Privacy policy

What Roster Flow collects about the businesses that use it and the people who work for them, why, who can see it, how long it is kept, and what you can ask for.

Some details are still to be confirmed.This was written from how Roster Flow actually works. These points are still to be confirmed by the business, and each is marked where it appears below:

The contact address of the business that provides Roster Flow, beside its name and ABN
Whether that business is covered by the Privacy Act 1988, or chooses to follow the Australian Privacy Principles
Whether any personal information is stored or processed outside Australia, and if so in which countries. The policy has to say this, but it does not have to name the providers
How long backups keep information after an account is removed
The 30 days this policy gives for answering a privacy request or complaint, and the email notice before a change to the policy
A review by somebody qualified in Australian privacy law

About this policy

This policy explains how Roster Flow handles personal information: what we collect, why, who can see it, how long we keep it, and what you can ask us for. It covers the Roster Flow website, the app used by businesses and their staff, and the emails the service sends.

Roster Flow is provided by ToraDigm Pty Ltd (ABN 70 679 136 577), a company registered in Australia. Questions about this policy go to hello@rosterflow.com.au.

In this policy, we and us means Roster Flow. A business is an organisation that holds a Roster Flow account, and staff are the people that business adds to its account, including its owners and managers. It is written to follow the Australian Privacy Principles in the Privacy Act 1988.

Who is responsible for what

A business that uses Roster Flow decides who it adds, what it records about their working time, and whether clock in photos and location checks are switched on. It is responsible for telling its staff about that, and for having a lawful reason to collect it.

We hold and process that information to provide the service to the business, and for the other purposes in this policy. We do not use a business’s staff information for anything else. If you work for a business that uses Roster Flow, questions about why something is recorded are best asked of your employer first. We will help them answer.

What we collect

About a business and its account

The business name, and the name, address and map position of each venue.
The names, email addresses and roles of its owners and managers.
Its settings, such as clock in rules, pay period and how long clock in photos are kept.
Its plan, subscription status and billing dates.

About the people a business adds

Name, email address, optional mobile number, job title, venues, role, employment type and start date.
Details a person or their business chooses to add to a profile: address, suburb, postcode, date of birth, and an emergency contact’s name, phone number and relationship.
A pay rate and whether it is hourly or salaried, typed in or imported from payroll, and whether weekend and public holiday loadings apply. These are used to estimate what a roster costs.
Work rights, where a person records them: residency or visa type, its expiry, and any limit on the hours they can work.
Availability, leave requests, leave balances read from a connected payroll system, shift swaps and offered shifts.

About working time

Rostered shifts, clock in and clock out times, and breaks.
Corrections and approvals, with who made each change, when, and the reason they gave.

Clock in photos and location, only if the business switches them on

A photo taken on the person’s phone as they clock in or out.
At that moment, the phone reports where it is. We work out how far that is from the venue and whether it is within the distance the business set, and we keep the distance and the result. We do not keep the position the phone reported.
Location is never read in the background or between shifts, and never on any other screen.

When you contact us

Your name, business, email address, how many people you roster, what your question is about, and the question itself.

When you use the website or the app

A sign in session, held in a cookie, with a description of the browser and device it belongs to.
Failed sign in attempts, with the network address they came from, so repeated guessing can be slowed down.
On the public website only, and only when measurement is switched on: the pages visited and the steps of signing up. Nothing done inside the app is measured.

When a business pays

Card details are entered on our payment provider’s page and never reach Roster Flow. We keep the plan, the subscription status and dates, and the provider’s reference for the account.

How we collect it

From the business, when it sets up its account, adds people, builds rosters and approves hours.
From a payroll system the business connects, when it imports its employees, pay rates or leave balances.
From staff themselves, when they complete their profile, clock in, record availability or ask for leave.
From the person’s phone at clock in, for the photo and the location check, when the business has switched those on.
From you, when you use the contact form or email us.
Automatically, when you sign in or use the website.

Why we use it

To provide the service: rosters, clocking in, timesheets, approvals, reports, and sending approved hours to payroll.
To estimate what a roster costs, from the rates the business enters.
To send the emails the service needs, such as invitations, password resets, reminders and account notices.
To keep accounts secure, including sign in, two step sign in, and slowing down repeated failed attempts.
To give support, and to find and fix problems.
To bill for paid plans.
To answer questions sent to us.
To understand how the public website is used, when measurement is switched on.
To meet our legal obligations.

We use personal information for another purpose only where you would reasonably expect it, where you agree, or where the law requires or allows it.

What we do not do

We do not sell personal information, and we do not use it to build advertising profiles.
We do not put advertising trackers inside the app.
We do not track anyone’s location continuously, in the background, or between shifts.
We do not collect staff bank details. Pay is made in the business’s own payroll system.
We do not make decisions about anybody’s employment. Attendance is counted, and the business decides what it means.

Who can see it

Staff see their own shifts, hours, requests and profile. They do not see pay rates or other people’s details.
Managers see the roster, hours, attendance, contact details and pay rates for their business. An owner can limit a manager to the venues they are assigned to.
Owners see everything a manager sees, plus billing and the payroll connection.
Roster Flow support can open a business’s account only to help with a problem, read only, for up to 30 minutes at a time, and with a reason recorded. A banner shows in the app while it is open, and each visit appears in the business’s own audit trail.
Our team can see what running the service needs, such as account details, plan and delivery of emails. Every action taken in our operator tools is recorded.

Payroll systems a business connects

When an owner connects the business’s own payroll account, approved hours are sent there, and employee details, pay rates and leave balances can be imported from there. Only the owner can connect or disconnect it. What happens to information inside that system is governed by the business’s agreement with its provider.

Service providers

Like most online services, we rely on other companies to run parts of Roster Flow: hosting and running the application, storing the database and files, delivering email, taking card payments, showing maps and finding addresses, and measuring website visits when that is switched on. Each receives only what its part of the service needs. For example, the email provider receives the recipient’s address and the message, the payment provider receives the business name and the owner’s email address, and the mapping service receives the address a manager types to find a venue.

When the law requires it

We disclose information where a law, a court or a government agency with the power to require it does so.

If Roster Flow’s business changes hands

If Roster Flow is sold or merged, information may pass to the new owner, who must handle information collected under this policy in line with it.

Anyone else

Only with the agreement of the business or the person concerned.

Information outside Australia

Some service providers may store or process information in other countries. Where that happens, this section names the countries involved.

To be confirmed. Whether any personal information is stored or processed outside Australia, and if so in which countries.

How we protect it

Information travels to and from Roster Flow encrypted.
Passwords are stored only as a one way hash, never as the password itself.
Two step sign in with an authenticator app can be turned on for any account.
Repeated failed sign ins are slowed down.
A sign in lasts up to 30 days. Every signed in device is listed in account settings and can be signed out.
Payroll connection tokens and the credentials the service uses are stored encrypted.
Access inside a business follows its roles, and every change to a time record is recorded with who made it.

No system is completely secure. If a breach is likely to cause serious harm, we will tell the businesses affected, and, where the Notifiable Data Breaches scheme applies, the people affected and the Office of the Australian Information Commissioner.

How long we keep it

Clock in photos are deleted after the number of days the business sets. A business can choose to keep them while its account is open.
Time records, approvals and their history stay while the account is open, because they are pay records the business may have to produce. A person who is deactivated stays on the records of the hours they worked.
Sign in sessions end after 30 days at the latest and are then removed.
Invitation links expire after 14 days, and password reset links after 60 minutes.
When an account is removed, its rosters, timesheets and records are deleted, and this cannot be undone. Employers generally have to keep employee records for seven years under the Fair Work Act 2009, so export what you need first.

To be confirmed. How long backups keep information after an account is removed.

Seeing and correcting information

Staff can see their own records in the app, and change their own contact details there.
Staff can ask their employer for a copy of what is held about them, or for a correction.
A business can correct its records in the app, and export its reports as CSV files at any time.
Anyone can ask us for access to, or correction of, personal information we hold about them, by emailing hello@rosterflow.com.au.

We may need to confirm who you are first. We will reply within 30 days. If we cannot do what you ask, we will tell you why and what else you can do.

Cookies and browser storage

Signing in uses a cookie that keeps you signed in. The app cannot work without it.
When website measurement is switched on, the public website uses cookies to count visits, and keeps the first page of a visit in the browser until the visit ends, so a sign up can be traced back to the page that started it.
You can block or clear cookies in your browser. Blocking the sign in cookie stops you signing in.

Emails from us

The service sends the emails it needs to work: invitations, password resets, reminders and notices about an account. Sending a question through the contact form does not add you to a mailing list.

Young workers

Roster Flow is used by businesses, and a business may add staff who are under 18. The business is responsible for any consent needed from them or their parent or guardian. We do not knowingly collect information about children in any other way.

Complaints

If you think we have mishandled your personal information, email hello@rosterflow.com.au and tell us what happened. We will look into it and reply in writing within 30 days.

If you are not satisfied with our reply, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

Changes to this policy

When this policy changes, the date at the top changes with it. When a change affects how information is used, account owners are told by email before it takes effect.

Contact

Privacy questions and requests go to hello@rosterflow.com.au, or through the contact page.