The companies that process data on our behalf

These three work under our instructions, each under a written data processing agreement (the contract UK data-protection law requires) — signed and in place, or completing signature. Where they hold data outside the UK, a recognised international-transfer safeguard applies.

The companies that handle your payment

We never see or hold your card details. Checkout is handled by a Merchant of Record — the company you actually buy from, which is responsible for the payment, taxes, and payment data under its own privacy policy, and passes us only what we need to deliver your purchase (your name, email, and order reference).

Which one you buy through depends on the checkout button you choose. Each is an independent controller of your payment data; the fulfilment details they pass to us are then covered by our privacy policy and its assessment addendum.

The storefront

Shopify (Shopify International Ltd, Ireland, part of Shopify Inc., Canada) hosts the ace.works store pages you browse before purchase. Canada's data-protection regime holds a UK adequacy finding — data may flow there without additional safeguards.

Signing in to view your results

We issue our own credentials, so there is no third-party credential portal and no social or enterprise sign-in. Access to your results page works through single-use sign-in links we send to your email address, with optional two-factor authentication. No identity provider is involved, and there is no password to create or lose.

When this page changes

If we add or replace a provider, we update this page. Our internal register of each provider's legal terms is re-verified at least annually and whenever a provider announces changes to its terms.