Adaptibles Privacy Policy

1. Who We Are

Adaptibles CIC ('Adaptibles', 'we', 'us', or 'our') is a Community Interest Company registered in England and Wales, with our principal place of business in Middlesbrough, United Kingdom. We operate the Adaptibles platform at www.adaptibles.com, a neuroinclusive digital learning and talent development service designed for neurodivergent and differently-abled adult learners.

Adaptibles CIC is the data controller for personal data collected through the Platform. This means we determine how and why your personal data is processed.

If you have any questions about this Privacy Policy or how we handle your data, please contact us at support@adaptibles.com.

2. Our Approach to Privacy

At Adaptibles, privacy and data protection are not compliance exercises. They are expressions of the respect we have for our users.

Many of our users share information with us that is deeply personal, including details about their neurodivergent conditions, learning differences, and experiences of navigating systems that were not built for them. We treat this information with the utmost care. We collect only what we need, we use it only for the purposes we describe, and we protect it with appropriate technical and organisational measures.

We operate in full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

3. What Personal Data We Collect

3.1 Data You Provide Directly

When you register for an account, use the Platform, or contact us, you may provide:

• Your name and email address
• A password (stored in encrypted form; we never store plaintext passwords)
• Your learning profile information, including your self-selected neurodivergent or learning profile type during onboarding
• Profile image, biography, and other optional profile information
• Payment information when purchasing a course (processed by Stripe; we do not store full card details)
• Course content and materials, if you are an instructor
• Community posts, discussion contributions, and messages
• Feedback, reviews, and ratings
• Communications you send to us, including support requests

3.2 Data We Collect Automatically

When you use the Platform, we automatically collect certain technical data, including:

• IP address and approximate geographic location
• Device type, operating system, and browser information
• Pages visited, features used, and time spent on the Platform
• Referring URLs
• Session identifiers and cookie data

This data is used to operate and improve the Platform, to diagnose technical issues, and to understand how our service is being used.

3.3 Special Category Data

Some of the information you may choose to share with us, including information about neurodivergent conditions, mental health, or disability, constitutes 'special category data' under the UK GDPR. This category of data receives the highest level of protection under data protection law.

We process special category data only:

• Where you have given us your explicit consent to do so, via our onboarding flow and profile settings
• Where processing is necessary for the provision of our service as requested by you
• Where required by law

You are never required to disclose your specific diagnosis or condition to use the Platform. Our adaptive onboarding system allows you to describe how you experience learning without requiring clinical labels.

4. How We Use Your Personal Data

We use your personal data for the following purposes and on the following legal bases:

To Provide and Operate the Platform

Legal basis: Performance of a contract. We process your data to create and manage your account, deliver course content you have purchased, operate the AI learning assistant Ada, and provide you with the services you have requested.

To Personalise Your Experience

Legal basis: Consent / Legitimate interests. We use your learning profile, usage patterns, and preferences to adapt the Platform to your needs, including personalising course recommendations and adjusting the interface to your accessibility preferences.

To Process Payments

Legal basis: Performance of a contract. We share necessary transaction data with our payment processor, Stripe, to handle course purchases and instructor payouts.

To Communicate With You

Legal basis: Performance of a contract / Legitimate interests. We send you account-related communications including registration confirmation, purchase receipts, course updates, and moderation notifications. We may also send you service announcements and updates relevant to your use of the Platform.

To Send Marketing Communications

Legal basis: Consent. We will only send you marketing emails if you have opted in to receive them. You can withdraw your consent and unsubscribe at any time using the link in any marketing email or by updating your notification preferences in your account settings.

To Moderate Content and Ensure Safety

Legal basis: Legitimate interests / Legal obligation. We process content posted to the Platform to detect and address violations of our Community Guidelines, safeguarding concerns, and illegal content. This includes the use of automated AI moderation tools, subject to human review.

To Improve the Platform

Legal basis: Legitimate interests. We analyse aggregated and anonymised usage data to understand how the Platform is being used, to identify areas for improvement, and to develop new features.

To Comply With Legal Obligations

Legal basis: Legal obligation. We may process and retain certain data to comply with our obligations under applicable law, including tax law, data protection law, and our duties in relation to safeguarding.

5. Special Provisions for Neurodivergent and Accessibility Data

We recognise that information about neurodivergence, cognitive differences, and disability is sensitive and meaningful in ways that go beyond the legal definition of special category data.

Our specific commitments in relation to this data are:

• We will never share your neurodivergent profile or learning type with third parties for commercial or advertising purposes.
• Your declared learning profile is used solely to adapt the Platform to you and to improve our neuroinclusive design.
• You can update or delete your learning profile information at any time from your account settings.
• We will never use accessibility data to make automated decisions that negatively affect your access to the Platform.
• We will never sell this data, ever, under any circumstances.

6. Who We Share Your Data With

We do not sell your personal data to third parties. We share data only in the circumstances below:

Service Providers

We work with trusted third-party service providers who help us operate the Platform. These providers may have access to your personal data only to the extent necessary to perform their services for us. They are contractually obligated to protect your data and may not use it for their own purposes.

• Stripe, for payment processing
• Cloud hosting and infrastructure providers
• Email delivery services
• Analytics providers (using anonymised or pseudonymised data where possible)
• AI and machine learning service providers who support the operation of Ada and our moderation systems

All service providers are required to process data only on our instructions and to maintain appropriate security standards.

Instructors

If you are a learner enrolled in a course, the instructor of that course may see your name and any course-related activity you have chosen to share, such as questions posted in discussion areas. Instructors do not have access to your learning profile, accessibility settings, or payment information.

Legal Requirements

We may disclose your data to law enforcement, regulatory bodies, or other authorities if required to do so by law, or where we believe in good faith that such disclosure is necessary to protect the safety of any person or to prevent illegal activity.

Business Transfer

If Adaptibles CIC is involved in a merger, acquisition, or asset sale, your data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

7. Data Retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements.

As a guide:

• Account data is retained for as long as your account remains active and for a reasonable period thereafter in case you choose to reactivate.
• Transaction records are retained for seven years in accordance with HMRC requirements.
• Community and course content you have posted will be retained unless you request deletion, in which case it will be removed or anonymised.
• Data processed for legal compliance purposes will be retained for as long as the relevant legal obligation requires.

You may request deletion of your account and associated data at any time. See Section 9 for how to exercise this right.

8.Data Security

We take the security of your personal data seriously. Our technical and organisational measures include:

• Encryption of data in transit using TLS
• Encryption of sensitive data at rest
• Secure, hashed storage of passwords
• Role-based access controls limiting who within Adaptibles can access personal data
• Regular security assessments, including penetration testing and vulnerability scanning
• An incident response plan for data breaches

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it, and will notify you directly without undue delay where required.

9. Your Rights

Under the UK GDPR, you have the following rights in relation to your personal data:

Right of Access

You have the right to request a copy of the personal data we hold about you. We will respond within one month of receiving your request.

Right to Rectification

If any of the data we hold about you is inaccurate or incomplete, you have the right to request that we correct it.

Right of Erasure

You have the right to request that we delete your personal data where there is no compelling reason for us to continue processing it. Note that we may be unable to delete certain data where we have a legal obligation to retain it.

Right to Restrict Processing

You have the right to ask us to restrict the processing of your data in certain circumstances, such as while we are resolving a dispute about its accuracy.

Right to Data Portability

You have the right to receive a copy of personal data you have provided to us in a structured, commonly used, machine-readable format, and to request that we transmit it to another data controller where technically feasible.

Right to Object

Where we are processing your data on the basis of legitimate interests, you have the right to object. We will stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests.

Rights in Relation to Automated Decision-Making

You have the right not to be subject to decisions made solely by automated processing that produce legal or similarly significant effects on you. Where we use automated moderation tools, these are always subject to human review and you may appeal any outcome.

Right to Withdraw Consent

Where we are processing your data on the basis of consent, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at support@adaptibles.com with the subject line 'Data Rights Request'. We will respond within one month. If we are unable to fulfil your request, we will explain why.

10. Cookies

We use cookies and similar technologies on the Platform. A full explanation of how we use cookies, which cookies are essential and which are optional, and how to manage your preferences is provided in our Cookie Policy at www.adaptibles.com/cookies.

11. Children's Privacy

The Platform is intended solely for users aged 18 and over. We do not knowingly collect personal data from children under the age of 18. If we become aware that a user is under 18, we will take steps to delete their account and associated data promptly.

If you believe a child has registered on our Platform, please contact us immediately at support@adaptibles.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or the services we offer. Where changes are material, we will notify you by email and via a notice on the Platform at least 14 days before they take effect.

The date at the top of this document indicates when it was last updated. Continued use of the Platform after a change takes effect constitutes acceptance of the updated policy.

13. Contact and Complaints

For any questions, requests, or concerns relating to this Privacy Policy or our data practices, please send an email to

support@adaptibles.com