# Privacy Policy **Reasoned Limited** | Company No. 16859259 | ICO Registration No. ZC090450 128 City Road, London EC1V 2NX, United Kingdom team@reasonedfinance.com | https://reasonedfinance.com **Version 2.0 · Last updated: September 2026** --- ## 1. Introduction Reasoned Limited ("**Reasoned**", "we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains what we collect, why, who we share it with, how long we keep it and what rights you have. It applies when you use https://reasonedfinance.com and app.reasonedfinance.com, create an account, use Learn, Compete or Get Hired, buy a plan, enter competitions, use our AI features, receive our emails, or contact us. We process personal data in accordance with the **UK GDPR**, the **Data Protection Act 2018**, and the **Privacy and Electronic Communications Regulations 2003 (PECR)**. Related documents: **Platform Terms of Service**, **Subscription and Billing Terms**, **Third-Party Data Sharing Terms**, **Cookie Policy**. Where this policy and the Third-Party Data Sharing Terms differ on sharing, the Third-Party Data Sharing Terms apply. --- ## 2. Who is responsible for your data Reasoned Limited is the **data controller**. Reasoned Limited, 128 City Road, London EC1V 2NX · Company No. 16859259 · ICO Registration No. ZC090450 · team@reasonedfinance.com We are not required to appoint a Data Protection Officer, and we review that position as the platform grows. Data protection enquiries go to team@reasonedfinance.com and we respond within one calendar month. **Age.** Reasoned accounts are for people aged **18 or over**. We do not knowingly collect personal data from under-18s. If we learn that we have, we delete it promptly. --- ## 3. What we collect, why, and our lawful basis ### 3.1 Account and profile data Name, email address, username, hashed password, university or institution, course, graduation year, areas of interest, and anything else you add to your Reasoned Profile. **Why:** to create and run your account, personalise recommendations, and communicate with you. **Lawful basis:** performance of a contract. ### 3.2 Contact details Phone number where you provide it, and message content when you contact us. **Why:** support, account and competition communications, identity verification. **Lawful basis:** contract; legitimate interests (running the service and keeping it secure). ### 3.3 Learning and platform activity Lessons, quizzes, flashcards, projects, XP, tiers, streaks, badges, assessment attempts and scores, Interview Coach sessions, CV Tailor use, application tracker entries, Feed activity, team and society membership. **Why:** to provide the features, track your progress, recommend what to do next, and maintain platform integrity. **Lawful basis:** contract; legitimate interests. ### 3.4 Competition data Entries, simulated trading activity, performance metrics, rankings, Reasoned Score, certificates. **Why:** to run competitions, produce leaderboards, issue certificates and verify results. **Lawful basis:** contract; legitimate interests. ### 3.5 Documents you upload CVs, Vault items (certificates, awards, work experience letters), and other files. **Why:** to provide CV Tailor, your profile and Vault. **Lawful basis:** contract. Please do not upload special category data (for example health or ethnicity information) or other people's personal data unless necessary. ### 3.6 AI feature inputs and outputs What you type or record into the AI Interview Coach, CV Tailor and automated assessment feedback, and the responses generated. **Why:** to provide the feature, and to keep it safe and working. **Lawful basis:** contract; legitimate interests for safety, abuse prevention and quality monitoring. **How we use it:** inputs are sent to our AI providers (see section 11) to generate your response. **Our providers do not use your inputs or outputs to train their models.** We use aggregated or de-identified information — for example average scores or common error patterns — to improve Reasoned. We will not use your identifiable inputs to train a model of our own unless we ask for your consent first and give you a way to opt out. ### 3.7 Usage measurement How much of each feature you use, how close you get to your plan's limits, how often you reach them, and the processing cost of each action. **Why:** to apply your plan's limits, to plan capacity, and to design future pricing fairly, including any move to a credit-based allowance. **Lawful basis:** contract (applying your plan) and legitimate interests (product and pricing design). ### 3.8 Billing data Plan, billing period, renewal dates, payment status, invoices, the last four digits and expiry date of your card, refunds and disputes. Full card details are handled by Stripe and never stored by us. **Why:** to take payment, manage renewals, handle refunds and meet accounting obligations. **Lawful basis:** contract; legal obligation (tax and accounting records). ### 3.9 Referral data Your referral link, who signed up through it, and whether a referral has qualified. **Why:** to run the referral programme and prevent abuse. **Lawful basis:** contract; legitimate interests (preventing fraud). ### 3.10 Technical and security data IP address, device and browser type, operating system, pages visited, session and security logs. **Why:** to keep Reasoned secure and working, detect and prevent fraud and misuse, and diagnose problems. **Lawful basis:** legitimate interests. ### 3.11 Marketing data Email address, preferences, and how you interact with our emails. **Why:** to send you offers, product news and tips. **Lawful basis:** consent, or legitimate interests where we are permitted to email existing customers about similar services under PECR. You can opt out at any time. ### 3.12 Optional information Demographic or diversity information, where we ask for it, is always optional and clearly marked. **Lawful basis:** consent. Special category data (such as ethnicity or disability) is only processed with your explicit consent and is never shared with employers without a separate, specific consent. --- ## 4. Where your data comes from Almost all the personal data we hold comes **from you** — what you enter when you register, what you upload, and how you use the platform. We also generate data about you (scores, progress, your Reasoned Score, usage measurement), and we receive limited data from **Stripe** (payment status), our self-hosted mail server (delivery status), and partner **societies or universities** where you take part through them. --- ## 5. Leaderboards and public information 5.1 Competition participation means your username, ranking, performance metrics and (where provided) university affiliation may be visible to other users, partner societies and, in published results, the public. 5.2 Your username is the main public identifier. Choose one that does not reveal personal information if you prefer to stay pseudonymous. 5.3 Your Reasoned Profile is private to you unless you choose to share it or opt into employer visibility (section 10). --- ## 6. Vault and public credential pages 6.1 **Vault sharing.** You can set your Vault to **public** (anyone with the link) or **gated** (the viewer enters an email first). Live items each have their own link. Items that are pending, private, flagged or removed on review are not shown. 6.2 Only upload documents you are willing to have seen. Avoid uploading documents containing other people's personal data, or details such as your home address or date of birth. 6.3 Staff can review uploaded items from an admin spot-check queue and may ask you for evidence. Items that fail a check are hidden or flagged rather than deleted, and you can appeal. 6.4 **Viewer email (gated Vaults).** When a Vault is gated we ask the viewer for an email address before they can see it. We may use that address to contact them about Reasoned's recruitment products. Lawful basis: our legitimate interests in business development. We tell them at the point of collection. We do not collect a viewer email on a fully public Vault. 6.5 If you delete an item or your account, its public links stop working. We cannot recall anything a viewer has already saved. --- ## 7. Student representatives and ambassadors If you apply to our ambassador programme we process your name and contact details, university, degree, LinkedIn profile, your application answers and estimated reach, your referral link and code, the sign-ups attributed to you, your progress and status (including "At risk" and "Inactive" flags), and any content you tell us about. We use this to assess applications, run the programme, grant and withdraw benefits, and prevent abuse. Lawful basis: contract, and our legitimate interests in preventing fraud and misuse. Ambassadors **do not receive personal data about the people who sign up through their link** — only counts and progress. Ambassadors are not employees, workers or agents of Reasoned. Application and programme records are kept for the duration of your participation and for 12 months afterwards. --- ## 8. Events, talks and campus activations At in-person events we may collect details you give us on sign-up sheets or QR forms, and we may photograph, film or record the event for marketing and reporting. Lawful basis: legitimate interests, and consent where we use a recognisable image of you or a testimonial in advertising. Tell any member of our team, or email us, if you would prefer not to be filmed or photographed. --- ## 9. If you are a recruiter, firm, society, sponsor or partner contact We process business contact details — name, role, organisation, work email and phone, and our correspondence with you — to contact you about partnerships, sponsorship, recruitment products and events, to manage the relationship and to keep records. Lawful basis: legitimate interests in business development, or contract where we already work together. We obtain details from you, your organisation's website, professional networks such as LinkedIn, and events. You can object or unsubscribe at any time at team@reasonedfinance.com. --- ## 10. Employers, recruiters and firms 10.1 **We never share your identifiable profile, contact details or results with an employer, recruiter or firm unless you specifically opt in.** Using Reasoned, buying a plan or entering a competition does not constitute consent. 10.2 If you opt in, we tell you what will be shared and with whom, and you can withdraw at any time in your profile settings or by emailing us. Withdrawal stops future sharing but does not undo sharing already made. 10.3 Employers and recruiters who receive your data act as independent controllers and must provide you with their own privacy information. 10.4 Details are in the **Third-Party Data Sharing Terms**. --- ## 11. Who we share data with We do not sell lists of your personal data, and we never share your details for a partner's marketing unless you have opted in to that specific partner (see the row below and section 7A of the Third-Party Data Sharing Terms). We share personal data as follows: | Recipient | Purpose | Role | |---|---|---| | **Hetzner** (hosting, Germany) | Hosting the platform and databases | Processor | | **Stripe** | Payments, renewals, refunds, fraud prevention | Independent controller for payment data | | **BillionMail** (self-hosted on our infrastructure) | Transactional emails, service notices and marketing emails | Processor (software we run; we do not send your mailbox to a third-party ESP) | | **Anthropic** (Claude API) | Generating AI Interview Coach, CV Tailor and assessment feedback | Processor; does not train on your data | | **Google** (Google Identity / OAuth) | Optional sign-in with a Google account | Independent controller for the Google account you use to sign in | | **Google Analytics 4** | Usage measurement after you accept analytics cookies | Processor | | **Microsoft Clarity** | Session analytics after you accept analytics cookies | Processor | | **Google AdSense** | Display advertising on Learn (and landing where a publisher id is configured). Today this is not gated by the analytics banner — see the Cookie Policy | Independent controller | | **TradeLocker** (where used for trading competitions) | Simulated trading environment | Processor or independent controller, depending on the activity | | **Partner university societies** | Society leaderboards and participation reporting | Independent controller, under written agreement | | **Anyone with a link to your public Vault** | Viewing the credentials and achievements you have chosen to make public | You are publishing this yourself | | **Sponsors and partners** | Aggregated statistics by default; identifiable data only with your specific consent (for example prize fulfilment) | Independent controller | | **Sponsors, partners and Perks partners you opt in to** | Their own marketing to you — name, contact details, university, course, graduation year and campaign source, shared only where you give a separate, named opt-in. We may be paid for these introductions | Independent controller | | **Employers and recruiters** | Opt-in only (section 10) | Independent controller | | **Professional advisers, auditors, insurers** | Legal, accounting and insurance purposes | Independent controller | | **Authorities, regulators, courts** | Where required by law, or to protect people's safety or our rights | Independent controller | | **A buyer or successor** | If our business or assets are sold or restructured | Independent controller | Processors act only on our written instructions under data processing agreements. Full detail, including the safeguards for each, is in the **Third-Party Data Sharing Terms**. --- ## 12. Sub-processors and changes 12.1 Our processors may use their own sub-processors. We require them to obtain our authorisation, to tell us before adding or replacing one, and to pass on the same obligations. 12.2 We keep an up-to-date list of our processors and sub-processors, available on request at team@reasonedfinance.com. 12.3 If we change a provider in a way that materially affects how your data is handled, we update this policy and, where the change is significant, tell you. --- ## 13. International transfers 13.1 Our primary hosting is in **Germany (EEA)**. Some providers process data outside the UK and EEA. 13.2 Where they do, we rely on UK adequacy regulations, the ICO's International Data Transfer Agreement or Addendum, or Standard Contractual Clauses, and carry out a transfer risk assessment where required. 13.3 You can ask for details of the safeguards for any transfer at team@reasonedfinance.com. --- ## 14. How long we keep data | Data | Retention | Reason | |---|---|---| | Account and profile data | While your account is open. After you confirm deletion we erase or anonymise it (see below). We do not yet run a separate 12-month post-closure job | Reactivation, disputes, fraud prevention | | Learning and assessment activity | While your account is open, then 12 months | Progress history and verification | | Competition results and certificates | 6 years from issue | Verification and preventing misuse | | Billing records and invoices | 6 years from the end of the relevant tax year | Legal obligation (tax and accounting) | | AI inputs and outputs | 12 months, unless you delete them sooner | Providing the feature, safety and quality monitoring | | Usage measurement | Aggregated after 12 months and kept in aggregate form | Capacity and pricing design | | Marketing data | Until you unsubscribe; suppression records kept indefinitely | PECR compliance | | Support communications | 3 years from closure of the case | Quality and legal claims | | Security and access logs | 12 months | Security and fraud detection | | Anonymised and aggregated data | Indefinitely | Cannot identify anyone | Where we must keep data longer because of a legal claim, investigation or regulatory requirement, we keep only what is necessary. **Deleting your account.** You can delete your account in CentralHost Settings → Security (Download my data / delete account). When you confirm deletion we erase or anonymise your personal data **at that time**, except records we must keep by law, and published competition results, which may remain in historic leaderboards in anonymised form. There is no 30-day cooling-off job. Deleting your account cancels any paid plan immediately; refunds are dealt with in the Subscription and Billing Terms. **Inactive accounts.** We do not currently auto-delete inactive accounts. If we introduce that, we will email you first and update this policy. --- ## 15. Automated processing 15.1 We use automated processing to: score assessments and competitions against published rules; calculate XP, tiers, streaks and your Reasoned Score; recommend content; generate AI feedback; and apply your plan's usage limits. 15.2 These processes follow objective, published criteria. **No decision producing legal effects or similarly significant effects on you is made solely by automated means.** Where an automated outcome affects eligibility for a certificate, prize or feature, a member of our team can review and override it. 15.3 You can ask us to explain how an automated result was reached, and you can challenge it at team@reasonedfinance.com. 15.4 AI feedback is generated automatically and is a preparation aid, not an assessment of your ability or employability. --- ## 16. Data protection impact assessments Where a new feature is likely to involve higher-risk processing — for example employer-facing features, large-scale profiling, or new uses of AI — we carry out a data protection impact assessment before launching it, and we keep it under review. --- ## 17. Meetings, calls and webinars We may record webinars, online meetings and sales or partnership calls, and use transcription and note-taking tools to produce summaries. We tell participants at the start, and you can ask us not to record. Recordings and notes are used to follow up, improve what we deliver and keep a record of what was agreed, and are kept for 12 months unless they relate to a signed agreement, in which case we keep them for the life of that agreement plus 6 years. --- ## 18. If you apply to work with us If you apply for a role, internship or volunteer position at Reasoned, we process your application, CV, interview notes and references to assess your application and communicate with you. Lawful basis: our legitimate interests in recruiting, and taking steps to enter a contract with you. Unsuccessful applications are kept for 12 months so we can consider you for other roles, and you can ask us to delete them sooner. --- ## 19. Security 19.1 We use appropriate technical and organisational measures, including hosting within the EEA with access controls, hashed passwords, encryption in transit (TLS), role-based access limited to staff who need it, logging and monitoring, and regular review of our security practices. 19.2 No system is completely secure. We will notify the ICO, and you where the risk to you is high, without undue delay in the event of a personal data breach, as required by UK GDPR. 19.3 Keep your login details secure and tell us immediately if you suspect unauthorised access. --- ## 20. Your rights You have the right to: **access** your data; have it **corrected**; ask us to **delete** it; **restrict** how we use it; **object** to processing based on legitimate interests; receive your data in a **portable** format; and **withdraw consent** where we rely on it. You have an absolute right to object to direct marketing. To exercise any right, email **team@reasonedfinance.com** with the subject "Data Subject Request". We respond within one calendar month and may extend by two months for complex requests, telling you if we do. We may need to verify your identity. **Complaining to us.** You have the right to complain directly to us about how we handle your personal data. Email **team@reasonedfinance.com** with the subject "Data protection complaint". We acknowledge every complaint within 30 days, investigate it without undue delay, keep you updated while we do, and tell you the outcome. **Complaining to the regulator.** You can also complain to the **Information Commissioner's Office** — https://www.ico.org.uk — helpline 0303 123 1113. We would appreciate the chance to put things right first. --- ## 21. How to make a request about your data 21.1 Email **team@reasonedfinance.com** with the subject "Data Subject Request", telling us which right you are exercising and what the request covers. 21.2 We may ask you to verify your identity, and we may ask you to narrow a very broad request, but we will not charge you or refuse a valid request because it is inconvenient. 21.3 We respond within one calendar month. For complex or multiple requests we may extend by up to two further months and will tell you within the first month if we do. 21.4 If we cannot do what you have asked, we explain why and tell you how to complain to the ICO. 21.5 Some data cannot be deleted on request, for example invoices we must keep for tax purposes, records needed to defend a legal claim, and published competition results, which may remain in anonymised form. --- ## 22. Marketing 22.1 **Service messages** (receipts, renewal reminders, payment problems, security and policy changes) are sent to everyone with an account, because they are needed to run your account. You cannot opt out of these while you hold an account. 22.2 **Our own marketing messages.** We send these where you have opted in, or where you are an existing customer and we are permitted to email or text you about our own similar products and services under the "soft opt-in" in PECR. In that case we offer you the chance to refuse at the point we collect your details and in every message we send, so you can be on this list without ticking a box and leave it at any time. 22.3 **Partner marketing.** We share your contact details with a sponsor, partner or Perks partner for their own marketing only where you have given a separate, named opt-in for that partner, as set out in section 7A of the Third-Party Data Sharing Terms. Refusing never affects your access to Reasoned, your plan, a competition or a prize. You can withdraw at any time by emailing us, and you can also unsubscribe from the partner directly. 22.4 Every marketing email has a one-click unsubscribe link, and you can manage preferences in **Account → Notifications**. We action unsubscribes within 2 days. We do not currently send marketing SMS or WhatsApp. --- ## 23. Cookies Our use of cookies and similar technologies is explained in the **Cookie Policy**, including the categories we use, how consent is obtained for non-essential cookies, and how to change your preferences. --- ## 24. Third-party links Reasoned links to third-party sites and services, including Perks partners, sponsors and the trading platform used in competitions. This policy does not apply to them. Read their privacy policies before using them. --- ## 25. Changes to this policy We may update this policy. The current version is always published with the date it was last updated. Where changes are material, we will email you or show a prominent notice before they take effect. --- ## 26. Contact Reasoned Limited · 128 City Road, London EC1V 2NX · Company No. 16859259 · ICO Registration No. ZC090450 team@reasonedfinance.com · https://reasonedfinance.com © 2026 Reasoned Limited. All rights reserved.