Version 0.3 · Updated 13 October 2026 · Draft for review before adoption or signature

For current portal access and signing privacy, use Admin portal terms. This document remains a review template and is not executed by accepting the portal terms. The current proposed Community Lead arrangement is unpaid volunteering under document 24, with separately recorded authority under document 08. Any future paid arrangement requires a new, separately agreed agreement; documents 18 and 19 are earlier employment proposals, not current onboarding.

Approved access

Only appointed and inducted admins with a recorded purpose may receive access. Keep role-based permissions, multifactor authentication and individual logins. Do not place passwords, recovery codes or sensitive member details in the registers supplied with this pack. Use an approved password manager and company-controlled recovery arrangements.

Default permissions exclude bulk exports, downloads to private devices, financial systems, ownership changes and sending from official social or email accounts. Company Director must approve exceptions and record scope and review date. Community Lead reviews current permissions at least quarterly and when roles change; this is an operator responsibility, not a volunteer attendance requirement.

Member information

Use the minimum information necessary for the approved purpose. Keep factual and respectful notes. Do not record speculative sensitive traits, health information or investor assessments in general member records. Escalate any need for sensitive information to the responsible privacy contact before collecting it.

Do not sell lists, supply attendees to sponsors, reuse contacts for your own employer or recruiting business, or treat a personal introduction as permission for broader data sharing. Obtain permission from both people before sharing contact details for an introduction. Use approved systems rather than private spreadsheets or personal messaging archives.

Outreach

Use the approved contact purpose and channel. Verify applicable marketing permission and suppression records before sending promotional messages. Event attendance or accepting admin terms does not automatically permit unrelated Studio sales messages. A non-commercial event invitation may still be direct marketing; the privacy lead should classify campaigns before launch.

Do not assume the charitable soft opt-in applies: Physical I/O has not been established as a qualifying charity. Do not treat a publicly visible email address as consent. Respect opt-outs promptly; retain only the minimum suppression information needed to prevent further unwanted messages. Operational messages should remain operational and not conceal promotions.

Sources: ICO electronic mail marketing guidance and ICO marketing planning guidance.

Brand and publication

Use only approved brand assets for authorised activity. Permission ends when the activity or appointment ends unless expressly continued. Obtain approval for merchandise, sponsorship claims, public announcements, recordings and new official groups. No admin may register a confusing official-looking domain or account as a personal asset.

Genuine historical descriptions and lawful uses are not prohibited by this policy. Agree the wording of current roles and historical credits separately. Specific content rights are handled through document 10 or another reviewed agreement, not presumed from voluntary participation.

Incidents and requests

Report suspected compromise, mistaken disclosure, lost devices, phishing or improper access immediately when discovered to [INCIDENT CONTACT], with [BACKUP CONTACT] if unavailable. Record what happened and discovery time; preserve evidence and do not investigate beyond your permission. Do not hide or delete logs.

Forward access, deletion, correction or objection requests promptly to [PRIVACY CONTACT]. Do not promise deletion of every record or disclose records to an unverified requester. The controller owns the legal assessment and response.

The controller must assess breach reporting promptly; where notification is required, the usual UK GDPR deadline is within 72 hours of awareness. Individual admins should report internally immediately rather than waiting for that deadline. ICO breach guidance.

Retention and leaving

Use the approved retention schedule, distinguishing active records, consent and suppression records, agreements, incidents and legal holds. No indefinite default retention is authorised. Document 15 must be completed consistently with actual tools and practices.

On exit revoke sessions, roles, tokens, integrations and shared secrets where relevant; transfer authorised files and conversations; confirm return or deletion of unauthorised local copies. Preserve legally required evidence under restricted access. Never demand a departing volunteer’s personal account password.

Membership choice and inactive portal access

We would like everyone to stay in the community. You are welcome to remain a community member if you do not wish to become or continue as a Community Admin or Community Lead. Choosing “Remain a community member” ends the current admin/lead onboarding or appointment and removes admin portal access without ending community membership. It does not accept a new agreement, erase past signatures or remove surviving confidentiality, data-return, IP or handover obligations. A later appointment needs a new authorised onboarding process.

Community Admin and Community Lead portal access is automatically revoked after three calendar months without an authenticated visit to the admin portal. Visits to the members’ space, email opens and background API polling do not reset the clock. Superadmin accounts are exempt to preserve company control. Existing appointees receive a full initial three-month period when tracking begins; new appointees start on appointment. This is an access-security rule, not a requirement to volunteer regular hours.

An inactive person may request restored access while remaining a member. A currently active Community Lead must approve restoration. If no active Community Lead is available, the Company Director may approve as a fallback. No one may approve their own restoration. Restoration restores only previously authorised portal access, requires an active matching membership and does not reinstate an ended appointment or waive acceptance of current terms. A renewed visit or email-link click does not itself restore access.

Authenticated portal activity timestamps, membership choices, restoration requests and approval records are retained with the access audit records under the Admin Privacy Notice. Access revocation does not transfer ownership, change company control, end community membership or retrospectively vary an executed employment, services, IP-transfer or other agreement. Any separate continuing rights or obligations remain governed by that agreement.