Privacy Policy

Last updated: 2 November 2026

This Privacy Policy explains how WorkTenure (operated by JPTECK, United Kingdom; "WorkTenure", "we", "us") collects, uses, stores, shares and protects personal data when you use the WorkTenure web application at worktenure.co.uk (the "Service"). WorkTenure is a timesheet, approval, invoicing and compliance platform used by IT contract recruitment agencies, their clients and their contractors.

1. Who is responsible for your data

For account and subscription data of agencies using the Service, WorkTenure is the data controller. For the timesheet, invoice and compliance records an agency stores in the Service about its contractors and clients, the agency is the data controller and WorkTenure processes that data on the agency's behalf and on its instructions.

2. Data we collect

Category	Examples	Source
Account data	Name, email address, role, company name, hashed password, sign-in history	You or your agency administrator
Work and placement data	Clients, placements, contract dates, pay and charge rates, purchase orders	Agency administrators
Timesheet data	Days and hours worked, notes, submission and approval history	Contractors, agency administrators and approvers
Invoicing data	Invoices, self-bill invoices, company and VAT details, bank details for payment, logos	Agencies and contractors
Compliance documents	Right-to-work, insurance and similar documents and their expiry dates	Contractors and agencies
Subscription and billing data	Plan, billing contact, payment status (card details are handled by Stripe and never stored by us)	Agency administrators, Stripe
Connected cloud storage	Google or Dropbox account email and access tokens (see section 4)	Agency administrators who connect an account
Technical data	IP address, browser type, timestamps and an audit log of actions taken in the Service	Collected automatically

3. How we use data

To provide the Service: recording timesheets, routing them for approval, generating invoices, self-bills and PDF documents, and tracking compliance documents.
To send service emails such as invitations, password resets, approval requests, reminders, weekly summaries and document-expiry notices.
To manage subscriptions and payments.
To keep the Service secure, prevent misuse, maintain an audit trail and provide support.
To meet legal, tax and accounting obligations.

We do not sell personal data, and we do not use it for advertising.

4. Google Drive and Dropbox data

Agency administrators can choose to connect their own Google Drive or Dropbox account so they can save invoice, self-bill and approved timesheet PDFs to their own storage. Connecting is optional and can be undone at any time.

What we access

Google: we request the drive.file scope, which lets WorkTenure create and manage only the files and folders it creates itself. We cannot see, read or change any other file in your Google Drive. We also request your basic Google account email (openid, email) so we can show which account is connected.
Dropbox: we request permission to write files into a dedicated WorkTenure app folder in your Dropbox, and to read your account email to show which account is connected.

How we use it

Only when an administrator clicks "Save to cloud", we upload the selected PDFs into a WorkTenure folder, organised by client and by document type (Invoices, Self-bills, Timesheets).
We store the OAuth access and refresh tokens, encrypted in transit and held in our database, only to perform those uploads for that agency. Each agency's tokens are used only for that agency's account.
We do not read, download, index, analyse or share the contents of your Google Drive or Dropbox, and we do not use this data to train AI or machine-learning models.

Google API Services User Data Policy. WorkTenure's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not allow humans to read this data unless you give us explicit permission (for example, for support), it is needed for security purposes, or the law requires it.

Removing access

Click "Disconnect" in Settings → Organisation details to delete the stored tokens immediately. You can also revoke access from your Google account permissions or your Dropbox "Connected apps" settings. Files already saved to your storage belong to you and stay there.

5. Legal bases (UK GDPR)

Contract: to provide the Service to agencies and their users.
Legitimate interests: security, fraud prevention, service emails and improving reliability.
Legal obligation: tax, accounting and record-keeping.
Consent: connecting Google Drive or Dropbox, which you can withdraw at any time by disconnecting.

6. Who we share data with

We share data only with service providers that help us run the Service, under contracts that protect it:

Cloud hosting and database providers that store the Service and its data.
Stripe, for subscription payments.
Our email delivery provider, for service emails.
Google and Dropbox, only when you choose to connect them and save files.

Within the Service, data is visible only to users of the same agency according to their role (for example, approvers see only timesheets they are asked to approve). We may disclose data if required by law.

7. International transfers

Some of our providers may process data outside the UK. Where they do, we rely on appropriate safeguards such as UK adequacy regulations or the UK International Data Transfer Agreement / Addendum.

8. How long we keep data

We keep account and work records for as long as the agency's subscription is active, and afterwards for as long as needed to meet legal, tax and accounting requirements. Cloud storage tokens are deleted as soon as an account is disconnected. Agencies can ask us to delete their data when they close their account.

9. Security

All traffic uses HTTPS encryption.
Passwords are stored only as secure hashes.
Access is controlled by role, and every request is restricted to the user's own agency.
Email approval links and sign-in invitations are single-purpose and expire.
Important actions are recorded in an audit log.

10. Your rights

Under UK data protection law you can ask to access, correct, delete or restrict the use of your personal data, object to its use, and receive a copy in a portable format. If your data was added by an agency, please contact that agency first; we will help them respond. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk.

11. Cookies and local storage

We use only what is needed to keep you signed in and remember preferences such as light or dark mode. We do not use advertising or tracking cookies.

12. Children

The Service is for business use and is not intended for anyone under 18.

13. Changes to this policy

We may update this policy. We will change the "Last updated" date above and, for significant changes, notify agency administrators by email or in the Service.

14. Contact us

For privacy questions or data requests, please use our contact page.
WorkTenure · JPTECK, United Kingdom