Waitlist Privacy Notice

WORK ON SHOW PRE-LAUNCH WAITLIST PRIVACY NOTICE Effective date: 24 August 2026 Version: 2026-08-24 1. Who we are Work On Show is an early-stage creative platform operated in the United Kingdom by its founder as an individual. It is not currently operated by a named incorporated company. For personal data handled through this pre-launch waitlist, the controller is the individual operating Work On Show. The public contact channel for privacy, security, deletion and other questions is hello@workonshow.com. This notice identifies the operating arrangement honestly. It does not state that a company, partnership or other legal entity operates the service, and it does not publish a company name or postal address that has not been provided for this purpose. 2. What this notice covers This notice applies to the invitation-only Work On Show pre-launch Creator waitlist, its invitation, verification, confirmation, reconfirmation and withdrawal messages, and the related pages at workonshow.com. It does not apply to a future formal Creator account, application, profile, membership, payment service or content licence. Those services will have their own current legal information and will require fresh acceptance where required. 3. Information we collect The waitlist is designed to collect only a small amount of information: - preferred name; - email address, which must be verified; - school or institution, supplied by you and not independently verified; - primary discipline; - confirmation that you are aged 18 or over; - acknowledgement that you have read this notice and an affirmative request to be considered for a future invitation; and - optional practice or studio description, one website or social URL, education status and matching year. We also create operational records needed to run the service, such as invitation source, invitation and code status, verification and delivery status, timestamps, limited abuse-prevention signals, and a record of actions taken by the operator. A source label is used for internal attribution only. It is not a ranking, recommendation or priority signal. Please do not submit identity documents, private evidence, portfolio files, payment details, confidential client information or other material that the waitlist does not request. 4. How we use information We use waitlist information to: - issue and manage a targeted invitation or a reusable access code; - verify an email address and prevent duplicate, abusive or automated submissions; - keep a confirmed interest record and send necessary service messages; - send one reconfirmation request when the confirmation period ends; - decide whether the founder may later send a separate formal invitation; - respond to deletion or objection requests and maintain a do-not-contact suppression record; - protect the service, investigate misuse, maintain limited audit records and meet legal obligations; and - plan the future service without publishing a queue, count, ranking or school-based measure. The waitlist does not automatically create a formal account, application, membership, profile, identity number or approval. We do not use school, discipline, source, submission order or confirmation time as an automatic promise of selection, priority or outcome. 5. Lawful basis and the waitlist request The core processing is based on the controller's legitimate interests in understanding genuine, invited interest in a future creative service, operating a controlled pre-launch list, preventing abuse and maintaining a reliable record of requests. The fields are limited to what is needed for those purposes and the service does not use the waitlist for advertising, behavioural profiling or sale of personal data. The waitlist checkbox records that you have read this notice and affirmatively asked to be considered. It is an acknowledgement and request, not a description of UK GDPR consent to general processing. It is not consent to marketing. If a later service needs a different lawful basis or a separate permission, that will be explained at the time. 6. Service email We send only necessary service messages for invitation, verification, confirmation, reconfirmation and a possible later formal invitation. These are not newsletters or advertising. The service may use the sender name Work On Show and the address no-reply@auth.workonshow.com, with replies directed to hello@workonshow.com. Open and click tracking are not used for these messages. Messages are kept short and should not contain your optional form details or internal selection notes. 7. Who receives information The founder and authorised service systems may access waitlist information only for the purposes above. We use service providers to host the website, store the waitlist and deliver necessary email, including Vercel, Supabase and Resend. They process information under their applicable terms and service arrangements. We do not sell waitlist information, use an advertising network, add it to a marketing list, sync it to a CRM, or use third-party visitor analytics for this service. Information may also be disclosed where reasonably necessary to comply with law, respond to a valid legal request, protect the service or people, investigate suspected abuse, or establish, exercise or defend legal rights. 8. International processing Some service providers may process information in the United Kingdom, the European Economic Area or the United States. In particular, provider account and log data may be stored in the United States, and the email provider may retain delivery information for approximately 30 days under its service terms. Where UK data protection law requires a transfer safeguard, the controller will use an applicable adequacy decision, contractual safeguard or other lawful transfer mechanism. Current provider and transfer choices may change and this notice will be updated when a material change affects the waitlist. 9. How long we keep information - An invitation is normally valid for 30 days. A verification link is normally valid for 24 hours. - An unverified waitlist record is deleted after the verification period and the short operational period needed to handle retries, normally no later than 7 days after creation. - A confirmed record is kept for up to 12 months. We send one neutral reconfirmation message at the end of that period. If you do not reconfirm, personal fields are deleted after a further 30-day period and the record becomes expired. - If you ask to withdraw or delete your waitlist record, personal fields are removed and the record is marked withdrawn. A one-way do-not-contact suppression value and limited audit information may remain where needed to prevent repeat contact, prove that the request was handled or protect legal rights. - A record is marked converted only after a separate formal invitation is redeemed and formal account creation is completed. A formal account and its information are governed by the legal information presented for that formal service. - Encrypted operational backups are kept for a limited rolling period and then overwritten. We do not use backups to extend the normal retention period intentionally. Retention may be extended only where necessary for a legal obligation, an active dispute, fraud or abuse prevention, security, or another documented lawful reason. When that reason ends, the information is deleted or irreversibly de-identified as appropriate. 10. Your rights Subject to the limits and conditions in UK data protection law, you may ask for access to your information, correction, erasure, restriction of processing, objection to processing based on legitimate interests, and data portability where that right applies. You may also ask questions about the processing or complain to the Information Commissioner's Office. For a waitlist correction request, we normally avoid silently changing the historical invitation, source or acknowledgement. We may instead withdraw or delete the existing record, keep only the necessary suppression value, and arrange a fresh invitation so that the new information is verified and recorded clearly. To exercise a right or ask a privacy question, email hello@workonshow.com. We may need enough information to confirm that a request relates to the correct record. We will not ask you to send a password, access code or one-time verification code by email. You can complain to the UK Information Commissioner's Office at https://ico.org.uk/make-a-complaint/data-protection-complaints/. 11. Security We use access controls, separate service credentials, rate limits, verification, limited audit information and other reasonable technical and organisational measures intended to protect the waitlist. No online service can guarantee absolute security. If we identify a personal data incident, we will contain it, revoke affected access where appropriate, preserve limited evidence and assess notification duties under applicable law. 12. Age requirement The waitlist is for people aged 18 or over. Do not submit information if you are under 18. If you believe a person under 18 has submitted information, contact hello@workonshow.com so it can be reviewed and removed where appropriate. 13. Changes to this notice We may update this notice when the waitlist, its providers, its purposes or applicable law changes. The current version and effective date will be shown on the Waitlist Privacy page. If a change materially affects how existing confirmed records are used, we will take any further notice or acknowledgement step required by law. 14. Contact Work On Show Privacy and general contact: hello@workonshow.com