Cookie Policy of Opraas.co.uk

Last updated: 16 December 2025

This document informs Users about the technologies that help opraas.co.uk to achieve the purposes described below. Suchtechnologies allow the Owner to access and store information (for example by using a Cookie) or use resources (for example byrunning a script) on a User’s device as they interact with opraas.co.uk.

For simplicity, all such technologies are defined as “Trackers” within this document – unless there is a reason to differentiate.For example, while Cookies can be used on both web and mobile browsers, it would be inaccurate to talk about Cookies in thecontext of mobile apps as they are a browser-based Tracker. For this reason, within this document, the term Cookies is only usedwhere it is specifically meant to indicate that particular type of Tracker.

Some of the purposes for which Trackers are used may also require the User’s consent. Whenever consent is given, it can befreely withdrawn at any time following the instructions provided in this document.

Opraas.co.uk uses Trackers managed directly by the Owner (so-called “first-party” Trackers) and Trackers that enable servicesprovided by a third-party (so-called “third-party” Trackers). Unless otherwise specified within this document, third-partyproviders may access the Trackers managed by them.The validity and expiration periods of Cookies and other similar Trackers may vary depending on the lifetime set by the Owneror the relevant provider. Some of them expire upon termination of the User’s browsing session.In addition to what’s specified in the descriptions within each of the categories below, Users may find more precise and updatedinformation regarding lifetime specification as well as any other relevant information – such as the presence of other Trackers – inthe linked privacy policies of the respective third-party providers or by contacting the Owner.

How opraas.co.uk uses Trackers

Necessary

Opraas.co.uk uses so-called “technical” Cookies and other similar Trackers to carry out activities that are strictly necessary forthe operation or delivery of the Service.

Trackers managed directly by the Owner

Preference Cookies (opraas.co.uk)

Preference Cookies store the User preferences detected on opraas.co.uk in the local domain such as, for example, their timezoneand region.

Personal Data processed: Trackers.

sessionStorage (opraas.co.uk)

sessionStorage allows opraas.co.uk to store and access data right in the User’s browser. Data in sessionStorage is deletedautomatically when the session ends (in other words, when the browser tab is closed).

Personal Data processed: Trackers.

Trackers managed by third parties

iubenda Privacy Controls and Cookie Solution (iubenda srl)

The iubenda Privacy Controls and Cookie Solution allows the Owner to collect and store Users’ preferences related to theprocessing of personal information and in particular to the use of Cookies and other Trackers on opraas.co.uk.

Personal Data processed: IP address and Trackers.

Place of processing: Italy – Privacy Policy.

Trackers duration:

_iub_cs-*: 1 year

Google reCAPTCHA (Google LLC)

Google reCAPTCHA is a SPAM protection service provided by Google LLC. The use of reCAPTCHA is subject to the Googleprivacy policy and terms of use.

In order to understand Google’s use of Data, consult their partner policy and their Business Data page.

Personal Data processed: answers to questions, clicks, keypress events, motion sensor events, mouse movements, scroll position,touch events, Trackers and Usage Data.

Place of processing: United States – Privacy Policy.

Trackers duration:

_GRECAPTCHA: duration of the session

rc::a: indefinite

rc::b: duration of the session

rc::c: duration of the session

rc::f: indefinite

iubenda WayWidget (iubenda srl)

iubenda WayWidget is a service that helps websites to comply with accessibility standards and is provided by iubenda srl.

Personal Data processed: IP address, page views, Trackers and Usage Data.

Place of processing: Italy – Privacy Policy.

Functionality

Opraas.co.uk uses Trackers to enable basic interactions and functionalities, allowing Users to access selected features of theService and facilitating the User’s communication with the Owner.

Mailing list or newsletter

By registering on the mailing list or for the newsletter, the User’s email address will be added to the contact list of those who may receive email messages containing information of commercial or promotional nature concerning opraas.co.uk. Your email addressmight also be added to this list as a result of signing up to opraas.co.uk or after making a purchase.

Personal Data processed: email address, Trackers and Usage Data.

MailPoet (Automattic Inc.)

MailPoet is an email marketing and newsletter service provided by Automattic Inc. that allows opraas.co.uk to manage mailing lists and send newsletters to Users.

Personal Data processed: email address, Trackers and Usage Data.

Place of processing: United States – Privacy Policy.

Trackers duration:

mailpoet_subscriber: indefinite

mailpoet_page_view: duration of the session

Experience

Opraas.co.uk uses Trackers to improve the quality of the user experience and enable interactions with external content, networksand platforms.

Elementor Form widget (Elementor Ltd.)

Elementor Form widget is a form builder for Elementor.

Personal Data processed: Data communicated while using the service, Trackers and Usage Data.

Place of processing: Israel – Privacy Policy.

Google Fonts (Google LLC)

Google Fonts is a typeface visualisation service provided by Google LLC that allows opraas.co.uk to incorporate content of thiskind on its pages.

Personal Data processed: Trackers and Usage Data.

Place of processing: United States – Privacy Policy.

Vimeo video (Vimeo, LLC)

Vimeo is a video content visualisation service provided by Vimeo, LLC that allows opraas.co.uk to incorporate content of thiskind on its pages.

Personal Data processed: Trackers and Usage Data.

Place of processing: United States – Privacy Policy.

Trackers duration:

player: 1 year

sync_active: duration of the session

vuid: 2 years

Measurement

Opraas.co.uk uses Trackers to measure traffic and analyze User behavior to improve the Service.

Google Analytics 4 (Google LLC)

Google Analytics 4 is a web analysis service provided by Google LLC (“Google”). Google utilizes the Data collected to track andexamine the use of opraas.co.uk, to prepare reports on its activities and share them with other Google services. Google may usethe Data collected to contextualize and personalize the ads of its own advertising network. In Google Analytics 4, IP addressesare used at collection time and then discarded before Data is logged in any data center or server. Users can learn more byconsulting Google’s official documentation.

In order to understand Google’s use of Data, consult their partner policy and their Business Data page.

Personal Data processed: number of Users, session statistics, Trackers and Usage Data.

Place of processing: United States – Privacy Policy – Opt out.

Trackers duration:

_ga: 2 years

_ga_*: 2 years

Site Kit (Google LLC)

Site Kit is a WordPress plugin provided by Google LLC that connects to various Google services to monitor website metrics suchas site performance, traffic, and ad revenue.

Personal Data processed: country, purchase history, search history, Trackers, Usage Data and various types of Data as specified inthe privacy policy of the service.

Place of processing: United States – Privacy Policy.

Marketing

Opraas.co.uk uses Trackers to deliver personalised ads or marketing content, and to measure their performance.

How to manage preferences and provide or withdraw consent on opraas.co.uk

Whenever the use of Trackers is based on consent, users can provide or withdraw such consent by setting or updating theirpreferences via the relevant privacy choices panel available on opraas.co.uk.

With regard to any third-party Trackers, Users can manage their preferences via the related opt-out link (where provided), byusing the means indicated in the third party’s privacy policy, or by contacting the third party.

How to control or delete Cookies and similar technologies via your device settings

Users may use their own browser settings to:

See what Cookies or other similar technologies have been set on the device;

Block Cookies or similar technologies;

Clear Cookies or similar technologies from the browser.

The browser settings, however, do not allow granular control of consent by category.

Users can, for example, find information about how to manage Cookies in the most commonly used browsers: Google Chrome, Mozilla Firefox, Apple Safari, Microsoft Internet Explorer, Microsoft Edge, Brave, Opera.

Users may also manage certain categories of Trackers used on mobile apps by opting out through relevant device settings such asthe device advertising settings for mobile devices, or tracking settings in general (Users may open the device settings and look forthe relevant setting).

How to opt out of interest-based advertising

Notwithstanding the above, Users may follow the instructions provided by YourOnlineChoices (EU), the Network AdvertisingInitiative (US) and the Digital Advertising Alliance (US), DAAC (Canada), DDAI (Japan) or other similar services. Suchinitiatives allow Users to select their tracking preferences for most of the advertising tools. The Owner thus recommends thatUsers make use of these resources in addition to the information provided in this document.

The Digital Advertising Alliance offers an application called AppChoices that helps Users to control interest-based advertising onmobile apps.

Consequences of denying consent

Users are free to decide whether or not to grant consent. However, please note that Trackers help opraas.co.uk to provide a betterexperience and advanced functionalities to Users (in line with the purposes outlined in this document). Therefore, in the absenceof the User’s consent, the Owner may be unable to provide related features.

Owner and Data Controller

OPRaaS Limited
Suite 10
Harefield House
Alderley Road
Wilmslow
Cheshire
SK9 1RA

Owner contact email: info@opraas.co.uk

Since the use of third-party Trackers through opraas.co.uk cannot be fully controlled by the Owner, any specific references tothird-party Trackers are to be considered indicative. In order to obtain complete information, Users are kindly requested toconsult the privacy policies of the respective third-party services listed in this document.

Given the objective complexity surrounding tracking technologies, Users are encouraged to contact the Owner should they wishto receive any further information on the use of such technologies by opraas.co.uk.

Definitions and legal references

Personal Data (or Data)

Any information that directly, indirectly, or in connection with other information — including a personal identification number —allows for the identification or identifiability of a natural person.

Usage Data

Information collected automatically through opraas.co.uk (or third-party services employed in opraas.co.uk), which can include:the IP addresses or domain names of the computers utilised by the Users who use opraas.co.uk, the URI addresses (UniformResource Identifier), the time of the request, the method utilised to submit the request to the server, the size of the file received inresponse, the numerical code indicating the status of the server’s answer (successful outcome, error, etc.), the country of origin,the features of the browser and the operating system utilised by the User, the various time details per visit (e.g., the time spent oneach page within the Application) and the details about the path followed within the Application with special reference to thesequence of pages visited, and other parameters about the device operating system and/or the User’s IT environment.

User

The individual using opraas.co.uk who, unless otherwise specified, coincides with the Data Subject.

Data Subject

The natural person to whom the Personal Data refers.

Data Processor (or Processor)

The natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller, asdescribed in this privacy policy.

Data Controller (or Owner)

The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposesand means of the processing of Personal Data, including the security measures concerning the operation and use of opraas.co.uk.The Data Controller, unless otherwise specified, is the Owner of opraas.co.uk.

opraas.co.uk (or this Application)

The means by which the Personal Data of the User is collected and processed.

Service

The service provided by opraas.co.uk as described in the relative terms (if available) and on this site/application.

European Union (or EU)

Unless otherwise specified, all references made within this document to the European Union include all current member states tothe European Union and the European Economic Area.

Cookie

Cookies are Trackers consisting of small sets of data stored in the User’s browser.

Tracker

Tracker indicates any technology – e.g Cookies, unique identifiers, web beacons, embedded scripts, e-tags and fingerprinting -that enables the tracking of Users, for example by accessing or storing information on the User’s device.

Legal information

This policy relates solely to opraas.co.uk, if not stated otherwise within this document.

Latest update: 16 December 2025

Version: 3

Acronym	Full Term	Definition
CFA 2017	Criminal Finances Act 2017	UK legislation introducing Corporate Criminal Offence (sections 45/46): failure to prevent the facilitation of tax evasion. Requires businesses to implement 'reasonable prevention procedures' (RPP). The only defence is having adequate RPP or showing it was not reasonable to expect such procedures.
MSA 2015	Modern Slavery Act 2015	UK legislation mandating supply chain transparency and worker safeguarding. Section 54 requires commercial organisations with ≥£36m turnover to publish annual modern slavery statements (board-approved, signed by director, published on website with prominent homepage link).
IR35	Off-Payroll Working Rules	Tax legislation determining whether a contractor should be treated as employed or self-employed for tax purposes. Since April 2021, medium and large private sector clients must determine contractor status and deduct employment taxes if inside IR35. Requires Status Determination Statement (SDS).
JSL	Joint & Several Liability	2026 legislation imposing strict liability on agencies and end-hirers for umbrella company tax debts, even where due diligence checks have been undertaken. Makes supply chain participants jointly responsible for unpaid PAYE taxes.
AWR	Agency Workers Regulations 2010	UK regulations giving agency workers the right to the same basic working and employment conditions as permanent employees after 12 weeks in a qualifying assignment (12-week parity rule).
Good Work Plan	Good Work Plan 2020	UK employment law reforms requiring written 'section 1 statement' of employment particulars to be given to employees and workers on or before day 1 of engagement (effective 6 April 2020). Sets out key terms but is not itself the contract.
Construction Act	Housing Grants, Construction and Regeneration Act 1996	UK legislation governing payment practices in construction contracts. Section 113 renders "pay when paid" clauses ineffective (except where upstream payer is insolvent). Requires clear due dates, final dates for payment, and compliant payment/pay less notices.
Pensions Act 2008	Pensions Act 2008	UK legislation establishing workplace pension auto-enrolment requirements. Employers must automatically enrol eligible workers into qualifying pension schemes and make minimum contributions.

Acronym	Full Term	Definition
HMRC	HM Revenue & Customs	UK government department responsible for tax collection, payment of tax credits and benefits, and enforcement of tax law. Operates PAYE, CIS, RTI systems and conducts compliance audits. Business Tax Account provides reconciliation data.
GLAA	Gangmasters and Labour Abuse Authority	UK government body regulating labour providers in certain sectors (agriculture, horticulture, shellfish gathering, food processing/packaging) and investigating worker exploitation. Operates licensing regime and has criminal investigation powers. Hotline: 0800 432 0804 (03000 718234 out of hours).
ICO	Information Commissioner's Office	UK independent authority upholding information rights. Enforces UK GDPR and Data Protection Act 2018. Personal data breaches must be reported to ICO within 72 hours where there's risk to individuals' rights. Provides guidance on lawful bases, DSARs, and data-sharing.
CITB	Construction Industry Training Board	Industry body that collects levy from construction employers (payroll ≥£80k in PAYE in last tax year, or ≥£80k net CIS payments) and provides training grants. CITB levy compliance is audited in construction-focused compliance audits.

Acronym	Full Term	Definition
PAYE	Pay As You Earn	HMRC's system for collecting Income Tax and National Insurance Contributions from employees' wages. Employers deduct tax before paying employees, then remit to HMRC. Operates under Real Time Information (RTI) reporting requirements.
CIS	Construction Industry Scheme	Tax deduction scheme for payments to subcontractors in construction industry. Contractors must verify subcontractors with HMRC before first payment and make deductions (20% for verified, 30% for unverified) on labour element only (excluding VAT and allowable materials). CIS300 returns due by 19th following tax month.
GPS	Gross Payment Status	CIS status allowing subcontractors to be paid without deductions. Must apply to HMRC and meet compliance tests (business test, turnover test, compliance test). Contractors must verify GPS and keep evidence; continue to file CIS300 but make no deduction.
CIS300	CIS Monthly Return	HMRC return submitted by contractors detailing total payments made to each subcontractor and CIS tax deductions applied. Must be filed by the 19th following the tax month (6th–5th). Should reconcile to subcontractor statements and bank payments.
CIS340	CIS340 Guidance	HMRC's official guidance document defining what constitutes 'construction operations' for CIS purposes. Only work qualifying under CIS340 can legitimately be paid through the Construction Industry Scheme. Includes site preparation, construction, alteration, repairs, demolition.
RTI	Real Time Information	HMRC system requiring employers to report PAYE information at or before each pay run. Consists of Full Payment Submission (FPS) for regular pay data and Employer Payment Summary (EPS) for adjustments/recoveries. Must reconcile to payslips and Business Tax Account.
FPS	Full Payment Submission	RTI submission reporting gross taxable pay, Income Tax, and NICs for each employee on each payday. FPS values must match payslips. Should not be used to mask under-deductions.
EPS	Employer Payment Summary	RTI submission used only for adjustments, such as recoveries, statutory payments, employment allowance claims, or apprenticeship levy. Should not be used to mask PAYE under-deductions.
Bacs	Bankers' Automated Clearing Services	UK electronic payment system used for direct debits and credits, including salary payments. Net pay on payslip must match Bacs transfer to worker's bank account. Never use "BACS" (incorrect).
UTR	Unique Taxpayer Reference	10-digit number issued by HMRC to identify individuals and businesses for tax purposes. Required for CIS verification and self-assessment tax returns. Note: UTR alone isn't proof of CIS verification; contractor must verify with HMRC before first payment.
NIC / NICs	National Insurance Contributions	UK social security tax paid by employees (via PAYE), employers (as on-costs), and the self-employed (Class 2/4 via self-assessment). Funds state benefits including state pension, statutory sick pay, and maternity allowance. CIS deductions are payments on account of Income Tax and Class 4 NICs.
NMW	National Minimum Wage	Legal minimum hourly rate employers must pay workers in the UK. Rates vary by age band. Post-deduction pay (after deductions for employer's own use/benefit) must not fall below NMW. Records must be kept for 6 years.
NLW	National Living Wage	Higher rate of National Minimum Wage for workers aged 21 and over. Often referred to together as "NMW/NLW". Different from voluntary Real Living Wage calculated by Living Wage Foundation.
AE	Auto-Enrolment (Pensions)	Workplace pension scheme where employers must automatically enrol eligible workers (aged 22+ to state pension age, earning ≥£10k annually) into a qualifying pension. Minimum contributions, opt-out rights, and re-enrolment (every 3 years) required.
P45	P45 (Leaving Employment)	HMRC form given to employees when they leave employment, showing pay and tax details for the year to date. New employer uses P45 to operate correct tax code. Emergency codes (e.g., 1257L W1/M1) apply without P45/P6.

Acronym	Full Term	Definition
DRC	Domestic Reverse Charge (VAT)	VAT mechanism for construction services where the customer accounts for VAT instead of the supplier. Applies to most construction services under CIS340. Designed to combat missing trader fraud in construction supply chains.
Kittel	Kittel Principle	EU/UK legal principle that a taxpayer who knew or should have known their transaction was connected to VAT fraud may be denied the right to deduct input VAT. Creates due diligence obligations for supply chain participants.
DR	Disguised Remuneration	Tax avoidance arrangements designed to pay individuals while avoiding income tax and NICs, often involving loans, offshore entities, or trusts. HMRC actively targets such schemes. Loan charge applies to outstanding loans.

Acronym	Full Term	Definition
SDC	Supervision, Direction or Control	Key factor in determining employment status under agency rules (ITEPA 2003 s44). If a worker is under supervision, direction or control by any person (client, agency, end-hirer) over how they work, PAYE must be operated. SDC alone is not the general CIS status test—apply usual status tests (control, substitution, mutuality).
MOO	Mutuality of Obligation	Employment status indicator examining whether the employer is obliged to provide work and the worker is obliged to accept it. Absence of MOO suggests self-employment; presence suggests employment.
SDS	Status Determination Statement	Document required under IR35 reforms (April 2021) where medium/large clients must provide written reasons for their determination of a contractor's employment status for tax purposes. Must be given before contract starts or worker begins work.
CEST	Check Employment Status for Tax	HMRC's online tool for determining whether a worker should be classified as employed or self-employed for tax purposes. Results are binding on HMRC if information provided is accurate and not relating to highly complex arrangements.
PSC	Personal Service Company	Limited company through which a contractor provides their services. Often used by contractors working outside IR35, but subject to IR35 rules if the underlying relationship is one of employment. Requires SDS from medium/large clients.
KID	Key Information Document	Plain-English factsheet (not a contract) that agencies must give to workers before they agree to an assignment (Conduct of Employment Agencies and Employment Businesses Regulations 2003). Includes worked pay illustration, deductions, who pays the worker, benefits. Must be updated within 5 working days of any change.
ITEPA 2003	Income Tax (Earnings and Pensions) Act 2003	UK tax legislation governing employment income. Section 44 contains agency rules requiring PAYE where worker is under SDC. Section 61N–61R cover off-payroll working (IR35) for public sector and (from 2021) medium/large private sector.
DBS	Disclosure and Barring Service	UK government service providing criminal record checks for employment purposes (particularly roles working with children or vulnerable adults). Processing DBS data requires DPA 2018 Schedule 1 condition and appropriate policy document.

Acronym	Full Term	Definition
UK GDPR	UK General Data Protection Regulation	UK data protection law (retained EU law post-Brexit) governing processing of personal data. Requires lawful basis (Art 6), data minimisation, security, transparency (Arts 13-14), and respect for data subject rights. Works alongside Data Protection Act 2018.
DPA 2018	Data Protection Act 2018	UK legislation supplementing UK GDPR. Schedule 1 sets conditions for processing special category data (health, biometric, union membership) and criminal offence data (e.g., DBS checks). Provides exemptions (crime prevention, tax collection, legal professional privilege).
DSAR	Data Subject Access Request	Individual's right under Art 15 UK GDPR to obtain copy of their personal data. Must respond within one month (extendable by 2 months for complex requests). Usually no fee. Must verify identity proportionately.
DPO	Data Protection Officer	Required role for public authorities or organisations conducting large-scale systematic monitoring or processing special category data (Art 37). Oversees data protection compliance, advises on DPIAs, and acts as contact point for ICO and data subjects.
LIA	Legitimate Interests Assessment	Assessment required when relying on legitimate interests (Art 6(1)(f)) as lawful basis. Three-part test: identify legitimate interest → demonstrate necessity → balancing test (interests vs individual rights). Appropriate for audit/assurance; avoid consent for audits.
DPIA	Data Protection Impact Assessment	Required assessment where processing is likely to result in high risk to individuals (Art 35). Must complete for large-scale, systematic monitoring or extensive special category data processing. Documents risks, mitigation measures, and necessity/proportionality.
RoPA	Records of Processing Activities	GDPR requirement (Art 30) documenting all personal data processing activities. Must include purposes, lawful bases, data categories, recipients, retention periods, security measures, and international transfers. Must be available to ICO on request.
IDTA	International Data Transfer Agreement	UK mechanism for lawfully transferring personal data outside the UK (replacing EU Standard Contractual Clauses post-Brexit). Required unless recipient country has adequacy decision or other derogation applies. Alternative: UK Addendum to EU SCCs.
SCCs	Standard Contractual Clauses	EU Commission-approved contract templates for international data transfers. For UK data exports, use UK Addendum to EU SCCs or UK IDTA.
Art 28 DPA	Article 28 Data Processing Agreement	Mandatory contract between controller and processor (Art 28 UK GDPR). Must cover: subject matter, duration, data types, processing instructions, confidentiality, security, sub-processors, data subject rights assistance, breach notification, data deletion/return, audit rights.
Art 26	Article 26 (Joint Controllers)	UK GDPR provision for parties who jointly determine purposes and means of processing. Requires arrangement setting out respective responsibilities, data subject rights, and contact points. Different from controller-processor (Art 28) or controller-controller data-sharing.
Controller	Data Controller	Organisation that determines the purposes and means of processing personal data. Bears primary GDPR obligations. Agencies, umbrellas, and end-hirers usually act as independent controllers for their own audit/compliance purposes.

Acronym	Full Term	Definition
LSCA	Labour Supply Chain Assurance	Due diligence framework ensuring compliance with tax, employment, and ethical standards throughout the labour supply chain. Covers PAYE/CIS compliance, modern slavery, CFA 2017, worker rights, and IR35. Aims to detect exploitation, fraud, and phoenixism.
PSL	Preferred Supplier List	Vetted list of approved suppliers (typically umbrella companies or agencies) that meet compliance standards. Key governance control for managing supply chain risk. Should be reviewed regularly and require re-certification.
End-Hirer	End-Hirer / End Client	The organisation where agency or contract workers ultimately perform their work. Under current regulations, medium/large end-hirers have IR35 status determination responsibilities and supply chain due diligence obligations.
CCO	Corporate Criminal Offence	CFA 2017 offence: failure to prevent facilitation of tax evasion by an associated person. Three-stage liability: (1) taxpayer evades tax, (2) associated person criminally facilitates it, (3) organisation failed to prevent. Only defence: reasonable prevention procedures (RPP).
RPP	Reasonable Prevention Procedures	The only defence to Corporate Criminal Offence under CFA 2017. HMRC's six principles: risk assessment, proportionate procedures, top-level commitment, due diligence, communication (training), monitoring & review. Must be risk-based and documented.
SRO	Senior Responsible Owner	Senior person accountable for CFA 2017 compliance, risk assessments, and implementation of reasonable prevention procedures. Provides top-level commitment and board oversight.
MSAT	Modern Slavery Assessment Tool	UK Government tool (Home Office/Cabinet Office) for assessing modern slavery risks in supply chains. Free to organisations registered on UK Government Supplier Registration Service.

Acronym	Full Term	Definition
Instance	Audit Form Instance	Individual audit submission. Users can create unlimited instances, each stored as WordPress custom post type with responses in wp_opraas_audit_responses table. Assigned to logged-in user via post_author field.
Completion	Completion Score	Frontend metric showing percentage of questions answered (any answer counts). Includes ALL sections: Section 1 checkbox, Section 2 (8 fields), Declaration (7 fields), and all audit questions. N/A responses count as answered.
Compliance	Compliance Score	Backend metric measuring quality of compliance. Scoring: Yes=5 points, No=0 points, N/A=0 points (excluded from maximum), Don't Know=1 point. EXCLUDES Sections 1, 2, and Declaration entirely. ≥80% = Compliant, 60-79% = Partially Compliant, <60% = Non-Compliant.
Evidence	Evidence Files	Supporting documents uploaded to substantiate audit responses. Stored in AWS S3 via WP Offload Media plugin, with Evidence Table providing S3-aware ZIP downloads that temporarily download from cloud before adding to archives.
Red Flags	Red Flags	Warning indicators in audit questions identifying practices that may indicate non-compliance, fraud risk (phoenixism, MUCs, disguised remuneration), or regulatory breaches requiring immediate attention and remediation.