Who this policy applies to
Rosta is a workforce management service operated by VTech IT Solutions in Melbourne, Victoria, Australia. This policy applies when businesses, managers and employees use Rosta's mobile application, web dashboard and related services.
An employer or organisation using Rosta controls many workplace settings, including employee accounts, work locations, attendance rules, enabled verification methods and manager permissions.
Information Rosta may process
Rosta only processes information relevant to the functions enabled and used by the organisation.
Background location is limited to an active shift.
Where active-shift geofence monitoring is enabled, Rosta may access location in the background, including when the app is closed or not in use, only after the employee successfully Clocks In and while that employee remains Clocked In.
Selfie and camera access
Where enabled, Rosta may use the device camera for attendance selfie verification, QR scanning or another clearly identified function. A selfie may be associated with an attendance event so an authorised manager can verify the event.
Leave documents and workplace records
Employees may submit documents such as medical certificates or information through workplace or HR requests. These records may contain sensitive information.
Rosta processes this information only for the relevant workplace, administrative, record-keeping, support or compliance purpose. Access is limited to authorised users and service personnel where reasonably necessary.
Why information is used
Who can access information
Information may be available to the employer or organisation using Rosta and to authorised managers, HR users, administrators or other workplace users according to their permissions.
Rosta may also use service providers for functions such as cloud hosting, storage, authentication, notifications, communications, security monitoring, error logging and technical support.
Information may be disclosed where required or authorised by law. Rosta does not disclose employee location, attendance or selfie information for third-party advertising.
How information is retained and protected
Personal information is retained only for as long as reasonably necessary for service operation, workplace records, reporting, security, dispute handling and applicable legal obligations.
Attendance, location and geofence information may be retained with the relevant attendance record where reasonably required for verification, reporting, audit or dispute review. Medical or supporting documents are retained only for as long as reasonably necessary for the relevant workplace or legal purpose.
Rosta uses technical, administrative and operational safeguards designed to protect personal information, including access controls, authentication, secure communications, logging and restrictions on administrative access.
Device permissions
Depending on the enabled functions, Rosta may request access to location, background location, camera, photos or files and notifications.
Where background location is required for active-shift geofence verification, Rosta provides an in-app disclosure before requesting the relevant permission. Users may manage permissions through device settings, but disabling a required permission may prevent the related feature from working.
Access, correction and deletion
Users may request access to personal information held about them and may request correction of inaccurate information. Deletion requests may be made where deletion is legally and technically available.
Because an employer controls many workplace records, employees may be directed to their employer or authorised HR administrator for employment-related records. Rosta may verify identity and authority before completing a privacy request.
Privacy questions or complaints
Privacy questions, access requests, correction requests or complaints can be sent to VTech IT Solutions. Where applicable, unresolved privacy matters may also be raised with the Office of the Australian Information Commissioner.
Changes to this policy
This policy may be updated when Rosta's features, data-handling practices, legal requirements, security practices or app-store requirements change. The "Last updated" date at the top of this page will be revised when material changes are made.