Privacy — the partner application

1. Why this page exists separately

The privacy policy on rutba.io is written about customers and site visitors. A partner applicant is neither: you are a business telling us about your business, in more commercial detail than a customer ever does, before either of us has committed to anything.

So this covers the partner programme specifically. Where it is silent, the main policy applies.

2. Stage one — registering interest

Eight fields: your name, work email, company, website, country, phone, the territory you would cover, the track and lines you are interested in, and anything you want to add.

Deliberately nothing financial. The application is in two stages precisely so that nobody has to disclose turnover to a vendor they have not yet decided about.

3. Stage two — the application

Reached from a link we email you. It asks about your market, your team, your existing business and your finances — including turnover, headcount and, on the tracks where you would hold the customer contract, supporting financial statements.

That information is used for one thing: deciding which track fits, what territory and terms are appropriate, and what credit arrangements are sensible. It is not used to assess you for anything else, it is not shared with another applicant or partner, and it is not used to approach your customers.

If you would rather provide statements under a non-disclosure agreement, say so and we will sign one before you send anything.

4. The link we email you

There is no account and no password. The link in the email is the credential, and it is treated as one: it is generated from cryptographically secure random bytes and only a digest of it is stored, so nobody here can read your link back out of the database.

It expires. Ask for a new one at the resend page and nothing you had already filled in is lost — the draft belongs to the application rather than to the link.

Because the link is the credential, treat the email as you would a password: do not forward it to somebody you would not want completing the application as you.

5. Who sees it

The partner team, and nobody else. Applications are not circulated internally, not shown to other partners, and not published in any form — including in aggregate, in a way that could identify you.

The sub-processor list names every third party that touches data for us. There is no customer-relationship platform in that list: applications are held on our own infrastructure.

6. Legal basis

Steps taken at your request before entering into a contract, for everything you send us as part of an application; and our legitimate interest in running and protecting a partner programme, for the security logging around it.

If you register interest and never apply, we will contact you about the programme on the basis of legitimate interest, and every message has an unsubscribe link that works.

7. How long we keep it

• Applications that become partnerships — for the life of the agreement, and for six years afterwards where financial records require it.
• Applications that do not — two years, so that a partner who comes back does not start from nothing, and then deleted.
• Registrations that never became applications — two years.
• Financial statements you sent us — deleted as soon as the decision is made, unless you have become a partner and they support a credit arrangement.

Ask us to delete it sooner and we will, unless the law requires otherwise.

8. Your rights

You can ask us for a copy of what we hold about you, ask us to correct or delete it, object to how we use it, or withdraw consent where consent is what we relied on. Write to hello@rutba.io and we answer within a month.

The full detail — who the controller is, where data is processed, international transfers and how to complain to a supervisory authority — is in the main privacy policy, which applies alongside this page.