Platform Broking The IWE Benefits Sectors Resources Tools How It Works About Book a call Start free

Privacy Policy

Last updated: October 2026

1. About Us & Data Controller

Alltoogether is the trading name of All Toogether Ltd, a UK company regulated by the Financial Conduct Authority (FCA). We are an appointed representative of Sante Partners Ltd under FCA numbers 946194 and 914023 respectively.

Registered Address:
Jactin House, 24 Hood Street, Manchester, M4 6WX, United Kingdom

Contact Email:
hello@alltoogether.com

We are a data controller under UK data protection law (Data Protection Act 2018 and UK GDPR). We are not currently registered with the Information Commissioner's Office (ICO), but we comply fully with all requirements of UK data protection law.

2. What Data We Collect

We collect personal data in the following ways:

Contact Form Data

  • Name, email address, company name, and job title
  • Phone number (optional)
  • Any message content you provide
  • Enquiry type and subject matter

Platform Account Data

  • Login credentials (email and password hash)
  • Account profile information
  • Company/firm information
  • User role and permissions

Intelligent Wellbeing Engine (IWE) Data

  • Employee survey responses relating to health and wellbeing
  • Aggregated and anonymised wellbeing metrics
  • Data is collected only with explicit employee consent
  • Individual responses are not visible to employers (only organisation-wide aggregated data is shared)

AI Assistant Connectors (Claude, ChatGPT)

  • Our plugins (Absence Cost Planner, UK Workplace Health Data and Hidden Value Finder) run when you use them inside an AI assistant such as Claude or ChatGPT
  • The assistant sends a plugin only what it needs to answer, such as a headcount, earnings, dates, an insurer's name or an area name
  • Our plugins do not ask for names, National Insurance numbers or health details, and we ask you not to enter them
  • We do not receive your name, email address or account details from the assistant, and we do not save what you type into our plugins
  • We count how often each tool is used and may keep anonymous, rounded figures, such as a headcount band, to produce aggregate statistics. These never include names, employers, IP addresses or conversation identifiers. We only publish figures based on 10 or more uses
  • Our application hosting provider keeps short-lived technical request logs for security and reliability
  • Your conversation itself is handled by the AI assistant's provider under its own privacy policy

Newsletter & Marketing

  • Email address for newsletter signups
  • Source page (page you signed up from)
  • Timestamp of signup
  • Communication preferences

Business Contacts & Prospective Clients

  • Name, job title and employer
  • Business email address at your organisation's domain
  • Organisation name, size band and sector
  • A record of what we have sent you and any reply or opt-out

Research Participation (Where Would You Go?)

If you take part in one of our open research studies, such as Where Would You Go?, your answers are collected anonymously and are not personal data as far as we are able to keep them that way.

  • We collect your answers to the study questions, how long each screen took, the order the answer options were shown to you, and which advert or link brought you to the study
  • We ask, optionally, which of four broad age groups you are in, so that answers can be compared across generations. You can skip it
  • We do not collect your name, your employer, your job title, your income, your precise location, your date of birth or exact age, gender, ethnicity or disability, or any health information or diagnosis
  • We do not store your IP address against your answers
  • If you choose to write a free-text comment, we ask you not to include identifying details, we review every comment before any use, and we delete the original text after a maximum of twelve months

If you ask us to send you the findings, your email address is stored separately from your answers, in a different part of our database, with no reference linking the two. It is recorded with the date only rather than the time, and with the advertising campaign only rather than the specific advert, so that your email cannot be matched back to a set of answers by comparing when each was recorded. Consent to receive the findings is separate from consent to marketing, neither is pre-selected, and we never use research answers to decide who to contact or what to send them.

Study answers are kept so that the research can be repeated and compared over time. Emails given for the findings are deleted once the findings have been sent, unless you separately asked for marketing updates.

UK Benefits Explorer and Our Research Bot

Our research bot, AlltoogetherBenefitsResearch, reads employers' public careers pages and job adverts to record what UK employers say they offer their staff. It keeps facts about each employer's benefits, with the short sentence each fact came from, the link and the date. Names, email addresses and phone numbers are removed before anything is stored. Raw page text is never published. We keep it so we can re-check each fact when our reading improves, and we delete an employer's copies if it asks to be removed. Our research bot page explains how to stop it.

  • When you use the UK Benefits Explorer, the benefits text you paste and any policy document you check are read inside your browser. They are not sent to us or stored.
  • If you ask us to email you a copy of a check, we collect your email address and, if you give them, your company name and renewal month, with a summary of the result: the benefits and services found, not your text or document. We use them to send the copy and, as the form says, to follow up about it. The basis is your consent, which you can withdraw at any time.
  • If you ask us to correct or remove an employer's entry, we collect your work email address, your company and your message, and use them to deal with your request.
  • If you add your company to the UK Benefits Explorer, we collect your work email address, your company's name, website and sector, and the benefits text you send. We email that address a link to confirm. If you confirm, we publish your company's benefits, quoted from your text, at our next data update, and keep your email address to deal with changes or removal and to follow up about it, as the form says. If you don't confirm, nothing is published and the request is deleted after 30 days. The basis is your consent, which you can withdraw at any time.

Cookies & Analytics

  • Session cookies for website functionality
  • Analytics data via third-party services
  • Browser type, IP address, pages visited

3. Legal Basis for Processing

We process your personal data under the following legal bases:

  • Contract: Processing necessary to provide the Alltoogether platform and services you've engaged us to deliver
  • Legitimate Interest: Understanding user needs, improving our services, preventing fraud or misuse, and introducing our services to business contacts at prospective client organisations (see section 5)
  • Consent: For newsletter signups (opt-in via consent checkbox); you can withdraw consent at any time via the unsubscribe link in each email
  • Vital Interests: For IWE health and wellbeing data, where the data relates to supporting employee wellbeing
  • Legal Obligation: Compliance with FCA requirements and other regulatory obligations

4. How We Use Your Data

  • Providing and maintaining the Alltoogether platform
  • Communicating with you about our services
  • Sending marketing communications (with consent, or to business contacts under legitimate interests as described in section 5)
  • Processing IWE wellbeing surveys and generating anonymised insights
  • Analyzing usage patterns to improve our services
  • Complying with legal and regulatory obligations
  • Preventing fraud, abuse, or other unlawful activity
  • Responding to enquiries and support requests

5. Business Contacts & Prospective Clients

If you hold a senior People, Reward, Finance or Operations role at a UK employer, we may hold your business contact details (name, job title, business email address, employer name and size) and send you occasional emails introducing our services. This processing is based on our legitimate interests, and a legitimate interests assessment is on file.

  • Where the data comes from: licensed business contact databases and publicly available company information. We verify addresses before use.
  • What we send and how often: a short series of introductory emails to your work address, at most one per month. If you do not respond, we stop.
  • What we do not do: we do not use personal (non-work) email addresses, and these emails carry no open or click tracking.
  • Providers we use for this: business contact data is sourced from Apollo, addresses are verified by MillionVerifier, and emails are sent through Instantly and Google Workspace.
  • How to stop us: every email includes an unsubscribe link, and a reply asking us to stop is honoured for you and your whole organisation. We keep a minimal suppression record (your address and organisation) so we never contact you again.

6. Data Sharing & Processors

We may share your personal data with the following third parties (data processors):

Essential Service Providers

  • Cloud database, on Amazon Web Services: Database hosting and storage. The platform's data are held in Dublin, Ireland.
  • Email delivery, on Amazon Web Services: Emails the platform sends, such as sign-in links and notices, sent from Dublin, Ireland.
  • Website and app hosting: The platform's apps run in Dublin, Ireland. This website's pages are served from a global network, and its forms are handled in the United States.

Principal FCA Regulated Entity

  • Sante Partners Ltd: We share relevant firm and client data as required, since we are their appointed representative under FCA regulations

The full named list of our sub-processors is in our data processing agreement, or on request from hello@alltoogether.com. All processors are contractually bound to process data only as instructed and to maintain appropriate security measures.

Data Storage: The platform's data are stored in Dublin, Ireland. See Security and data for where each service runs.

7. Data Retention

  • Contact Form Enquiries: Retained for 2 years for business records
  • UK Benefits Explorer company entries: Confirmed entries are kept while they are published and for 2 years after for business records; requests never confirmed are deleted after 30 days
  • UK Benefits Explorer Requests: Requests for an emailed copy, and requests to correct or remove an employer's entry, retained for 2 years for business records, or until you ask us to delete them
  • Research bot page copies: Raw text of employers' public pages, with names, email addresses and phone numbers removed, kept to re-check the facts we publish; deleted when an employer asks to be removed
  • Platform Account Data: Retained while your account is active, deleted within 30 days of account closure
  • IWE Survey Data: Retained for the duration of your organisation's engagement, then deleted or anonymised
  • Marketing/Newsletter Data: Retained until you unsubscribe, then deleted within 30 days
  • Business Contact Data (section 5): Removed from active use if you have not responded after twelve months; if you object or unsubscribe, we keep only a minimal suppression record so we do not contact you again
  • System/Server Logs: Retained for up to 90 days for security and troubleshooting

8. Your Rights

Under UK GDPR and the Data Protection Act 2018, you have the following rights:

Right of Access

You can request a copy of all personal data we hold about you.

Right of Rectification

You can request that we correct inaccurate or incomplete data.

Right of Erasure

You can request deletion of your personal data (subject to legal obligations).

Right to Restrict Processing

You can request that we limit how we use your data.

Right to Data Portability

You can request your data in a structured, portable format.

Right to Object

You can object to processing for marketing or legitimate interest purposes. An objection to marketing is absolute: we stop, and we keep a minimal suppression record so we do not contact you again.

Right to Withdraw Consent

For any processing based on consent (such as marketing emails), you can withdraw consent at any time.

To exercise any of these rights, please contact us at hello@alltoogether.com. We will respond within 30 days.

9. Cookies & Tracking

Our website uses three kinds of cookies and similar technologies:

  • Essential cookies: Required for the website to work (session management, preferences, security, and remembering your cookie choice).
  • Analytics: PostHog, sent through our own domain, counts page views and clicks so we can see whether our pages work. It runs unless you choose Reject on the cookie banner, and choosing Reject switches it off.
  • Advertising cookies: Google, LinkedIn, Meta and Apollo tags load only after you choose Accept on the cookie banner. Until then they do not load.

You can control cookies through your browser settings. Disabling essential cookies may affect site functionality.

10. Security

We implement appropriate technical and organizational measures to protect your personal data from unauthorized access, alteration, disclosure, or destruction. These include encryption, secure authentication, and limited access controls. However, no system is entirely secure, and we cannot guarantee absolute protection.

11. Complaints & Regulators

If you believe we have mishandled your personal data or breached data protection law, you can:

For FCA-regulated concerns, you can contact the Financial Conduct Authority directly.

12. Children & Vulnerable Adults

Our platform is not intended for individuals under 18 years of age. We do not knowingly collect data from children. If we become aware that a child has provided personal data, we will delete it promptly.

13. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by updating the "Last updated" date at the top of this page and, where appropriate, by email.

14. Contact Us

For any questions about this privacy policy or your personal data, please contact:

All Toogether Ltd t/a Alltoogether
Email: hello@alltoogether.com
Address: Jactin House, 24 Hood Street, Manchester, M4 6WX