Privacy Policy

When you use Rotazen as an employee, your employer is the controller of your personal data and Rotazen is a processor acting on that employer's instructions. Requests to access, correct, or delete data in your employment records go to your employer first.

Account Information:

• Name, email address, and password
• Organization name and contact details
• Profile picture (optional)
• Role and job position

Scheduling Data:

• Work schedules and shift assignments
• Availability and unavailability records
• Time-off requests and approvals
• Shift swap requests and history

Technical Data:

• IP address and browser information
• Device type and operating system
• Usage patterns and feature interactions
• Error logs and performance data

Location data:

• GPS coordinates at the moment you clock in or clock out
• The coordinates are saved with the corresponding time record and kept with it, so that the clock event can be verified as having been made at the workplace
• We do not track your location between clock events, or while the app is in the background

Personnel-file documents:

• Scanned copies of documents your employer uploads to your profile — employment contract, annexes, termination document, education and qualification documents.
• These copies usually contain your personal identification number (ЕГН) and address, because the document itself does. Rotazen does not extract or record the ЕГН as a separate field.
• Medical documents — for example the occupational health service's fitness-for-work conclusion. This is health data under Art. 9 GDPR.
• For non-EU citizens — a copy of the residence document, which the employer must keep under Art. 10(2) of the Labour Migration and Labour Mobility Act.
• Medical documents and residence documents are visible only to the organisation's administrators and to the employee, and every opening is logged.

We use the collected information to:

• Provide and maintain the scheduling service
• Process shift assignments and schedule changes
• Display informational warnings based on Bulgarian labor law rules
• Send notifications about schedule updates
• Improve and personalize the user experience
• Respond to support requests and inquiries
• Ensure the security of your account
• Storing copies of documents from your personnel file on your employer's instructions

When you write to us through the contact form we process your name, e-mail, subject, message and (optionally) organisation size in order to reply — on the basis of Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries), and, where the enquiry is a step towards a contract, Art. 6(1)(b); messages are delivered through our e-mail service provider.

Your employer processes the documents in your personnel file because this is necessary for your employment contract and for its obligations under the Labour Code and the Social Insurance Code (Art. 6(1)(b) and (c) GDPR). Medical documents are processed only as far as necessary for its obligations in the field of employment law, subject to the confidentiality duty in Art. 287(3) of the Labour Code (Art. 9(2)(b) GDPR). Rotazen processes these documents only as a processor, on your employer's instructions.

We engage the following providers, who process data on our behalf and only on our instructions:

All providers we engage process data under a data processing agreement and only on our instructions. We do not sell personal data and do not use it for advertising.

In addition to these providers, a customer organisation may itself designate a recipient — for example its accountant — to whom we send documents on that organisation's instruction. Such a recipient is not our sub-processor: we do not select it and have no contract with it; the relationship is the organisation's own. Employee personnel-file documents are never sent to such a recipient.

Some of these providers are established outside the European Economic Area. In those cases the transfer is made on the basis of a European Commission adequacy decision or of standard contractual clauses under Art. 46(2) GDPR.

We retain your data according to the following policies:

As a data subject in the European Union, you have the following rights:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a portable format
• Right to Object: Object to certain types of processing

To exercise any of these rights, write to us at privacy@rotazen.app.

You can view the copies of your personnel-file documents in the app, under "My documents". Certified copies of the originals are provided by your employer within 14 days (Art. 128b(4) and Art. 128a of the Labour Code).

You have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (КЗЛД), 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, cpdp.bg. Where the complaint concerns your employment records, it is directed against your employer as controller.

We use the following types of cookies:

• Essential Cookies: Required for the service to function (authentication, security)
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Help us understand how you use the service

You can control cookie preferences through your browser settings. Note that disabling essential cookies may prevent certain features from working properly.

We implement industry-standard security measures including:

• Encryption of data in transit (TLS/SSL)
• Encryption of data at rest
• Regular security audits and vulnerability assessments
• Access controls and authentication mechanisms
• Employee security training and data handling policies
• Employee documents are kept in private storage and opened only through links valid for up to 10 minutes; every opening of a medical or residence document is logged

Our mobile application requests the following device permissions. All are optional and only activated when you choose to use the related feature. You can revoke any permission at any time from your device's system settings.

• Camera: Used only when you choose to take a photo — for a profile picture, for a daily-report document or, if you are an administrator, for an employee document. We do not access your camera in the background or at any other time. The photo is uploaded to our secure storage and used only for the purpose you took it for.
• Photo Library: Used only when you choose a photo or file from your device — for a profile picture, a daily-report document or, if you are an administrator, an employee document. We access only the files you explicitly select.
• Precise Location: Used only during shift clock-in and clock-out, to confirm you are within the geofenced range of your assigned work site. The coordinates are saved with the time record and kept with it, because they form part of the documentation of hours worked. We do not track your location between clock events, or while the app is in the background.
• Push Notifications: Used to deliver shift reminders, swap requests, team announcements, and schedule changes. Notifications can be disabled at any time in Settings.

For privacy-related questions or to exercise your data rights, please contact us:

We aim to respond to all privacy requests within 30 days as required by GDPR.