Legal

Privacy Policy

Last updated: 14 August 2026

There is no enquiry form on this website, no account, no mailing list and no advertising. Nothing on it asks you for personal data or submits anything on your behalf. What it does publish is two email addresses, one for enquiries and one for applications, so if you want to reach us you write to us from your own email account, in your own words, and we hold what you chose to send. The one other thing that runs is a cookieless measurement of how the site is read, which stores nothing on your device and does not identify you.

This policy covers the website only. Personal data held under a client engagement is governed by that engagement's own contract.

Who we are

Option One is a trading name. The trading name is the controller for the data described here, and correspondence you send is held by the people behind it. The entity, its company number and its registered office will be stated here at launch.

Privacy matters can be raised through the contact page.

What we collect

Nothing through the site itself. There is nowhere on it to submit information: no form, no field and nothing that sends anything anywhere. The Get News tick box on the contact page is part of this rather than an exception to it. It stores nothing, sets nothing on your device and posts nothing. Ticking it adds one line to an email you have not sent yet, so that if you do send it, you have asked us in your own message. You can delete that line before sending, and nothing reaches us unless you press send. The discipline selector on the careers page works the same way: it sets the subject line of a message you have not sent, and it records nothing at this end.

What we do hold is correspondence. When you write to the address published on the contact page we receive your email address, your name if you give it, and whatever you put in the message. We use it to answer you and to carry on the conversation that follows. The lawful basis is our legitimate interest in responding to people who choose to contact us, or, where you are writing about engaging us, the steps taken at your request before entering a contract. That mail is handled by Proton AG, our email provider, and is stored in their encrypted mailboxes. We keep enquiries that do not lead anywhere for two years and then delete them; correspondence that becomes a client engagement is kept under that engagement's own terms.

Applications are held on the same footing, with one difference. When you write to the address published on the careers page we receive whatever you send, and that will usually include a CV, which carries more about you than an enquiry does: your employment history, your qualifications, and any personal details your own CV format includes. We use it to consider you for work and to reach you if an undertaking calls for what you do. The lawful basis is our legitimate interest in finding people able to do work we are retained for, and, where you are writing about a specific engagement, the steps taken at your request before entering a contract. That mail is handled by Proton AG in the same way. We hold applications for two years and then delete them, whether or not we replied. If you would rather we deleted yours sooner, write and say so and we will.

We do measure how the site is read, using Cloudflare Web Analytics. It records the page viewed, the site you arrived from, the country the visit came from, the general browser and device type, and how quickly the page loaded. It sets no cookie and stores nothing on your device. Cloudflare states that it does not follow visitors over time by IP address, browser user agent or any other fixed attribute, and does not fingerprint devices. What reaches us is aggregate counts, from which you cannot be identified or singled out. The cookie policy describes it in full.

The site is served by GitHub Pages. GitHub records technical request data, including IP addresses, to serve pages and protect the service. That is GitHub's own processing under its privacy statement; we have no access to it.

Cookies

This site sets none. See the cookie policy.

Sharing

Two third parties are involved, and both act on our instructions. Proton AG holds the mail you send us. Cloudflare, Inc. provides the measurement described above. Nobody else sees your correspondence, and we do not sell, rent or trade personal data in any circumstances.

Where the data goes

Proton is a Swiss company and your mail is stored in Switzerland, which the United Kingdom recognises as providing an adequate level of data protection, so no further transfer safeguard is needed.

Cloudflare is a United States company and processes measurement data outside the United Kingdom. Those transfers are covered by Cloudflare's data processing addendum, which applies the standard contractual clauses together with the Information Commissioner's international data transfer addendum, and by Cloudflare's certification under the UK extension to the EU-US Data Privacy Framework. Everything else about this site is served from GitHub Pages under GitHub's own arrangements.

Your rights

Under the UK GDPR you may ask for a copy of any personal data we hold about you, have it corrected or erased, restrict or object to its use, or receive it in a portable form. Requests can be made through the contact page and will be answered within one month, free of charge.

If you are unhappy with our handling of your data you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would rather you raised it with us first.

Changes

If a mailing list is added, or the measurement described above is changed for one that identifies you, this policy will be updated before the change goes live. That is how the contact address came to be published on 08 August 2026, and the applications address on 14 August 2026: this page was amended in the same pass each time. The date at the top shows when it was last revised.