual deadline continues to apply. Pending deletion cases are reviewed as part of our monthly ISMS review. Deletion is managed through our Azure environment.

Routine SQL backups are retained for up to 35 days. Following deletion of live service data, existing backup copies remain until they expire under this backup cycle. Any separately retained support or archive copies are managed in accordance with the applicable Data Processing Addendum and agreed retention arrangements.

Separate retention arrangements for Gillett Limited's own business contact and accounting records are explained in our Company Privacy Statement.

USE OF COOKIES

iRota uses first-party cookies to deliver the service, identify users and provide authentication security. It does not use analytics services, embedded advertisements or third-party cookies. Please see the iRota Policy for the Use of Cookies for more details.

IROTA DATA PROCESSING ADDENDUM (DPA)

This document should be read in conjunction with the iRota Data Processing Addendum (DPA).