Where your details came from
From the contractor named in your invitation. They typically gave us your name, email address and phone number, and sometimes your Unique Taxpayer Reference or National Insurance number. Everything else comes from you, or from the checks you complete during onboarding.
Who is responsible for your data
- The contractor is responsible for the onboarding records it requires — your right-to-work evidence, your employment-status determination, your signed contract, and the CIS records of your work for them. We hold and process those on their instructions.
- Valla is responsible for your account itself, your sign-in and security, and for running the Platform.
If you want to see, correct, or object to your onboarding records, ask the contractor first. If it is easier, contact us and we will point you to the right person and let them know.
What onboarding involves
Four steps, in this order. All are required before you can invoice that contractor through Valla:
- HMRC verification — we check your CIS status with HMRC to get your deduction rate. Without it, the law requires deduction at 30% instead of 20%, or the contractor cannot pay you.
- Right to work — an identity check through a certified provider. You will photograph an identity document and take a video selfie. Without this, the contractor cannot lawfully engage you.
- Employment-status questionnaire — your answers go to the contractor. The contractor decides your status, not the questionnaire and not us.
- Signing your contract — electronically, in the Platform.
What the contractor can see
The contractor who invited you sees the onboarding evidence it required, and the invoices, statements and payments between you and them. It does not see your data relating to any other contractor.
What we do not do
We do not sell your data. We do not use it to advertise to you. We do not use it to train AI models. We do not decide your employment status, and we do not decide whether you get work.
Where your data is kept, and for how long
In the United Kingdom, on servers in London. Tax records are kept for at least six years because HMRC requires it; right-to-work evidence for the engagement plus two years, because the Home Office requires it. Full detail is in our Privacy Policy.
Some of our records are append-only — built so entries cannot be edited or deleted, which is what makes them trustworthy to HMRC. For those records we cannot delete your data, and we will restrict its use instead. We would rather tell you that up front.
Your rights
You can ask us for a copy of your data, ask us to correct it, object to how it is used, ask for it to be erased, or ask us to restrict it. You can also ask a person to review any decision the Platform made automatically about you.
Email privacy@vallacis.co.uk and we will reply within one month.
If you are unhappy
Tell us first — use the form at vallacis.co.uk/privacy/complaint or email privacy@vallacis.co.uk with “Data protection complaint” in the subject. We will acknowledge within 30 days and tell you the outcome.
You can also complain to the Information Commissioner’s Office at ico.org.uk or 0303 123 1113, at any time.
Valla CIS Limited · Company number 17216592 · Neville House, 66 High Street, Henley-in-Arden, England, B95 5BX
Full detail: Privacy Policy · Terms and Conditions
Last updated 7 September 2026.