Privacy Policy
This policy explains what personal data RotaStars collects, why, and what rights you have over it. It applies to both organisation admins who sign up directly, and staff members whose details an admin adds.
Who we are
RotaStars is operated by CareFinder Pro Limited, a company registered in England and Wales (Company No. 16661484), registered office 3rd Floor, 86–90 Paul Street, London, EC2A 4NE. We are the data controller for organisation admin accounts, and a data processor for the staff records organisations add to the system.
What we collect
From organisation admins (when you sign up):
- Your name and email address
- Your organisation's name and business sector
- The RotaStars page or campaign you signed up from
- A securely hashed password (we never store your actual password — see Security, below)
- Billing information, handled directly by Stripe (see below — we don't store your card details ourselves)
From staff members (added by your organisation admin):
- Name and email address
- Points activity: awards given, categories, and any notes an admin adds explaining an award
- Cash-out requests they submit
Automatically:
- A session cookie, so you stay logged in between page loads (see Cookies, below)
- Basic usage data such as page visits and signup steps, without names, email addresses or free-form content
Why we process this data
- To provide the service — running the points system, letting staff log in and see their totals, processing cash-out requests. This is necessary to perform our contract with your organisation.
- To take payment — processing your subscription via Stripe. Also necessary to perform our contract.
- To keep the service secure — things like password hashing and session management. This is in our legitimate interest, and yours, in keeping accounts secure.
Who we share data with
- Stripe, to process subscription payments. Stripe acts as an independent data controller for payment details — see Stripe's own privacy policy for how they handle this.
- Our hosting and database providers, who store the data on our behalf under data processing agreements. Our database is hosted in the EU.
- We do not sell your data, or your staff's data, to anyone. We don't share it with third parties for marketing.
Cookies
RotaStars uses one essential cookie: a session cookie that keeps you logged in. This cookie is strictly necessary for the service to function — without it, you'd need to log in again on every page. Because it's strictly necessary, UK law doesn't require us to ask for your consent to use it, but we're telling you about it here for transparency. We use cookieless analytics to understand page visits and signup conversions by sector. We don't use advertising or tracking cookies, and analytics events do not include names, email addresses or free-form content.
How long we keep data
We keep your account data for as long as your subscription is active, plus a short period afterwards in case you want to reactivate or need a copy of your records. If you'd like your organisation's data deleted sooner, get in touch and we'll action it, save for anything we're required to keep for legal or accounting reasons (like billing records).
Your rights
Under UK GDPR, you (and your staff members, for their own records) have the right to:
- Access the personal data we hold about you
- Correct it if it's inaccurate
- Delete it, in most circumstances
- Restrict or object to certain processing
- Receive a copy of your data in a portable format
To exercise any of these rights, contact us at hello@rotastars.co.uk. If you're a staff member and want to see or correct your own points record, your organisation admin can usually help directly — or you can contact us and we'll help coordinate with your organisation.
You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk, if you're unhappy with how we've handled your data.
Security
Passwords are hashed before storage — we never store or have access to your actual password. Data is transmitted over encrypted connections. Access to your organisation's data is restricted to your own organisation's admin accounts.
Children
RotaStars isn't intended for anyone under 18. We don't knowingly collect data from children.
Changes to this policy
We may update this policy from time to time. If we make a material change, we'll let you know by email.
Contact
Questions about this policy, or to exercise your data rights: hello@rotastars.co.uk
CareFinder Pro Limited
Registered in England and Wales · Company No. 16661484
3rd Floor, 86–90 Paul Street, London, EC2A 4NE