I think that you may need to re-assess you view on taxation. Based on your 'profit' and your day job, you will need to provide this information to HMRC so they can establish 'if' you need to pay tax. I would do this sooner rather than later. I appreciate that very few of your associates will be aware of this, but best to look after your own goals.
RE DPA - taken from your link
'Arbonne Independent Consultants are not employed at Arbonne. As a result, Arbonne has no influence whatsoever and does not accept any responsibility or liability for the collection, use or disclosure of personal data by Arbonne Independent Consultants'
This is in essence saying that if you have a data breach, lose phone, leave notebook in Starbucks, with any client data in, and that client then sues you, you are personally responsible for this breach.
It also seems that you, as a holder of data, should have an IPO and GDPR policy in place for yourself. It very much drops the ball deep into your court, and I assume very few of you are aware of the potential implications.