Privacy Policy
Last updated: 12 July 2026 · Effective: 12 July 2026
Rosterly Ltd (“Rosterly”, “we”, “us”, or “our”) is committed to protecting the privacy of the personal information we collect and hold. This privacy policy explains how we collect, use, store, disclose, and protect personal information in accordance with the New Zealand Privacy Act 2020 and the Information Privacy Principles (“IPPs”) set out in that Act.
Rosterly provides a cloud-based workforce management platform for New Zealand businesses, offering rostering, time & attendance tracking, employee records management, document storage, and payroll preparation services.
TLS encryption in transit, AES-256 encryption at rest. Industry-standard bcrypt password hashing.
Every organisation’s data is completely separate. Multi-tenant isolation at the database query level.
Managed cloud platform with automated backups, DDoS protection, and continuous uptime monitoring.
1. Information We Collect
We collect personal information that is necessary for the purposes described in this policy. The types of information we may collect include:
Employee Information (collected by your employer via Rosterly)
- Full name, date of birth, and contact details (email, phone, address)
- Employment details — role, start date, employment type, pay rate, hours, and primary work site
- Emergency contact information
- Tax and payroll details (IRD number, tax code, KiwiSaver information)
- Bank account details for payroll purposes
- Identity documents (e.g. passport, driver licence, visa) uploaded for employment verification
- Time and attendance records — clock-in/out times, GPS location (if kiosk mode is used), break times
- Shift rosters and availability
- Employment agreements and signed contracts
Account Information
- Login credentials (email address and securely hashed password)
- User role and permissions within the platform
- Session and authentication data
Business Information
- Business/trading name and contact details
- Work site names and addresses
- Business settings and preferences (e.g. pay method, shift templates, kiosk PIN)
Automatically Collected Information
- Browser type and device information when accessing the platform
- Usage data such as login times and feature interactions
2. How We Collect Information
We collect personal information:
- Directly from you — when you create an account, complete your employee profile, upload documents, or use the platform
- From your employer — when they add you as an employee, create your roster, or manage your employment records through Rosterly
- Automatically — through your use of the platform (e.g. clock-in/out actions, session data)
We only collect personal information by lawful means, and we will not collect more information than is reasonably necessary for the purposes described in this policy.
3. Purpose of Collection
We collect and use personal information for the following purposes:
- Providing and operating the Rosterly workforce management platform
- Managing employee rosters, time tracking, and attendance records
- Processing payroll data and generating payroll exports
- Storing and managing employment documents and agreements
- Authenticating users and managing account access
- Communicating with users about their account or employment matters (e.g. shift notifications, onboarding emails)
- Generating business reports and analytics for employers
- Improving and developing our platform and services
- Complying with legal obligations under New Zealand employment and tax law
4. Disclosure of Information
We may disclose personal information to:
- Your employer — employee data is accessible to authorised administrators and managers within your organisation via the Rosterly platform
- Cloud infrastructure providers — our hosting and data storage partners who process data on our behalf, subject to strict data processing agreements
- Third-party payroll systems — if your employer uses an integrated payroll service (e.g. iPayroll), relevant payroll data may be exported to that system
- Legal authorities — if required by law, regulation, or valid legal process
We do not sell, rent, or trade personal information to any third party. We do not use personal information for marketing purposes unrelated to the Rosterly service.
5. Data Security
We take the security of your personal information seriously and implement multiple layers of protection to safeguard your data.
All data transmitted between your browser and Rosterly is encrypted using TLS (HTTPS). Data stored in our databases and file storage is encrypted at rest using AES-256 encryption.
Your organisation's data is completely separate from every other organisation using Rosterly. Every database query is scoped to your organisation at the application level — one client cannot access another's data, even if they attempted to manipulate requests.
We use industry-standard session-based authentication with bcrypt password hashing, CSRF protection, and server-side session validation on every request. A four-tier role-based access control system (Superadmin, Admin, Manager, Employee) ensures each user can only access functions and data appropriate to their role.
Employee documents (identity documents, contracts, etc.) are stored in encrypted cloud storage with access controlled through time-limited signed URLs. Documents are never publicly accessible — each download request is authenticated and authorised.
Rosterly is hosted on enterprise-grade cloud infrastructure with managed databases, automated daily backups, and encrypted storage at rest. The platform provides security patching, DDoS protection, and continuous uptime monitoring.
Our database enforces connection limits, idle session timeouts, and statement timeouts to prevent abuse. All database connections are encrypted and access is restricted to the application layer only — there is no direct external database access.
6. Data Storage & Retention
Personal information is stored on secure cloud servers. We retain personal information for as long as it is needed to fulfil the purposes for which it was collected, or as required by New Zealand employment and tax legislation.
Under New Zealand law, employers are generally required to retain employment records for a minimum of six years. We will retain data in accordance with these requirements and our client agreements.
When personal information is no longer needed, we will securely delete or de-identify it.
7. Your Rights Under the Privacy Act 2020
Under the New Zealand Privacy Act 2020, you have the right to:
- Access your information — you can request a copy of the personal information we hold about you
- Request correction — if you believe any information we hold is inaccurate or incomplete, you can request that we correct it
- Request deletion — you can request deletion of your personal information, subject to any legal retention obligations
- Complain — if you believe your privacy has been breached, you can make a complaint to us or to the Office of the Privacy Commissioner
Employees can access and update much of their personal information directly through the Rosterly employee portal, including their profile details, contact information, and uploaded documents.
For access or correction requests that cannot be handled through the platform, please contact us using the details below. We will respond to your request within 20 working days, as required by the Privacy Act 2020.
8. Notifiable Privacy Breaches
In accordance with Part 6 of the Privacy Act 2020, if we become aware of a privacy breach that poses a risk of serious harm to affected individuals, we will:
- Notify the Office of the Privacy Commissioner as soon as practicable
- Notify affected individuals as soon as practicable
- Take reasonable steps to contain the breach and mitigate any harm
9. Cross-Border Data
Our cloud infrastructure may process or store data in data centres located outside of New Zealand. Where personal information is transferred overseas, we ensure that it is protected by appropriate safeguards, including contractual obligations with our service providers that are comparable to the protections provided by the Privacy Act 2020.
10. Use of AI Features
Rosterly includes optional AI-powered features such as natural language shift creation, employment law assistance, document data extraction (OCR), and roster analytics. When you use these features:
- Data sent to AI services is used solely to provide the requested feature and is not used to train AI models
- AI responses are informational and should not be treated as legal, financial, or professional advice
- Employers control which AI features are available to their employees
11. Cookies & Session Data
Rosterly uses essential session cookies to authenticate users and maintain login state. These cookies are necessary for the platform to function and cannot be disabled. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.
12. Changes to This Policy
We may update this privacy policy from time to time. Any changes will be posted on this page with an updated effective date. If we make material changes, we will take reasonable steps to notify affected users (e.g. via email or an in-app notification).
13. Contact Us
If you have any questions, concerns, or requests relating to this privacy policy or our handling of personal information, please contact us:
You can also contact the Office of the Privacy Commissioner at www.privacy.org.nz or call 0800 803 909 if you have a complaint about our handling of your personal information.