Adaptive Fitness · Partner programme

Privacy notice for partners.

What we hold about partners, applicants and their contacts, why, and for how long.

This notice is for people who apply to be a partner, partners who join as a person, and the named contacts at partner companies. For buyers and test takers, see our privacy policy.

Who we are: Orderly Disruption Ltd, trading as Adaptive Fitness, registered in England and Wales (company no. 09024211). We are the controller of the personal data described here. Contact: info@orderlydisruption.com.

Version 1.0 · Effective on publication

What we hold, and why

Each row says what we hold, why we need it, and the lawful basis that allows it.

What we hold
Why
Lawful basis
Your partner number
WhyTo identify you in our records without relying on an email address
Lawful basisContract
Whether you joined as a company or a person
WhyTo apply the right checks and rules
Lawful basisContract
Your name or your company’s name, trading name, country, company number and registered address; your website
WhyTo identify you, check you can join, and keep records
Lawful basisContract; legal obligation
For a company, its proof of good standing: a link to its entry in the official register
WhyTo check it can join
Lawful basisContract
Your employer’s name and the email domain it uses
WhyOnly to apply clause 5.8 of the partner agreement: no commission on purchases by you or your employer
Lawful basisContract
Your VAT or tax number, if you gave one, and our dated record of checking it. We keep it encrypted, with its last four characters, so we can recognise it. We never ask for a US Social Security number.
WhyTax and VAT records
Lawful basisLegal obligation
What you told us about your product and AI work, your answers about how you will promote us, and our notes of the checks
WhyTo decide your application
Lawful basisLegitimate interests: admitting only partners who meet the programme’s criteria
Whether a certification body’s rules allow you to partner with us
WhyTo decide your application
Lawful basisLegitimate interests: avoiding conflicts with certification bodies
The result and date of our sanctions check
WhyTo comply with sanctions law
Lawful basisLegal obligation
The version of the agreement you accepted, its fingerprint, when you accepted it, and the name and position of the person who accepted it
WhyTo prove what was agreed
Lawful basisContract; legitimate interests: keeping a record of what was agreed
Your payment currency, and your bank details, held in our Wise account to pay you. Our own systems never store your bank details.
WhyTo pay you
Lawful basisContract
Your partner contact and billing contact: name, position and work email, and a phone number for the billing contact
WhyTo run the agreement, send statements, and confirm any change of bank account by phone
Lawful basisContract, if you are the partner. Legitimate interests, if you are a contact at a partner company: running our agreement with your company
Your invoices, kept whole
WhyAccounting and audit
Lawful basisLegal obligation
Commission records and statements
WhyAccounting and tax records
Lawful basisLegal obligation
A buyer’s email you send us as proof of a sale
WhyTo check your claim
Lawful basisLegitimate interests: crediting sales correctly
Correspondence with us
WhyTo run the agreement and handle disputes
Lawful basisLegitimate interests: keeping a record of what was agreed
Records of suspected fraud or breach
WhyTo investigate and to protect the programme
Lawful basisLegitimate interests: preventing fraud

What we do not hold

Data about your clients. We do not give you data about buyers, and your statements never name a customer.

Where it comes from

From you: on the application and registration forms, and later. From public sources: company registers, HMRC’s VAT checking service, the EU’s VAT checking service, the IRS for a US employer number (EIN), and public sanctions lists.

Who we share it with

Only these. We never sell your data.

Wise

Wise Payments Limited UK

Pays you. Your bank details are held in our Wise account, not in our own systems.

Shopify

Shopify International Ltd, part of Shopify Inc. Ireland / Canada

Hosts the ace.works site and receives what you type into the partner application form.

UK safeguard: Canada’s data-protection regime holds a UK adequacy finding.

Cloudflare

Cloudflare, Inc. USA

Hosts our systems and the records they keep, including partner records and commission records.

UK safeguard: certified under the EU–US Data Privacy Framework including its UK Extension, with the EU Standard Contractual Clauses and the UK Addendum as fallback.

Resend

USA

Sends our email, such as statements and notices. It keeps a record of what it sends, including your address, for 30 days.

UK safeguard: certified under the EU–US Data Privacy Framework including its UK Extension.

Google Workspace

Google Ireland Ltd / Google LLC Ireland / USA

Hosts our mailboxes, and is our standby email sender if Resend is unavailable.

UK safeguard: Google Workspace Cloud Data Processing Addendum, with the EU Standard Contractual Clauses and the UK Addendum.

Anthropic

Anthropic Ireland, Limited; processing by Anthropic, PBC Ireland / USA

Makes Claude, the AI tool we may use when we investigate a problem. We use it under business terms (Claude Team) with a data processing agreement. It does not train on what we share, and we share the minimum, usually a partner number rather than a name.

UK safeguard: processed in the USA, under the UK Addendum to the EU Standard Contractual Clauses in Anthropic’s data processing addendum.

Our accountant and advisers

UK

Our accountant, and our professional advisers when needed.

Authorities

UK

HMRC and other authorities, where the law requires it.

Some of these companies process data outside the UK, for example in the United States. Where they do, the safeguard shown above applies. For more on each company, see who handles your data.

Decisions

A person decides every application. We make no decision about you by automated means alone.

How long we keep it

Our company year ends on 31 May.

  • Partner records, both contacts included: six years after the end of the company year in which the agreement ends.
  • Your invoices: six years, whole, offline and encrypted.
  • An application we turn down: six years after the end of the company year in which we decided. We keep it to answer complaints and to recognise a repeat application.
  • A registration link that is never used: it expires after 14 days.
  • Your bank details: removed from our Wise account after our last payment to you.
  • A buyer’s email sent as proof of a sale: deleted once the claim is decided.
  • Correspondence: six years.

When this notice changes

If we change this notice, we will email you.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it where we do not need it, object to processing based on legitimate interests, and ask us to restrict processing.

If you are unhappy with our answer, you can complain to the Information Commissioner’s Office at ico.org.uk. If you are in the EU, you can also complain to the data protection authority where you live.

Email info@orderlydisruption.com

Orderly Disruption Ltd (t/a Adaptive Fitness) · UK data controller

Version 1.0 · Effective on publication