Privacy policy

1. Who we are

Club Roster ("we", "us", "our") is based in New Zealand. Our privacy contact is hello@clubroster.co.nz.

This policy covers our website, clubroster.co.nz, and the Club Roster app that each business uses at its own web address.

2. Information we hold for businesses

Each business that uses Club Roster (a gym, club, shop or other workplace) decides who is in its Club Roster and what's recorded. We keep that information for the business, as its service provider. Under section 11 of the Privacy Act 2020 it's treated as held by the business, and we don't use it for our own purposes.

So if you're on the team of a business that uses Club Roster, that business is responsible for your information in it and is the first place to ask about it. Businesses should tell their people that their details are kept in Club Roster, and point them to this policy.

3. What's in a Club Roster

• Names, email addresses and mobile numbers.
• The areas and stores each person works in, their employment type, their access in the app, and in a gym, the programmes they're qualified to teach.
• Pay rates, salaries and guaranteed hours for staff, and in a gym, class fees for instructors.
• Rosters, swaps and cover, a gym's classes, and who agreed to them.
• Usual availability, days someone can't work, and leave requests, including the type of leave and any reason the person chooses to give.
• Clock-in and clock-out times, with the internet (IP) address of the phone or computer used, and timesheets.
• For instructors, the invoice amounts and numbers recorded against their statements.
• Sign-in records: emailed sign-in codes, stored scrambled, never as they were sent.
• A change log of who changed what and when, with the before and after.
• Copies of the emails the app sends.

4. How it's used

• To run Club Roster for the business: building the roster (and a gym's timetable), offering cover, sending notices, keeping timesheets, preparing statements and reporting against budgets.
• When a business has email switched on, the app emails people about their rosters, classes and requests. Instructors can turn off emails about classes on offer.
• To support the business when it asks us to, and to keep Club Roster secure and working properly.
• We don't sell personal information, use it for advertising, or use one business's information for another.

5. Who can see it

• Inside the business, it depends on the access it gives each person. The owner sees everything. Admins and managers see what they look after, and nobody sees the pay of anyone at their level or above, unless the owner lets an admin see all pay. Staff see their own shifts, requests and timesheets, and the week's team roster. A gym's instructors see their own classes and statements, and the covers they could take.
• When an instructor can't teach a class and gives a reason, the instructors offered the class can see that reason.
• We look at a business's information only to set it up, support it, fix a problem, or keep Club Roster secure.
• Our service providers: Cloudflare, Inc. hosts Club Roster and this website, stores the databases and sends the app's emails. Google Fonts supplies the typeface on our pages: your browser fetches the font files from Google, so Google sees your IP address, but no cookies are set.
• WhatsApp, only when someone chooses to share something there, like a class needing cover. What's shared is then handled by WhatsApp under that person's own account.
• Anyone else only when the law requires it.

6. Where it's stored

Club Roster runs on Cloudflare's global network, so information may be stored and processed in data centres outside New Zealand. Cloudflare handles it only to provide its services to us, under its data protection terms. Each business's information is kept in its own separate database.

7. Keeping it safe

• Everything is sent encrypted (HTTPS), and our pages use strict browser security settings.
• There are no passwords to steal: people sign in with their own email and a one-time code, and codes are stored scrambled.
• Access is limited by role, and every change is logged.
• Links in the app's emails open the right page but never sign anyone in, so a forwarded email gives nothing away. A business can sign someone out everywhere at any time.
• The owner and admins can download a full backup. A backup holds personal information, so keep it somewhere safe.

8. How long it's kept

• A business's information is kept while it uses Club Roster. People who leave are archived rather than deleted, so the business keeps the records it needs, like wage and time records. A business can ask us to delete a person's details.
• When a business stops using Club Roster, we keep its information for 30 days so it can download a copy, then delete it. Recovery copies held by our hosting provider are gone within a further 30 days.
• Information we hold for ourselves, like our invoices, is kept for as long as we need it, and for seven years where tax law requires it.

9. Information we collect for ourselves

• When a business talks to us or signs up, we keep the contact details of the people we deal with, what we've agreed, and invoices and payments.
• When you email us, we keep your email and our reply.
• This website has no forms, analytics or tracking. Our hosting provider processes technical details, like IP addresses, to deliver the website and protect it.
• We use this information to reply to you, to set up and support your business, and to bill for Club Roster. We email our customers' contacts about their service, and we won't send marketing emails without your OK.

10. Cookies and browser storage

This website sets no cookies. The Club Roster app uses only the cookies it needs to work: one that keeps you signed in and one that remembers which page to open after you sign in. In a shop with several stores, the app also remembers which store you last looked at, in your browser's own storage on that device; it holds nothing else and isn't sent anywhere. There are no tracking, analytics or advertising cookies.

11. Seeing and correcting your information

• You can ask to see the personal information held about you, and ask for it to be corrected.
• For information in a business's Club Roster, ask that business first. Managers can update most details, and a gym's instructors can update their own contact details and programmes in the app. You can also email us, and we'll work with the business to respond.
• For information we hold for ourselves, email us.
• We'll respond as soon as we can, and within 20 working days.

12. Privacy breaches

If something happens that puts a business's information at risk, we'll tell the business without undue delay and help it respond. Where a breach is likely to cause serious harm, the business (or we, for information we hold for ourselves) will tell the Privacy Commissioner and the people affected, as the Privacy Act requires.

13. Questions and complaints

Email hello@clubroster.co.nz. If you're not happy with our response, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

14. Changes to this policy

We'll update this page when things change, and tell our customers about important changes. The date at the top shows when it last changed.