Privacy Policy
Last updated: August 2026
1. About Us & Data Controller
Alltoogether is the trading name of All Toogether Ltd, a UK company regulated by the Financial Conduct Authority (FCA). We are an appointed representative of Sante Partners Ltd under FCA numbers 946194 and 914023 respectively.
Registered Address:
Jactin House, 24 Hood Street, Manchester, M4 6WX, United Kingdom
Contact Email:
hello@alltoogether.com
We are a data controller under UK data protection law (Data Protection Act 2018 and UK GDPR). We are not currently registered with the Information Commissioner's Office (ICO), but we comply fully with all requirements of UK data protection law.
2. What Data We Collect
We collect personal data in the following ways:
Contact Form Data
- Name, email address, company name, and job title
- Phone number (optional)
- Any message content you provide
- Enquiry type and subject matter
Platform Account Data
- Login credentials (email and password hash)
- Account profile information
- Company/firm information
- User role and permissions
Intelligent Wellbeing Engine (IWE) Data
- Employee survey responses relating to health and wellbeing
- Aggregated and anonymised wellbeing metrics
- Data is collected only with explicit employee consent
- Individual responses are not visible to employers (only organisation-wide aggregated data is shared)
Newsletter & Marketing
- Email address for newsletter signups
- Source page (page you signed up from)
- Timestamp of signup
- Communication preferences
Business Contacts & Prospective Clients
- Name, job title and employer
- Business email address at your organisation's domain
- Organisation name, size band and sector
- A record of what we have sent you and any reply or opt-out
Research Participation (Where Would You Go?)
If you take part in one of our open research studies, such as Where Would You Go?, your answers are collected anonymously and are not personal data as far as we are able to keep them that way.
- We collect your answers to the study questions, how long each screen took, the order the answer options were shown to you, and which advert or link brought you to the study
- We ask, optionally, which of four broad age groups you are in, so that answers can be compared across generations. You can skip it
- We do not collect your name, your employer, your job title, your income, your precise location, your date of birth or exact age, gender, ethnicity or disability, or any health information or diagnosis
- We do not store your IP address against your answers
- If you choose to write a free-text comment, we ask you not to include identifying details, we review every comment before any use, and we delete the original text after a maximum of twelve months
If you ask us to send you the findings, your email address is stored separately from your answers, in a different part of our database, with no reference linking the two. It is recorded with the date only rather than the time, and with the advertising campaign only rather than the specific advert, so that your email cannot be matched back to a set of answers by comparing when each was recorded. Consent to receive the findings is separate from consent to marketing, neither is pre-selected, and we never use research answers to decide who to contact or what to send them.
Study answers are kept so that the research can be repeated and compared over time. Emails given for the findings are deleted once the findings have been sent, unless you separately asked for marketing updates.
Cookies & Analytics
- Session cookies for website functionality
- Analytics data via third-party services
- Browser type, IP address, pages visited
3. Legal Basis for Processing
We process your personal data under the following legal bases:
- Contract: Processing necessary to provide the Alltoogether platform and services you've engaged us to deliver
- Legitimate Interest: Understanding user needs, improving our services, preventing fraud or misuse, and introducing our services to business contacts at prospective client organisations (see section 5)
- Consent: For newsletter signups (opt-in via consent checkbox); you can withdraw consent at any time via the unsubscribe link in each email
- Vital Interests: For IWE health and wellbeing data, where the data relates to supporting employee wellbeing
- Legal Obligation: Compliance with FCA requirements and other regulatory obligations
4. How We Use Your Data
- Providing and maintaining the Alltoogether platform
- Communicating with you about our services
- Sending marketing communications (with consent, or to business contacts under legitimate interests as described in section 5)
- Processing IWE wellbeing surveys and generating anonymised insights
- Analyzing usage patterns to improve our services
- Complying with legal and regulatory obligations
- Preventing fraud, abuse, or other unlawful activity
- Responding to enquiries and support requests
5. Business Contacts & Prospective Clients
If you hold a senior People, Reward, Finance or Operations role at a UK employer, we may hold your business contact details (name, job title, business email address, employer name and size) and send you occasional emails introducing our services. This processing is based on our legitimate interests, and a legitimate interests assessment is on file.
- Where the data comes from: licensed business contact databases and publicly available company information. We verify addresses before use.
- What we send and how often: a short series of introductory emails to your work address, at most one per month. If you do not respond, we stop.
- What we do not do: we do not use personal (non-work) email addresses, and these emails carry no open or click tracking.
- Providers we use for this: business contact data is sourced from Apollo, addresses are verified by MillionVerifier, and emails are sent through Instantly and Google Workspace.
- How to stop us: every email includes an unsubscribe link, and a reply asking us to stop is honoured for you and your whole organisation. We keep a minimal suppression record (your address and organisation) so we never contact you again.
6. Data Sharing & Processors
We may share your personal data with the following third parties (data processors):
Essential Service Providers
- PostgreSQL Database: Database hosting and storage (data stored in EU regions)
- Resend: Transactional email delivery
- Netlify: Website hosting and deployment
Principal FCA Regulated Entity
- Sante Partners Ltd: We share relevant firm and client data as required, since we are their appointed representative under FCA regulations
All processors are contractually bound to process data only as instructed and to maintain appropriate security measures.
Data Storage: All data is stored on PostgreSQL databases hosted in EU regions.
7. Data Retention
- Contact Form Enquiries: Retained for 2 years for business records
- Platform Account Data: Retained while your account is active, deleted within 30 days of account closure
- IWE Survey Data: Retained for the duration of your organisation's engagement, then deleted or anonymised
- Marketing/Newsletter Data: Retained until you unsubscribe, then deleted within 30 days
- Business Contact Data (section 5): Removed from active use if you have not responded after twelve months; if you object or unsubscribe, we keep only a minimal suppression record so we do not contact you again
- System/Server Logs: Retained for up to 90 days for security and troubleshooting
8. Your Rights
Under UK GDPR and the Data Protection Act 2018, you have the following rights:
Right of Access
You can request a copy of all personal data we hold about you.
Right of Rectification
You can request that we correct inaccurate or incomplete data.
Right of Erasure
You can request deletion of your personal data (subject to legal obligations).
Right to Restrict Processing
You can request that we limit how we use your data.
Right to Data Portability
You can request your data in a structured, portable format.
Right to Object
You can object to processing for marketing or legitimate interest purposes. An objection to marketing is absolute: we stop, and we keep a minimal suppression record so we do not contact you again.
Right to Withdraw Consent
For any processing based on consent (such as marketing emails), you can withdraw consent at any time.
To exercise any of these rights, please contact us at hello@alltoogether.com. We will respond within 30 days.
9. Cookies & Tracking
Our website uses essential cookies only to support basic functionality:
- Essential/Necessary Cookies: Required for website functionality (session management, user preferences, security)
We currently do not use analytics or marketing cookies. Should we implement analytics or marketing tracking in the future, we will obtain your explicit consent first through a cookie consent banner.
You can control cookies through your browser settings. Disabling essential cookies may affect site functionality.
10. Security
We implement appropriate technical and organizational measures to protect your personal data from unauthorized access, alteration, disclosure, or destruction. These include encryption, secure authentication, and limited access controls. However, no system is entirely secure, and we cannot guarantee absolute protection.
11. Complaints & Regulators
If you believe we have mishandled your personal data or breached data protection law, you can:
For FCA-regulated concerns, you can contact the Financial Conduct Authority directly.
12. Children & Vulnerable Adults
Our platform is not intended for individuals under 18 years of age. We do not knowingly collect data from children. If we become aware that a child has provided personal data, we will delete it promptly.
13. Changes to This Policy
We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by updating the "Last updated" date at the top of this page and, where appropriate, by email.
14. Contact Us
For any questions about this privacy policy or your personal data, please contact:
All Toogether Ltd t/a Alltoogether
Email: hello@alltoogether.com
Address: Jactin House, 24 Hood Street, Manchester, M4 6WX