Legal
Privacy Policy
Itembay Limited (trading as RotaCubed). Company Number 12027952. Registered Office 235 Foxhall Road, Ipswich, IP3 8LF. Last updated: 10 August 2026.
1. Who We Are
1.1 This Privacy Policy explains how Itembay Limited, a company registered in England and Wales under company number 12027952, with registered office at 235 Foxhall Road, Ipswich, IP3 8LF, trading as RotaCubed ("we", "us", "our"), collects, uses and protects personal data.
1.2 We are registered with the Information Commissioner's Office (ICO) as a data controller.
1.3 If you have any questions about this Privacy Policy or how we handle personal data, contact us at support@rotacubed.com.
2. The Two Roles We Play
2.1 Because of how RotaCubed works, we act in two different capacities depending on whose data is involved.
(a) Data Controller: for the personal data of the individual who creates a RotaCubed Account and any billing contacts, such as name, work email, and payment details, we are the data controller. Sections 3 to 12 of this Policy describe our role as controller.
(b) Data Processor: for personal data that our business customers input into the Service about their own employees, contractors or workers, such as names, contact details, shift patterns, and pay related data, we act only as a data processor, processing that data on the instructions of our customer, who remains the data controller for that data. If you are an employee or worker whose data has been entered into RotaCubed by your employer, please direct any data protection queries to your employer in the first instance, as we act only on their instructions. Business customers can request a Data Processing Agreement from us at support@rotacubed.com.
3. Personal Data We Collect
3.1 As a data controller, we collect and process the following personal data about our Account holders and website visitors.
(a) Account and contact data: name, email address, job title, company name, and login credentials.
(b) Billing data: billing address and payment details, processed on our behalf by Stripe. We do not store full card details ourselves.
(c) Support data: any information you provide when contacting support@rotacubed.com.
(d) Usage and technical data: information about how you use the Service and our website, including IP address, browser type, device information, and pages visited, collected via PostHog (product analytics), and, on our marketing website, Google Analytics, Meta advertising tools, and the LinkedIn Insight Tag.
(e) Marketing data: your preferences in relation to receiving marketing from us.
4. How We Use Your Personal Data and Our Legal Basis
4.1 We use personal data for the following purposes.
(a) To provide and maintain the Service, and to manage your Account. Legal basis: performance of a contract.
(b) To process payments via Stripe. Legal basis: performance of a contract.
(c) To provide customer support. Legal basis: performance of a contract and our legitimate interests in resolving your queries.
(d) To understand how the Service and our website are used, and to improve them, using PostHog and Google Analytics. Legal basis: legitimate interests, or consent where required by cookie law.
(e) To run advertising campaigns and measure their effectiveness, using Meta advertising tools and the LinkedIn Insight Tag. Legal basis: consent, obtained via our website cookie banner.
(f) To manage our sales and customer relationships using our CRM, Attio. Legal basis: legitimate interests.
(g) To send you marketing communications about RotaCubed, where you have opted in or where permitted under the soft opt in rules for existing customers. Legal basis: consent or legitimate interests, as applicable. You can opt out at any time.
(h) To comply with our legal obligations, including tax and accounting requirements.
5. Who We Share Data With
5.1 We share personal data with the following categories of third party service provider, each of whom is contractually required to protect personal data.
(a) AWS (Amazon Web Services): cloud hosting infrastructure.
(b) Supabase: database and backend infrastructure.
(c) Cloudflare: content delivery, security and website hosting.
(d) PostHog: product analytics within the Service.
(e) Attio: customer relationship management (CRM).
(f) Stripe: payment processing.
(g) Google Analytics: website analytics.
(h) Meta (Facebook and Instagram advertising tools): website advertising and retargeting.
(i) LinkedIn: website advertising via the LinkedIn Insight Tag.
5.2 We do not sell personal data to third parties.
5.3 We may disclose personal data if required to do so by law, or to protect our rights, property, or safety, or that of our customers or others.
6. International Data Transfers
6.1 The RotaCubed application itself, including all Customer Data entered by our business customers, is hosted and processed exclusively within the United Kingdom and European Economic Area (EEA). We do not transfer Customer Data entered into the core Service outside the UK and EEA.
6.2 Some of the third party tools used on our marketing website and for our own sales and marketing activities, namely Google Analytics, Meta advertising tools, the LinkedIn Insight Tag, and Attio, are provided by companies that may process data outside the UK and EEA, including in the United States. Where this occurs, we rely on appropriate safeguards recognised under UK data protection law, such as Standard Contractual Clauses or the UK International Data Transfer Addendum, or the provider's participation in a recognised adequacy framework.
7. Data Retention
7.1 We retain personal data for as long as your Account remains active.
7.2 Following cancellation or termination of an Account, we retain Account and Customer Data for a period of 1 year, after which it is permanently deleted, unless we are required to retain it for longer to comply with a legal, tax or accounting obligation, or to resolve disputes.
7.3 Website analytics and marketing data are retained in accordance with the retention settings of the relevant third party tool, for example Google Analytics' standard retention periods, or until you withdraw consent.
8. Cookies
8.1 Our marketing website uses cookies and similar technologies, including for Google Analytics, Meta advertising tools, and the LinkedIn Insight Tag. Some cookies are essential for the website to function; others are used for analytics and advertising and require your consent, which we obtain via a cookie banner when you first visit our website.
8.2 You can manage or withdraw your cookie consent at any time via the cookie banner or your browser settings.
9. Your Rights
9.1 If we are the data controller for your personal data, as described in section 2(a), you have the following rights under UK data protection law.
(a) the right to access your personal data;
(b) the right to have inaccurate data corrected;
(c) the right to have your data erased in certain circumstances;
(d) the right to restrict or object to processing in certain circumstances;
(e) the right to data portability;
(f) the right to withdraw consent at any time, where processing is based on consent;
(g) the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk, or by calling 0303 123 1113.
9.2 To exercise any of these rights, contact us at support@rotacubed.com.
9.3 If your personal data has been entered into RotaCubed by your employer or another organisation using our Service, we act only as a data processor for that data, and you should direct your request to that organisation in the first instance. We will support our business customers in responding to such requests as required by data protection law.
10. Security
10.1 We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or alteration, including encryption, access controls, and the use of reputable infrastructure providers, namely AWS, Supabase, and Cloudflare.
10.2 No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
11. Children
11.1 The Service is intended for business use and is not directed at, or intended for use by, individuals under the age of 18. We do not knowingly collect personal data from children.
12. Changes to This Policy
12.1 We may update this Privacy Policy from time to time. Material changes will be notified to Account holders by email or via the Service. The last updated date at the top of this Policy indicates when it was last revised.
13. Contact Us and Complaints
Itembay Limited (trading as RotaCubed). Company Number 12027952. Registered Office 235 Foxhall Road, Ipswich, IP3 8LF. Email: support@rotacubed.com
If you are unhappy with how we have handled your personal data, you can also complain to the Information Commissioner's Office (ICO): ico.org.uk, telephone 0303 123 1113.
Copyright © 2026 ItemBay Limited