Identity data is not a marketing asset

Purchaser KYC data is high-risk personal data. It needs a controller, a purpose, a notice, a vendor with a contract, access control, retention, and a deletion story. It does not need to live next to the claims register. Mixing comms and KYC is how a contractor sees passports. Contractors seeing passports is how you write to a data commissioner as well as a financial one.

Product waitlists collect the minimum. Offering processes, if they exist, collect what the process legally requires, on rails designed for it. Do not pre-collect “so we’re ready.” Readiness is a programme, not a Dropbox.