Data-processing note
Version 2026-11 · Between the customer (controller) and Mohammad Al Hussein (enskild firma, trading as AstraDev), organisation number 20030804, Skansgatan 8, 21132 Malmö, Sweden (processor). It forms part of the terms of service and applies when the customer enters personal data of its staff into AstraRota. Questions: info@astrarota.com.
1. What is processed
| Subject | Providing a shift-scheduling service to the customer, for as long as the customer’s organisation exists. |
|---|---|
| People concerned | The customer’s employees and other workers who are scheduled; the customer’s own users (owner, managers, team leaders). |
| Data | Name; skills and contract days; absences (with type: vacation, sick, unavailable); shift wishes and availability; assigned shifts; requests for time off, swaps and open shifts with the reasons the person writes; for staff who have an account: email address, language and notification settings; where the customer turns the time clock on: clock-in and clock-out times, corrections with reason, flags, and the device location read at the moment of clocking (coordinates and accuracy); notes the customer chooses to write; user names and roles of the customer’s users; the activity log of changes. |
| Special categories | Absences marked “sick” can reveal information about health. The customer must have a legal basis for recording this (for example employment-law obligations, art. 9.2 b GDPR) and should record only the fact of absence, never a diagnosis or symptoms. Where this is not needed, use “unavailable” instead. |
| Location | Location is read only when a person presses clock in or out, only if the team’s settings ask for it, and after the person’s device permission. It is stored with that entry only, never tracked continuously, and can be wrong or manipulated. The customer must decide that it is necessary and proportionate, inform its staff, and keep to local law on monitoring; it can switch location off per team. |
| Not needed | The service does not ask for national IDs, home addresses, pay data or health details, and the CSV import ignores such columns. |
2. What we promise as processor
- We process the data only on the customer’s documented instructions (these terms, the settings and actions of the customer’s users), unless law requires otherwise; then we tell the customer first if we may.
- Everyone who can reach the data with us is bound by confidentiality.
- We keep appropriate security measures: HTTPS, hashed passwords, separation between organisations (tested automatically), access-restricted servers, daily backups, restricted access to backups.
- We use only the sub-processors below, and tell the customer by email at least 30 days before adding or replacing one; the customer may object on reasonable grounds and end the agreement instead.
- We help the customer answer requests from the people concerned, and with security, breach notification and impact assessments, as far as the nature of the service allows. The customer can export all data itself at any time (Account > Organisation), including time-clock entries, and can correct or remove a person’s data in the app.
- We tell the customer about a personal-data breach affecting its data without undue delay, and aim to do so within 48 hours of becoming aware.
- When the agreement ends or the customer deletes its organisation, the data is deleted from the live system at once and disappears from backups within about 60 days (the two newest nightly backups on the server and one further offline copy that is replaced regularly). On request in writing we confirm deletion.
- We give the customer the information needed to show that these obligations are met and allow audits by the customer or an auditor it appoints, with reasonable notice, during normal hours and at the customer’s cost.
3. Sub-processors
| Who | What | Where |
|---|---|---|
| Clouding.io (Cloudi Nextgen SL), Spain | Server and storage for the service and its backups | As stated |
| Brevo (France) | Sends notification and account emails (receives the recipient’s address, name and message text) | As stated |
Stripe processes payment details as an independent controller for the customer’s billing data and receives no team data.
4. Customer’s responsibilities
The customer is the controller. It decides which data to enter, informs its staff as required (including that schedules may be shared by public link if the customer turns that on — anyone with the link can see the names and shifts in it; sick leave is shown there only as “unavailable”), makes sure it has a legal basis, and sets retention: under Organisation > How long data is kept the owner chooses after how many months schedules, calendar shifts, absences, wishes and requests are deleted automatically (by default they are kept while the organisation exists). Time-clock entries are deleted automatically after 400 days unless the customer sets a different period for a team; the customer must not set a longer period than it can justify. The customer decides who among its staff gets an account, makes sure each email address is the right person’s, and tells staff that the service sends them emails about their schedule. The customer chooses which of its users may see which teams.
5. Transfers outside the EU/EEA
Team data stays with the hosting provider named in section 3; we do not send it anywhere else. If that provider’s servers are outside the EU/EEA, we will state so in section 3 and agree EU standard contractual clauses with the customer. If the customer is established outside the EU/EEA, the customer is responsible for the lawfulness of sending data to the service.
6. Liability and law
Liability follows the terms of service. Swedish law applies.