This notice explains how [ClinTra QA Ltd] ("ClinTra QA", "we") uses personal information about subcontractors who use Clintra Portal, our app and system for recording hours, expenses and mileage, and for monthly claims.

1. Who we are

ClinTra QA Ltd is the data controller for the personal information in Clintra Portal.

• Registered office: [address]
• Company number: [number]
• ICO registration number: [number]
• Contact for anything in this notice: [email]
  

PxL Tech Ltd builds and runs Clintra Portal for us. They act on our instructions only.

2. What information we hold about you

Your account

• Your name, email address and initials.
• Your position (for example Auditor), the date you started in it, and your working-day length.
• Whether you are VAT-registered.
• Your pay rates, and any agreement reference attached to them.
• The projects you are assigned to, and the dates.

Your work and expenses

• Hours you log, with the date, project and the description of the work.
• Expenses, with amounts, the VAT shown on the receipt, any foreign currency, and a photo or file of each receipt. Receipts can show other details, such as the shop or hotel and part of a card number.
• Mileage journeys: where from, where to, the purpose and the miles.
• Your monthly claims, their status, and any comments between you and ClinTra QA about them.

Sign-in and security

• Your password, stored only in a scrambled form we can't read back.
• The secret behind your two-step sign-in, stored encrypted.
• When you were invited, chose your password and last signed in.
• How many devices are signed in, and any temporary lock after too many wrong attempts.
• A record of changes made in Clintra Portal (the audit trail), and of the emails it sent you.

On your phone

• The app keeps your sign-in on your phone, in its secure storage, if your phone has a screen lock.
• It saves forms you haven't finished, so you don't lose them. Signing out removes them.
• It uses the camera or your files only when you choose to add a receipt. Photos are made smaller and their location data is removed before upload.
• Fingerprint or face unlock is handled by your phone. We never receive it.

The app has no advertising, and no analytics or tracking.

3. Why we use it

• To pay you correctly for your work, expenses and mileage, and to produce your monthly summaries.
• To invoice our clients for your work and for expenses they have agreed to pay back.
• To keep the records the law requires us to keep, including for HMRC.
• To keep your account and our systems secure, and to show who changed what and when.
• To contact you about your account and your monthly claims, for example reminders before the end of the month.

4. Our lawful bases

- **Contract:** most of this is needed to run our agreement with you: recording your work, paying you and managing your claims.

- **Legal obligation:** keeping financial and tax records for the periods the law requires.

- **Legitimate interests:**

- security, preventing fraud and keeping an accurate audit trail

- giving our clients the evidence behind our invoices

We have weighed these against your interests and kept what we share to what is needed.

## 5. Who we share it with

**Our clients**

Each month we send the client you worked for a month pack. It contains:

- your name and initials

- the dates, hours and project of your work, and your descriptions of it

- the expenses they have agreed to pay back, with the receipts

- your mileage journeys for them (from, to, purpose and miles)

Clients never see your pay rate, what you are paid, or your other information. Please describe places by town or site name, not by a home address. The app reminds you of this.

**Service providers who work for us**

- PxL Tech Ltd, which builds, hosts and supports Clintra Portal.

- [Hosting provider], which runs the server in [country].

- Cloudflare, which stores receipts and month packs privately in [region].

- Zoho (ZeptoMail), which delivers our emails.

They may only use your information to provide their service to us.

**Others**

- Our accountants, and HMRC or other authorities where the law requires it.

- Apple and Google distribute the app. Their own privacy policies cover the app stores.

We do not sell your information.

## 6. How long we keep it

**Records:** we keep claims, hours, expenses, receipts and their audit trail for **six years from the end of the financial year they relate to**, as HMRC requires. After that we delete them.

**When you stop working with us:** we deactivate your account straight away, so it can no longer be used. The records above are kept until their six years are up.

**Sign-in sessions:** these end after 30 days without use, or when you sign out.

**On your phone:** anything the app saved on your phone is removed when you sign out.

## 7. Where it is stored

Your information is stored in [the UK / country] [and in region for receipts]. [If anything is processed outside the UK: we only do this with the safeguards UK law requires, such as [the UK International Data Transfer Agreement].]

## 8. How we keep it safe

- Everything travels encrypted.

- Signing in needs your password and a code from an authenticator app.

- Receipts and month packs are kept in private storage.

- A receipt opens only for you or ClinTra QA, through a short-lived link.

- A month pack goes to the client's named contact as a download link that stops working after 14 days.

- Contractors can only ever see their own information.

## 9. Your rights

You can ask us to:

- give you a copy of your information

- correct anything that's wrong (you can also ask ClinTra QA to change your name or email at any time)

- delete your information, where we don't have to keep it

- restrict how we use it, or object to our use of it

- give you your information in a form you can take elsewhere

Email support@clintraqa.com. We'll reply within one month.

**Deleting your account:** email support@clintraqa.com from the address on your account. We'll close the account straight away. As explained in section 6, we have to keep the work and expense records for six years, then we delete them.

If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office:

- website: ico.org.uk

- phone: 0303 123 1113

We'd appreciate the chance to put things right first.

## 10. Changes to this notice

If we change this notice, we'll update the date at the top. If a change is important, we'll tell you by email or in the app.

This notice covers Clintra Portal. Our website's own cookies and analytics are covered by the website's cookie notice.