Consent you can prove, data you can delete.

Consent is the usual basis

You need a lawful basis to process personal data. For a waitlist you’ll email, that’s usually consent (Art. 6(1)(a)): the person agreed to give you their address for a purpose you stated. Many countries also have their own rules for marketing email on top of the GDPR, and those usually ask for consent too.

Consent has to be freely given, specific, informed and unambiguous, shown by a statement or a clear action (Art. 4(11)). On a waitlist form, that comes down to this:

• The text by the button says what you’ll send, such as launch news and an invite
• People act to agree, by entering their address and clicking the button or by ticking an empty box
• No boxes ticked in advance: Recital 32 says pre-ticked boxes don’t count as consent
• Other uses, such as a newsletter after launch, get their own clear wording or their own box
• A link to your privacy policy, with who you are, what you use the data for and how long you keep it (Art. 13)

Double opt-in shows who agreed

With double opt-in, a new signup gets an email with a confirmation button, and only the click puts them on the list. With single opt-in, they’re on the list the moment they send the form.

The GDPR never mentions double opt-in. What it asks is that you can demonstrate consent (Art. 7(1)). With single opt-in that’s hard, because anyone can type someone else’s address into a form. A click in the confirmation email shows that the owner of the inbox agreed.

Two details matter. Put the confirmation behind a button on a page, because some mail programs and security scanners open every link in an email. And decide what happens to addresses that never confirm: delete them after a set time, such as 30 days, because you have no consent for them.

Keep a record of consent

If a person or a regulator asks, you need to show who agreed, when and to what. When you change the fine print, keep the old text too: the people who joined last month agreed to that version, and your records should still show it.

Waitlark keeps the exact consent text and version each person saw, with the date they confirmed. Whatever tool you use, keep this for each person:

• The email address
• When they signed up, and when they confirmed
• The exact consent text they saw, or a version number that points to it
• Where they signed up: which form or page, and in which language

Store only what you use

Data minimisation (Art. 5(1)(c)) means you collect only what you need for the purpose. For a waitlist, that’s the email address, the consent record and perhaps a language and a source. Answers to signup questions can fit too, when you use them to decide who to invite or what to build.

The tool that holds your list processes the data on your behalf, so you need a data processing agreement with it (Art. 28). Check where it stores the data as well: a transfer outside the EU needs a basis of its own, such as an adequacy decision or standard contractual clauses.

Things to leave out:

• IP addresses and browser details, unless you have a clear reason to keep them
• Phone numbers, birthdays and postal addresses you won’t use before launch
• Health, religion, political views and other special categories of data (Art. 9), which come with strict extra rules
• Copies of the list in spreadsheets on several laptops

Delete on request and after launch

People can withdraw consent at any time, and withdrawing must be as easy as giving it (Art. 7(3)). Put an unsubscribe link in every email, and make it work without a login. For a waitlist, unsubscribing usually means you have no reason left to keep the data, so delete it.

People can also ask what you hold on them (Art. 15) or ask you to erase it (Art. 17). You have to answer without undue delay, and within one month (Art. 12(3)). Make sure you can find a person by email, export their data and delete it everywhere, including old exports and other tools you sent it to.

Then there’s the list itself. Once you’ve launched and sent the invites, it has done its job, and storage limitation (Art. 5(1)(e)) means you shouldn’t keep it longer than you need. Set a retention period, such as a few months after launch, and delete what’s left. Waitlark lets you set one, after which old lists delete themselves.

If you want to keep emailing people after launch, say so in the consent text from the start, or offer a separate, unticked newsletter box at signup. Don’t send an email asking for that permission later: a message that asks for marketing consent can itself count as marketing.