The companies that process data on our behalf

These companies work under our instructions, each under a written data processing agreement (the contract UK data-protection law requires) — signed and in place, or completing signature. Where they hold data outside the UK, a recognised international-transfer safeguard applies.

The companies that handle your payment

We never see or hold your card details. Checkout is handled by a Merchant of Record — the company you actually buy from, which is responsible for the payment, taxes, and payment data under its own privacy policy, and passes us only what we need to deliver your purchase (your name, email, and order reference, and, if you came through a partner's link, that partner's code).

Which one you buy through depends on the checkout button you choose. Each is an independent controller of your payment data; the fulfilment details they pass to us are then covered by our privacy policy and its assessment addendum.

The storefront

Shopify (Shopify International Ltd, Ireland, part of Shopify Inc., Canada) hosts the ace.works store pages you browse before purchase, and receives what you type into the forms on them — contact, ambassador application, and the newsletter sign-up. Canada's data-protection regime holds a UK adequacy finding — data may flow there without additional safeguards.

If a partner sent you

If you came through a partner's link, the partner's code travels with your order, so we know who recommended us. We set no cookie for it. The partner sees the order, never who you are. That is why partners are not listed on this page: we pass them no personal data about you.

A backup page, hosted elsewhere

GitHub (GitHub, Inc., USA, part of Microsoft) hosts our backup credential-verification page, so a badge can be checked even if our own site is down. The page holds no personal data and sends nothing anywhere: a credential you paste or upload is checked inside your own browser. If you use it, GitHub receives the ordinary data of a web visit, such as your IP address, under GitHub's own privacy statement. We receive nothing from that page.

Signing in to view your results

We issue our own credentials, so there is no third-party credential portal and no social or enterprise sign-in. Access to your results page works through single-use sign-in links we send to your email address, with optional two-factor authentication. No identity provider is involved, and there is no password to create or lose.

When this page changes

If we add or replace a provider, we update this page. Our internal register of each provider's legal terms is re-verified at least annually and whenever a provider announces changes to its terms.