Policies # Privacy policy. How we collect, use and protect your personal data, and the rights you have over it. [Privacy Policy](/privacy/) [Terms of Use](/terms/) ## TLDR - We never sell your data and only share it with the software we use. [Who We Share It With](#who-we-share-it-with) - We collect form submissions and site usage data, and link the two if you send us an enquiry. [What We Collect](#data-we-collect) - You can see what we hold about you and have it deleted at any time. [Your Rights](#your-rights) - Every complaint gets a reply from a real person within 30 days. [Complaints](#complaints) ## Your Rights See your data Ask for a copy of the personal data we hold about you. Correct it Ask us to fix anything that’s wrong or incomplete. Delete it Ask us to erase your data. Restrict it Ask us to keep your data but stop using it for now. Object Tell us to stop using your data. Take it elsewhere Get the data you gave us in a format you can reuse. Withdraw consent Change your mind about anything you agreed to, like joining our newsletter. Ask for a person Have a person review any automated decision about you. Complain To us first, or to the Information Commission. ## The full policy ### Who we are. Together is the trading name of Together Holdings Ltd, a company registered in England and Wales (company number 11342654). Our registered office is Search House, Charnham Lane, Hungerford, Berkshire, RG17 0EY, United Kingdom. We are the controller of the personal data described in this policy, which means we decide how and why it is used. The policy covers our website, together.agency, and the personal data we handle when you get in touch, apply for a role, download a press kit, subscribe to our newsletter, or work with us as a client or supplier. For anything about your data, email [hello@together.agency](mailto:hello@together.agency). A director is responsible for how we handle personal data. Our website is not intended for children, and we do not knowingly collect data about them. ### Data we collect. ### When you get in touch Through our contact form we collect your name and email address and, if you give them, your company, your website, your message, how you heard about us, and any files or links you share. If you email or call us, we keep what you send. ### When you apply for a role We collect your name, email address, location, portfolio and social links, your CV and any other files you upload. We also record the IP address you applied from and the city and country it points to. ### When you download a press kit We collect your name and email address, and which project you requested. ### When you subscribe to our newsletter We collect your email address. ### When we work together If you are a client, a supplier or a contact at one, we hold your business contact details, our correspondence and meeting notes, and the billing details we need to invoice or pay. If we get your details from someone else, such as your employer, a colleague who introduces you, or public sources like your company website or LinkedIn, we hold your name, job title and business contact details. ### When you browse the site Once you interact with a page, PostHog and Vercel Web Analytics record information about your visit: the pages you view, what you do on them, such as the videos you play and links you follow, how you arrived, your device and browser, and your approximate location. If you send us an enquiry, we keep a note of how you arrived with it, and link it to what PostHog recorded about your visits (see Cookies and analytics). Our servers also process your IP address for a short time to keep the site secure and stop spam. ### Do you have to give us your data? No, but without your name and email address we cannot reply to you, send you a press kit or our newsletter, or consider your application. If you are a client, we need billing details to carry out our contract with you. We do not ask for special category data, such as information about your health or ethnicity. Please do not include it in anything you send us. ### How we use your data. Purpose Data Lawful Basis Reply to your enquiry and talk about working together Contact details, message, files Legitimate interests. Responding to people who contact us. Steps you ask us to take before a contract. Deliver our work, and invoice and pay Business contact details, correspondence, billing details Performance of a contract. Where you are personally our client. Legitimate interests. Managing our relationship with your organisation. Legal obligation. Keeping tax and accounting records. Assess your application and run our hiring process Application details, CV and files Steps you ask us to take before a contract. Legitimate interests. Hiring the right people. Check we can employ you where you are IP address, city and country Steps you ask us to take before a contract. Legitimate interests. Only considering applicants we can lawfully employ. Send the press kit you asked for and answer your questions Name, email address, project Legitimate interests. Responding to press requests. Send our newsletter Email address Consent. Understand how the site is used and improve it Analytics data Legitimate interests. Improving our website. See what led you to get in touch Analytics data, linked to your enquiry Legitimate interests. Understanding which of our work brings us enquiries. Keep the site secure and stop spam IP address, form data Legitimate interests. Protecting the site and the people who use it. Meet our legal obligations Any of the above, where required Legal obligation. ### Automated decisions We can only employ people in certain countries. When you apply, our system checks where the IP address you apply from is located. If it is outside the countries we can employ in, the system automatically marks your application as unsuccessful. IP location can be wrong, for example if you use a VPN. If this happens we will tell you, and you can give us more information, ask a person to review the decision, or challenge it, by emailing [hello@together.agency](mailto:hello@together.agency). We make no other decisions about you based solely on automated processing. ### Cookies and analytics. Our website sets two cookies, both for PostHog (below). It also keeps a few small things in your browser: which video formats your device can play, a note of how you arrived and a flag for measuring how smoothly our animations run, both of which last until you close the tab, and anything you’ve typed into our contact form, so you don’t lose it. We use PostHog and Vercel Web Analytics to understand how people use the site. Neither loads until you interact with a page. PostHog then sets two cookies on together.agency, and keeps a little more in your browser, so it can tell when the same browser comes back. They hold a random ID and the page you first arrived on, never your name or email address, and last up to a year, or about a week in Safari. Vercel Web Analytics sets no cookies. PostHog is hosted in the EU. It does not record your screen or what you type into our forms. We use both for statistics, never for advertising. If you send us an enquiry, we also link it to what PostHog recorded about your visits from that browser, so we can see what led you to get in touch. PostHog receives an ID and your company’s web address for this, never your name or email address, but our team can see those visits alongside your enquiry. We don’t ask for your consent for these cookies, because we use them to measure and improve our website, including seeing which of our pages lead to enquiries. You can stop them at any time by blocking or clearing cookies and site data for together.agency in your browser’s settings. ### Who we share it with. We never sell your personal data. We share it only with the providers that help us run our business, under contracts that require them to keep it secure and use it only on our instructions: - Vercel, which hosts our website and counts page views - Cloudflare, which stores files uploaded through our forms - Attio, where we manage enquiries, relationships and newsletter subscribers - Notion, where we manage job applications and press requests - Slack, which tells our team about new enquiries and applications - Mailchimp, which sends our newsletter - Google, for email and documents - PostHog, which measures how people use our website - Xero, our accounting software - ipapi.co, which looks up an approximate IP location when our host cannot We may also share data with our professional advisers, such as accountants and lawyers, with authorities when the law requires it, and with a buyer if we sell or merge our business. ### International transfers. Several of our providers are based in, or store data in, the United States. Some of the people who work with us are based in the European Union and Ukraine. When personal data leaves the UK, we make sure it stays protected to the UK standard. Transfers to the European Union, and to US companies certified under the UK Extension to the EU-US Data Privacy Framework, rely on UK adequacy regulations. Other transfers, including to Ukraine, use the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for a copy of the safeguards that apply. ### How long we keep it. We keep personal data only for as long as we need it: - Enquiries that do not lead to work: two years from our last contact - Client and supplier records: six years after our work together ends - Job applications, including the IP address recorded with them: six months after the role closes, unless you agree to us keeping them longer for future roles. If you join us, your application becomes part of your staff record. - Press kit requests: two years from your request - Newsletter: until you unsubscribe. We keep a note that you unsubscribed so we don’t email you again. - Analytics: up to seven years in PostHog - IP addresses used to stop spam: deleted within 24 hours Files you upload, and the notifications we receive in Slack, are deleted with the record they belong to. After these periods we delete your data or anonymise it so it can no longer identify you. ### How we protect it. Only the people at Together who need your data can access it, and files you send us are stored privately. Our providers are chosen with security in mind and are bound by contracts to protect your data. We have procedures for dealing with a suspected data breach, and we will tell you and the regulator when the law requires us to. ### Your rights. You have the right to: - Ask for a copy of the personal data we hold about you - Ask us to correct data that is wrong or incomplete - Ask us to delete your data - Ask us to restrict how we use it - Object to us using it - Ask us to transfer data you gave us to you or to another organisation, where we rely on your consent or a contract - Withdraw your consent at any time. Every newsletter has an unsubscribe link. - Ask a person to review, give your view on, or challenge any decision made about you solely by automated means ### Your right to object You can object at any time to us using your data on the basis of our legitimate interests, and we will stop unless we have compelling reasons to continue. If you object to direct marketing, such as our newsletter, we will always stop. Some of these rights have exceptions. To use any of them, email [hello@together.agency](mailto:hello@together.agency). It is free in most cases. We may ask you to confirm your identity, and we will reply within one month, or tell you within that month if we need longer because your request is complex. ### Complaints. If you are unhappy with how we have handled your data, please tell us first, by email at [hello@together.agency](mailto:hello@together.agency) or by post to our registered office. We will acknowledge your complaint within 30 days, look into it and tell you the outcome without undue delay. You can also complain to the Information Commission (ICO), the UK data protection regulator, at [ico.org.uk](https://ico.org.uk) or on 0303 123 1113. ### Changes to this policy. We review this policy regularly and publish any changes here, with a new date. If a change affects how we use data you have already given us, we will tell you directly. This policy was last updated on 6 November 2026. Contact Questions about your data? Write to [hello@together.agency](mailto:hello@together.agency).