Contractor Privacy Policy
Last updated: 23/10/2026
CLINTRA QA Ltd · Version 1.0 · Effective 1 November 2026
1. Introduction
This policy explains how CLINTRA QA Ltd (trading as ClinTra QA, "we", "us") collects and uses personal data through the ClinTra Portal (the "Portal"), our contractor app and its admin dashboard.
The Portal is used by contracted staff and subcontractors to log working hours, record expenses and upload receipts, and by ClinTra QA administrators to review submissions, calculate pay and prepare client invoices. This policy applies to everyone who uses the Portal. It does not cover the ClintraQA.com website, which has its own notice.
We process your data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Who is responsible for your data
CLINTRA QA Ltd is the data controller for personal data processed in the Portal.
Detail | Information |
|---|---|
Company | CLINTRA QA Ltd (trading as ClinTra QA) |
Registered address | Baylis House, Room 16, Stoke Poges Lane, Slough, Berkshire, SL1 3PB, United Kingdom |
Company number | 17163211 |
Privacy contact | Ahmed Salih, Director — support@clintraqa.com |
We do not have a statutory Data Protection Officer. Direct any privacy questions to the contact above.
3. What personal data we collect
We collect only what is needed to run the Portal, pay you correctly and invoice our clients.
Category | Examples | Source |
|---|---|---|
Account and identity | Name, email address, phone number, role, login credentials (stored as a one-way hash) and two-step verification secret (stored encrypted), VAT registration status and VAT number where applicable | You, when your account is set up |
Engagement details | Client(s) you are assigned to, your agreed hourly rate, standard working-day length, contract start and end dates | ClinTra QA, from your subcontractor agreement |
Time records | Daily hours logged, dates, client and activity worked on, monthly submission status | You, through the Portal |
Expenses and receipts | Expense type, amount, date, description, and the receipt image or PDF you upload | You, through the Portal |
Mileage | Journey date, start and end points, miles claimed, vehicle details if required | You, through the Portal |
Payment and billing | Pay calculated from your hours and rate, expense reimbursements, invoice references, bank details for payment | You and ClinTra QA |
Technical and usage | IP address, device and browser type, login times, actions taken in the Portal (audit log) | Collected automatically |
Receipts you upload may contain personal data about you or occasionally about others (for example a hotel booking). Please redact anything not needed to support the expense, such as card numbers.
We do not ask for, and you should not upload special category data (such as health information) to the Portal.
4. How we use your data and why we are allowed to
Each use below rests on one of the lawful bases in Article 6 of the UK GDPR.
Purpose | Lawful basis |
|---|---|
Creating and managing your Portal account | Performance of a contract (your subcontractor agreement) |
Recording, reviewing and approving your hours and expenses | Performance of a contract |
Calculating and paying what you are owed | Performance of a contract |
Preparing invoices and supporting evidence (timesheets, receipts) for our clients | Legitimate interests — running our consultancy and billing clients accurately |
Keeping financial and tax records, including VAT and mileage records | Legal obligation (HMRC and Companies Act requirements) |
Maintaining audit logs and securing the Portal | Legitimate interests — protecting the Portal, our clients' data and preventing fraud |
Resolving queries, disputes or complaints about pay or expenses | Legitimate interests and, where relevant, legal claims |
Contacting you about submissions, deadlines and Portal changes | Performance of a contract |
We do not use your data for marketing, profiling or automated decisions with legal effects. Pay and billing figures are calculated automatically from the hours and rates entered, but every submission is reviewed by a ClinTra QA administrator before payment or invoicing.
Contractors can see only their own rate and records. ClinTra QA's client charge-out rates are visible only to administrators.
5. Who we share your data with
We share your data only where needed to run the Portal and the business. We never sell it.
Recipient | What they receive | Why |
|---|---|---|
Our clients (e.g. the sponsor you are contracted to) | Your name, hours worked, dates, expense amounts and receipts, as part of the monthly invoice pack | To evidence the services billed to them |
PxL Tech Ltd | Develops, hosts and maintains the Portal and its database on a private server | Our processor, under a written contract |
Contabo GmbH | Provides the EU-based server that PxL Tech manages | Hosting infrastructure |
Cloudflare, Inc. (R2 storage) | Receipts, monthly client packs and invoice PDFs | Private file storage; files are served only through permission-checked links that expire after 5 minutes |
Zoho Corporation (ZeptoMail, EU service) | Your name and email address; sign-in links; reviewer comments when a month is returned or reopened | Sending invitations, password resets, claim updates and reminders. Emails never contain rates or amounts |
Apple App Store and Google Play | App download and update data under their own privacy terms | Distributing the app |
Accountants and bookkeepers | Pay, expense and invoice records | Preparing accounts, VAT returns and tax filings |
HMRC and other authorities | Financial and tax records | Where the law requires it |
Professional advisers (legal, insurance) | Relevant records | If needed to handle a claim or dispute |
The Portal does not use third-party sign-in, push notifications, error monitoring or in-app analytics. Client invoice packs contain only the information needed to support the charges — your hourly rate is not shared with clients.
6. International transfers
The Portal's server and database are hosted by Contabo in the European Union. Receipts, invoice files and database backups are held in Cloudflare R2 storage in the European Union. Emails are sent through ZeptoMail's EU service. The UK recognises the EU as providing adequate protection for personal data. Cloudflare (United States) and Zoho (India and United States) are headquartered outside the UK; where any of their support or processing takes place outside the UK or EU, we rely on the UK Addendum to the EU Standard Contractual Clauses or the UK International Data Transfer Agreement included in their terms.
7. How long we keep your data
We keep records for as long as needed for the purpose, then delete or anonymise them.
Data | Retention period | Reason |
|---|---|---|
Timesheets, expenses, receipts, mileage and invoices | 6 years from the end of the financial year they relate to | HMRC record-keeping requirements for VAT and corporation tax |
Account and engagement details | Duration of your engagement, then 6 years | Linked to the financial records above and any contractual claims |
Bank details | Until your final payment has cleared, then deleted | No longer needed once paid |
Audit log (who did what, and when, in the Portal) | 6 years, in line with our financial record keeping | Evidence that submissions, approvals and admin actions were genuine. The log cannot be edited or deleted by anyone |
Login credentials and two-step secrets | Disabled when your account is deactivated; deleted with the account record at the end of the retention period | No longer needed |
Backups | Daily database backups to Cloudflare R2, reviewed periodically and deleted once they are older than the 6-year retention period | Recovery after loss or failure |
When your engagement ends, your account is deactivated: sign-in is refused immediately and all your devices are signed out, but your submitted records stay for the retention period because they support payments and client invoices. An account that was never used (no entries, claims or receipts) is deleted outright. You can delete entries yourself only in a month you have not yet submitted; nothing submitted can be deleted.
Where a client's own contractual or regulatory retention rules (for example GCP record-keeping) require a longer period for invoice packs sent to them, the client holds those copies as controller of its own records.
8. How we keep your data secure
We apply technical and organisational measures appropriate to the risk, including:
- Mandatory two-step verification: every contractor and administrator must use an authenticator app (time-based 6-digit code) on every sign-in
- Passwords are never stored — only a salted one-way hash (PBKDF2-SHA256); authenticator secrets are encrypted (AES-GCM)
- Role-based access: contractors see only their own records; admin functions are restricted to ClinTra QA administrators
- All traffic uses HTTPS (TLS); release builds of the app refuse unencrypted connections
- Receipts, invoice files and database backups are encrypted at rest by Cloudflare; files are served only through permission-checked links that expire after 5 minutes
- The app's session token is held in the phone's secure storage (Keychain or Keystore) and excluded from device backups; Face ID or fingerprint unlock is handled by the phone, and no biometric data reaches the app or our server
- Repeated failed sign-ins lock the account, and sign-in attempts are rate-limited; app sessions expire after 30 days unused and after 90 days regardless, and admin sessions end after 30 minutes idle
- A tamper-proof audit log of submissions, approvals and admin actions, which never contains passwords, tokens or two-step codes
- The database is backed up automatically every day to Cloudflare R2, separate from the server
- Written contracts with PxL Tech and our other processors covering confidentiality and security
If a personal data breach is likely to put your rights at risk, we will tell you and, where required, report it to the Information Commissioner's Office within 72 hours.
9. Your rights
Under the UK GDPR you can:
- Access — ask for a copy of the personal data we hold about you
- Rectification — ask us to correct inaccurate or incomplete data
- Erasure — ask us to delete your data, where we no longer need it (financial records must be kept for the periods in section 7)
- Restriction — ask us to pause processing while a query is resolved
- Portability — receive the data you gave us in a structured, machine-readable format
- Objection — object to processing based on legitimate interests
To exercise any right, email support@clintraqa.com. We will respond within one month and will not charge a fee unless a request is clearly unfounded or excessive. We may ask you to confirm your identity first.
Accounts are created by ClinTra QA rather than by you, so there is no in-app option to delete your account. Erasure requests are handled under the retention rules in section 7: records that support payments and invoices must be kept for 6 years, but your account will be deactivated, your bank details deleted once your final payment has cleared, and anything else not needed for those records removed.
10. Cookies and similar technologies
The app uses no cookies or tracking. The admin dashboard uses one essential cookie to keep you signed in. Neither uses analytics.
The public website at ClintraQA.com uses Google Analytics, but only after a visitor clicks Accept on the cookie banner; the choice can be changed at any time under "Cookie settings" in the website footer. The website has its own cookie notice.
11. Changes to this policy
We may update this policy when the Portal or the law changes. The current version is always available in the Portal and at ClintraQA.com. We will notify you in the Portal or by email of any material change.
Version 1.0 — effective 1 November 2026.
12. Complaints
If you are unhappy with how we handle your data, please contact us first at support@clintraqa.com so we can put it right.
You also have the right to complain to the UK supervisory authority: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; helpline 0303 123 1113; ico.org.uk.