CPG tribeWaitlist Privacy Notice

Who is responsible for your information

Fiona Fitz Consulting Ltd is the controller responsible for personal information collected through the CPG tribe waitlist.

A controller decides why and how personal information is used.

Information we collect

We may collect:

• your name;
• your email address;
• your company or brand name;
• your role or professional position;
• your industry or product category;
• your company’s approximate revenue band;
• answers you submit through the waitlist form;
• your communication preferences;
• records of your consent or withdrawal of consent;
• correspondence between you and us;
• registration timestamps;
• limited technical or security information generated when you submit the form, such as an IP address, device or browser information, which is automatically recorded by our service providers;
• information reasonably necessary to identify duplicate, fraudulent or abusive registrations.

We do not intentionally request special-category personal data through the waitlist. Please do not submit sensitive personal information in the form.

Why we use your information

3.1 Operating the waitlist

We use your information to:

• record your interest;
• confirm your registration;
• manage and maintain the waitlist;
• communicate about your waitlist status;
• respond to questions;
• manage invitations;
• remove you when requested.

Lawful basis: our legitimate interests in establishing, administering and evaluating the waitlist.

3.2 Assessing eligibility and fit

We may use your company, role, category and revenue-band information to:

• assess whether CPG tribe is relevant to you;
• verify your eligibility;
• maintain an appropriate mix of founders, operators, categories and business stages;
• prioritise or sequence invitations;
• understand demand for CPG tribe.

Lawful basis: our legitimate interests in developing a relevant, trusted and useful platform.

Administrative or technical tools may support invitation decisions, but they will not be made solely by automated processing in a way that produces legal or similarly significant effects.

3.3 Preparing for membership

If we invite you to create an account, we may use the information necessary to take steps at your request before entering into a membership relationship.

Lawful basis: taking steps at your request before entering into a contract.

3.4 Optional marketing

Where you separately opt in, we may use your contact information to send:

• CPG and AI intelligence;
• founder stories;
• editorial updates;
• event information;
• platform news;
• offers and promotional communications.

Lawful basis: your consent.

You may withdraw consent at any time by using the unsubscribe link in an email or contacting fiona@fionafitzconsulting.com.

Withdrawing consent does not affect processing that took place before you withdrew it.

3.5 Security and legal purposes

We may use information to:

• protect the waitlist, Site and technical systems;
• detect or prevent fraud, abuse or unauthorised access;
• investigate technical or security incidents;
• maintain records of consent and unsubscribe requests;
• comply with legal or regulatory obligations;
• respond to lawful requests;
• establish, exercise or defend legal claims.

Lawful basis: our legitimate interests and, where applicable, compliance with legal obligations.

Convex and our technical infrastructure

We use Convex to provide hosted database and backend infrastructure for the waitlist.

Our production Convex deployment is hosted in the Amazon Web Services (AWS) EU West (Ireland) region located in Dublin, Ireland, to support regional data residency and compliance requirements."

Convex processes personal information on our behalf as a processor. Convex may use subprocessors to provide elements of its service.

The selected deployment region does not necessarily mean that every support, security or subprocessor activity takes place only in that region.

Where personal information is processed outside the Isle of Man, United Kingdom or European Economic Area, we use an appropriate lawful transfer mechanism and contractual safeguards where required.

Further information about relevant transfer arrangements is available from us on request.

Who may receive your information

We may share personal information with:

• Convex, which provides our hosted backend and database infrastructure;
• our website-hosting provider;
• providers used to send waitlist confirmations and invitations;
• marketing email providers where you have opted in;
• authorised developers, agencies or technical-support providers working on our behalf;
• professional advisers, including lawyers, accountants, insurers and security advisers;
• regulators, courts, law-enforcement bodies or public authorities where legally required;
• a future CPG tribe operating company, as described below.

Providers acting as processors may only use personal information in accordance with our instructions, their contract with us and applicable law.

We do not:

• sell your personal information;
• give future CPGtribe Marketplace suppliers access to waitlist information;
• share waitlist information with suppliers for their own marketing;
• sell identifiable information about your waitlist activity.

Future transfer to CPG tribe Ltd

We intend to establish a separate Isle of Man company to operate the CPG tribe platform.

If the waitlist or platform business transfers from Fiona Fitz Consulting Ltd to CPG tribe Ltd or another CPG tribe operating company:

• we will tell you the company’s legal name and contact details;
• we will explain when it becomes responsible for your information;
• we will explain any material change in how the information will be used;
• the new company will be required to handle the information in accordance with applicable data-protection law;
• you may exercise your applicable data-protection rights.

The transfer will not, by itself, create a platform account or paid subscription.

Until the transfer takes effect, Fiona Fitz Consulting Ltd remains responsible for the waitlist information.

International processing

Some providers or their subprocessors may process personal information outside the Isle of Man, United Kingdom or European Economic Area.

Where additional safeguards are legally required, we may rely on:

• an applicable adequacy decision;
• approved contractual clauses;
• an applicable addendum or equivalent safeguard;
• another legally recognised transfer mechanism.

We also assess the contractual and security arrangements of relevant service providers.

How long we keep your information

We normally retain waitlist information for up to 12 months from registration.

We may delete it earlier if:

• the waitlist closes;
• the CPG tribe platform does not proceed;
• the information is no longer needed;
• you ask us to delete it and no lawful reason requires us to retain it.

Before the 12-month period expires, we may invite you to confirm that you wish to remain on the waitlist. If you do not respond, we may delete or anonymise your entry.

If you have separately opted in to optional communications, we may retain the contact information needed to send them after your waitlist entry has been removed. We will periodically review inactive marketing records and delete information that is no longer required.

When you unsubscribe, we may retain a minimal suppression record so that we can honour your request and avoid sending further marketing communications.

We may retain limited information for longer where reasonably necessary to:

• comply with law;
• maintain security or audit records;
• investigate misuse;
• resolve a dispute;
• establish, exercise or defend legal claims.

How we protect your information

We use technical and organisational measures designed to protect personal information, including where appropriate:

• restricted administrative access;
• named user accounts;
• authentication and access controls;
• encryption in transit;
• separation of development and production environments;
• processor agreements;
• access-review procedures;
• logging and security monitoring;
• backup and incident-response procedures.

No online service can guarantee absolute security.

Your rights

Depending on the circumstances and applicable legal conditions, you may have the right to:

• request access to your personal information;
• ask us to correct inaccurate or incomplete information;
• ask us to delete information;
• ask us to restrict certain processing;
• object to processing based on legitimate interests;
• receive certain information in a portable format;
• withdraw consent where processing relies on consent;
• raise concerns about certain automated decisions.

These rights may be subject to legal conditions, limitations or exemptions.

To exercise a right, contact fiona@fionafitzconsulting.com. We may need to verify your identity before responding.

Complaints

Please contact us first if you have a concern about how we use your information:

Email: fiona@fionafitzconsulting.com

You also have the right to complain to the:

Current contact information is available through the Commissioner’s official website.

No non-essential cookies or tracking

The waitlist page does not currently use analytics cookies, advertising pixels or other non-essential tracking technologies.

The Site and its technical providers may process limited information that is strictly necessary to:

• operate and secure the form;
• transmit your submission;
• prevent misuse;
• maintain technical logs.

If we later introduce analytics, advertising pixels or other non-essential tracking, we will update this notice and introduce any consent mechanism required before those technologies operate.

Changes to this notice

We may update this Privacy Notice to reflect changes in:

• the waitlist;
• our service providers;
• the CPG tribe business structure;
• applicable law;
• how we use personal information.

The latest version will appear on the Site with its last-updated date.

If a change materially affects existing waitlist members, we will provide appropriate notice.

Contact

Questions, requests or concerns about this notice or your personal information should be sent to: