Privacy Notice

Who is responsible for your information

Create50 Ltd (company number 10121926) is the data controller for the information described here, registered at Ealing Studios, Ealing Green, London W5 5EP, England.

We are registered with the UK Information Commissioner's Office under registration number ZB019894.

For anything to do with your personal information, including any of the rights below, contact chris@londonswf.com.

What we collect

When you apply, we collect the answers you give on the application form. That always includes your name and email address, and normally your phone number, country of residence and occupation. Depending on the programme, it may include longer written answers and files you choose to upload, such as a CV or a script.

If you tell us about additional needs or adjustments, that answer may reveal information about your health or disability. UK data protection law treats that as a special category of information and gives it extra protection. We ask for it separately, we ask for your explicit permission before you give it, and it is optional — see “Additional needs” below.

If you join a programme as a delegate, we also hold the profile you choose to publish to your cohort: a short biography, a photograph, links and an optional video.

If you are offered a place, we hold the price agreed with you and a record of what you have paid: the amount, the date, how it was paid, and any reference or note our staff add to it. If you are on an instalment plan, we hold which plan you are on and how many instalments have been paid.

We never see or store your card details. Card payments are taken on our payment provider's own pages; we send them your email address so they can issue a receipt, and they send us back reference numbers for the payment. Those reference numbers are all we keep.

Our staff may add private notes about your application — for example, a record of a phone call. You can ask to see these.

We record your IP address when you submit a form or sign in. This is used to limit how often the same source can submit, so the site cannot be flooded by automated traffic.

Why we use it, and our lawful basis

To consider your application and talk to you about it. Our basis is that this is necessary to take steps at your request before entering into a contract, and our legitimate interest in running a fair selection process.

To deliver the programme if you take part — scheduling, materials, the delegate app and communications about the event. Our basis is performance of our contract with you.

To take payment for your place and keep track of what has been paid, including running an instalment plan and telling you if a payment fails. Our basis is performance of our contract with you.

To keep the service secure and working: rate limiting, bot protection, error monitoring and backups. Our basis is our legitimate interest in protecting the service and the people whose information is in it.

To meet our own legal and accounting obligations where they apply — which includes keeping a record of money we have received from you.

We do not use your information to build advertising profiles, we do not sell it, and we do not make automated decisions about you that produce legal or similarly significant effects.

Additional needs (health information)

The application form may ask whether there is anything we can do to support you during the programme. Answering is entirely optional, and leaving it blank has no effect on your application.

Because an answer here can amount to health information, we ask for your explicit consent before you provide it, and we record when that consent was given. Our lawful basis is your explicit consent under Article 9(2)(a) of the UK GDPR.

We use it only to make practical arrangements for your participation. It is visible to the small number of programme staff who need it for that purpose. It is not used in deciding whether your application succeeds.

You can withdraw your consent at any time and we will delete what you told us. Withdrawing it does not affect anything we did with it beforehand, and it does not affect the rest of your application.

Who else processes it

We do not sell or share your information for anyone else's marketing. We do rely on a small number of suppliers who process it on our instructions, under contract, and only to provide their service to us:

Hosting and application infrastructure (Render). Database hosting (Neon, in London). File storage and bot protection (Cloudflare). Sending email (Resend). Taking card payments (Stripe). Error monitoring, if enabled, is configured not to send us your personal details along with a report.

Stripe is different from the others: as well as processing payments on our instructions, it is responsible in its own right for the card details you give it and for preventing fraud, and it keeps its own records of the payment. Its privacy policy is at stripe.com/privacy.

Our application servers currently run in the United States, so your information is transferred outside the UK. Where that happens, the transfer is covered by the supplier's standard contractual clauses or an equivalent approved safeguard. Our database itself is hosted in London.

We will also disclose information where the law requires it, or to establish or defend legal claims.

How long we keep it

We keep application records for 2 years after the programme you applied to has finished, and then delete them. That gives us time to deal with any follow-up and to consider you for a later cohort.

Files uploaded to an application form but never submitted with an application are deleted automatically after 24 hours.

If you ask us to delete your information, we will do so unless we are required to keep it. Deleting an application removes the answers you gave, any files you uploaded, any notes about you, and the payment records held in this service.

The financial record of a payment lives on beyond that, in our own accounts and with our payment provider, because tax and company law requires us to keep records of money received. That record is kept for as long as the law requires and is not used for anything else.

We keep a record of significant administrative actions — including the fact and date of a deletion — so that we can show what happened to your information. That record identifies the action, not the contents of what was deleted.

Cookies

This service sets a cookie when you sign in, so that you stay signed in as you move between pages. It is necessary for the service to work and is not used to track you.

Cloudflare's bot check may set a short-lived cookie to confirm that a form was submitted by a person rather than a script. It is a security measure.

We do not use analytics, advertising or social-media tracking cookies. Because of that we do not show a cookie banner — there is nothing here that you would need to consent to.

Your rights

You have the right to ask for a copy of the information we hold about you; to have inaccurate information corrected; to have your information deleted; to restrict or object to how we use it; and, where it applies, to receive it in a portable form.

Where we rely on your consent — which is the case for the additional-needs question — you can withdraw it at any time.

To exercise any of these, contact chris@londonswf.com. We will respond within one month.

If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113. We would rather you came to us first so we can put it right.

Changes to this notice

If we change how we use your information we will update this page and, where the change is significant, tell you directly.