Privacy Policy

1. Who we are (data controller)

The data controller responsible for your personal data is:

[LEGAL ENTITY NAME]
[Registered address]
[Jurisdiction of incorporation / company number]

For any privacy question or to exercise your rights, contact us at privacy@gobeyondclub.com [confirm mailbox exists] or by post at the address above.

2. What data we collect

We collect only what we need to record your reservation of interest and confirm it. Specifically:

• Name and email address — to record your reservation and send you a confirmation email.
• City preference and membership-tier preference — this is the demand signal you are choosing to share with us.
• Reservation metadata — a timestamp, your confirmation status, and an opaque reference identifier used to manage your reservation.
• Economics-information request — if you ask to be considered for gated materials, we record the email address you submit for that request.
• A salted, one-way (SHA-256) hash of your IP address — used solely for rate-limiting and abuse prevention. This is not used to identify you, and we do not store your raw IP address for this purpose.

We do not collect special-category data, and we do not ask for payment information, because nothing is sold on the Site.

3. Why we use it, and our lawful basis

Where we rely on consent, you can withdraw it at any time (see Section 7). Withdrawing consent does not affect processing carried out before withdrawal.

If you are in California, we process this data to provide the reservation service you requested and for the security purpose described above. We do not sell or share your personal data (see Section 8).

4. Who we share it with (processors and sub-processors)

We do not sell your personal data and we do not share it for advertising. We use a small number of trusted service providers who process data on our behalf, under contract and only on our instructions:

• Supabase — database and storage (hosts the reservation records).
• Resend — transactional email delivery (your confirmation email and our internal admin notification).
• Railway — application hosting.

These providers may process data on servers located outside the UK and EEA, including in the United States. Where personal data is transferred internationally, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the UK Addendum (and, where applicable, the provider’s certification under the EU–US / UK–US Data Privacy Framework). [Counsel to confirm the exact transfer mechanism relied on for each provider.] You can request a copy of the relevant safeguards using the contact details above.

We may also disclose personal data if required to do so by law, or to protect our legal rights.

5. How long we keep it

We keep your personal data only as long as necessary for the purposes above:

• Unconfirmed reservations (where you did not complete the double opt-in): retained for [proposed: up to 6 months], then deleted. [Confirm]
• Confirmed reservations: retained until the earlier of your withdrawal, the launch of membership in your city, or [proposed: 24 months], after which we review and delete or re-consent. [Confirm]
• Economics-information requests: retained for [proposed: up to 24 months] or until fulfilled and no longer needed. [Confirm]
• Rate-limiting hashes: retained only for the short period needed for abuse prevention, then purged.

When retention periods lapse, we delete the data or irreversibly anonymise it.

6. Cookies

The Site uses essential/functional cookies only — the cookies strictly necessary for the Site to work and to remember your cookie choice. We show a cookie banner, and non-essential cookies are declined by default. We do not use third-party analytics or advertising cookies, and we do not track you across other sites. [Counsel: please confirm this “essential-only” statement against the final build before launch.]

7. Your rights

Depending on where you live, you have some or all of the following rights over your personal data:

• Access — request a copy of the data we hold about you.
• Rectification / correction — ask us to fix inaccurate or incomplete data.
• Deletion / erasure — ask us to delete your data.
• Objection and restriction — object to, or ask us to restrict, certain processing.
• Portability — receive your data in a portable format.
• Withdraw consent — at any time, without affecting prior processing.

If you are in the EEA or UK, these are your GDPR rights. If you are in California, you have the right to know, delete, and correct your personal information, and the right to opt out of sale or sharing — noting that we do not sell or share personal data, so there is nothing to opt out of. We will not discriminate against you for exercising any right.

To exercise any right, email privacy@gobeyondclub.com [confirm mailbox]. We will respond within the timeframe required by applicable law (generally one month under GDPR). You also have the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner’s Office; in the EU, your national supervisory authority).

8. We do not sell or share your data

We do not sell your personal data, and we do not share it with third parties for their own marketing or for cross-context behavioural advertising, within the meaning of the California CPRA or any comparable law. The only parties who process your data are the service providers listed in Section 4, acting on our behalf.

9. Children

The Site and Beyond membership are intended for adults. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.

10. How we protect your data

We use reasonable technical and organisational measures to protect your data, including encryption in transit (the Site is served over SSL/TLS), storing only a salted hash rather than raw IP addresses for rate-limiting, and restricting access to reservation records to those who need it. No method of transmission or storage is completely secure, but we work to protect your data and to review our safeguards.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where changes are material, take reasonable steps to notify you. Please review this page periodically.

12. Contact us

[LEGAL ENTITY NAME]
Privacy: privacy@gobeyondclub.com [confirm mailbox]
Post: [Registered address]