Legal
Version 2026-10-04 · last updated 4 October 2026
This Data Processing Agreement ("DPA") is between Quickrota ("Quickrota", "we", "us") and the business that holds a Quickrota account ("you", the "Customer"). It sits alongside our Terms of Service and Privacy Policy and forms part of the contract between us. If there is a conflict between this DPA and the Terms of Service on the subject of processing personal data, this DPA takes precedence.
It records how we process the personal data of your employees on your behalf, as required by Article 28 of the UK GDPR. For that data, you are the data controller and Quickrota is your data processor, under the UK GDPR and the Data Protection Act 2018. This DPA does not cover your own account and billing details, where Quickrota is the controller; that is dealt with in our Privacy Policy.
The subject matter is the processing of your employees' personal data that is necessary to provide the Quickrota service to you: rota scheduling, staffing-demand and coverage tools, working-time compliance checks, staff clock-in and timesheets, and payroll export.
This DPA applies for as long as you have an active Quickrota account, whether on a free trial or a paid subscription. It ends when your account is closed, subject to the return-and-deletion obligations in Section 7, which continue until they are complete.
We process the data only to operate the service for you and to support you in using it. In practice that means storing the data you and your staff enter, using it to build and check rotas, matching clock-in records to shifts, generating timesheets and payroll exports, and showing employees their own rotas and clock-in history through the staff portal. We also process it as needed to keep the service secure, to diagnose and fix problems, and to take backups.
We do not use your employees' personal data for our own purposes. We do not sell it, and we do not use it for advertising or profiling, because we do not run any advertising.
Categories of data subjects: your employees and workers, including anyone you give staff-portal or on-site device access to.
Types of personal data: names; contact details; job roles; contracted and available hours; pay rates; clock-in and clock-out records and the timesheets derived from them; recorded absences; staff-portal login identifiers; and, where a manager records it, an employee's date of birth (used to apply the correct working-time limits for staff under 18 and to flag pay below the National Minimum Wage rate for their age band, and treated with the same care as any other sensitive personal data) and whether a signed 48-hour working-time opt-out is on file. The data is entered by you, by your managers, or by your employees through the staff portal.
Quickrota is not designed for special category data (such as health data) beyond what a basic absence record may imply, and you should not enter special category data into free-text fields.
We will:
Process only on your instructions. We process your employees' personal data only on your documented instructions, which for now are: this DPA, the Terms of Service, the settings and actions available to you in the app, and any further written instructions you send us. If we believe an instruction breaches data protection law, we will tell you. If we are ever required by law to process the data in some other way, we will tell you first unless the law prevents us.
Keep it confidential. Access to your data is limited to the people who need it to run or support the service: currently just us, and any staff or contractors engaged in future under a confidentiality obligation.
Secure it. We apply technical and organisational measures appropriate to a small SaaS product and to the risk, including: encryption of data in transit (HTTPS); hosting and database services from established providers (see Section 5); access to production systems restricted to the people who need it and protected by individual credentials; staff and on-site device passwords and PINs stored only as salted hashes, never in plain text; and regular database backups. These measures will develop as the product and the team grow, and we will not reduce the overall level of protection during your subscription.
Help you meet data subject requests. If one of your employees asks you to give them access to their data, correct it, delete it, or export it, and you need our help to respond, we will help, taking into account the nature of the processing and the information available to us. Much of this you can do yourself in the app; email us if you need more.
Help you with your wider obligations. We will give you reasonable help, on request, with data protection impact assessments, prior consultation with the Information Commissioner's Office, and your own security and breach-notification duties, so far as they relate to our processing and the information available to us.
You give us general authorisation to use sub-processors to help provide the service. Each sub-processor is engaged under a written contract that imposes data protection obligations comparable to those in this DPA, and we remain responsible to you for what they do with the data.
The sub-processors currently used for your employees' personal data are:
Vercel: application hosting and delivery.
Supabase: the PostgreSQL database where the data is stored, plus backups.
We also use Resend to send account emails and Twilio to send verification texts. Both handle only your own account email address and mobile number — never your employees' personal data — so neither is a sub-processor under this DPA. They are covered by our Privacy Policy.
We also use Stripe to take subscription payments. Stripe processes your account and billing details only (such as your card details and billing address) as a separate processor for that purpose. It is not a sub-processor for your employees' personal data, which is not shared with it. Stripe's handling of your billing data is covered by our Privacy Policy and Stripe's own terms, not by this DPA.
Before we add or replace a sub-processor that handles your employees' personal data, we will notify the email contact on your account at least 30 days beforehand. If you have a reasonable data-protection objection, tell us within that period and we will work with you in good faith to address it; if we cannot, you may terminate your subscription in respect of the affected processing.
If we become aware of a personal data breach affecting your employees' personal data, we will notify you without undue delay, and in any event within 72 hours of becoming aware of it. The notification will describe, so far as we know it at the time: what happened, which data and roughly how many people are affected, the likely consequences, and the steps we are taking in response. We will keep you updated as we learn more, and we will help you meet any obligation you have to notify the ICO or affected individuals. Deciding whether a notification to the regulator or to individuals is required is your call as the controller.
Your venue's data in Quickrota is deleted from live systems within 90 days of your account being cancelled, or of a trial pausing with no payment method added. Copies held in our database provider's automatic backups are removed when those backups age out on their normal retention cycle. This is the same commitment set out in our Privacy Policy, and covers data Quickrota itself controls; it doesn't extend to Stripe's own billing/tax records or Resend's/Twilio's own message logs, which those providers keep under their own policies. We will email the account holder 14 days before permanent deletion, with instructions for exporting the data first.
On request while your account is active, or during that pre-deletion window, we will return your data to you in a commonly used machine-readable export. After deletion, residual copies may persist in encrypted backups for a limited period until those backups age out on their normal cycle, after which they are overwritten. We will not use any such residual data for any purpose.
We do not have formal third-party audit certifications such as SOC 2 or ISO 27001, and we are not going to claim an audit programme we do not run. What we will do is answer reasonable written questions about how we process your data and the measures in Section 4, complete a reasonable security questionnaire, and provide the information we have that is needed to demonstrate compliance with Article 28, normally within 30 days of your request.
If that is genuinely not enough for your own regulatory obligations, we will discuss a proportionate further check: for example a call with us, or a review carried out by an independent third party at your cost, on reasonable notice, no more than once a year, arranged so it does not disrupt the service or expose other customers' data. As the product matures we intend to put more of this on a formal footing.
Our sub-processors may process or store data outside the UK. Where that happens, we rely on that provider's data-transfer safeguards (such as the UK's International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or adequacy under UK law) rather than making the transfer ourselves under our own clauses. We will not instruct a transfer of your employees' personal data outside the UK without an appropriate safeguard in place.
Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms of Service. Nothing in this DPA limits any liability that cannot lawfully be limited, including under the UK GDPR.
Questions about this DPA, or a request for a signed copy: support@quickrota.co.uk.