Privacy policy

Effective [EFFECTIVE DATE]. Version 1.0.

This policy explains what personal data RosterBuddy collects, why, who can see it, how long we keep it, and the choices and rights you have. It is written to meet the Personal Data Protection Act 2012 (Singapore), the General Data Protection Regulation (EU) and UK GDPR, the Privacy Act 1988 and Australian Privacy Principles (Australia), Law No. 27 of 2022 on Personal Data Protection (Indonesia), and the Data Privacy Act of 2012, Republic Act No. 10173 (Philippines). Where those laws give you different rights, section 10 sets out what applies to you.

1. Who is responsible for your data

The controller (in Singapore's terms, the organisation; in the Philippines, the personal information controller; in Indonesia, the data controller; in Australia, the APP entity) is RosterBuddy, the operator of the RosterBuddy service, [POSTAL ADDRESS]. You can reach our Data Protection Officer at [email protected] or by post at the address above, marked for the attention of the DPO. [If required: our representative in the EU is [EU REPRESENTATIVE NAME AND ADDRESS]; our representative in the UK is [UK REPRESENTATIVE].]

2. What we collect

Information you give us

• Account details: your name and email address, and your password, which we store only as a salted hash.
• Crew profile: your employer (airline), home base and its time zone, rank, airline staff number, and the aircraft types you are qualified on, with expiry dates and whether you are business-class trained. These are self-declared.
• PayNow number: a Singapore mobile number, only if you add one to receive incentives.
• Your roster: the flights, standby and training you enter, including flight numbers, airports, report, departure, arrival and release times, and aircraft.
• Trade activity: the duties you offer, the terms you propose, counter and accept (including any incentive amount), the steps you record (roster change made, confirmed, incentive sent or received), and any dispute you raise, with the reason you give.
• Website signup: if you leave your email address on rosterbuddy.app to hear when your invitation is ready.
• Support correspondence and anything else you choose to send us.

Information collected automatically

• Server logs: for each request, your IP address, the address requested (without its query), the response status and how long it took, and a request ID. Logs never contain passwords, session tokens or what you entered.
• Sign-in sessions: when you sign in we create a session, stored only as a one-way digest of its token, with its expiry.
• Cookies: the web app uses one strictly necessary cookie to keep you signed in. The rosterbuddy.app website sets no cookies, runs no analytics and loads no third-party scripts or fonts. We do not use advertising or analytics cookies anywhere.
• An audit record of significant actions, such as terms proposed or accepted, a trade step confirmed, an invitation issued or an account suspended, with who did it and when.

Information we do not collect

We do not collect roster PDFs or screenshots, your airline login, precise location, contacts, health information, passport or government ID numbers, card or bank details, or information about your passengers. We ask you not to put sensitive personal data, such as health, religion or union membership, in a dispute reason or anywhere else in the Service.

Your roster is information about your work schedule. Under some of the laws that apply to us it may be treated as employment information; it is not special-category or sensitive data in itself, but we protect it as if it were because of what it reveals about your movements.

3. Why we use it and our legal basis

Under the GDPR and UK GDPR we need a legal basis for each purpose; under the PDPA, Indonesia's PDP Law and the Philippine DPA we rely on your consent or on a lawful basis set out in those laws; under the Australian Privacy Act we collect only what is reasonably necessary for our functions. The table shows each purpose and the basis we rely on.

Where we rely on legitimate interests we have checked that they are not outweighed by your interests and rights; you can object at any time (section 10). Where we rely on consent, withdrawing it does not affect what was done before you withdrew, and we will tell you if withdrawing consent means we can no longer provide part of the Service.

We do not use your data for automated decisions that have legal or similarly significant effects on you. The eligibility checks are automated and decide which offered duties you see, but every trade is proposed and accepted or declined by the people involved. If you think a check is wrong, correct your roster or profile, or contact us.

4. Who can see your data

Other members

Members at your airline whom the checks find eligible to take a duty you offer see that duty and your terms, including any incentive. They do not see your name or any other duty. Once a trade is accepted, the two members involved see each other's name and staff number, and the duties being traded. Once both have confirmed the roster change, a member who owes an incentive sees the receiving member's PayNow number. When duties change hands, the receiving member's roster holds a copy of the duty they took. Nobody else sees your roster, your email address or your profile.

Our administrators

Our administrators can see the account directory (name, email address, role, status and recent activity), manage invitations, and suspend accounts. They cannot see any member's roster. When a trade is disputed, a moderator sees that trade's agreed terms, the steps each member recorded, and the dispute reason.

Airlines and employers

We will disclose your information to an airline only if the law compels us to (for example a court order), or if you ask us to.

Service providers

We use companies that process data on our behalf and under our instructions, with contracts that require them to protect it: cloud hosting ([HOSTING PROVIDER], [REGION]); a network and security provider in front of our servers where we use one; and, where flight lookup is switched on, AeroDataBox, which receives only the flight number and date you look up, never who you are. A current list is available from the DPO. These providers may not use your data for their own purposes. We do not use any email, notification, analytics or advertising provider.

Others

We may disclose data to courts, regulators or law-enforcement bodies where legally required; to professional advisers under confidentiality; and to a buyer or successor if the Service changes hands, in which case this policy continues to apply and we will tell you. We never sell personal data and never share it with advertisers or data brokers.

5. How long we keep it

When you delete your account, we delete your roster entries that were never offered or traded, your profile, qualifications, PayNow number, password and sessions straight away. We keep a record that the account existed, without your name or email, so the other members' trade history and our security records still make sense.

6. How we protect it

Data is encrypted in transit. Passwords are stored as salted hashes and sign-in sessions only as one-way digests. Third-party API keys are stored encrypted. Every request for a roster is limited, on our servers, to the member it belongs to, and administrators have no screen that shows rosters. Our database is not reachable from the internet, and access to the servers is limited to the people who operate the Service.

If a breach is likely to result in significant harm to you, we will notify you and the relevant authority without undue delay and within the timelines each law sets: 72 hours under the GDPR and UK GDPR, 3 calendar days of assessing a notifiable breach under the PDPA, as soon as practicable under Australia's Notifiable Data Breaches scheme, 3 × 24 hours under Indonesia's PDP Law, and 72 hours under the Philippine DPA.

7. Where your data goes

Our primary servers are in [PRIMARY HOSTING REGION]. Because crew and our service providers are in several countries, your data may be transferred to and stored in countries other than your own, including [LIST OF COUNTRIES]. When that happens we make sure the data stays protected to a standard comparable to this policy:

• EU, EEA and UK residents: we transfer only under an adequacy decision or using the European Commission's Standard Contractual Clauses (and the UK Addendum or International Data Transfer Agreement), with a transfer risk assessment. A copy is available from the DPO.
• Singapore residents: transfers meet the PDPA Transfer Limitation Obligation, through contractual terms requiring a comparable standard of protection.
• Australian residents: before disclosing data overseas we take reasonable steps to ensure the recipient handles it in line with the Australian Privacy Principles, and we remain accountable for it under APP 8.
• Indonesian residents: transfers are made only to countries with an equal or higher level of protection, or under binding safeguards, or with your explicit consent, as the PDP Law requires. If Indonesian law requires certain data to be kept in Indonesia, we will comply.
• Philippine residents: we remain accountable for personal data transferred abroad and use contractual or other reasonable means to ensure a comparable level of protection, as the DPA requires.

8. Children

The Service is for working crew aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, tell us and we will close it and delete the data.

9. Marketing and notifications

We do not send marketing. The Service does not send push notifications, emails or text messages yet; updates about your trades appear in the app. If you leave your email address on our website, we use it only to tell you when your invitation is ready. If we add notifications later, we will update this policy first.

10. Your rights

Wherever you live, you can do the following in the app or by emailing [email protected]: see the personal data we hold about you; get a copy in a portable format (by email); correct it (in the app, under Profile); remove roster entries or delete your whole account (in the app, under Profile, Delete account); withdraw any consent you have given; and object to or restrict particular uses. We respond within 30 days (and within the shorter periods some laws set), free of charge unless requests are clearly excessive, and we may need to verify your identity first. If we refuse a request we will tell you why and how to challenge the refusal.

Singapore (PDPA)

You have the rights of access, correction, data portability and withdrawal of consent. If you are not satisfied with our response you may complain to the Personal Data Protection Commission (pdpc.gov.sg).

European Union, EEA and United Kingdom (GDPR, UK GDPR)

You have the rights of access, rectification, erasure, restriction, data portability, objection (including to processing based on legitimate interests and to direct marketing), and the right not to be subject to solely automated decisions with legal or similarly significant effects. You may complain to the supervisory authority in the country where you live or work; in the UK, the Information Commissioner's Office (ico.org.uk).

Australia (Privacy Act 1988)

You may access and correct your personal information, and we will not charge for access except reasonable costs. If you have a complaint, contact our DPO first; we will acknowledge it within 7 days and aim to resolve it within 30. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au). You may also deal with us anonymously or by pseudonym where practicable, though an invitation and a crew profile are needed to trade duties.

Indonesia (Law No. 27 of 2022)

You have the rights to information about the identity of the controller and the purposes of processing, to access and obtain a copy, to correct, to delete or destroy, to withdraw consent, to object to automated decision-making, to restrict processing, and to data portability, as well as to compensation for breaches of the law. Requests are handled within 3 × 24 hours for acknowledgement and completed within the periods the law and its regulations set. Complaints may be made to the Indonesian data protection authority once established, and in the meantime to the Ministry responsible for communications and digital affairs.

Philippines (Republic Act No. 10173)

You have the rights to be informed, to object, to access, to rectification, to erasure or blocking, to damages, to data portability, and to lodge a complaint with the National Privacy Commission (privacy.gov.ph). Our DPO is registered with the Commission where required.

11. Changes to this policy

We will tell you by email at least 30 days before any change that reduces your privacy or expands how we use your data, and ask for new consent where the law requires it. Smaller changes take effect when published, with the version number and date updated at the top. Previous versions are available on request.

12. Contact

Data Protection Officer
RosterBuddy
[POSTAL ADDRESS]
[email protected]