Privacy notice

Summary

• We are [to be confirmed], trading as Accord Data Partners (ADP). We are the controller of the personal data described in this notice.
• We collect what we need to run customer accounts, sell the info pack and business-introduction leads, run our referral programme and answer messages.
• A business contact’s details are passed to one ADP customer, who pays for that introduction, and only after the contact has asked to be introduced and agreed to it.
• We don’t share personal data with advertisers, we don’t use advertising or analytics cookies, and our analytics can’t follow you from one day to the next.
• You can ask for a copy of your data, have it corrected or deleted, object, or withdraw your consent at any time by emailing [to be confirmed].

1. Who we are

This notice explains how [to be confirmed], trading as Accord Data Partners (ADP) (“ADP”, “we”, “us” or “our”) uses personal data when you use https://ledgerdatapartners.com, our customer portal and our services.

• Company name: [to be confirmed]
• Trading name: Accord Data Partners (ADP)
• Company number: [to be confirmed]
• Registered office: [to be confirmed]
• ICO registration number: [to be confirmed]
• VAT number: [to be confirmed]
• Email: [to be confirmed]

We have not appointed a data protection officer. For any privacy question or request, email [to be confirmed].

2. Who this notice covers

• people who visit our website;
• customers with an ADP account, including info pack owners, customers who buy leads and members of our referral programme;
• business owners, directors and staff who ask us to introduce their business (“business contacts”);
• people who send us an enquiry, request a call or message us;
• people who are referred to us by an ADP customer.

If you are a business contact, the customer who buys your introduction becomes responsible for how they use your details and must give you their own privacy information.

3. What we collect and why

Your account

• What: your name, email address, a salted hash of your password (we never see or store the password itself), whether you have verified your email address, your referral code, who referred you (if anyone), your marketing choice, how you found us and, where known, your country. Each time you sign in we keep a session record with the time, your browser type and a hashed form of your IP address.
• Why: to create and run your account, keep it secure, and prevent fraud and misuse.
• Lawful basis: contract, because we need this to provide your account, and our legitimate interests in keeping the service secure.

Purchases and payments

• What: your order number, what you bought, prices, payment method and status, references from our payment provider (Stripe) or your bank transfer, refunds, the version of our terms you accepted and, for the info pack, the time you asked for immediate access and acknowledged that your right to cancel would end once access starts.
• Card details: card payments are taken on Stripe’s secure checkout page. We never see or store your full card number.
• Why: to take payment, give you access, handle refunds and keep the financial records the law requires.
• Lawful basis: contract, and legal obligation for tax and accounting records.

Info pack progress

• What: the modules you have completed and your knowledge-check attempts and scores.
• Why: to show your progress and let you pick up where you left off.
• Lawful basis: contract.

Business contacts who ask to be introduced (leads)

• What: your name, role, work email, phone number (if given), company name, website, sector, region, country, staff numbers, years trading, company status, the kinds of records the business holds, your answers about record language and rights, anything you write in the description, the time you gave consent and the wording you agreed to, how you found us (including campaign tags) and a hashed form of your IP address.
• Why: to check and review your request; to list your business anonymously for ADP customers (sector, region, staff band, record types and status only, never your name, company name or contact details); to pass your details to the one customer who buys the introduction; to keep track of progress; and to act on any withdrawal.
• Lawful basis: your consent to be introduced and to have your details passed to one ADP customer. For business information about the company, and for keeping proof of your consent, we rely on our legitimate interests in running a business-to-business introduction service and being able to show that we acted lawfully. You can withdraw your consent at any time (see section 10).

Progress on a lead

• What: stage updates, notes and any referral reward that the customer who bought a lead reports to us.
• Why: to support that customer, check that leads are handled properly, act on withdrawals and resolve disputes.
• Lawful basis: contract with the customer, and our legitimate interests in running a fair and well-managed marketplace.

Messages, notifications and emails

• What: messages you send us in the portal and our replies, our team’s internal notes about a conversation, in-portal notifications, and the emails we send you (address, subject, content and whether delivery succeeded).
• Why: to answer questions, provide support and keep a record of what was agreed.
• Lawful basis: contract, and our legitimate interests in providing good support and keeping accurate records.

Referral programme

• What: your referral code; visits to your referral link (the page, the referring website and a daily visitor hash); accounts created through your link; commissions; payouts with our transfer reference; and the bank details you give us for payouts, which we store encrypted.
• If you were referred: we record which customer referred you and, if you buy the info pack, the commission due to them. Your referrer sees the status of their commission, not your contact details.
• Why: to credit referrals, calculate and pay commission, prevent self-referral and fraud, and keep financial records.
• Lawful basis: contract (our affiliate terms); our legitimate interests in crediting referrals correctly and preventing fraud; and legal obligation for financial records. We only use the adp_ref cookie if you agree to it (see our cookie policy).

Enquiries and call requests

• What: your name, email address, profession or firm details, your message and request type, and whether you confirmed your request.
• Why: to reply and arrange what you asked for.
• Lawful basis: our legitimate interests in responding to enquiries, or steps you ask us to take before entering into a contract.

Website analytics (cookieless)

• What: the pages you visit, page titles, the website that referred you, campaign tags in the link, approximate country, device type, browser, operating system, time on page, and key actions such as signing up or starting a checkout. If you are signed in, we may link these records to your account.
• How it works: we don’t use cookies or device storage for analytics. We combine your IP address and browser details with a random value (a “salt”) that changes every day, and keep only the resulting one-way hash. Each salt is deleted after two days, so the hash can’t be reversed or used to link your visits across days.
• Why: to understand how the site is used, fix problems and see which pages help people sign up and buy.
• Lawful basis: our legitimate interests in running and improving the site. You can object at any time.

Marketing emails

• What: your email address and your marketing choice, with the date you made it.
• When: only if you opt in. Account, order and security emails are not marketing and are sent whatever your choice.
• Lawful basis: consent. You can unsubscribe using the link in any marketing email or by emailing us. We keep a minimal record so that we don’t contact you again.

Security and records

• What: sign-in and security events, rate-limit records based on IP address, payment-provider event records, and a log of staff actions on accounts, orders, leads and payouts.
• Why: to protect the service, detect fraud and misuse, and show what happened if there is a dispute.
• Lawful basis: our legitimate interests in security, fraud prevention and establishing or defending legal claims, and legal obligation where records must be kept.

4. Information we don’t want

ADP is an introducer. We never receive a business’s datasets or operating records, and there is no way to upload files to ADP. Please don’t send us documents, data exports, passwords, client files or special category data (such as health information). If you send us something we don’t need, we will delete it.

5. Who we share it with

We share personal data only where we need to:

• Hosting: Hostinger, which hosts our application, database and backups on servers in the UK or the EU.
• Network and security: Cloudflare, which provides our domain name service, content delivery and protection against attacks. Every request to our website, including your IP address, passes through Cloudflare.
• Payments: Stripe, which processes card payments on its hosted checkout page. Stripe acts as our processor and, for its own fraud-prevention and legal obligations, as an independent controller under its own privacy notice.
• Email delivery: our email delivery provider, which sends account, order and notification emails on our behalf.
• Our bank: when you pay by bank transfer or we pay you a commission.
• The customer who buys a lead: if you are a business contact who asked to be introduced, we pass your contact and business details to the one customer who buys that introduction. That customer becomes an independent controller of your details and must follow our lead terms and data protection law.
• Professional advisers and insurers, under a duty of confidentiality, where needed.
• Authorities: HMRC, the police, regulators or courts, where the law requires it or to protect our rights.
• A future owner: if our business or its assets are sold, under a duty of confidentiality.

Hostinger, Cloudflare, Stripe (for payment processing) and our email provider act on our instructions under contracts that require them to protect your data. We don’t sell or share personal data with advertisers or data brokers, and we never share your details with AI data buyers. If you choose to apply to a buyer’s programme, you deal with that buyer directly under its own privacy notice.

6. International transfers

Our database is stored in the UK or the EU, and EU countries are covered by UK adequacy regulations. Some providers, such as Cloudflare and Stripe, operate worldwide and may process data in other countries, including the United States. Where they do, they rely on safeguards recognised under UK law, such as UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework for certified US companies), the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

If the customer who buys a lead is based outside the UK, we only pass on a business contact’s details where the transfer is lawful under UK data protection law. Email [to be confirmed] for more information about transfer safeguards.

7. How long we keep it

8. How we protect it

• Every page is served over an encrypted connection (HTTPS).
• Passwords are stored only as salted hashes, and session tokens only as hashes.
• Payout bank details are encrypted.
• Staff access is limited by role. Staff accounts need an approved email address and a second sign-in step using an authenticator app.
• Customers only see their own records. A lead’s contact details are visible only to our team and the customer who bought it.
• We keep regular backups, and Cloudflare protects the site against attacks.

No system is completely secure. If a personal data breach is likely to put you at high risk, we will tell you without undue delay.

9. Your rights

Under UK data protection law you have the right to:

• access your personal data and receive a copy;
• rectification of data that is inaccurate or incomplete;
• erasure of your data in certain circumstances;
• restriction of how we use your data in certain circumstances;
• object to our use of your data based on legitimate interests, and an absolute right to object to direct marketing;
• data portability, to receive data you gave us in a commonly used format, where we rely on consent or contract;
• withdraw consent at any time, where we rely on consent;
• not be subject to decisions based solely on automated processing that have legal or similarly significant effects (we don’t make any).

To use a right, email [to be confirmed]. We will reply within one month. If your request is complex or you make several, we may extend this by up to two further months and will tell you why. We usually don’t charge. We may need to confirm your identity, and the time limit is paused until we have what we need. Some rights have limits: for example, we must keep certain financial records even if you ask us to delete them.

10. Withdrawing consent and withdrawing a lead

If you asked us to introduce your business, you can change your mind at any time. Email [to be confirmed] from the address you used, with your company name and, if you have it, your reference number.

• If your introduction has not been sold, we will promptly remove it from our listings and delete your details, keeping only a minimal record of your request and your withdrawal.
• If it has been sold, we will promptly tell the customer who bought it to stop contacting you and to delete your details, and we will record your withdrawal. That customer is an independent controller, so you can also tell them directly.

Withdrawing consent doesn’t affect anything done lawfully before you withdrew. You can also ask us never to contact you again; we keep a short suppression record so that we can honour that request.

11. Automated decisions

We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects. A member of our team reviews every introduction request and every refund or replacement request.

12. Children

Our services are for people aged 18 or over. We don’t knowingly collect personal data about children.

13. Complaints

If you are unhappy with how we have handled your personal data, please tell us first at [to be confirmed]. We will acknowledge a data protection complaint within 30 days and respond without undue delay. Our complaints policy explains the process.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

14. Changes to this notice

We update this notice when the way we use personal data changes. The version and effective date are shown at the top. If a change is significant, we will tell account holders by email or in the portal before it takes effect.