Privacy policy.

When you get in touch

Through our contact form we collect your name and email address and, if you give them, your company, your website, your message, how you heard about us, and any files or links you share. If you email or call us, we keep what you send.

When you apply for a role

We collect your name, email address, location, portfolio and social links, your CV and any other files you upload. We also record the IP address you applied from and the city and country it points to.

When you download a press kit

We collect your name and email address, and which project you requested.

When you subscribe to our newsletter

We collect your email address.

When we work together

If you are a client, a supplier or a contact at one, we hold your business contact details, our correspondence and meeting notes, and the billing details we need to invoice or pay.

If we get your details from someone else, such as your employer, a colleague who introduces you, or public sources like your company website or LinkedIn, we hold your name, job title and business contact details.

When you browse the site

Once you interact with a page, PostHog and Vercel Web Analytics record information about your visit: the pages you view, what you do on them, such as the videos you play and links you follow, how you arrived, your device and browser, and your approximate location. If you send us an enquiry, we keep a note of how you arrived with it. Our servers also process your IP address for a short time to keep the site secure and stop spam.

Do you have to give us your data?

No, but without your name and email address we cannot reply to you, send you a press kit or our newsletter, or consider your application. If you are a client, we need billing details to carry out our contract with you.

We do not ask for special category data, such as information about your health or ethnicity. Please do not include it in anything you send us.

Automated decisions

We can only employ people in certain countries. When you apply, our system checks where the IP address you apply from is located. If it is outside the countries we can employ in, the system automatically marks your application as unsuccessful. IP location can be wrong, for example if you use a VPN. If this happens we will tell you, and you can give us more information, ask a person to review the decision, or challenge it, by emailing hello@together.agency. We make no other decisions about you based solely on automated processing.

Our website does not set cookies. It keeps a few small things in your browser: which video formats your device can play, a note of how you arrived and a flag for measuring how smoothly our animations run, both of which last until you close the tab, and anything you’ve typed into our contact form, so you don’t lose it.

We use PostHog and Vercel Web Analytics to understand how people use the site. Neither sets cookies, and neither loads until you interact with a page. PostHog is hosted in the EU. It does not record your screen, what you type into our forms, or your name or email address. We use both only for statistics, never for advertising.

We never sell your personal data. We share it only with the providers that help us run our business, under contracts that require them to keep it secure and use it only on our instructions:

• Vercel, which hosts our website and counts page views
• Cloudflare, which stores files uploaded through our forms
• Attio, where we manage enquiries, relationships and newsletter subscribers
• Notion, where we manage job applications and press requests
• Slack, which tells our team about new enquiries and applications
• Mailchimp, which sends our newsletter
• Google, for email and documents
• PostHog, which measures how people use our website
• Xero, our accounting software
• ipapi.co, which looks up an approximate IP location when our host cannot

We may also share data with our professional advisers, such as accountants and lawyers, with authorities when the law requires it, and with a buyer if we sell or merge our business.

Several of our providers are based in, or store data in, the United States. Some of the people who work with us are based in the European Union and Ukraine. When personal data leaves the UK, we make sure it stays protected to the UK standard.

Transfers to the European Union, and to US companies certified under the UK Extension to the EU-US Data Privacy Framework, rely on UK adequacy regulations. Other transfers, including to Ukraine, use the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for a copy of the safeguards that apply.

We keep personal data only for as long as we need it:

• Enquiries that do not lead to work: two years from our last contact
• Client and supplier records: six years after our work together ends
• Job applications, including the IP address recorded with them: six months after the role closes, unless you agree to us keeping them longer for future roles. If you join us, your application becomes part of your staff record.
• Press kit requests: two years from your request
• Newsletter: until you unsubscribe. We keep a note that you unsubscribed so we don’t email you again.
• Analytics: up to seven years in PostHog
• IP addresses used to stop spam: deleted within 24 hours

Files you upload, and the notifications we receive in Slack, are deleted with the record they belong to. After these periods we delete your data or anonymise it so it can no longer identify you.

Only the people at Together who need your data can access it, and files you send us are stored privately. Our providers are chosen with security in mind and are bound by contracts to protect your data.

We have procedures for dealing with a suspected data breach, and we will tell you and the regulator when the law requires us to.

You have the right to:

• Ask for a copy of the personal data we hold about you
• Ask us to correct data that is wrong or incomplete
• Ask us to delete your data
• Ask us to restrict how we use it
• Object to us using it
• Ask us to transfer data you gave us to you or to another organisation, where we rely on your consent or a contract
• Withdraw your consent at any time. Every newsletter has an unsubscribe link.
• Ask a person to review, give your view on, or challenge any decision made about you solely by automated means

Your right to object

You can object at any time to us using your data on the basis of our legitimate interests, and we will stop unless we have compelling reasons to continue. If you object to direct marketing, such as our newsletter, we will always stop.

Some of these rights have exceptions. To use any of them, email hello@together.agency. It is free in most cases. We may ask you to confirm your identity, and we will reply within one month, or tell you within that month if we need longer because your request is complex.

If you are unhappy with how we have handled your data, please tell us first, by email at hello@together.agency or by post to our registered office. We will acknowledge your complaint within 30 days, look into it and tell you the outcome without undue delay.

You can also complain to the Information Commission (ICO), the UK data protection regulator, at ico.org.uk or on 0303 123 1113.