Privacy Policy

One All CIC · oneall.org.uk

Last updated: January 2026 · Version 1.0

Introduction

One All CIC (‘One All’, ‘we’, ‘us’, ‘our’) is a UK-registered Community Interest Company. We are committed to protecting the privacy of everyone who visits our website, uses our products, or engages with us in any capacity.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have in relation to it. It applies to:

the One All website at oneall.org.uk, built and hosted on Kajabi;
the Origins of Play app, currently hosted on Base44;
any communications, forms, or interactions through which you provide us with personal data.

Please read this policy carefully. By using our website or products, you confirm that you have read and understood how we handle your personal data.

1. Who we are

The data controller for all personal data processed through the One All website and products is:

ONE ALL CIC

Company number: 16883147

Registered address: 167–169 Great Portland Street, London, England, W1W 5PF, United Kingdom

Email: [email protected]

Telephone: +44 20 3443 9610

As the data controller, One All determines the purposes and means of processing your personal data. We process data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What data we collect and why

2.1 Website visitors

When you visit oneall.org.uk, certain data is collected automatically by the platforms and tools we use. This may include your IP address, browser type, device information, pages visited, and time spent on each page. This data is collected for analytics purposes and to improve the website experience.

We use the following third-party tools on our website:

Google Analytics, to understand how visitors find and use the site. Data is processed by Google in accordance with its own privacy policy. Where possible, we use IP anonymisation.
Meta Pixel, to measure the effectiveness of any advertising and to understand how users interact with content shared through Meta platforms. Meta processes this data in accordance with its own privacy policy.

You can manage your cookie preferences using the cookie settings link in the footer of our website.

2.2 Contact and enquiry forms

When you submit a contact or enquiry form on our website, we collect:

your name;
your email address;
your telephone number, if provided;
your organisation or institution, if provided;
your pathway of interest (Education, Sport, or Development);
any message or information you choose to include.

We use this data to respond to your enquiry and, where relevant, to route it to the appropriate person or team. We will not use your contact details for any other purpose without your consent.

2.3 Waitlist registration

When you join the waitlist for Origins of Play: The Circle, we collect your name, email address, and any additional information you choose to provide. We use this data solely to notify you when registration opens and to manage waitlist communications.

2.4 Individual registration for Origins of Play

When a young leader registers for Origins of Play as an individual, we collect:

their name and email address;
the name and contact details of a parent or guardian.

We use the parent or guardian contact details to send a parental consent request. Access to the app is not granted until consent has been confirmed. We do not use parent or guardian contact details for any other purpose.

Young leaders must be aged 15 or over to register for Origins of Play. We do not knowingly collect personal data from individuals under the age of 15.

2.5 Group registration for Origins of Play

When an organisation purchases group access to Origins of Play, the contracting party is the organisation itself, represented by the designated group coordinator. At the point of group purchase, we collect:

the name and contact details of the group coordinator;
the name of the organisation or institution.

Individual learner data is collected within the app at the point of first login, not at the point of group purchase. By accepting these terms on behalf of the group, the group coordinator confirms that the organisation has obtained all necessary consents, including parental or guardian consent for participants under the age of 18, in accordance with applicable law.

2.6 Origins of Play app

Within the Origins of Play app, we collect:

account registration details (name and email address);
progress data, including modules and lessons completed and learning activities submitted;
reflection responses and other content you enter as part of the programme;
your completed Playbook, which is generated automatically from your inputs throughout the course.

The Origins of Play app is currently hosted on Base44, a platform operated by Wix. Base44 acts as a data processor on our behalf under a Data Processing Addendum. Base44 has its own infrastructure privacy policy, but One All remains responsible for how your data is used within the app.

The coordinator dashboard, available to group coordinators, provides access to group-level progress data only. Coordinators can see how many learners in their group have completed each module, but they cannot view the individual responses, reflections, or content submitted by learners. Learners choose independently whether to share their completed Playbook with their coordinator.

2.7 Payments

All payments for Origins of Play are processed by Stripe. When you make a purchase, you are directed to Stripe’s secure payment environment. One All does not store your payment card details. Stripe processes payment data in accordance with its own privacy policy and is PCI DSS compliant. One All retains a record of the transaction, including the amount paid, the date of purchase, and the email address associated with the purchase.

2.8 CRM and communications

We use HubSpot as our customer relationship management (CRM) platform. Contact details collected through our website forms, waitlist, and registration flows may be stored in HubSpot to manage our communications with you. HubSpot processes data in accordance with its own privacy policy and our data processing agreement with them.

2.9 Programme improvement

One All retains anonymised, non-identifiable content derived from completed Playbooks for the purpose of improving our programmes and understanding the impact of our work. Before any internal analysis or programme review takes place, all identifying information is removed. What we retain and use for this purpose is not personal data and cannot be traced back to any individual.

3. The legal basis for processing your data

We process your personal data on the following legal bases:

Contract: where processing is necessary to fulfil a contract with you, including providing access to Origins of Play following purchase.
Legitimate interests: where processing is necessary for our legitimate interests, such as understanding how our website is used and improving our services, provided those interests are not overridden by your rights.
Consent: where you have given us specific consent to process your data, such as subscribing to marketing communications or accepting non-essential cookies.
Legal obligation: where we are required to process data to comply with a legal requirement.

4. How we share your data

We do not sell your personal data. We share data only with the third-party service providers necessary to operate our website and products, including:

Kajabi (website hosting and course platform);
Base44, a Wix company (Origins of Play app hosting);
Stripe (payment processing);
HubSpot (CRM and communications);
Google (analytics);
Meta (advertising measurement).

All third-party providers are required to handle your data securely and only for the purposes we have specified. We do not transfer your data to third parties for their own marketing purposes.

5. International data transfers

One All is a UK-registered organisation and your data is processed under UK GDPR. Some of our third-party service providers, including Google, Meta, HubSpot, and Stripe, may process data in countries outside the United Kingdom and the European Economic Area.

Where data is transferred internationally, we ensure that appropriate safeguards are in place, such as the use of UK International Data Transfer Agreements or the EU Standard Contractual Clauses. The UK currently holds adequacy status with the European Union, meaning data can flow freely between the two.

If you are based in the United States, and specifically in California, you may have additional rights under the California Consumer Privacy Act (CCPA). You can exercise those rights by contacting us at [email protected].

6. How long we keep your data

We keep your personal data only for as long as is necessary for the purposes for which it was collected, or as required by law. As a general guide:

Account and registration data is retained for the duration of your access period and for a period of two years thereafter, unless you request earlier deletion.
Transaction records are retained for six years in accordance with UK financial and tax regulations.
Contact and enquiry data is retained for two years from the date of last contact.
Waitlist data is retained until the relevant programme launches, or until you request removal from the waitlist.

Anonymised data derived from Playbooks is retained indefinitely, as it does not constitute personal data.

7. Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

The right to access the personal data we hold about you.
The right to rectification, if any data we hold is inaccurate or incomplete.
The right to erasure (‘the right to be forgotten’), subject to certain legal exceptions.
The right to restrict processing in certain circumstances.
The right to data portability, where processing is based on consent or contract and carried out by automated means.
The right to object to processing based on our legitimate interests.
The right to withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 90 days. We may need to verify your identity before processing your request.

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection. You can contact the ICO at ico.org.uk or by telephone on 0303 123 1113.

8. Cookies

Our website uses cookies, which are small text files stored on your device when you visit a page. Some cookies are essential for the website to function; others are used for analytics and advertising measurement.

You can manage your cookie preferences at any time using the cookie settings link in the footer of our website. Withdrawing consent for non-essential cookies will not affect the functionality of the site.

For a full list of the cookies we use and their purposes, please refer to our Cookie Preferences panel.

9. Children’s data

Origins of Play is designed for young leaders aged 15 to 17. We do not knowingly collect personal data from individuals under the age of 15. Where individual young leaders register directly, we require parental or guardian consent before access is granted. Where organisations purchase group access, the organisation confirms that all required consents have been obtained.

Even when we extend our programmes to younger age groups in the future, we will not accept registrations from individuals under the age of 13.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the ‘last updated’ date at the top of this page. We encourage you to review this policy periodically. Continued use of our website or products following any update constitutes acceptance of the revised policy.

11. Contact

If you have any questions about this Privacy Policy or about how we handle your personal data, please contact us:

One All CIC

167–169 Great Portland Street, London, England, W1W 5PF

[email protected]

+44 20 3443 9610

oneall.org.uk

One All CIC · Company number 16883147 · UK-registered Community Interest Company