Privacy

Who holds the data

The data controller has not been filled in. It appears in this build as the literal placeholder TODO_CONTROLLER, beside the consent checkbox as well as here.

Outstanding The registered legal entity acting as controller must be set in src/content/marketing/landing.ts before this page or the reservation form is shown to real visitors. A consent notice that names nobody identifies no one to hold responsible.

What the reservation form stores

If you reserve a place, we store your email address exactly as you typed it, together with a normalised copy of it used only to tell whether that address has reserved before. We do not display or send mail to the normalised copy.

Alongside it we store the exact wording of the consent you agreed to, a version identifier for that wording, the time you agreed according to our server’s clock, and the network address the form was submitted from. We keep the wording itself rather than a reference to it so that we can show what was agreed to, not merely that something was.

If you arrived through a campaign link, we also store what that link said about where you came from — the source, medium and campaign it named, and the referring page.

Your reservation is not active until you open the link we email you. That link is stored only as a one-way hash, so we cannot reproduce it after it has been sent; it expires, and opening it records the time and the network address it was opened from. If you never open it, nothing further happens.

Why we hold it

The email address and consent record exist so we can email you once when Series One opens for reservation, and so we can show afterwards what you agreed to. The network address exists for one narrower reason: the reservation form is public and it sends mail, so it is rate-limited per address to stop it being used to deliver unsolicited mail through our domain.

Outstanding The lawful basis under Article 6 needs confirming rather than assuming. Consent evidently covers the marketing email; the abuse-prevention use of the network address is more naturally legitimate interests, which would need a balancing test recorded somewhere. Both should be stated explicitly here once settled.

How long we keep it

Reservation records are currently kept indefinitely. Nothing in the system deletes or expires them.

Outstanding No retention period has been decided, and none is implemented. This section states the truth as it stands rather than a period nobody has committed to. A decided period would need both a statement here and something that actually enforces it.

Who else handles it

The site is hosted by Vercel, the database is Neon, and the confirmation email is delivered by Resend. Each of them necessarily handles the data described above in the course of providing that service.

Outstanding This list is read off the current stack, not off a signed sub-processor register. It needs checking for completeness, and each entry needs the data-processing terms and transfer basis that normally accompany it.

Analytics, and why there is no cookie banner

The site measures visits without setting cookies and without building a profile of you, which is why you were never asked to accept any. No advertising or cross-site tracking technology runs on these pages.

Asking to be removed

You can ask to be removed from the reservation list, and we will stop emailing you.

You should know what that does and does not do today. Reservation records are stored append-only: the system is deliberately built so that a consent record cannot be edited or quietly deleted afterwards, because a record someone could later dispute is worthless if it can be rewritten. The consequence is that there is currently no mechanism that erases a reservation.

Outstanding This is the one place where the design and the promise beside the checkbox do not yet meet. The consent wording tells people they can ask to be removed at any time; the storage model has no deletion path, sanctioned or otherwise. Reconciling the two is a decision for the controller and their adviser — the plausible shapes are a suppression record that stops all mail while preserving the evidence, or a bounded exception to append-only for this one table. Neither should be chosen by whoever writes the page.

Outstanding No contact address for rights requests has been set. One is required before this page is published, and the rights that normally accompany it — access, rectification, objection, portability, and the right to complain to a supervisory authority — should be listed here once there is somewhere to send them.