Wavely Labs SRL · Last updated 2026-10-14
Privacy policy
Template — requires legal review before launch.
Who is responsible for your data
Wavely Labs SRL, based in Bucharest, Romania, is the controller for personal data collected through this website and project enquiries. Contact contact@wavelynow.com with a privacy question or rights request. The controller’s registered address, registration details and applicable supervisory authority must be verified during the legal review. This policy is dated 2026-10-14.
Information we collect
When you send a brief, we collect your name, work email, company, project choices and any message you provide. We derive the email domain to understand the organisation making the enquiry. Our hosting and security systems may process an IP address, request time and technical error information. With your permission, analytics and marketing services may collect browsing events, device information and campaign attribution. Please avoid sending sensitive personal information in a project brief.
Project replies and other purposes
We use brief details to assess the requested production, reply and prepare a proposal. Where the enquiry involves steps you request before entering a contract, the legal basis is GDPR Article 6(1)(b). Business correspondence involving another organisation’s representative may instead rely on our legitimate interest in responding to a relevant enquiry under Article 6(1)(f), following an appropriate assessment. Security and fraud prevention also rely on legitimate interests. Accounting or other mandatory records are processed to meet legal obligations under Article 6(1)(c).
Optional analytics and marketing
We use optional analytics to understand which pages and interactions are useful, and optional marketing tools to evaluate campaigns. These activities rely on your consent under Article 6(1)(a) and applicable electronic-communications rules. Google, Meta and Microsoft tags load only after the relevant choice is granted. Rejecting optional tracking does not prevent you from viewing the site or sending a brief. We do not include your name, email or message in analytics events, and do not sell enquiry details.
Service providers and recipients
Our contracted hosting provider processes requests and serves the website. Resend may deliver project-enquiry emails; an appointed CRM provider may receive completed briefs through a configured webhook. Google provides analytics and tag management when enabled, Meta provides marketing measurement, and Microsoft Clarity provides analytics when consented. Cal.com receives booking details only if you choose to open and use the calendar. WhatsApp receives the information you choose to send through its service. Access is limited to relevant staff and contracted providers, with processor terms where required.
Transfers outside the EEA
Some providers may process information outside the European Economic Area. Before activating them, we assess the destination, the provider’s contractual terms and the required transfer mechanism. Transfers must use an applicable adequacy decision or suitable safeguards, such as the European Commission’s Standard Contractual Clauses with additional measures where needed. The final processor list and transfer arrangements form part of the pre-launch legal review. You may contact us for information about the safeguards relevant to your data.
How long information is kept
The proposed retention period for an enquiry that does not become a project is twelve months after the last substantive contact. Contractual correspondence and accounting records are retained for the period required by applicable law, with access restricted after the active project. Security logs are proposed to be retained for thirty days unless an incident requires a longer record. Consent choices are stored for six months. Optional vendor retention settings and these proposed periods must be confirmed before launch; information is then deleted or anonymised when no longer needed.
Your choices and rights
Subject to the conditions in data-protection law, you may request access, correction, deletion, restriction or portability, and object to processing based on legitimate interests. You may withdraw optional tracking consent through Cookie settings in the footer; withdrawal does not affect processing already lawfully carried out. Send a rights request to our contact email. We may ask for proportionate information to verify your identity, and ordinarily respond within one month, with a permitted extension explained when necessary. You may complain to the competent data-protection authority, including Romania’s ANSPDCP where applicable.
Security and policy updates
We use access controls, transport encryption and proportionate safeguards to protect project correspondence. No website can guarantee that every security incident will be prevented. We do not use enquiry details for a solely automated decision that produces legal or similarly significant effects. If our purposes, providers or practices change, we update this policy and seek a new consent choice where required. The published revision date identifies the current version.