Legal
Third-Party Data Sharing Terms
Third-Party Data Sharing Terms
Reasoned Limited | Company No. 16859259 | ICO Registration No. ZC090450 128 City Road, London EC1V 2NX, United Kingdom
team@reasonedfinance.com | https://reasonedfinance.com
Version 2.0 · Last updated: September 2026
1. What this document is
1.1 These Third-Party Data Sharing Terms ("Sharing Terms") explain how Reasoned Limited ("Reasoned", "we", "us") shares personal data with other organisations.
1.2 They stand alone and are also incorporated into our Privacy Policy. Where the two differ on third-party sharing, these Sharing Terms apply. They form part of the Platform Terms of Service.
1.3 They are written to comply with the UK GDPR, the Data Protection Act 2018 and PECR. Where users are in the EU or EEA, EU GDPR requirements are also taken into account.
1.4 We never share or sell your personal data for someone else's marketing unless you have specifically opted in to that sharing, with the recipient named at the time. Where you do opt in, we may receive payment from that partner. You can withdraw at any time. This is explained in section 11.
1.5 We may also commercialise genuinely anonymised and aggregated data, which is not personal data — see section 11.
2. Scope
These Sharing Terms apply to personal data processed through: our website and app; account registration; Learn, Compete and Get Hired; subscriptions and payments; competitions; society and team pages; Perks; the referral programme; our emails; any community platform we operate; and any other Reasoned feature.
3. Lawful bases for sharing
| Basis | When we rely on it |
|---|---|
| Contract (Art. 6(1)(b)) | Sharing needed to deliver what you asked for — for example payment processing, or creating a simulated trading account |
| Legitimate interests (Art. 6(1)(f)) | Operating, securing and improving the platform, society reporting, aggregate analytics and fraud prevention. We keep a legitimate interests assessment for each such purpose |
| Consent (Art. 6(1)(a)) | Sharing identifiable data with employers, recruiters, sponsors or prize providers, and marketing where consent is required |
| Legal obligation (Art. 6(1)(c)) | Disclosure required by law, a court order or a regulator |
Withdrawing consent stops future sharing but does not affect sharing already made lawfully.
4. Who we share personal data with
| Recipient | Purpose | Data shared | Basis | Their role |
|---|---|---|---|---|
| Hetzner (Germany) | Hosting and infrastructure | All platform data as stored | Contract / legitimate interests | Processor |
| Stripe | Payments, renewals, refunds, fraud prevention | Name, email, payment and transaction data | Contract | Independent controller |
| BillionMail (self-hosted) | Transactional and marketing email | Name, email, preferences | Contract / consent | Processor (software we run) |
| Anthropic (Claude API) | Generating AI Interview Coach, CV Tailor and assessment feedback | The content you submit and the generated response | Contract | Processor. Does not use your data to train its models |
| Google (sign-in) | Optional Google account sign-in | Name and email Google shares with us if you choose that sign-in | Contract | Independent controller for the Google account |
| TradeLocker (competitions) | Simulated trading environment | Account identifier, simulated activity | Contract | Processor or independent controller depending on the activity |
| Partner university societies | Society leaderboards, participation and engagement reporting | Username, university, participation and performance metrics | Contract / legitimate interests | Independent controller, under written agreement |
| Sponsors and partners | Competition delivery, prize fulfilment | Aggregated statistics by default; identifiable data only with your specific consent | Legitimate interests / consent | Independent controller |
| Sponsors, partners and Perks partners (marketing) | Their own marketing to you, where you opt in (section 11) | Name, email, phone if given, university, course, graduation year, campaign source | Consent | Independent controller |
| Employers, recruiters, firms | Talent identification — opt-in only | Profile, results, certificates, contact details, CV, as you choose | Consent | Independent controller |
| Perks partners | Delivering an offer you choose to take up | Only what is needed, or nothing where you go to their site directly | Contract / consent | Independent controller |
| Professional advisers, auditors, insurers | Legal, accounting and insurance purposes | Minimum necessary | Legitimate interests / legal obligation | Independent controller |
| Authorities, regulators, courts | Legal compliance, safety, enforcement | Minimum necessary | Legal obligation / legitimate interests | Independent controller |
| Buyer or successor | Sale, merger or restructuring of our business | Data necessary for the transaction | Legitimate interests | Independent controller |
5. Processors and agreements
5.1 Where a third party processes data on our behalf, we put a written data processing agreement in place before processing starts, meeting Article 28 UK GDPR: subject matter and duration; nature and purpose; categories of data and data subjects; processing only on our documented instructions; confidentiality; security measures; restrictions on sub-processors; assistance with data subject rights, breaches and impact assessments; deletion or return of data on termination; and audit rights.
5.2 We carry out due diligence before engaging a processor and review our processors periodically.
5.3 Processors may only engage sub-processors with our prior written authorisation, and must tell us before adding or replacing one so that we can object. We keep an up-to-date list of our processors and sub-processors, available on request at team@reasonedfinance.com.
6. University societies
6.1 Where you provide your university or society, we may share your username, university affiliation and participation and performance metrics with that society, so it can run society leaderboards, report engagement and administer joint activities.
6.2 We only share with societies that have a written partnership agreement with us containing data protection obligations. Societies act as independent controllers for what they do with the data.
6.3 We do not share your email address, phone number or documents with a society unless you ask us to or clearly agree.
6.4 If you do not want your data shared with your society, do not add a society affiliation, or email team@reasonedfinance.com.
7. Sponsors and prize providers
7.1 By default, sponsors receive only aggregated statistics — for example the number of participants, or overall performance distributions — which do not identify anyone.
7.2 Identifiable data is shared with a sponsor or prize provider only where you have given specific, informed consent, the sharing is limited to what is necessary (for example delivering a prize), and a written agreement with data protection obligations is in place.
7.3 Taking part in a sponsored competition does not mean your details go to the sponsor. If a sponsor needs to contact winners to deliver prizes, we ask those winners individually.
7.4 We never share your identifiable details with a sponsor by default, and never as a hidden condition of taking part. Consented sharing for a sponsor's own marketing is dealt with in section 11.
8. Consented sharing with sponsors and partners for their own marketing
8.1 Some of what we offer is funded by sponsors and partners — for example competition sponsors, Freshers and campus activations, prop firms, brokers, data providers and Perks partners. Some of those partners want to contact interested students directly, and we are paid for introductions of that kind.
8.2 The soft opt-in that applies to our own marketing does not extend to other organisations. So we share your name, email address and other contact details with a partner for their own marketing only where you have given consent to that specific sharing. That consent is:
- Named — the partner is identified at the point you give it, or the offer makes clear exactly who will receive your details;
- Specific — it covers that partner and that purpose, not sharing in general;
- Separate — it is a distinct, unticked opt-in, never bundled into our terms, a competition entry or an account sign-up;
- Optional — refusing does not affect your access to Reasoned, your plan, a competition or any prize, unless the offer itself is the partner's product (see 11.4);
- Informed — we tell you what will be shared, who with, why, and that they may market to you;
- Recorded — we keep a record of who consented, when, to what wording and version, so we can evidence it.
8.3 What we may share under 9.2, depending on the form you complete: first and last name, email address, phone number (if you give one), university, course, graduation year, and the campaign, event or competition you came from. We do not share your CV, Vault documents, assessment results, Reasoned Score, competition performance, or any special category data under this section.
8.4 Where sharing is part of the offer itself. If you claim a partner's product, prize, discount code, account or trial — for example a sponsor's evaluation account, a Perks offer redeemed with the partner, or a prize that the partner must deliver to you — we share only what is needed to provide it. That sharing is necessary to give you what you asked for, and it is made clear before you claim the offer. We do not use that route to pass your details on for unrelated marketing.
8.5 Payment. We may be paid a fee, commission or sponsorship value in connection with introductions and campaigns under this section. Where that applies to a specific offer, we say so where the offer appears.
8.6 What the partner may then do. Once a partner receives your details they act as an independent controller. They must give you their own privacy information, market to you only in line with their own legal obligations, honour any opt-out you give them, and they may not sell your details on or share them further. We require these commitments in writing before any sharing takes place, and we carry out due diligence on the partner first.
8.7 Withdrawing. You can tell us at any time at team@reasonedfinance.com and we will stop sharing your details and tell the partner you have withdrawn. Because the partner is an independent controller, you should also unsubscribe from them directly; every marketing message they send must include a way to do that. Withdrawal does not undo sharing already made.
8.8 Limits we apply. We do not share details with a partner we have not vetted, we do not share with businesses whose products we consider unsuitable for a student audience, we do not share the details of anyone under 18 (Reasoned accounts are 18+), and we do not pass on data collected purely for running your account. We also keep the number of partners on any single form to a level where your consent remains meaningful.
8.9 Financial promotions. Where a partner is a prop firm, broker or other financial business, any promotional content we display about them is subject to clause 26 (Sponsors, partners and advertising) of the Platform Terms of Service and the financial promotion rules. Sharing your contact details with a partner is not, and does not make Reasoned responsible for, that partner's own marketing or products.
9. Employers, recruiters and firms (opt-in only)
9.1 We may operate a programme allowing verified employers, firms and recruiters to see profiles of users who have opted in.
9.2 Your data is never shared without your prior explicit opt-in. You will not be enrolled automatically, and participation in competitions, assessments or a paid plan is not consent. Consent is never bundled with our terms, and we do not use pre-ticked boxes.
9.3 If you opt in, what may be shared is limited to what your profile contains and what you choose to include, which may be: name; contact details; university and course; performance data, results and certificates; career preferences; your CV and any profile materials.
9.4 Special category data (for example health, ethnicity or religion) is never shared through this programme without separate explicit consent for that specific purpose.
9.5 Before granting any employer access we verify who they are, enter a written agreement requiring compliance with data protection law, restrict onward transfers, impose confidentiality and security obligations, and limit access to named personnel. We can revoke access at any time.
9.6 Employers act as independent controllers once they receive your data and must give you their own privacy information.
9.7 You can withdraw at any time in your profile settings, or by emailing team@reasonedfinance.com with the subject "Recruitment opt-out". Withdrawal stops future access immediately and removes you from the visible pool, but cannot undo processing already carried out lawfully by an employer.
9.8 Where an employer is outside the UK or EEA, we put appropriate transfer safeguards in place first.
9.9 We do not charge you any fee in connection with this programme, or for finding you work.
10. Public Vault pages and recruiter leads
10.1 A public Vault is visible to anyone with the link. That is publication by you, not sharing by us, and you control it: make your Vault private, delete items, or delete your account, and the links stop working.
10.2 When a recruiter or other visitor views a public Vault we may ask for their email address and organisation, and use those details to contact them about our recruitment products. We rely on our legitimate interests in business development, tell them so at the point of collection, and give them an easy way to opt out. We do not pass those details to students or to other partners.
10.3 Business contact data about recruiters, firms, societies, sponsors and partners is processed as described in the Privacy Policy and is never shared with another partner for their marketing unless that contact has agreed.
11. Anonymised and aggregated data
11.1 We may create, use, license and sell anonymised and aggregated data derived from platform and competition activity — for example participation trends, aggregate performance distributions, engagement statistics and cohort-level insights.
11.2 Anonymised data is data processed so that no individual can reasonably be identified, directly or indirectly, by us or anyone else. It is not personal data, so consent is not required.
11.3 Our anonymisation standard. Before any dataset leaves our systems: all direct identifiers are removed; data is aggregated so that individual-level inferences cannot reasonably be drawn, with cohorts below a minimum size suppressed; distinctive outliers and quasi-identifiers are generalised or removed; and a re-identification risk assessment is carried out and recorded.
11.4 Who we may share it with: universities and academic researchers; financial institutions, trading firms and employers; sponsors and partners; analytics and research organisations; and investors, in the course of business discussions.
11.5 Limits we apply. We do not license anonymised datasets to data brokers or for advertising profiling. Recipients are contractually prohibited from attempting re-identification, from combining the data with other datasets to identify individuals, and from onward sale without our consent. If we discover an attempt at re-identification, we terminate the arrangement and notify the ICO where required.
11.6 We do not build or sell datasets of identifiable students. Identifiable details go to a partner only through the consented route in section 11, or where you have opted into the employer programme in section 11.
12. Our providers, where they process data, and our agreements with them
| Provider | Purpose | Location of processing |
|---|---|---|
| Hetzner | Hosting and databases | Germany (EEA), subject to the live server's assigned DC |
| Stripe | Payments and fraud prevention | UK, EEA and United States |
| BillionMail | Email we send (self-hosted on the same infrastructure) | Same location as our hosting |
| Anthropic | AI features (Claude API) | United States |
| Optional sign-in; analytics and advertising only after consent | United States / global | |
| TradeLocker | Simulated trading environment for competitions | As set out in their terms |
| Meeting recording and transcription tools | Not a product processor. Any sales-call tool is named to you at the time if we use one | — |
Locations can change as providers add regions. Where processing takes place outside the UK we apply the safeguards in section 18. An up-to-date list of our processors and sub-processors is available at team@reasonedfinance.com.
Where we act as a processor for a business customer — for example an employer, university or society that uses our services and decides its own purposes — we enter a data processing agreement with them on UK GDPR Article 28 terms, and a copy is available on request.
13. Retention by recipients, and breaches
13.1 Processors must keep data only as long as they need it to provide the service to us, and delete or return it when our agreement ends.
13.2 Independent controllers — sponsors, partners, employers, societies — set their own retention periods and must tell you what they are.
13.3 Processors must notify us of any personal data breach affecting our users without undue delay. We assess the risk, contain it, and notify the ICO and affected users where UK GDPR requires.
13.4 Where a partner breaches its agreement with us, we may suspend sharing immediately, require deletion, and end the relationship.
14. International transfers
14.1 Our primary hosting is in Germany (EEA). Some providers process data outside the UK and EEA.
14.2 Where they do, we use UK adequacy regulations, the ICO's International Data Transfer Agreement or Addendum, or Standard Contractual Clauses, and carry out a transfer risk assessment where required.
14.3 You can request details of the safeguards for any specific transfer at team@reasonedfinance.com.
15. Data minimisation and purpose limitation
- Adequate and relevant: we share only what the specific purpose requires.
- Minimised: for example, a username and metrics where a name and contact details are not needed.
- Purpose-limited: recipients may not reuse data for another purpose (such as their own marketing) without your separate consent.
- Retained no longer than needed: recipients must delete or return data when the purpose ends.
16. Security requirements for recipients
Recipients must protect data with appropriate measures, including encryption in transit and at rest, access controls and multi-factor authentication, role-based restrictions, monitoring and logging, breach detection and reporting, prompt notification to us of any breach affecting our users, and secure deletion or return of data.
Where a processor suffers a breach affecting our users, we will contain it, assess the risk and notify the ICO and affected users as required by UK GDPR.
17. Your rights
You have the right to be informed about sharing (this document), to access your data, to object to sharing based on legitimate interests, to withdraw consent, to request erasure, and to request restriction. Note that we cannot compel an independent controller to delete data it has already lawfully received, though we will pass your request on.
Email team@reasonedfinance.com with the subject "Data Rights Request". We respond within one calendar month. You may also complain to the Information Commissioner's Office — https://www.ico.org.uk — helpline 0303 123 1113.
18. Records and accountability
We maintain records of processing under Article 30 UK GDPR, covering each recipient, the categories of data shared, the purpose and lawful basis, the recipient's role, transfer safeguards, and the agreements in place. These are available to the ICO on request.
19. Changes
We may update these Sharing Terms. The current version is always published with the date it was last updated. Where we introduce a new category of sharing or a new programme involving personal data, we will notify registered users by email and display a notice before the change takes effect.
20. Contact
Reasoned Limited · 128 City Road, London EC1V 2NX · Company No. 16859259 · ICO Registration No. ZC090450 team@reasonedfinance.com · https://reasonedfinance.com
© 2026 Reasoned Limited. All rights reserved.