SGEP Fitness Assessments · Your data
How we treat your data.
From purchase to credential, personal data is collected minimally, protected in transit and at rest, moved across borders only under written safeguards, and deleted on request, with the few exceptions named below. This page is the whole journey.
Protected throughout
Minimal by design
We hold what fulfilment needs — name, email, order, result — and no payment data, ever. Each processor sees only its own step.
Locked in transit and at rest
TLS everywhere; encryption at rest with our processors; sign-in links work exactly once; access codes are single-purpose.
Never singled out
Group insights, if you consent, appear only in aggregates of at least ten people. Below that threshold, nothing is shown to anyone.
Leaves when you do
Every processor is bound by a written DPA with deletion duties; ClassMarker deletes on our instruction, and returns or deletes everything within 60 days when our contract ends. Credentials we issue ourselves sit on our own infrastructure, so deletion requests are handled by us directly. Three things survive an erasure request: anonymised accounting figures, the dated record that you withdrew consent, and, if we have refused you further assessments, the record of that refusal, kept so that the refusal holds. Our retention schedule is available on request.
Purchase
You buy from a Merchant of Record, the seller of record and the controller of your payment: Paddle in the UK and EU, FastSpring elsewhere. Card details never reach us; payment providers hold payment records under their own policies. We receive only your name, email and order number, to deliver what you bought.
If you came through a partner's link, the partner's code travels with your order, so we know who recommended us. We set no cookie for it. The partner sees the order, never who you are. We also check orders against our partner rules, so that partners earn nothing on their own or their employer's purchases.
Paddle (IE / US) · UK–EEA adequacy + SCCs & UK Addendum FastSpring · SCCs + UK AddendumAccess
Our service issues your access codes and single-use sign-in links, delivered by email. We keep the order record, your codes and your consent receipts. Like any email provider, ours keeps a record of each message it sends you, including your address, for 30 days. If our usual provider is unavailable we switch by hand to a standby, Google, and back again; the same 30 days applies there. Optional two-factor authentication protects your results page; our own operator access is hardware-key gated.
When we investigate a problem with your order or results, we may use an AI tool, Claude, made by Anthropic, under business terms with a data processing agreement. It does not train on what we share. We share the minimum, usually an order number rather than your name.
Cloudflare · DPF incl. UK ext. Resend · DPF incl. UK ext. Google Workspace · standby sender · SCCs + UK Addendum Anthropic (US) · Claude Team · [SAFEGUARD FROM REGISTER]Assessment
You take the test on ClassMarker: name, email, answers, score, and, as on any website, your IP address. Anything beyond delivering your result — marketing, or inclusion in a group summary with no names and no individual scores — is asked as an explicit consent question inside the test, and defaults to no.
ClassMarker (AU / US-hosted) · SCCs + UK Addendum · signed DPACredential
Pass, and your badge is issued by us — Orderly Disruption — on the Open Badges standard: cryptographically signed and hosted on our own infrastructure, with no third-party credential platform involved. A public verification page lets employers confirm the credential is genuine — published only if you choose, asked at the moment your credential is issued. It carries only the credential itself, and you can change your mind and have it removed at any time. A backup verification page is also hosted on GitHub, so your badge stays checkable even if our site is down; it holds no personal data and sends nothing anywhere.
Issued by Orderly Disruption (UK) · no third-party issuer Cloudflare · DPF incl. UK ext. Resend · DPF incl. UK ext. GitHub · backup verification page · no personal dataWant the full detail?
Every company named above — who they are, where they are, what they do for us, and the exact safeguard covering each data flow — is set out in plain language on its own page.
Who handles your dataOrderly Disruption Ltd (t/a Adaptive Fitness) · UK data controller · Data requests: info@orderlydisruption.com
Every cross-border transfer is covered by a written safeguard: UK Addendum / SCCs, UK adequacy, or DPF including the UK Extension. See also our privacy policy and its assessment addendum.
Version 3.3 · Effective on publication