Luna Rota

Privacy

Privacy Policy for Luna Rota

Effective Date: 20 October 2026

This Privacy Policy explains how Luna Rota collects, uses, and protects personal data. Luna Rota is a staff rota service for hospitality venues, part of Luna Loyalty and operated by Elliott Digital Solutions LTD. We provide rota software to independent venues across the UK.

We are committed to handling personal data securely and in accordance with United Kingdom data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller and Data Processor

Responsibilities are divided between Luna Rota and the venues that use it:

  • Data Controller (The Venue): The venue that employs you and sets up its rota on Luna Rota is the Data Controller for its staff data. It decides which staff are on the rota and how the rota is used.
  • Data Processor (Luna Rota): Elliott Digital Solutions LTD, trading as Luna Loyalty, acts as the Data Processor. We operate the platform and infrastructure that runs the rota on behalf of venues.

Luna Rota does not hold customer data. It is a tool for a venue's staff and managers.

2. What Information We Collect

We only collect information that is needed to run the rota and provide support.

  • Staff Identity and Contact Data: Staff names and, where a venue provides one, an email address.
  • Rota Data: Shift days and times, role labels, availability, and the weeks a venue has drafted and published.
  • Pay Data: Pay rates and the costs and totals worked out from them. A venue's owners and admins can see these. They are not sent to staff.
  • Security Data: Your sign-in details. Passwords are stored only in a scrambled (hashed) form, so neither venue managers nor our administrators can read them.
  • Activity Records: An audit trail of publishes, staff deletions, restores and the creation of staff logins. Draft edits are not recorded in it.
  • Snapshots: Copies of a venue's rota data that a venue creates, or that are made automatically, so the venue can recover from mistakes.
  • Support Data: If you email us for help, the contents of your message and the details you choose to include.

3. Why We Process Data (Lawful Basis)

We process personal data on behalf of venues under the following lawful bases:

  • Contractual Necessity: To run the rota for the venue, show staff their shifts, and send essential emails such as published-week notices and password resets.
  • Legitimate Interests: To keep the service secure, diagnose problems, prevent misuse, and keep backups so a venue can recover its data.
  • Legal Obligation: Where the law requires us to keep or disclose information.

4. Who Can See Your Data

We do not sell personal data. Access is limited by role:

  • Staff: Staff can see the whole team's names and times for published weeks. They cannot see drafts or any pay figures.
  • Owners and Admins: A venue's owners and admins can see its staff details, drafts, hours, pay rates and costs. They cannot see any other venue's data.
  • Other Venues: Each venue's data is kept in its own database schema, separate from every other venue's.
  • Platform Administrators: Luna Loyalty processes data centrally to host, secure and maintain the service.

Third-Party Sub-Processors To deliver the service, Luna Rota uses the following infrastructure providers:

  • OVHcloud: Server hosting and database infrastructure.
  • Cloudflare: Security and page delivery.

Email from Luna Rota is sent through Luna's own mail service. Where a provider handles data outside the UK, it must do so under the safeguards required by UK data protection law.

5. Data Retention

  • Active Venues: A venue's rota data is kept for as long as the venue uses Luna Rota.
  • Deleted Staff: When a venue permanently deletes a staff record, a snapshot is taken first so the venue can recover from a mistake. Snapshots are kept until they are removed.
  • Leaving Luna Rota: If a venue stops using Luna Rota, ask us and we will delete its data.
  • Support Emails: Kept only as long as needed to help you.

6. Your Data Protection Rights

Under UK data protection law, you have the following rights regarding your personal data:

  • Right of Access: You can request a copy of the personal data held about you.
  • Right to Rectification: You can ask for inaccurate or incomplete data to be corrected.
  • Right to Erasure: You can ask for your personal data to be deleted.

To exercise these rights, speak to the management of the venue you work for first. For platform-level queries, email us at [email protected].

If you are dissatisfied with how your personal data has been handled, you have the right to lodge a complaint with the Information Commissioner's Office (ICO). You can contact them at ico.org.uk.