Privacy Policy

Who we are

WavesPath is a membership, events and learning platform made and operated by TAPP Digital Incorporated ("TAPP", "we", "us"). This policy explains how we handle personal data when you visit wavespath.com, talk to us, or use the platform.

You can reach us about anything in this policy at hello@wavespath.com.

The two roles we play

Most personal data on WavesPath belongs to the organisations that use it: their members, applicants, delegates, speakers, authors, learners, subscribers and the people who answer their forms or book their facilities. For that data the organisation is the controller and decides why and how it is used. We are its processor: we hold and process it only to run the platform for that organisation, under our Data Processing Agreement.

If you are a member of an organisation that uses WavesPath, that organisation's own privacy notice applies to you, and it is the first place to go with a request about your record. We help organisations answer those requests.

We are the controller for a smaller set of data: visits to wavespath.com, enquiries and conversations with our website assistant, the accounts of the people who run each organisation on the platform, and our own billing records. The rest of this policy covers that data, and how we look after everything we process.

What we collect and why

• Enquiries. When you press Find out more or ask to talk to a person, we keep what you send: your name, role, email, phone, organisation, its type and size, what interests you, and your message. We use it to reply and to follow up on your enquiry.
• Website assistant conversations. The assistant on wavespath.com keeps each conversation (your questions, its answers, the page you were on, your country and the kind of device) so that we can see what people ask and improve our answers. The chat window says so. We do not store your network address with it. If you send an enquiry from the chat, the two are linked.
• Website visits. We count visits to wavespath.com ourselves, without cookies. We record the page, the referring website (its address only, never the full link), any campaign tags in the link, your country, device and browser type, how long a page was in view and how far you read. Visits are grouped by a code made from the day, your network address and your browser, scrambled so that it cannot be turned back into either and changes every day; the address itself is not stored. Browsers that send a Global Privacy Control signal are not counted at all, and nor is anybody signed in.
• Accounts for the people who run an organisation. Name, email, a scrambled (hashed) password, two-factor settings, the organisation and permissions they hold, and records of sign-ins and important changes, including the network address used, to keep accounts secure.
• Billing. The organisation's details, its plan, invoices, payments received and their bank references. Card payments are taken on our payment provider's own secure pages; card numbers never reach our servers.
• Messages with us. Emails and other correspondence you send us.

Data organisations keep on the platform

For data an organisation puts on WavesPath, we act only on that organisation's instructions: to store it, show it to the people the organisation allows, send the emails it asks us to send, take payments through the gateway it connects, and keep it secure. We do not sell it, use it for our own marketing, or use it to train artificial intelligence models.

The organisation decides what it collects, for example through its membership forms, and is responsible for telling its members and having a lawful basis to do so.

Who we share it with

We do not sell personal data. We share it only with:

• Service providers who run parts of the platform for us under contract and only on our instructions: cloud hosting, a managed database, file storage, email delivery and an artificial intelligence provider for the website assistant and optional writing help. The categories, their purposes and where they operate are listed on our Security page.
• The payment gateway an organisation chooses to connect, when somebody pays that organisation. The gateway handles the card and tells us whether the payment succeeded.
• Professional advisers, such as accountants and lawyers, where needed.
• Authorities, where the law requires it or to protect the rights and safety of people and of the platform.
• A buyer or successor, if our business or part of it is transferred, under the same protections.

Cookies and storage on your device

We use no advertising cookies and no third-party tracking. Our own website counting needs no cookie at all.

• A sign-in cookie for the people who run an organisation, to keep them signed in.
• A device cookie when a member opens their own member area, so that their personal link only works on devices they have confirmed.
• Storage on your device for conveniences you choose: text size and motion settings, the sessions you starred on a delegate page, the room you are in, a ticket code you entered, and similar. These never leave your device.

These are needed for the platform to work or are things you asked for, so we do not show a cookie banner.

How long we keep it

• Website visit records and assistant conversations: about 26 months (800 days), long enough to compare a month with the same month a year earlier, then deleted automatically.
• Enquiries: for as long as we are in conversation with you and for a reasonable period afterwards, unless you ask us to delete them sooner.
• Accounts: while the organisation uses WavesPath, and then as set out in our Terms.
• Billing and accounting records: for as long as tax and accounting law requires.
• Data organisations keep on the platform: as the organisation decides while it is a customer, and deleted or returned when it leaves, as our Data Processing Agreement describes.

How we protect it

Data travels encrypted and is held encrypted by our hosting providers. Each organisation's data is kept apart from every other's, staff see only the areas they are given, our own team must use two-factor sign-in, and important actions are recorded. Our Security page describes this in more detail.

Your rights

Depending on where you live, you can ask to see the personal data we hold about you, correct it, delete it, limit or object to how we use it, or receive a copy to take elsewhere, and you can withdraw consent where we rely on it. Write to us at hello@wavespath.com. We may need to confirm who you are first. For data an organisation keeps on WavesPath, please ask that organisation; if you write to us we will pass your request on and help it answer.

If you are unhappy with how your data is handled, you can complain to the Data Protection Commissioner in Barbados, or to the data protection authority where you live.

If you are in the European Union or the United Kingdom

Where the GDPR or the UK GDPR applies, we rely on these lawful bases: performing a contract with you or your organisation (running accounts, billing, answering an enquiry you sent); our legitimate interests in running, securing and improving WavesPath and our website (visit counting, keeping assistant conversations, preventing abuse), which we balance against your rights and which you can object to; legal obligations (accounting records); and consent where we ask for it.

Our providers operate mainly in the United States. When personal data leaves the EU or the UK, we rely on recognised safeguards such as the European Commission's Standard Contractual Clauses and the UK's equivalent.

Children

wavespath.com is not aimed at children. Some organisations keep records of junior members on the platform; in that case the organisation is responsible for having the consent of a parent or guardian where the law requires it.

Changes to this policy

We will update this page when what we do changes, and change the date at the top. If a change is significant we will tell the organisations that use WavesPath before it takes effect.