Privacy Notice

Fitter for Purpose Limited

Version 1.1. Published 9 August 2026. Replaces the privacy policy dated 16 March 2022.

This notice explains what we do with information about people. It covers our website and it covers our products, because the two are not separate. If you are asked to accept this notice before using Confidence, Initiative Maturity, Repertoire or any other Fitter for Purpose service, this is the notice you are accepting.

Please read section 5 if you have been told that your name appears in our system and you have never used our products. That section is written for you.

1. Who we are

Fitter for Purpose Limited is a private limited company incorporated in England and Wales with company registration number 14221082. Our registered office is at 27A Green Lane, Northwood, Middlesex, England HA6 2PX.

In this notice, "we", "us", "our" and "FFP" mean Fitter for Purpose Limited. "You" means the person the information is about.

For anything to do with this notice, or with information we hold about you, write to privacy@fitterforpurpose.io.

We are registered with the Information Commissioner's Office as a data controller.

2. What this notice covers

This notice covers:

- our website at fitterforpurpose.io, and any marketing we send;

- Discovery Lab, our customer discovery platform;

- Commit, our platform for developing a Buyable Story;

- Un-Limit, our talent characterisation platform;

- our Instruments, being IMPact Potential, Initiative Maturity, Confidence, Team Fit, Repertoire and Match Fit;

- the workshops, reviews, masterclasses and coaching we deliver around them.

We refer to all of these together as the Services.

Where we work through a certified partner or facilitator, that partner is a separate business with its own responsibilities. This notice covers what we do. It does not cover what your coach, your employer or a partner does with information they hold about you in their own systems.

3. The three kinds of people this notice is about

Most privacy notices are written for people who signed up. Ours has to do more than that, because our products hold information about people who did not.

Account holders. You registered, you log in, and you use the Services. You know we hold information about you.

People who complete an Instrument. You were invited by your employer, your coach or a programme, and you answered questions about yourself. You know we hold information about you, and section 8 explains the unusual position of the record we build.

People we hold information about who never signed up. You may be a prospective customer that one of our users is researching, or someone named in passing in a record about somebody else, for example as a colleague, an adviser, a referrer or an academic contact. You did not agree to anything and in the ordinary case you did not know the record existed. Section 5 sets out what we hold, why, and what you can ask us to do about it.

4. What we collect, and why

4.1 Visiting the website or contacting us

We collect your name, email address, and anything else you choose to tell us, when you fill in a form, subscribe to our mailing list or write to us. Our website records standard technical information including your IP address, browser and device type, and the pages you looked at.

We use this to answer you, to send you material you asked for, and to understand how the website is used.

4.2 Holding an account

We collect your name, email address, a hashed password, the organisation or team you belong to, your role and permissions in the system, and the record of what you did in it. Our audit log records the action, the time, your IP address and your browser.

We use this to give you the Services, to keep the account secure, to support you when something goes wrong, and to bill for it.

4.3 Completing an Instrument

We collect your answers, and the characterisation those answers produce. Depending on the Instrument this may cover your mindset, confidence, human skills and drive, what you know how to do and to what depth, your view of your own capability, and your fit with a team or an initiative.

The Drive dimension of IMPact Potential uses a framework developed by Kathy Kolbe to characterise how you naturally take action.

Where you mark an item in Repertoire as one you know deeply, we hold in addition a know-how record: your own account of what you did, its scale, its outcome, the evidence for it and the transferable pattern, drawn out in a short conversation, together with the turns of that conversation. The account is yours. It is drafted from what you gave us, you confirm or correct every part of it, and nothing reaches your profile without you.

We also hold, against a deep item, an internal marker of how well evidenced your account is. It is not a mark, it is not shown to you in the product, and it is never visible to an organisation. You are entitled to see it if you ask, and section 14 explains how.

Some readings are computed by rule rather than by AI. Your Confidence scores and bands are calculated from your answers, and the AI never writes a number. Where the AI is unavailable during an Initiative Maturity assessment, part of it may be scored by a rule-based fallback instead, and the affected results are flagged in your record.

We use this to give you and, where you have agreed to it, the people you work with, a reading they can act on. Section 8 explains who can see it.

4.4 Meetings, conversations and uploaded material

Where you take part in a discovery conversation or a review that is recorded or transcribed, we hold the transcript, quotations attributed to the speaker, and the analysis we derive from it. Where you or a colleague upload a document, we hold the document and the text we extract from it.

We use this to prepare for conversations, to evaluate how a conversation went, and to build the evidence base an initiative team works from.

We do not record or transcribe a conversation without telling the people in it. If you are in a conversation that is being recorded, you should be told at the time, and you can say no.

4.5 Research about a prospective customer

Our users identify organisations and individuals they want to approach. Where an individual is identified, we may hold their name, job title, employer, business email address, telephone number, professional profile links such as LinkedIn, and location; an assessment of their likely role in a buying decision; a research summary about their professional background; a record of outreach sent to them and any reply; and observations drawn from public professional sources, such as something they published, an event they attended, and notes made about what would matter to them in a conversation.

We use this so that a conversation with them is well prepared and relevant rather than generic. Section 5 explains our lawful basis for it and what you can do about it.

4.6 People named by someone else

Our users type into free text fields, and in doing so they sometimes name other people: co-founders, advisers, referrers, academic contacts, other members of a team. We hold what was typed.

We do not seek this information and it is not the purpose of the record. Section 5 applies to it in the same way.

5. If you are in our system and you never signed up

This section is for people described at 4.5 and 4.6.

What we hold. Your name and professional details, an assessment of your likely role in a buying decision at your organisation, a research summary drawn from public professional sources, any correspondence sent to you, and notes made by the person preparing to speak with you.

Why we hold it. We rely on our legitimate interests, and those of our customers, in identifying and preparing for business conversations with the right people at organisations that may benefit from what we do. We have assessed that interest against your rights, and you can ask us for that assessment.

What we do not do. We do not build a picture of your private life. We do not seek information about your health, your beliefs, your politics, your sex life, your racial or ethnic origin, your trade union membership, or any criminal matter, and we ask our users not to record it. Where we find such information in our system we delete it. We do not sell information about you, and we do not share it for anyone else's marketing.

What you can do. You can ask us what we hold about you, ask us to correct it, ask us to delete it, or object to us holding it at all. If you object, we will stop unless we can show a compelling reason not to, and in practice on a record of this kind we will normally simply delete it. Write to privacy@fitterforpurpose.io with your name and, if you can, your employer and your professional profile link, so that we can find the right record.

We will not charge you and we will answer within one month.

6. Our lawful bases

Under the UK General Data Protection Regulation we must have a lawful basis for each thing we do with personal data. Ours are as follows.

Give you an account and provide the Services to you: Performance of a contract

Take payment and keep accounting records: Legal obligation, and our legitimate interest in running the business

Send you marketing you asked for: Your consent, which you can withdraw at any time

Understand how the website is used: Your consent, given through the cookie banner

Hold and process your answers to an Instrument, and the record built from them: Your consent, given when you begin the Instrument

Research and prepare for a conversation with a prospective customer: Our legitimate interests, and those of our customer, as described at section 5

Keep the Services secure and investigate misuse: Our legitimate interest in protecting the Services and their users

Where we rely on consent, you can withdraw it at any time and we will stop. Withdrawing consent does not undo what we did before you withdrew it.

7. When we act for someone else

Sometimes we decide what is done with information and why. In that case we are the controller and this notice describes what we do.

Sometimes a customer uses our platform to do their own work, for example a client researching their own prospective customers in Discovery Lab, or an employer running a programme through Commit. In that case the customer decides what is collected and why, and we act on their instructions as their processor. Our contract with them governs what we may do, and their own privacy notice governs their side of it. If you ask us to exercise a right over information we hold on that basis, we will pass your request to them without delay and tell you we have done so.

8. Un-Limit and Repertoire: the record belongs to you

Un-Limit and Repertoire hold a durable record of how you are characterised and what you know how to do. That record is built through conversation and activity over time, and it is designed to outlast the cohort, programme or engagement in which it was started.

Because of that, we hold it on unusual terms and we want to be plain about them.

The record belongs to you. You are the only person who can grant a read of it, you choose who receives that read and for what purpose, and you may withdraw it at any time. When you withdraw it, they lose access. Nobody else can grant a read on your behalf, and we cannot.

An organisation running a programme you are on cannot be given a read of your record. That is not a matter of policy that could be relaxed for a particular client: no route exists by which an organisation can see an individual profile. Where an institution looks at a group it sees aggregates only, carrying no names, no free-text, no know-how record and no internal marker.

You are characterised, and never scored. No numeric measure is recorded against you. This is enforced where you cannot see it: the store that holds your profile rejects any field that looks like a score, rank, rating, grade or percentage, and it does so through every level of the record, so a number cannot be written against you even by mistake. Depth, maturity and the internal marker are words, not numbers, for that reason.

Where a team you belong to is using Commit, a limited and derived view of your profile may inform a suggestion about who might take on a piece of work. That view is advisory, it is scoped to your team, and it never includes your own words, your know-how record or the internal marker.

We keep the record for as long as you want it. You may ask us to delete it at any time and we will, and that request does not need a reason. The store keeps a history rather than overwriting, so a deletion is carried out through that history and we will confirm to you when it is done.

9. Who we share information with

We use other companies to run the Services. They act on our instructions and they may not use your information for their own purposes.

• Anthropic. Provides the AI models used in Discovery Lab for research, preparation and analysis, and in Repertoire for reading what you give it and drafting the know-how record. United States.

• Neon. Provides the database in which platform data is stored. Serverless Postgres, region confirmed on request.

• Replit. Hosts the Discovery Lab application. United States.

• Google. Provides the Gemini AI model that evaluates submitted evidence in Commit, and Google Workspace, in which Commit runs, and website analytics. United States and Ireland.

• Squarespace. Hosts our website. United States.

• Intuit Mailchimp. Sends our mailing list. United States.

We will also disclose information where the law requires it, where we need to establish or defend a legal claim, and to a buyer or successor if the business is sold, in which case we will tell you first.

We do not sell your information to anyone.

10. Artificial intelligence

Our products use artificial intelligence, and it is fair that you know what that means in practice.

We use two model providers. Anthropic provides the models used in Discovery Lab, for research, preparation, evidence and quotation extraction and evaluation, and in Repertoire, for reading what you give it and drafting the know-how record. Google provides the Gemini model used in Commit, which evaluates the evidence a team submits against the published criteria.

When we do any of those things we send the relevant material to the provider and it returns a result to us. The material sent can include a person's name, role and employer, relationship notes recorded about them, the transcript of a conversation, and your own account of your work.

Under the terms on which we use these providers, they process that material only to return the result to us and do not use it to train their models.

In Discovery Lab and Repertoire the output is a draft for a person to use, not a decision, and in Repertoire you confirm or correct every suggestion before it is recorded. In Commit the evaluation is automatic and applies fixed criteria to the evidence a team submits, and the resulting verdict is computed by a published rule from those scores. It evaluates the initiative's evidence, not the people on the team.

We do profile you. Building a characterisation of an individual from their answers and their account of their work is profiling, and the protections in data protection law that attach to profiling apply to it. What we do not do is make a decision about you by solely automated means that produces a legal effect or something similarly significant. The matching and connection features that could raise that question are not built, and we will not deploy them without addressing it first and telling you.

11. How long we keep information

Website enquiries and correspondence: Two years from your last contact with us

Mailing list: Until you unsubscribe, and in any event two years after you last engage with us

Website analytics: Twenty six months

Account records: For as long as the account is open, and twelve months after it is closed

Security and audit logs: Twelve months

Meeting transcripts, evaluations and uploaded material: Twenty four months from the date of the meeting, unless our customer instructs otherwise under section 7

Records about a researched individual: Twenty four months from the last activity on that record

Un-Limit and Repertoire records: For as long as you want them, and deleted on your request

Accounting records: Six years, as UK tax law requires

When a retention period ends we delete the record or anonymise it so that it is no longer about an identifiable person.

12. Special category data

We do not seek information about your health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetics, biometrics, sex life or sexual orientation, and we do not seek information about criminal offences.

Our Instruments characterise how you work. They are not health or clinical assessments and they should not be treated as one.

We ask everyone who uses our Services not to record information of this kind about anybody, and where we find it we delete it.

13. Where your information goes

We are based in the United Kingdom. Some of the companies listed at section 9 are based outside it, mainly in the United States.

Where we send personal data outside the United Kingdom, we do so under the International Data Transfer Agreement issued by the Information Commissioner, or the UK Addendum to the European Commission's standard contractual clauses, or where the country has been found by the United Kingdom to provide adequate protection.

You may ask us for a copy of the safeguard that applies to a particular transfer.

14. Your rights

You have the right to:

- ask us what we hold about you and get a copy of it;

- have it corrected if it is wrong or incomplete;

- have it deleted;

- restrict what we do with it while a question about it is resolved;

- object to what we are doing, in particular where we rely on legitimate interests;

- receive information you gave us in a portable form, and have it sent to another organisation where that is technically possible;

- withdraw consent at any time, where consent is what we relied on.

A copy of what we hold includes everything held against you, including the internal evidence marker described at section 4.3 that is not displayed in the product.

To exercise any of these, write to privacy@fitterforpurpose.io. We will answer within one month. We will not charge you. We may ask you to confirm who you are, so that we do not disclose your information to somebody else.

If you are unhappy with how we have handled your information, please tell us first so that we have the chance to put it right. You also have the right to complain to the Information Commissioner's Office, at ico.org.uk, by telephone on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

15. Security

We hold information in access-controlled systems. Passwords are hashed and are never stored in a readable form. Access to production data is limited to those who need it. Accounts are locked after repeated failed sign-in attempts and activity is logged.

No system is perfect. If a breach affects your information and is likely to result in a high risk to you, we will tell you without undue delay, and we will tell the Information Commissioner within seventy two hours where the law requires it.

16. Children

The Services are for people aged eighteen and over. We do not knowingly collect information about children, and we do not permit anyone under eighteen to register.

Where we license our methodology to an organisation that works with young people, that organisation is responsible for its own compliance and must have its own lawful basis and its own notice. We do not receive information about those young people.

17. Cookies

Our website uses cookies that are necessary for it to work, and analytics cookies that we only set if you agree. You can change your choice at any time through the cookie banner, and you can block or delete cookies in your browser. Our cookie notice sets out what each one does.

18. Changes to this notice

We will update this notice when what we do changes. The version number and date at the top will change and we will keep the previous versions. Where a change materially affects you, we will tell you directly rather than relying on you noticing.

19. How to contact us

Write to privacy@fitterforpurpose.io, or to the Data Protection Lead, Fitter for Purpose Limited, 27A Green Lane, Northwood, Middlesex, England HA6 2PX.

© 2026 Fitter for Purpose Limited. All rights reserved.