Privacy Policy

Your employer sees your name and job details because it put them there. It never sees your individual wellbeing answers: results only ever appear as averages of five or more people, enforced in our database. Health questions are optional, asked only with your explicit consent, and never shown to your employer in any form. Check-ins are voluntary. We do not sell data. Data is hosted in the EEA (Ireland). Research use of individual answers only ever happens if you separately and personally opt in, and your employer never knows whether you did. If your organisation switches on the Shop, we count clicks for your organisation, for each brand, each day; we do not record who clicked, and the brand only ever receives a code for your organisation, never for you. If your organisation switches on rewards and you turn coins into a gift card, we send your name and work email to Tremendous, our gift card partner in the United States, so it can email you the card.

For account holders' own signup data and for site visitors, we are the controller. For workforce records inside an organisation's account (names, roles, teams, leave and similar), your organisation is the controller and we process on its instructions. Individual check-in answers are never given to your organisation; we hold them to produce the anonymous aggregates.

Account holders: name, work email, organisation details, login and security records. To provide and secure the service (contract; legitimate interests).

Account holders, also: how you found us (for example the page or email that brought you to sign up), to understand which of our channels work (legitimate interests); and, if you sign up with Google or Microsoft, your name, email and whether that email is verified, which those services send us with your permission.

Members: the profile your organisation loads (name, work email, job title, team, manager and similar); your platform activity (invites, log-ins, notifications); your check-in answers, held under the anonymity rule below.

Members, also: if your organisation lets people join by work email, your work email domain, to match you to your organisation; thank-yous you send and receive, which colleagues in your organisation can see (your organisation is controller for these); Shop and offer activity as counts only: clicks per brand per day for your organisation, and how many people opened each offer, shown to your organisation only where five or more people are counted, never with names.

The welcome survey also offers two optional sections. Questions about your personal circumstances (for example caring responsibilities or neurodivergence) and about your health are special-category data: we process them only with your explicit consent, given section by section inside the survey, and you can skip either section or withdraw consent at any time without affecting the service. Your employer only ever sees the personal-circumstances answers inside anonymous averages of five or more people, and never sees your health answers in any form.

Legal bases: providing the service your organisation asked us to provide (its contract; our legitimate interests); your check-in participation is voluntary; your explicit consent for the optional special-category sections.

Visitors: basic technical logs to run and secure the site.

We never show your employer your individual answers, whether scores, trends or free responses. Results appear only as aggregates of five or more respondents, and today they are only shown for the organisation as a whole; no smaller group is ever shown. This is a database constraint, not a policy choice a support agent could override. Not answering is invisible too: your employer cannot see who participated.

If your organisation uses the platform, we email you invitations and reminders for the fortnightly check-in, and service messages such as account setup. These come from us on your organisation's behalf; they are not marketing. You can turn off reminder emails at any time from the link in each email or in your settings, without leaving the platform. We do not send you marketing unless you separately opt in.

We publish and contribute to workplace-wellbeing research using anonymised, aggregated statistics that identify no person. Individual responses are only ever used for research if you personally opt in through a separate consent step inside the platform, which is optional, invisible to your employer, and withdrawable at any time; declining changes nothing about the service.

When you open a brand from the Shop, you go to that brand's own website through a link that carries a code for your organisation, not for you. A tracking service used by the brand records the visit so the brand can pay us any commission; it receives the code for your organisation and the technical details any website visit sends. Whatever you buy, and any account you create, is between you and the brand under its own privacy policy. We do not receive what you bought, and we never show your organisation who used the Shop.

If your organisation switches on rewards, you can turn coins into retailer gift cards. To send a card, we share your name and work email with Tremendous, our gift card partner, which emails the card to you. Your organisation funds its own rewards account with Tremendous. It can see that gift cards were ordered and who they were sent to, but never your check-in answers or what you did to earn the coins. Tremendous is based in the United States; the transfer is protected by the EU standard contractual clauses and the UK International Data Transfer Addendum, under Tremendous's data processing agreement. A gift card that is not claimed is lost 12 months after it is sent, under Tremendous's terms. Coins themselves are not money and have no cash value.

Service providers that host and operate the platform: database, authentication and storage hosting in the EEA; email delivery; and application hosting. If your organisation switches on the Shop, the affiliate tracking service that brands use to record visits from the Shop is one of them (see The Shop). If your organisation switches on rewards, Tremendous, which sends gift cards, is one of them (see Gift card rewards). Each is bound by data-protection terms. We list changes on this page. We do not sell personal data and we do not share it with advertisers.

Workforce records: as long as your organisation uses the platform, then deleted 30 days after the account closes unless law requires longer. Individual check-in answers: retained to produce aggregates and trends; erased when you are erased from the platform.

Thank-yous: as long as your organisation uses the platform, or until removed. Shop click counts: kept as counts per organisation, brand and day; they contain no personal data. Gift card orders: kept while your organisation uses the platform, so you can see your own history; Tremendous keeps its own order records under its terms.

You can ask for access, correction, erasure, restriction, portability, and you can object. For workforce records your organisation is usually the right first contact, and much of your record is self-service in the platform. For anything else, contact us at privacy@alltoogether.com. You can complain to the Information Commissioner's Office (ico.org.uk).

We will post changes here and notify account holders of material changes.