Privacy Statement

1:90 Align

Effective Date: 24 January 2026

1. Introduction

1:90 Align ("we," "us," "our," or "Company") is committed to protecting your privacy. This Privacy Statement explains how we collect, use, disclose, and otherwise process personal information in connection with our website (190align.com), software platform, training programs, and other services.

We process personal information in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This Privacy Statement describes your privacy rights and how legal protections apply to you.

2. Data Controller

1:90 Align is the data controller for personal information we collect. If you have questions about our data practices, you can contact us using the information provided in the "Contact Us" section below.

3. Information We Collect

3.1 Information You Provide Directly

We collect information you voluntarily provide, including:

Account Information: Name, email address, password, company name, job title, phone number when you create an account
Organisational Data: Information about your organisation, team members, department structure, and roles
Platform Usage: Tasks, projects, goals, feedback, comments, and other content you create or input into the platform
Payment Information: Billing address, payment method details (processed securely by third parties)
Communication: Messages, emails, inquiries, support requests, and feedback you send to us
Training & Certification: Course enrollment details, progress, assessments, certification records, and related documentation
Consultancy Services: Information provided during consulting engagements, coaching sessions, and related services

3.2 Automatically Collected Information

When you use our platform and website, we automatically collect:

Device Information: Device type, operating system, browser type, IP address, and unique device identifiers
Usage Information: Pages visited, features accessed, time spent on site, click patterns, and navigation data
Log Data: Server logs containing IP addresses, access times, referring URLs, and error information
Cookies and Similar Technologies: See our Cookie Policy for detailed information

3.3 Information from Third Parties

We may receive information about you from business partners, integration partners, service providers, and other third parties who provide services on our behalf or in connection with your use of our services.

4. How We Use Your Information

4.1 Service Delivery

We use your information to provide, maintain, and improve our services, including account management, platform functionality, training delivery, and certification administration.

4.2 Communication

We use your information to communicate with you about your account, service updates, security alerts, customer support, and to respond to your inquiries and requests.

4.3 Platform Improvement

We analyze usage patterns and performance data to improve our services, develop new features, conduct research, and understand how our platform is used.

4.4 Legal and Compliance

We use your information to comply with legal obligations, enforce our Terms and Conditions, protect against fraud and security threats, and resolve disputes.

5. Legal Bases for Processing

We process personal information only where we have a valid legal basis under UK GDPR:

Purpose	Legal Basis
Service delivery	Performance of a contract
Payment processing	Performance of a contract
Customer support	Performance of a contract / Legitimate interests
Service notifications	Performance of a contract
Marketing	Consent / Legitimate interests
Analytics	Legitimate interests
Security	Legitimate interests / Legal obligation
Legal compliance	Legal obligation

6. Organisational Transparency

Within your organisation, visibility of Arcs (strategic initiatives), Waves (delivery phases), Milestones (key deliverables), and Tasks may be shared with team members and managers based on organisational structure and access controls you configure.

7. Data Sharing and Disclosure

7.1 Service Providers

We share information with third-party service providers who perform services on our behalf, such as hosting providers, payment processors, analytics providers, and customer support platforms. These providers are contractually obligated to use your information only as necessary to provide services to us.

7.2 Within Your Organisation

Information may be shared with other members of your organisation based on roles, permissions, and access controls you establish within the platform.

7.3 Professional Advisers

We may disclose information to our professional advisers (lawyers, accountants, auditors) as necessary for legal, tax, or business purposes.

7.4 Legal Requirements

We may disclose information when required by law, court order, or other legal process, or to protect our rights, privacy, safety, or property.

7.5 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a different privacy policy.

8. International Data Transfers

If we transfer data outside the UK and EEA, we implement appropriate safeguards, including Standard Contractual Clauses and other mechanisms approved by the UK Information Commissioner's Office, to ensure your data is adequately protected.

9. Data Retention

We retain personal information only as long as necessary for the purposes outlined in this Privacy Statement:

Information Type	Retention Period
Account information	Duration of account + 7 years
Platform usage data	Duration of account + 2 years
Payment records	7 years
Communication records	3 years
Marketing preferences	Until consent withdrawn
Training & certification records	Indefinitely

10. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These include:

Encryption of data in transit and at rest
Access controls and authentication mechanisms
Regular security assessments and testing
Employee training on data protection and security

11. Your Rights

Under UK GDPR, you have the following rights regarding your personal information:

Right of Access: You may request a copy of the personal information we hold about you
Right to Rectification: You may request that we correct inaccurate or incomplete information
Right to Erasure: You may request deletion of your personal information in certain circumstances
Right to Restrict Processing: You may request that we limit how we use your information
Right to Data Portability: You may request that we provide your information in a portable format
Right to Object: You may object to our processing of your information for certain purposes
Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time
Right to Automated Decision-Making: You have rights regarding decisions made solely by automated means

To exercise any of these rights, contact us using the information in the "Contact Us" section. If you believe your rights have been violated, you may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

12. Cookies

We use cookies and similar technologies on our website. For detailed information about the cookies we use and how to manage them, please see our Cookie Policy.

13. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we become aware that we have collected information from a child under 18, we will take steps to delete such information and terminate the child's account.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Statement or our data practices, please contact us at:

Email: privacy@190align.com
Website: 190align.com

15. Changes to This Privacy Statement

We may update this Privacy Statement from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by posting the updated Privacy Statement on our website and updating the "Effective Date" at the top of this statement. Your continued use of our services following the posting of changes constitutes your acceptance of those changes.