1. Who is responsible
The data controller is the operator of Show Me Your Pop Up.
- Trading status: Pending trading
- Legal or company name: Pending trading
- Business address: Pending trading
- Company number: Pending trading
- ICO registration number: Pending trading
- Privacy contact: privacy@showmeyourpopup.com
These details will be updated before trading or public data collection begins.
2. What applies during pre-launch
The public website is informational. It does not currently provide account registration, public submission forms, payments, mailing-list registration, analytics or advertising.
Like most websites, the hosting and network providers may temporarily process basic request and security information—such as an IP address, browser information, request time and requested page—to deliver the site, maintain security and diagnose faults. This is processed for the legitimate interests of operating and protecting the website and is retained only for the provider’s operational or security period.
If you choose to contact the privacy address, we receive the information you include in your message. We use it only to respond, manage the request and meet legal obligations.
3. Information the launched service is expected to use
Before the app accepts public users, this policy and the app’s just-in-time notices will be reviewed. Depending on the features you choose, the launched service is expected to process:
- account information such as name, email address, account ID and authentication records;
- profile information such as first name, last name, town or city, role and preferences;
- vendor information such as business name, description, contact details, services, social links, logo and subscription tier;
- pop-up details such as name, description, trading dates and times, location, map coordinates and check-in status;
- saved vendors and notification preferences;
- push-notification device tokens and delivery information;
- device location, only where permission is granted and a location feature is used; and
- technical, security and diagnostic information needed to run and protect the service.
4. Why information will be used
When the service launches, personal information may be used to:
- create, authenticate and administer accounts;
- provide search, maps, distance and local-discovery features;
- publish vendor profiles and pop-up listings chosen for public display;
- save favourites and deliver requested notifications;
- administer subscriptions and entitlements where enabled;
- provide support, prevent misuse and secure the service; and
- comply with legal and regulatory obligations.
5. Lawful bases
The lawful basis will depend on the activity. It is expected to include performance of a contract for account and service features; legitimate interests for security, support and service improvement; consent for optional device permissions or direct marketing where required; and legal obligation where records must be kept by law.
Consent can be withdrawn through device settings, in-app controls or by contacting us. Withdrawing consent does not affect processing that was lawful before withdrawal.
6. Service providers and public information
The launched service is expected to use carefully selected providers, including:
- Supabase for authentication, database and business-logo storage;
- Google Maps and device location services for maps, coordinates and location-based features;
- Expo and device notification services for app delivery and push notifications; and
- app-store and payment providers where subscriptions or purchases are offered.
Vendor profiles, logos, services and pop-up details designated as public may be visible to other users. Vendors should not publish personal information they do not want displayed publicly.
7. International transfers
Some providers may process information outside the UK. Before launch, we will confirm the relevant processing locations and use an applicable UK adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful safeguard where required.
8. Retention and deletion
Pre-launch privacy correspondence is kept only as long as needed to respond, establish what action was taken and meet legal obligations. Technical logs are retained according to the hosting provider’s short operational and security periods.
Before public launch, specific retention periods will be confirmed for accounts, listings, notifications, support and subscription records. Users will be able to request account deletion through the app and at our account-deletion page. Limited records may be retained where required for legal, tax, fraud-prevention, security or dispute purposes.
9. Security
We use proportionate technical and organisational safeguards, including access controls, encrypted connections, restricted database access and row-level access rules. No internet service can guarantee absolute security.
10. Your data-protection rights
Depending on the circumstances, UK data-protection law may give you rights to access, correct, erase, restrict or object to processing, and to receive certain information in a portable format. Where processing relies on consent, you may withdraw it.
To exercise a right, email privacy@showmeyourpopup.com. We may need to verify your identity. You may also complain to the Information Commissioner’s Office.
11. Children
The service is not directed at children under 13, and we do not knowingly invite them to create accounts. Before launch, age requirements will be reviewed for the features offered.
12. Changes to this policy
We will update this policy before public accounts or data-collecting features launch and whenever our practices materially change. The current version will remain available at this URL, which is also opened by the app so the wording is maintained in one place.