Data Processing Agreement
Last updated: 28 October 2026 (version 2026-10-28)
This Data Processing Agreement forms part of the Terms of Service between Bath and District Pharmacy Limited and each business that uses Zero Rota. It sets the terms on which Zero Rota handles a customer's staff data and meets the requirements of Article 28 of the UK GDPR. An owner of each organisation accepts it on the business's behalf in the app or on the website.
Parties. Bath and District Pharmacy Limited (company number 03216569), Office 1, 21 Hatherton Street, Walsall, WS4 2LA, trading as Zero Rota (the Processor), and the business that uses Zero Rota (the Customer).
1. Roles
The Customer is the controller of the personal data its account holds about its staff. Zero Rota is its processor. Zero Rota is the controller only of the data it needs to run the Customer's account, such as billing contacts and invoices, as our Privacy Policy explains.
2. Instructions
Zero Rota processes the data only to provide Zero Rota as described in Annex A, and on the Customer's documented instructions, unless the law requires otherwise (in which case Zero Rota tells the Customer first, if the law allows). The Customer's use of the app's settings and features counts as its instructions. Zero Rota tells the Customer if it believes an instruction breaks data protection law.
3. Confidentiality
Everyone Zero Rota allows to handle the data is bound by a duty of confidence.
4. Security
Zero Rota keeps the measures in Annex B in place and may improve them, but will not reduce the overall level of protection.
5. Sub-processors
The Customer authorises the sub-processors in the list below, including the developer who builds and supports Zero Rota. Zero Rota gives at least 30 days' notice, by email to an owner and by updating the list, before adding or replacing one. The Customer may object on reasonable data protection grounds, and either party may then end the affected service. Zero Rota puts terms on each sub-processor that meet Article 28 of the UK GDPR, and stays responsible for them.
6. International transfers
The database and file storage are in Ireland. Some sub-processors are based in, or handle data in, the United States, as the list shows. Any transfer outside the UK and the European Economic Area relies on a safeguard UK law recognises, such as UK adequacy regulations (including the UK extension to the EU-US Data Privacy Framework, where the provider is certified), the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
7. Staff rights
Zero Rota helps the Customer answer requests from its staff (to see, correct or delete their data, and the rest), mostly through the app's own export, edit and archive tools. A request sent to Zero Rota directly is passed to the Customer within 5 working days.
The app stores require that anyone can ask to delete their own account. When a member of staff asks Zero Rota to do that, the Customer instructs Zero Rota to delete that person's name, contact details and sign-in within 30 days, and Zero Rota tells the Customer. The Customer's records of that person's work, leave and pay are kept, no longer linked to the deleted account, unless the Customer asks otherwise.
8. Breaches
Zero Rota tells the Customer without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting the Customer's data. It gives what it knows at the time, and the rest as it learns it: what happened, the data and people affected, the likely effects, and the steps taken. This leaves the Customer time to report to the ICO within 72 hours where it must. Zero Rota keeps a record of every breach.
9. Assessments
Zero Rota provides the information the Customer reasonably needs for a data protection impact assessment, or for consulting the ICO. Zero Rota's own assessment of clock-in location and sickness records is available on request.
10. End of service
The Customer can export its data from the app at any time. Zero Rota does not delete a Customer's data just because a free trial or plan ends: the account stays open so the Customer can come back to it. When the Customer asks Zero Rota to close its account and delete its data, Zero Rota does so within 90 days, after giving the Customer a copy if it asks for one, unless the law requires Zero Rota to keep it. Copies in backups are removed as those backups expire.
11. Information and audits
Zero Rota provides the information needed to show it meets this agreement, mostly in writing. If the Customer reasonably needs more, it, or an independent auditor bound by confidentiality, may audit on 30 days' written notice, at the Customer's cost, no more than once in any 12 months (unless after a breach or at a regulator's request), and in a way that does not expose other customers' data. Zero Rota may arrange for audits asked for by several customers to be carried out together.
12. Liability and law
Liability under this agreement is as set out in the Terms of Service, including its limits. This agreement is governed by the law of England and Wales.
Annex A: details of the processing
| Item | Detail |
|---|---|
| Subject matter | Providing the Zero Rota rota, time and attendance, leave and payroll-preparation service, including support and fixing faults |
| Duration | While the Customer's account is open, and then until deletion under clause 10 |
| Purposes | Planning and publishing rotas; shift swaps and open shifts; recording clock-ins, breaks and timesheets, including by location check, kiosk and QR code; managing holiday, sickness and other absence; preparing pay figures, payslips and payroll reports; tasks, meetings, announcements and notifications; staff records, roles and permissions; account security, support and fixing faults |
| Nature | Storing, organising, using, sending (including push notifications and emails) and deleting the data, mostly by automated means. This includes working out hours, pay figures, leave balances and cover alerts, and, where the Customer turns them on, clocking people out automatically and taking off unpaid breaks |
| People | The Customer's staff (current and former, including agency staff and contractors), managers, owners and anyone invited to its account, and their emergency contacts |
| Data | Name, email, phone, date of birth and profile photo; emergency contacts; role, branch, contract, contracted hours, working pattern, pay rate, overtime and holiday entitlement; shifts, swaps and availability; clock-in and clock-out times, breaks and timesheets, and the phone's location at the moment of clocking where the branch checks location; leave and absence records; pay figures and payslips; tasks, comments, meeting notes and photos; uploaded documents; kiosk PIN hashes and QR codes; sign-in details, device and push notification identifiers, sign-in history, IP addresses and the audit log; support messages and screenshots |
| Special category data | Health data in sickness records, sickness reasons and sick notes, including absence for pregnancy, maternity or disability. Free text and uploaded documents may contain other special category data, or criminal records data if the Customer uploads, for example, a DBS certificate |
| Location | Database and file storage in Ireland; otherwise as in the sub-processor list |
| Retention | As the Customer decides through the app, and then as clause 10 sets out |
Annex B: security measures
- Database and file storage in the European Economic Area, with data encrypted in transit (TLS 1.2 or higher) and at rest.
- Each business's data kept separate by database access rules, so one customer cannot read another's.
- Role-based permissions inside each business; pay rates, sickness records and documents visible only to people allowed to see them.
- Sick notes, payslips and other files in private storage, opened only through links that expire within an hour. Profile photos are the one public exception.
- Two-step login available to every user.
- An audit log of changes, and automatic alerts on unusual sign-in activity.
- Kiosk PINs stored only as one-way hashes, with a lock-out after repeated wrong attempts.
- Daily backups kept by our hosting provider (currently for 7 days).
- Access to production systems limited to named people.
Sub-processors
Zero Rota uses the services below to run the app. They handle personal data only on Zero Rota's instructions. The database itself is stored in Ireland. Zero Rota gives at least 30 days' notice before changing this list.
| Service | What it does | Personal data it handles | Where |
|---|---|---|---|
| Ben Jones (our developer) | Builds, runs and supports Zero Rota under contract with us | Any, where needed to run Zero Rota or fix a fault | UK |
| Supabase | Database, sign-in, file storage and scheduled jobs | All app data, including sick notes | Ireland (US company) |
| Vercel | Hosts the website and the servers behind the app | Data passing through the website and app | EU and US (our servers run in Dublin) |
| Expo | App builds, app updates and push notification delivery | Push tokens and notification text | US |
| Apple; Google (including Firebase) | Push notifications | Push tokens and notification text | US |
| Resend | Emails, including invitations and sign-in codes | Names, email addresses and what the email says | US |
| Mapbox | Maps and address look-ups for clock-in location features | Branch addresses, and the phone's position when the clock-in map or walking route is drawn | US |
| OVH | Servers for building and testing the app, and for passing on fault reports | What a fault report contains | EU |
| Slack (Salesforce); Trello (Atlassian) | Fault reports and feedback | What a fault report contains, such as a screenshot | US |
| Meta (WhatsApp) | Fault reports and feedback from our own team | What a fault report contains, such as a screenshot | US and EU |
| GitHub | Stores the source code | None: personal data is not kept in the code | US |
| Google (Gmail) | Receives support emails sent to our zerorota.com addresses | What a support email contains | US |
| Porkbun | Domain registration and email forwarding | What a support email contains | US |
| goQR (api.qrserver.com) | Draws QR codes. We plan to replace it by drawing them inside the app | The account identifier inside the code | Germany |
| Anthropic | Software development and support tools | Data needed to look into and fix a fault | US |
| OpenAI | Software development and support tools | Data needed to look into and fix a fault | US |
These services receive some personal data but use it under their own terms, as controllers, so they are not sub-processors:
| Service | What it does | Personal data it handles | Where |
|---|---|---|---|
| Stripe | Takes subscription payments, under our own Stripe account | Billing contact, card and payment details | UK, EU and US |
| Apple and Google | The App Store and Google Play, and Sign in with Apple and Google sign-in if you use them | Your account with them, and app downloads | US |
| Open-Meteo | The weather shown on the home screen, if you allow it | The phone's approximate position | Switzerland |
| postcodes.io | Looks up branch postcodes | Branch postcodes | UK company |
Not switched on yet: Cloudflare (bot checks on the sign-up and contact forms) and Sentry (crash reports). Each will be added to the list above, with notice, before it is switched on.
Questions
Contact us at legal@zerorota.com.