RocketRota legal
Terms and Conditions
Effective: 23 October 2026 ยท Last updated: 30 October 2026
These terms govern business use of RocketRota and include the data-processing terms for workforce information. Please read them before creating a workplace, joining a team or purchasing a subscription.
1. About RocketRota
These Terms and Conditions govern access to and use of RocketRota, a workforce scheduling, rota management and time and attendance service for businesses employing shift-based workers (the Service).
The Service is provided by Jack McConnell trading as RocketRota, a sole trader. Email: rocketrota.team@gmail.com. Website: rocketrota.com. RocketRota, we, us and our mean this service provider.
Customer means the organisation or business using or purchasing the Service. Authorised Users means owners, administrators, managers, employees and other workforce members permitted to access it. Customer Data means information and records submitted by the Customer or its Authorised Users.
2. Business use and agreement
RocketRota is provided for business use. By creating a workplace, purchasing a subscription or accepting these Terms for a business, you confirm that you are authorised to enter into this agreement on its behalf. The Customer is responsible for ensuring that its Authorised Users comply with these Terms.
A workforce member joining a workplace agrees to the provisions governing their own use. Joining does not by itself authorise that person to enter into a subscription or other commercial commitment for the Customer. The Customer controls workplace access and permissions.
3. The Service
Depending on enabled features and permissions, RocketRota provides staff and staff-group management; organisation, location and zone management; draft and published rotas; shift assignments, templates and rota copying; rota notifications; optional shift-swap requests and approvals; labour-cost and budget estimates; rota PDF exports; timesheets comparing scheduled, recorded and payable hours; optional NFC clock-in and clock-out recording; manager corrections and review of time records; and Sage timesheet CSV exports.
Time & Attendance is an optional add-on enabled by location. Shift swaps must be enabled by the workplace. Functions also depend on user permissions and billing status. These Terms do not promise standalone availability or leave-management tools, automated legal compliance, a full payroll service or a direct connection to every payroll provider.
Features may be added, modified or improved. We will not materially reduce the core functionality of a paid subscription during its current paid period without reasonable justification. Where practicable, we will give advance notice of a material reduction and explain the Customer's options.
4. Accounts and security
Provide accurate account and workplace information and keep it current. Each user must keep their sign-in credentials secure and must not share their account. Tell us promptly if you suspect unauthorised access.
The Customer must assign appropriate permissions, maintain accurate employee details and remove access when no longer needed. It is responsible for use it authorises and activity through its accounts, except to the extent caused by a security failure for which RocketRota is responsible.
5. Trials, subscriptions and fees
The trial duration and limits are shown in the Service. The standard trial currently lasts 14 days and permits up to three rotas across the workplace. Creating an account does not require a payment method. Without an active paid subscription after the trial, paid actions may become unavailable.
Saving a payment method through the trial checkout sets up a subscription that starts charging when the remaining trial ends unless cancelled beforehand. It does not restart or extend the trial. If the trial has ended, completing paid checkout starts a paid subscription. Subscriptions automatically renew for the billing period shown at checkout until cancelled.
The current standard plan has one monthly base charge per organisation, including its first 10 used employees. A used employee is a distinct employee assigned to a published shift dated within the billing period or with a qualifying time entry in that period. Each employee is counted once across the organisation, even when working at multiple locations. Merely adding an employee profile does not make that employee billable.
Employees above the included allowance incur the displayed per-employee charge. Time & Attendance incurs a separate charge for each distinct used employee with qualifying usage at a location where the add-on is enabled, including published shift assignments even if the employee does not clock in. Deactivating an employee does not erase usage already recorded for the period. Disabling the add-on does not remove charges already incurred.
Prices, billing periods, allowances, add-on charges and applicable taxes are shown on the pricing page and during checkout or activation. Fixed subscription charges are generally billed in advance; metered employee and Time & Attendance usage is billed in arrears after the relevant period. Estimates may change as usage increases. The Customer authorises collection of fees properly due through its saved payment method and must keep payment details current.
6. Price changes
We may change pricing. For an existing paid subscription, a price increase will take effect no earlier than the next renewal after reasonable advance notice. The Customer may cancel before the new pricing takes effect. An increase in recorded usage under existing rates is not a price change.
7. Failed payments
If payment fails, we may retry collection and contact the Customer. The Service currently provides a five-day grace period for past-due subscriptions before paid actions are restricted. Unpaid or otherwise inactive subscriptions may also have restricted access. Resolving outstanding billing restores access subject to the subscription's status.
We may suspend or terminate a subscription if payment remains outstanding, normally after notice and a reasonable opportunity to resolve the issue. Restriction or suspension does not cancel fees already properly incurred.
8. Cancellation
An authorised billing administrator can manage or cancel the subscription through Manage billing. Contact rocketrota.team@gmail.com if these controls are unavailable. Cancellation stops automatic renewal at the end of the current subscription period. The Customer retains access to the subscribed Service until that period ends, subject to the other suspension and termination provisions of these Terms. The effective cancellation date is shown in Manage billing. To prevent a trial subscription becoming paid, cancel before the displayed trial end.
Time & Attendance can be cancelled separately for a location through its add-on controls and remains enabled until the cancellation date shown. Cancelling an add-on does not cancel the core subscription. Cancelling a subscription does not itself delete the workplace or its records.
We do not offer refunds or credits for cancellation, non-use or unused portions of a billing period, except where required by law or to give effect to remedies for our breach. Cancellation does not waive outstanding fees or final metered usage charges, which may be invoiced afterwards. Nothing in this policy removes rights or remedies that cannot lawfully be excluded.
9. Customer responsibilities
The Customer remains responsible for its staffing decisions, business operations, employment contracts, payroll, taxation, record keeping, employee privacy, health and safety, and compliance with employment, working-time, rest-period and minimum-wage rules.
Cost estimates, rates, warnings, budgets and calculated hours depend on entered information and settings. The Customer must verify them before making employment or payment decisions. RocketRota does not provide legal, employment, payroll, tax or accounting advice or determine whether a workplace is legally compliant.
10. Rotas, shift swaps and notifications
The Customer must check rotas before and after publication, including assignments, times, locations, coverage and subsequent changes. Draft changes should not be treated as communicated to staff until published. Where swaps are enabled, requests and approvals follow the available workflow and permissions; a request alone does not change an assigned shift.
Email, push and in-app notifications depend on contact details, user settings, device permissions, connectivity and delivery providers. Delivery or viewing is not guaranteed. The Customer should use an additional communication method for urgent or legally important changes, and Authorised Users should check their published schedules.
11. Time and attendance
When Time & Attendance and clocking are enabled for a location, employees can clock in and out using a supported device to tap a configured secure NFC station and complete the authenticated clocking flow. Records may include scheduled times, actual clock times, separately calculated payable times, shift segments, clocking source and station, reasons, failed attempts and manager adjustments.
Actual and payable times can differ because of configured grace periods, scheduled-time rules, early-start choices or manager corrections. Flags and payable hours assist review; they do not decide what wages are legally due. The Customer must check settings and resolve missing, open, disputed or review-flagged records before payroll. The Service does not currently provide a separate break-start and break-end clocking workflow.
Device compatibility, internet access, incomplete clocking actions, incorrect station setup and technical issues can affect records. A secure NFC tap is not conclusive proof of identity, physical presence throughout a shift or hours actually worked. Employees should report errors to their workplace; authorised managers can make corrections using available controls.
12. Clock-in stations
A location activating Time & Attendance may be eligible to request an included NFC station, as shown in the activation flow. Fulfilment is currently limited to supported delivery addresses in postcode areas BT47 and BT48. Do not assume hardware is available in every region or that activating the add-on means a station has been delivered.
The Customer is responsible for placement, protection and day-to-day management and for contacting support when a station needs moving, replacement or reconfiguration. Do not tamper with security features, duplicate secure identifiers or bypass clocking protections. Each station must be used for its configured location.
Additional hardware charges, delivery estimates, ownership or return requirements, replacement arrangements and warranty terms must be disclosed and agreed when hardware is supplied or separately ordered. These Terms do not promise a delivery deadline or unlimited free replacements.
13. Payroll and exports
RocketRota provides rota PDF exports and a Sage timesheet CSV export for completed, published rota weeks. Sage export requires employee payroll IDs and resolution of open or review-flagged entries. These are files for the Customer to review and use; they do not automatically submit payroll, pay employees or make tax filings.
The Customer must verify identifiers, hours, rates, mappings and payroll-system import settings before processing payroll. Compatibility depends on the supported format and receiving system; third-party changes may affect it. RocketRota does not guarantee compatibility with every Sage product or other payroll provider.
14. Acceptable use
Customers and Authorised Users must not use the Service unlawfully or fraudulently, infringe others' rights, upload malicious material, access accounts or data without authorisation, test security controls without permission, deliberately disrupt the Service, circumvent subscription or usage restrictions, or copy or reverse engineer the software except as permitted by law.
Do not scrape or automatically extract substantial amounts of information without permission, except through available exports or as permitted by law. We may restrict access where reasonably necessary to address a security, legal or operational risk.
15. Intellectual property
RocketRota and its licensors retain their rights in the software, design, branding and documentation. Subject to these Terms and applicable fees, the Customer has a limited, non-exclusive, non-transferable right to use the Service for its internal business purposes, including access for its Authorised Users.
The Customer retains its rights in Customer Data and permits us to host, process, display and transmit it as needed to provide and support the Service under the processing terms below. No ownership of either party's material is transferred. We may use voluntarily provided product feedback to improve the Service without payment, subject to confidentiality and data-protection obligations.
16. Customer Data
The Customer must have the right and lawful basis to provide Customer Data. It is responsible for accuracy, informing workforce members how their information is used, managing access and exports, responding to employment-related questions, and determining appropriate workforce-record retention requirements.
We process Customer Data to provide, secure, maintain and support the Service under documented instructions and the terms below. Account administration, billing and other processing for which we independently determine purposes are described in our Privacy Notice: https://rocketrota.com/privacy.
17. Data protection and processing terms
Each party must comply with applicable data-protection legislation, including the UK GDPR and the Data Protection Act 2018 as amended. For workforce personal data processed on the Customer's behalf, the Customer generally acts as controller and RocketRota as processor. We act as a separate controller where we independently determine purposes and means, such as for our own account administration, billing and legal obligations.
This section and section 18 form the processing terms for Customer personal data processed on its behalf. They do not replace the separate Privacy Notice for processing where RocketRota is controller.
17.1 Processing instructions
We will process Customer personal data only on documented instructions, including instructions about international transfers, unless UK law requires otherwise. These Terms, the Customer's configuration and use, and agreed written requests form those instructions. If law requires other processing, we will inform the Customer beforehand unless prohibited. We will immediately inform the Customer if, in our opinion, an instruction infringes applicable data-protection law.
17.2 Confidentiality
We will ensure that persons authorised to process Customer personal data are committed to confidentiality or subject to an appropriate statutory duty of confidentiality.
17.3 Security
We will implement appropriate technical and organisational measures required by Article 32 UK GDPR, accounting for the nature of processing and risks to individuals. Application controls include individual authenticated accounts, session checks and organisation- and location-based permission checks. Privileged database and email-service credentials are used in server-side code. Payment-card collection takes place through Stripe-hosted checkout; RocketRota stores payment references rather than full card details.
Production infrastructure, access-management and recovery measures: [VERIFIED PRODUCTION SECURITY AND RECOVERY MEASURES]. The Customer must secure its own devices, credentials, permissions and exported files.
17.4 Sub-processors
The Customer gives general written authorisation for the following sub-processors: netcup GmbH for application-server hosting in Germany, including processing of application requests and server logs; Supabase Pte. Ltd. for the hosted database, with primary project data in Ireland; Plus Five Five, Inc., trading as Resend, for transactional email delivery, including recipients, message content and delivery information, with primary processing in the United States; and coolLabs Solutions Kft., providing Coolify Cloud for hosted deployment management and server access, which may include access to deployment configuration and application logs, with processing locations [CONFIRMED COOLIFY CLOUD PROCESSING LOCATIONS]. [CONFIRM ANY ADDITIONAL SUB-PROCESSORS, INCLUDING SUPPORT AND BACKUP SERVICES].
We will notify the Customer in advance of intended sub-processor additions or replacements and allow a reasonable opportunity to object on data-protection grounds before the change. If an objection cannot be resolved, the parties will discuss an alternative or termination of the affected Service before the new processing begins.
We will impose equivalent applicable data-protection obligations on sub-processors and remain responsible to the Customer for their performance. A provider acting as an independent controller is not a sub-processor for that processing.
17.5 International transfers
Primary database processing takes place in Ireland, application hosting in Germany, and transactional email processing includes the United States. Hosted deployment management is provided through Coolify Cloud as identified in section 17.4. A primary hosting location does not mean that all provider support, administration or onward processing takes place in that country.
We will make restricted international transfers only under documented instructions and applicable law, using an applicable adequacy regulation or appropriate safeguards where required. Supabase's and Resend's published data-processing agreements include standard contractual clauses and a UK Addendum for applicable UK transfers. The safeguards and any additional processing locations applicable to our provider accounts are: [CONFIRMED PROVIDER AGREEMENTS AND TRANSFER ARRANGEMENTS].
17.6 Individual rights
Taking account of the nature of processing, we will assist the Customer through appropriate technical and organisational measures, insofar as possible, in responding to individuals exercising data-protection rights. We will pass requests about Customer-controlled workforce data to the Customer and will not respond on its behalf unless instructed or legally required.
17.7 Personal-data breaches
We will notify the Customer without undue delay after becoming aware of a personal-data breach affecting data processed on its behalf, and provide available information and updates to assist its assessment, regulatory notifications and communications to affected individuals.
17.8 Compliance assistance
Taking account of the nature of processing and information available, we will assist the Customer with security, breach-notification, data-protection impact assessment and prior regulatory consultation obligations under Articles 32 to 36 UK GDPR.
17.9 Information, audits and inspections
We will provide information necessary to demonstrate compliance with Article 28 and allow and contribute to audits and inspections by the Customer or its appointed auditor. Reasonable notice, confidentiality and proportionate arrangements may protect other customers and minimise disruption, but must not prevent an audit required by law or a regulator.
17.10 End of processing
When processing services end, we will, at the Customer's choice, return or securely delete personal data processed on its behalf and delete existing copies unless UK law requires retention. The Customer has 30 days after account closure or the end of processing services to request data return by emailing rocketrota.team@gmail.com. We will verify the requesting person's authority and arrange delivery in a commonly used electronic format through an appropriately secure method. The Customer may request earlier deletion.
If no return instruction is given within that period, we will delete the data. Completion times for requested returns and deletion from live systems: [DATA RETURN AND LIVE-DATA DELETION TIMESCALE]. Residual backup copies, where held, will be protected, put beyond ordinary operational use and removed within [BACKUP DELETION PERIOD]. If a backup is restored, relevant deletion instructions must be reapplied before the data is returned to ordinary use. Legally required retention is limited to that legal purpose. Cancelling billing alone is not an instruction to delete an otherwise continuing account.
18. Details of data processing
Subject matter: workforce management, rota scheduling, shift swaps, timesheets and optional time and attendance. Duration: while processing for the Customer continues and during the applicable return or deletion period afterwards.
Nature and purpose: receiving, storing, organising, retrieving, displaying, calculating, correcting, exporting and transmitting workforce information to provide the configured Service. The Customer determines workforce purposes, information entered, authorised access and processing instructions, subject to these Terms and law.
Categories of individuals: employees, workers, contractors, managers, workplace owners and other Authorised Users whose information is provided.
Types of data: names and supplied contact details; workforce and payroll identifiers; roles, staff groups and location assignments; employment and pay-rate information; rota and shift records; swap requests and decisions; clock-in, clock-out, scheduled and payable times; attendance reasons and notes; station identifiers and clocking attempts; corrections and related activity records. Account identifiers and technical information may also associate records and secure access.
Do not enter unnecessary personal data, medical details, other special-category data or criminal-offence data into free-text notes or other fields. Current features are not designed as a repository for these sensitive records. The Customer must inform workforce members about attendance recording and any monitoring it configures.
19. Confidentiality
Each party must protect the other's confidential information with reasonable care, use it only for this agreement and disclose it only to people who need it for that purpose and are subject to appropriate confidentiality obligations.
This does not cover information lawfully known already, independently developed, lawfully received elsewhere or public through no breach. Legally required disclosure is permitted, with advance notice where lawful. These obligations continue after termination while information remains confidential.
20. Availability and maintenance
We aim to provide a reliable Service and minimise disruption but do not guarantee uninterrupted or error-free access. Maintenance, security incidents, infrastructure failures, internet problems and third-party outages may interrupt access. We will give notice of planned material disruption where practicable. No specific uptime or support-response commitment applies unless separately agreed in writing.
21. Beta and experimental features
If we explicitly label a feature as beta, preview or experimental, it may contain errors, change, have limited support or be withdrawn. The Customer should assess it before relying on it for critical processes. This applies only to features identified as such.
22. Third-party services
The Service relies on third-party infrastructure, communications and payment services and may provide export formats for third-party software. Their independent operation can affect availability or compatibility. A Customer using a separate third-party product must comply with its applicable terms.
We may change an integration when a provider changes or ends access. This does not remove our obligations to provide the Service with reasonable care and skill or our responsibility for sub-processors under section 17.
23. Suspension
We may restrict or suspend access where reasonably necessary for non-payment, serious breach, suspected fraud or unlawful activity, security threats, harm to other customers or legal requirements. Restrictions will be proportionate where practicable. We will notify the Customer and provide an opportunity to resolve the issue where appropriate; urgent risks may require immediate action.
24. Termination
Either party may terminate for a material breach not corrected within a reasonable period after written notice, where correction is possible. We may terminate or suspend immediately for serious fraud, unlawful activity, deliberate security abuse or where continued provision would be unlawful. The Customer may cancel under section 8 and request account closure through rocketrota.team@gmail.com.
Termination does not affect accrued rights, fees or liabilities. Provisions intended to continue, including confidentiality, data return and deletion, intellectual property, payment, liability and dispute provisions, survive as applicable.
25. Data following termination
Download available exports before access ends. For 30 days after account closure or the end of processing services, the Customer may request return of its Customer personal data by contacting rocketrota.team@gmail.com, as described in section 17.10. Available self-service exports do not necessarily include every record held, and self-service access is not extended by this request window. Return and deletion remain governed by section 17.10. Cancelling renewal alone does not start the account-closure period.
26. Warranties
We will provide the Service with reasonable care and skill. Except for express commitments and rights that cannot lawfully be excluded, we give no additional warranties of uninterrupted availability, compatibility with every device or third-party product, or suitability for every particular business purpose.
27. Limitation of liability
Nothing excludes or limits liability for death or personal injury caused by negligence, fraud or fraudulent misrepresentation, or any liability that cannot lawfully be excluded or limited. Nothing restricts an individual's statutory data-protection rights.
Subject to the above and to the extent permitted by law, neither party is liable to the other for indirect or consequential losses, including loss of profits, revenue, anticipated savings, business opportunities or goodwill where those losses are indirect or consequential.
Subject to the above, and only to the extent permitted by law, RocketRota's total aggregate liability arising out of or in connection with the Service during any twelve-month period will not exceed subscription fees paid or payable by the Customer during the twelve months immediately preceding the event giving rise to the claim. This does not limit the Customer's obligation to pay fees properly due.
28. Customer indemnity
The Customer is responsible for third-party claims, losses and reasonable costs suffered by RocketRota to the extent caused by the Customer's unlawful use, deliberate infringement of rights, unlawful processing of personal data or material breach of section 14, excluding any part caused by RocketRota.
We will notify the Customer promptly of a claim, provide reasonable cooperation and take reasonable steps to reduce loss. We will not agree a settlement creating an obligation for the Customer without its consent, which must not be unreasonably withheld.
29. Events outside reasonable control
Neither party is responsible for delay or failure to the extent caused by events outside its reasonable control, provided it takes reasonable steps to limit impact and resume performance. Examples include widespread telecommunications or power failures, natural disasters, government restrictions and major infrastructure failures. This does not excuse fees already due or obligations that cannot lawfully be excluded.
30. Changes to these Terms
We may update these Terms for changes to the Service, law, security requirements or business operations. We will give reasonable advance notice of material changes affecting existing Customers, unless urgent legal or security requirements prevent it. Updated Terms identify their effective date. Where required, we will seek fresh agreement.
The Customer may cancel before a material change takes effect. Continued use afterwards constitutes acceptance where permitted by law and clearly explained in the notice. Changes do not remove rights accrued before they take effect.
31. Notices
We may send contractual and operational notices to the Customer's registered email address or through the Service. The Customer must maintain current contact details and check these communications. Notices to RocketRota should be sent to rocketrota.team@gmail.com.
32. Assignment
The Customer may not transfer this agreement without our prior written consent, which will not be unreasonably withheld. We may transfer it as part of a restructuring, sale, merger or transfer of the relevant business or assets, provided this does not materially reduce the Customer's rights, and will notify the Customer.
33. Severability
If a provision is invalid or unenforceable, the remaining provisions continue. Any necessary modification must be limited to what is required to make the provision enforceable, where permitted by law.
34. Waiver
A failure or delay to enforce a right does not waive it or prevent later enforcement.
35. Third-party rights
Unless expressly stated otherwise, a person who is not a party has no right to enforce these Terms under the Contracts (Rights of Third Parties) Act 1999. This does not affect rights available independently under law, including individuals' data-protection rights.
36. Entire agreement
These Terms, including sections 17 and 18 and schedules expressly referenced there, agreed checkout or activation details and any written order expressly agreed by both parties form the agreement for the Service. The Privacy Notice explains processing as controller; it does not replace processing terms for Customer-controlled data.
For conflicts concerning personal-data processing, applicable processing terms take priority to the extent needed to comply with law. Nothing in this section excludes liability for fraud or fraudulent misrepresentation.
37. Governing law and jurisdiction
These Terms and disputes or claims arising from them, including non-contractual disputes or claims, are governed by Northern Ireland law. The courts of Northern Ireland have exclusive jurisdiction, except where applicable law requires otherwise.
38. Contact
Send questions about these Terms, account closure or data return to Jack McConnell trading as RocketRota. Email: rocketrota.team@gmail.com. Website: rocketrota.com. The Help Centre provides product guidance but does not replace these contact details for legal notices.
