Privacy Policy

1. Introduction

RosterRoo ("we", "our", or "us") is committed to protecting the privacy of our users. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our rostering and workforce management platform designed for NDIS providers in Australia.

We comply with the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth), and our platform is designed to support providers in meeting their obligations to the NDIS Quality and Safeguards Commission when handling participant information.

2. Information We Collect

We collect the following types of information:

2.1 Provider Information

• Business name, ABN, and contact details
• Account credentials and authentication information
• Payment and billing information
• Business address and operational details

2.2 Support Worker Information

• Personal details (name, date of birth, address, contact information)
• Employment details and qualifications
• NDIS Worker Screening Check numbers and expiry dates
• First Aid and other compliance certifications
• Bank account details for payroll purposes
• Tax File Numbers (TFN) and superannuation details
• Shift attendance and location data during work hours

2.3 NDIS Participant Information

• Personal details (name, date of birth, address, contact information)
• NDIS participant numbers and plan details
• Support needs and care plan information
• Medical information including medications and allergies
• Emergency contact details
• Case notes and incident reports

3. How We Use Your Information

We use collected information to:

• Provide and maintain our rostering and workforce management services
• Process shift scheduling, timesheets, and payroll
• Generate invoices and manage billing
• Facilitate compliance with NDIS requirements
• Send shift reminders and important notifications
• Provide customer support and respond to enquiries
• Improve our platform and develop new features
• Comply with legal obligations and regulatory requirements

4. Data Security

We implement appropriate technical and organisational measures to protect your personal information, including:

• Encryption of data in transit and at rest
• Two-factor authentication (2FA) options for account security
• Role-based access controls ensuring data segregation between providers
• Regular security audits and monitoring
• Secure Australian cloud infrastructure with industry-standard physical and network security
• Row Level Security (RLS) policies ensuring providers can only access their own data

5. Data Location — Australian Hosting

All RosterRoo data — including NDIS participant information, support worker records, case notes, incident reports, payroll data and uploaded documents — is stored and processed on servers located in Australia, in the Sydney region (ap-southeast-2). Database records, file storage and backups all remain onshore.

We do not store participant data outside Australia. Where a third-party service you choose to connect (for example an accounting integration) processes data in its own environment, that handling is governed by that provider's terms and your configuration of the integration.

6. Data Sharing and Disclosure

We do not sell your personal information. We may share information with:

• Service providers who assist in operating our platform (e.g., payment processors, email services)
• Third-party integrations you choose to connect (e.g., Xero for accounting)
• Government authorities when required by law or to comply with NDIS reporting requirements
• Professional advisers (lawyers, accountants) when necessary

7. Data Retention

We retain personal information for as long as necessary to provide our services and comply with legal obligations. NDIS-related records are retained for a minimum of 7 years as required by NDIS Quality and Safeguards Commission guidelines. When you delete your account, we will securely delete or anonymise your data, except where retention is required by law.

8. Your Rights

Under Australian privacy law, you have the right to:

• Access your personal information held by us
• Request correction of inaccurate information
• Request deletion of your account and associated data
• Opt out of marketing communications
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC)

9. Cookies and Analytics

We use essential cookies to maintain your session and provide our services. We may also use analytics tools to understand how our platform is used and to improve user experience. You can manage cookie preferences through your browser settings.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on our platform and updating the "Last updated" date. Your continued use of RosterRoo after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us at: