Privacy
Why a Personal Data Protection Charter?
Your privacy is a priority for The Wave, a company headquartered at rue Middelbourg 66, 1170 Bruxelles, Belgique, and registered with the Crossroads Bank for Enterprises (CBE) under number 0453.138.765 (hereinafter referred to as “The Wave” or “we”). In this respect, we are committed to respecting the personal data of our online users (hereinafter referred to as “you”), handling it with the utmost care, and ensuring the highest level of protection of your data in accordance with Regulation 2016/679 of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and the free movement of such data (hereinafter referred to as the "GDPR") and the Belgian law of July 30, 2018, on the protection of natural persons with regard to the processing of personal data (hereinafter referred to as "Belgian law"). The present charter informs you about:
- The personal data we collect about you and the purposes for this collection,
- The ways we use your personal data,
- Your rights regarding your personal data and how to exercise them
Last modification date of the Charter : 12.11.2024 ( Historique des modifications)
Download the latest version in PDF PDF
You can also manage your personal data and protect your privacy at any time via your Privacy dashboard
Glossary of Key Legal Terms Used in This Charter
| Terms frequently Used in This Charter | Definitions given by the GDPR | Explanations in plain language |
|---|---|---|
| Personal Data (hereinafter "personal data") | Any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; | Any type of information related to a natural person, i.e., an individual, who can be identified, directly or indirectly, as a distinct person from others. Examples include: a name, a photo, a fingerprint, an email address, a phone number, a social security number, IP address, a voice recording, your website navigation data, data linked to an online purchase, etc. |
| Data Protection Officer (DPO) | The GDPR does not define the term Data Protection Officer. | The Data Protection Officer (DPO) assists the company in ensuring compliance with the GDPR and applicable national laws regarding the protection of personal data, as well as our policies and practices for managing your data. The DPO is also responsible for collaboration with the data protection supervisory authorities. The DPO is your main contact for any data-related inquiries. |
| Processing | Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. | Any use of personal data, regardless of the processing method (e.g., recording, organizing, storing, modifying, comparing with other data, transmitting, etc.). For example, using your data to manage orders, deliver products, or send newsletters, etc.. |
| Data Controller | the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. | The individual, public authority, company, or organization and decides how and for what purpose your data will be used and with whom it will be shared. They are primarily responsible for ensuring your data protection. |
| Joint Controllers | Controllers who jointly determine the purposes and means of the processing. | Controllers who decide together to process your data, including the purposes of the processing and the means of the processing. |
| Processor | The natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller. | A service provider that process data under the instructions and responsibility of the data controller. |
| Profiling | any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements. | Large-scale analysis of personal data regarding behavior patterns, to establish a link between data and specific behaviors, resulting in the creation of a profile and the attribution of such profile to an individual. |
| Enrichment | The GDPR does not define enrichment. | A process that enables to verify the accuracy of data within a database and/or completing a database with missing information about individuals already included in it, using the cross-referencing of data from various sources. |
| Audience Creation | The GDPR does not define audience creation. | A process that enables to target commercial communications to recipients who meet criteria defined by an advertiser (e.g., age, postal code, etc.). |
| Lookalike Audience Creation | The GDPR does not define lookalike audience creation. | A process that enables to create a new database composed by individuals with interests similar to those included in a reference database and sending them commercial communications tailored to their interests. |
Who is Responsible for the Use of Your Data in the Context of Your Relationship with Our Services?
The Wave can take on different roles regarding the processing of your data.
The Data Controller of Your Personal Data
The Data Controller of your personal data is The Wave SA, a company headquartered at rue Middelbourg 66, 1170 Bruxelles, Belgique, and registered with the Crossroads Bank for Enterprises (CBE) under number 0453.138.765.
The Wave processes your personal data as a Data Controller, for example:
- To send you commercial offers on behalf of advertisers, using the communication channels for which you have provided your consent, potentially based on criteria defined by the advertiser;
- To correct or complete a database where your data is already listed, in compliance with Article 6 of the GDPR;
- To create lookalike audiences.
For more details, please see the section: "Why Do We Collect Your Personal Data and On What Legal Basis?"
Joint Data Controllers
The Wave and its partners may act as joint controllers of your personal data in specific cases:
- When you consent, at the time of data collection, for your information to be collected on behalf of a partner (coregistration or co-sponsoring), your data is directly transmitted to that partner.
The list of partners is provided at the time of data collection.
Once transmitted, the partner processes your data in accordance with the purposes stated during the collection.
In this case, each joint controller will inform you of its respective privacy policy at the time of the collection of your data.
You can contact The Wave for any inquiries or to exercise your rights related to the collection of your data made jointly by the Wave and its partners.is joint data collection, you may contact The Wave.
However, once your data has been transmitted to the respective companies, partners, or advertisers, they process your data for their own purposes. At that point, they become the sole controllers for any subsequent processing of your data.
As a result, any requests regarding your GDPR rights for this later stage of processing should be directed to those entities directly.
The list of partners is provided at the time of data collection.
Once transmitted, the partner processes your data in accordance with the purposes stated during the collection.
In this case, each joint controller will inform you of its respective privacy policy at the time of the collection of your data.
You can contact The Wave fFor any inquiries or to exercise your rights related to the collection of your data made jointly by the Wave and its partners.is joint data collection, you may contact The Wave.
You can contact The Wave to exercise your GDPR rights concerning these joint data collection operations.
However, once your data has been transmitted to the respective companies, partners, or advertisers, they process your data for their own purposes. At that point, they become the sole controllers for any subsequent processing of your data.
As a result, any requests regarding your GDPR rights for this later stage of processing should be directed to those entities directly.
- When a third party collects your data and you have consented to have this data shared with The Wave by the data controller of that website:
The website administrator and The Wave act as joint controllers for this data collection activity.
Each entity will inform you of its respective privacy policy.
You can contact The Wave for any inquiries or to exercise your rights You can contact The Wave to exercise your GDPR rights related to this joint collection operation.
- When The Wave and a partner jointly define the criteria for segmenting the partner's database to create audiences
The list of partners jointly processing your data with The Wave is available here
Processor
The Wave may also act as a processor when it processes your personal data on behalf of, for the benefit of, and under the instructions of another company (e.g., a business partner or advertiser).
The Wave provides a range of tools and services to these companies.
When a company uses these tools or services and that it implies the processing by The Wave of your data on behalf of the company, The Wave does so solely as a processor.
The company, partner, or advertiser is the data controller of your data and has the obligation to you directly about the processing of your data and ensuring compliance with legal obligations related to your personal data.
Designation of a Data Protection Officer (DPO)
The Wave has appointed a Data Protection Officer (DPO). The DPO is independently charged with ensuring the internal application of rules related to the protection and management of your personal data.
Collaborating with data protection supervisory authorities.
You can contact our DPO at any time via email at privacy@thewave.digital
Why Do We Collect Your Personal Data and On What Legal Basis?
We collect personal data about you for various reasons. The Wave gathers and uses your personal data to operate efficiently and provide you with the best experiences of its services.
In addition, The Wave can only collect and use your personal data if this processing is based on one of the legal grounds listed by the GDPR, (such as your consent or the execution of a contract with Us)
You can participate in contests without consenting to the processing of your data for purposes other than the organization of the contest. Additionally, you may choose to grant your consent selectively, specifying certain purposes, recipients, and/or communication channels.
The table below outlines the purposes for which The Wave uses your personal data and the corresponding legal basis. When the legal basis is your consent, please note that you can withdraw it at any time (refer to the section "What Are Your Rights Regarding Your Personal Data?").
| Purpose of the processing of Personal Data | Legal Basis for Processing Your Personal Data |
|---|---|
| Contest Organization The data of contest participants areis processed by The Wave to enable your participation in the contest. Ensure the proper management and organization of the contest. Contact winners and efficiently deliver their prizes in case of a win. Communicate the contest results, at the very least. | The processing is based on the execution of a contract concluded with you (Article 6.1.b of the GDPR), specifically a contract for participation in the contest. |
| Managing Contractual Relationships with Our Partners/Suppliers The data of our partners, suppliers, and their staff are processed to execute the partnership, conclude the contract, manage and ensure communication between the contracting parties, and to the services covered by the contract. This also includes, if necessary, recovering unpaid invoices and notifying parties of any changes to the contract or the Data Protection Policy, (particularly regarding new purposes). | The processing is based on the execution of a contract concluded between The Wave and the Partner/Supplier (Article 6.1.b of the GDPR). |
| Compliance with Legal and Regulatory Obligations For example, The Wave is legally required to retain proof of your consent or records of communications related to the exercise of your rights. When you exercise your right to erasure or any other right concerning your data, we keep the data necessary to demonstrate that the erasure has taken place or that we have complied with your request. This data retention is solely for evidentiary purposes and includes only the data strictly necessary to establish proof of the erasure or the response provided by The Wave. | The processing is based on a legal obligation (Article 6.1.c of the GDPR). |
| Commercial Communications by The Wave : | |
| Commercialization of Your Data to enable The Wave to send you commercial Communications If you have provided your consent, your data is collected and processed by The Wave to send you promotional offers related to The Wave or certain partners active in various sectors (e.g., charities, energy, telecommunications such as Proximus, interest groups, and opinion groups). These partners cannot be named at the time of data collection as they are not yet known. This may involve the processing of your data for commercial segmentation based on criteria such as your address or street segment, your language, or your age, etc.. However, The Wave does not use profiling techniques for this purpose. Depending on the communication channels you have consented to, these communications may be sent to you via email, phone, postal mail, or by displaying promotional offers on websites, social networks, and connected TVs. | The processing is based on your consent (Article 6.1.a of the GDPR). |
| Analysis of Clicks and Opening Rates Some stores are equipped with a Smart Box terminal (Smart Traffik technology), indicated by a pictogram displayed in the store window, which detects your visit to the store. This pictogram provides information on how data is processed and also allows you to opt out of the processing of your location data by Smart Traffik. In certain cases, The Wave may receive statistical data regarding the percentage of SMS campaign recipients who visited an advertiser's store. | The processing is based on The Wave's legitimate interest in analyzing opening and click rates from its campaigns (Article 6.1.f of the GDPR). |
| Analysis of Your In-Store Visit After Receiving a Promotional SMS We also process the data necessary to analyze clicks and opening rates following one of our campaigns. This information is essential for reporting to our partners on the effectiveness of the campaign (audience statistics), invoicing for our services, and ensuring that we offer you communications and advertisements tailored to your interests. | The processing is based on your consent (Article 6.1.a of the GDPR). |
| Email retargeting The Wave uses cookies to send you an email after you have visited the website of one of our partners. This is done to invite you to revisit the website or to promote the goods or services offered by the partner. | The processing is based on your consent (Article 6.1.a of the GDPR). |
| Commercial Communications Sent by Third Parties: | |
| Joint Collection for a Partner (Co-registration and Co-sponsoring) If you have provided your consent, The Wave collects your data on behalf of a partner (as a joint controller for the collection process) so that the partner can directly send you commercial offers and special deals via the channel(s) you have authorized (e.g., postal mail, email, phone, SMS, voice messages, or via displays on websites or connected TVs). The data is jointly collected by The Wave and the partner, who is identified at the time of the collection of your consent . Once the collection process is completed, The Wave and the partner are each separate controllers for their subsequent use of your data. | The processing is based on your consent (Article 6.1.a of the GDPR). |
| Commercialization of Your Data for Sending Commercial Communications by The Wave’s Partners If you have provided your consent, your data is collected by The Wave to be transmitted to its partners for limited purposes, such as sending you promotional offers or conducting market analysis for a predefined period. After this period, the partners are required to delete your data unless you have become their customer. These partners, active in various sectors (e.g., charities, energy providers like Proximus, telecommunications, interest and opinion groups), cannot be identified at the time of data collection because they are not yet known. This process may involve the processing of your data for commercial segmentation based on criteria such as your address or street segment, your language, your age, etc. However, The Wave does not use profiling techniques for this purpose. Depending on the communication channels you have consented to, these communications may be sent to you via email, phone, SMS, voice message, postal mail, or by displaying promotional offers on websites and connected TVs The Wave and the partner are separate data controllers for your data. The Wave collects your data for its own purposes of data commercialization, while the partner processes your data for its own marketing purposes. | The processing is based on your consent (Article 6.1.a of the GDPR). |
| Audience Creation for our Partners The Wave may process your data, with your consent, to create groups of recipients for commercial communications from its partners (such as Bpost) or for display on websites or connected TVs. To achieve this purpose, The Wave and its partner may compare their respective databases, which are securely hashed in a protected environment provided by companies such as Liveramp, Infosum, or Proactivity. | The processing is based on your consent (Article 6.1.a of the GDPR). |
| Audience Creation on Social Media Some social networks, such as Facebook, offer a service to create a new group of similar recipients based on a reference group, to whom communications can then be sent. This process may involve sharing your personal data (e.g., your email address) with the social network for comparison purposes. The Wave can then display commercial communications, either on its behalf or on behalf of its partners, to users of the social network who are part of the newly identified recipient group. The Wave, its partner, and the social network are jointly responsible for the data processing related to audience creation. Facebook’s privacy policy of Facebook can be accessed via this link: Facebook Privacy Policy. | The processing is justified by The Wave's legitimate interest in displaying promotional communications to the created audiences (Article 6.1.f of the GDPR). |
| Data Quality / Database Enrichment Your data may also be used to validate, link, complete, or correct data already present in the databases of partners. | The processing is based on your consent (Article 6.1.a of the GDPR). |
| Your data may also be enriched with professional information relating to your profession collected from public sources. | The processing is justified by The Wave's legitimate interest in enriching data using publicly accessible information (Article 6.1.f of the GDPR). |
| Management of Our Social Media Accounts The data you share when visiting our social media pages may be jointly processed by the social network and the administrator of the page, namely The Wave, for the following purposes: Collecting certain data through cookies. Improving the social network’s advertising system. Obtaining statistics on the page's visits. The privacy policies of each social network can be accessed via the following links: | These data will only be processed by the page administrator within the framework of its legitimate interest (Article 6.1.f of the GDPR) to obtain statistics on page visitors to adequately promote the page. The audience statistics provided by the social network are transmitted to the page administrator in an anonymized form. |
| Cookies As part of the management of our web pages, we use what are known as cookies. These are small text files placed on your hard drive by the website you visit. These files allow the website to store and save certain information from your computer, as well as information about you. Some cookies are essential for the functioning of the internet, as they ensure proper communication between computers. Information collected this way can also be used to run applications you use on the website. These essential cookies cannot be refused. The Wave also uses cookies or similar technologies for purposes such as personalized advertising, measuring ad performance, personalized content, audience and statistics analysis, and for the improvement of our service and websites. These non-essential cookies can only be activated with your prior consent. This consent can be withdrawn at any time. For more detailed information, please refer to our Cookie Management Policy. | The use of essential cookies is justified by The Wave's legitimate interest in providing you with a functional website (Article 6.1.f of the GDPR) without requiring your consent. |
What Personal Data Do We Collect About You?
First, the personal data we collect about you depends on the nature and extent of your relationship with The Wave, whether it is contractual legal (e.g., participation in a contest) or not (e.g., visiting our website).
Below, we detail the personal data we collect during each of these interactionsWe detail below the personal data we collect during each of these interactions, for each use we make as well as the purpose of collection, the method of collection (direct or indirect collection, i.e. your data is provided by you directly or provided by a third party to whom you have given permission to transmit your data to The Wave) and the place of processing:
| Purpose of Collection | Personal Data Collected | Direct or Indirect Collection of Personal Data |
|---|---|---|
| Contest Organization | Personal identification data (name, surname, postal address, email address, phone number), electronic identification data (IP address, cookies, connection logs), demographic characteristics (age, gender, date of birth, country, language), contest answers | Data is collected directly from you. |
| Managing Contractual Relationships with Partners/Suppliers | Personal identification data (name, surname, postal address, email address, phone number), professional identification data (organization name, job title, VAT number, etc.), billing data | Data is collected directly from you. |
| Compliance with Legal and Regulatory Obligations | Name, surname, erasure request/right exercise request, date of effective erasure, erasure logs, and any information related to The Wave’s response to your request | Data is collected directly from you. |
| Sending Commercial Communications by The Wave | Personal identification data (name, surname, postal address, email address, phone number), electronic identification data (IP address, cookies, connection logs), demographic characteristics (age, gender, date of birth, country, language), hobbies, interests, household composition, type of residence, current suppliers. | Data is collected directly from you or indirectly through a third party authorized by you to transmit your data to The Wave. |
| Click and Open Rate Analysis | Electronic identification data (IP address, cookies, connection logs) | Data is collected indirectly through tracking technologies (e.g., cookies or pixels) embedded in the content being tracked. |
| In-Store Visit Analysis | Statistics on store visits by recipients of an SMS campaign | Data is collected by a third party via a Smart Box device, marked by a pictogram in the storefront, allowing you to opt out of the processing of your data. |
| Emailing retargeting | Personal identification data (name, surname, postal address, email address, phone number), electronic identification data (IP address, cookies, connection logs), demographic characteristics(age, gender, date of birth, country, language), hobbies, household composition, type of residence, current suppliers | Data is collected directly from you or indirectly through a third party authorized by you to transmit your data to The Wave. |
| Co-registration et co-sponsoring | Personal identification data (name, surname, postal address, email address, phone number), electronic identification data (IP address, cookies, connection logs), demographic characteristics (age, gender, date of birth, country, language), hobbies, household composition, type of residence, current suppliers | Data is collected directly from you. |
| Commercialization of Your Data for Partners’ Direct Communications or Market Analysis | Personal identification data (name, surname, postal address, email address, phone number), demographic characteristics (age, gender, date of birth, country, language), hobbies, household composition, type of residence, current suppliers | Data is collected directly from you. |
| Lookalike Audience Creation | Personal identification data (name, surname, postal address, email address, phone number), membership/non-membership status on the social network | Data is collected directly from you or indirectly through a third party (the social network). |
| Création d’audiences lookalike | Données d’identification personnelles (nom, prénom, adresse postale, numéro de téléphone, adresse mail)Statut de membre/non membre du réseau social | Dans le cadre de cette finalité, les données sont collectées directement auprès de vous ou de manière indirecte via un tiers (le réseau social). |
| Data Quality / Database Enrichment | Personal identification data (name, surname, postal address, email address, phone number), electronic identification data (IP address, cookies, connection logs, identifiers), demographic characteristics(age, gender, date of birth, country, language), hobbies, household composition, type of residence, current suppliers | Data is collected directly from you or indirectly through a third party authorized by you to transmit your data to The Wave. |
| Managing Our Social Media Accounts | Electronic identification data (IP address, cookies, connection logs), data related to your social media account, data related to content sharing or communications with others | Data is collected directly from you or indirectly through a third party (the social network). |
| Cookies | Cookies, User IDs, sites visited | Data collected by cookies is collected directly from you or indirectly through a third party. |
With Whom Do We Share Your Personal Data?
Outre nos partenaires cités au point suivant, dans le cadre de nos activités, il peut nous arriver de partager vos données personnelles avec des prestataires informatiques qui nous aident à fournir nos services d’un point de vue purement technique. Bien évidemment, nous le faisons toujours de manière à garantir une protection optimale de vos données personnelles.
1. With Our Processors
To pursue the processing of described in Section 4, The Wave delegates certain processing tasks to third parties known as processors. These are primarily IT service providers who offer various technical services that enable The Wave to carry out its activities. Here is the list of services provided:
| Processor involved in the processing of your Dataeason for Sharing Your Personal Data | Location of the Processor | Reason for Sharing Your Personal Data |
|---|---|---|
| Emailing Service Providers | France | Emailing |
| Technical Providers for Email Retargeting | France | Email retargeting |
| Database Management Solution Providers | France, Royaume-Uni, Luxembourg | Appending |
| SMS Messaging Providers | France | Messaging |
| Cookie Management by Sirdata Sirdata is a data marketing company that enables its clients to send users relevant offers tailored to their interests. Data collected by Sirdata is retained for a maximum of 365 days, based on the purpose of the processing, in compliance with applicable laws and the principle of data minimization. Learn more. To disable data collection by Sirdata: Click here. | France | Gestion de cookies |
| Data Management Platform (DMP) Providers Services from DMP providers allow The Wave to connect with potential partners interested in your data. These platforms also help locate advertising spaces to display commercial communications from The Wave or its existing partners. | Danemark,Pays-Bas,Royaume-Uni,Luxembourg | Matching, segmentation, audience creation, campaign statistics, and data activation across different media. |
| Data Clean Room Providers Services from Data Clean Rooms providers allow The Wave to connect with potential partners interested in your data. Data clean rooms provide secure environments where anonymized data is shared, allowing collaboration between The Wave and potential partners without granting partners direct access to The Wave's data. This service also facilitates the identification of advertising spaces for displaying commercial communications from The Wave or its existing partners. | France, Royaume-Uni | Création d’audiences et matching |
2. With Partners Who Process Your Data Jointly with Us
As explained above, The Wave and its partners may act as joint controllers for processing your personal data during data collection, segmentation, audience creation, and data activation. Data collected jointly by The Wave and its partners is exchanged between them.
- <b>Sectors of Our Partners</b>:<br>Our partners operate in various sectors, including charities, energy, telecommunications (e.g., Proximus), and interest/opinion groups. Where possible, these are listed by name when we collect your data.
- <b>Unidentified Partners at the Time of Collection:</b><br>If the partners are not known at the time of data collection, they cannot be named at the time of data collection. In that case, they will inform you about how they process your data when they contact you for the first time.
- <b>Identified Partners at the Time of Collection:</b><br>For partners explicitly identified at the time of data collection, you can choose to opt in or opt out of sharing your data with them.
We encourage you to review the data protection policies of these partners, either in the emails they send you or via links provided during data collection.
If you want more information about the joint controllers with whom your data has been shared, feel free to request it following the procedure described here.
3. With Partners to Whom We Transmit Your Data with Your Consent so that they can send you their promotional offers
We may use your personal data for the benefit of our business partners while keeping your data in our possession. These may be frequent partners or other commercial partners. We may also share your data with these partners if you have given your consent.
- Sectors of Our Partners:Our partners operate in various sectors, including charities, energy, telecommunications (e.g., Proximus), and interest/opinion groups. Where possible, these are listed by name when we collect your data.
- Unidentified Partners at the Time of Collection:If the partners are not known at the time of data collection, they cannot be named at the time of data collection. In that case, they will inform you about how they process your data when they contact you for the first time.
Identified Partners at the Time of Collection:
For partners explicitly identified at the time of data collection, you can choose to opt in or opt out of sharing your data with them.
We also recommend reviewing the data protection policies of these partners, either in the emails they send you or via links provided during data collection.
If you want more information about the third parties with whom your data has been shared, you can request it following the procedure described here.
4. With Consultants and Professional Service Providers
We may share your data with consultants and professional service providers such as lawyers, accountants, and auditors for purposes related to legal, financial, and compliance matters.
5. With Public Authorities
We may share your personal data with public authorities in response to legal requests, including those related to national security or law enforcement requirements.
6. In the Context of a Transaction
In the event of a transaction, such as a merger, acquisition, consolidation, or asset sale, we may share your personal data with buyers or sellers involved in the transaction.
Do We Use Commericalise Your Personal Data?
With your prior authorization, we use commercialise your personal data for the benefit of our partners, companies, or advertisers.
Our partners may include data brokers or the direct issuers of offers or market analyses. They operate in various sectors, including:
- Energy (e.g., Proximus)
- Charitable or associative organizations
- Public sector entities
- Interest and opinion groups
We may share your data with companies or advertisers who will then contact you. Whenever possible, these entities are explicitly listed at the time of data collection. We encourage you to review their data protection policies, which are often included in the emails they send you or via links provided during data collection.
We may also process your personal data for the benefit of our commercial partners listed above, while retaining possession of your data. These partners may be regular collaborators or other commercial entities, charitable organizations, associative groups, public sector bodies, and interest/opinion groups.
You can withdraw your consent, in whole or in part, at any time by following the procedures outlined in this charter.
How Long Do We Retain Your Personal Data?
The Wave retains your personal data for as long as necessary to fulfill the purpose for which it was collected.
Data Retention Periods by Purpose of Collection
| Purpose of Data Collection | Retention Period |
|---|---|
| Contest Organization | Data is retained for 10 years from the end of the contest for liability purposes. |
| Managing Contractual Relationships with Partners/Suppliers | Data is retained for 10 years from the end of the contract for liability purposes. |
| Compliance with Legal and Regulatory Obligations | Data is retained for the legally mandated period. If no specific duration is provided, data is retained for 10 years for liability purposes. |
| Sending Commercial Communications by The Wave | Data is retained until you request that we stop processing it or until you withdraw your consent. |
| Click and Open Rate Analysis | Data is immediately anonymized and used for statistical or billing purposes. |
| In-Store Visit Statistics | Not applicable (The Wave only receives aggregated statistics that do not contain personal data). |
| Email retargeting | Data is retained in accordance with the cookie policy, or until you request that we stop processing it or withdraw your consent. |
| Co-registration and co-sponsoring. | Data is retained by the partner you consented to share your data with, in accordance with their data protection policy. Data is not retained by The Wave after collection. |
| Commercialization of Your Data for Partners’ Communications | Data is retained by the partner for a very short period as defined contractually by The Wave. Data is retained by The Wave until you request cessation or withdraw your consent. |
| Audience Creation for Our Partners | Data is retained until you request that we stop processing it or withdraw your consent. |
| Lookalike Audience Creation | Data is retained until you request that we stop processing it or withdraw your consent. |
| Data Quality/Database Enrichment | Data is retained until you request that we stop processing it or withdraw your consent. |
| Managing Our Social Media Accounts | Data is processed as long as our social media pages exist and you continue to visit them. |
| Cookies | Cookie retention periods are defined in the Cookie Policy. |
What Are Your Rights Regarding Your Personal Data and How Can You Exercise Them?
We want to inform you as clearly as possible about the rights you have concerning your personal data and to enable you to exercise these rights easily.
The Wave makes every effort to answer your requests to exercise your rights as the data controller.
When The Wave processes your data on behalf of a company, partner, or advertiser (as a processor or joint controller), you can still submit a request to exercise your rights through The Wave. In such cases, The Wave will handle your request directly or forward it to the appropriate data controller, who is legally required to act on it.
You will find below a summary of your rights and a description of how to exercise them.
Right of Access
You have the right to request access to the following information regarding your personal data:
- Categories of Personal Data: The types of personal data we collect about you.
- Purposes of Use: The reasons why we use your personal data.
- Recipients of Your Data: The categories of individuals or entities to whom your personal data has been or will be disclosed, especially those outside of Europe.
- Data Retention Period: The length of time your personal data will be stored in our systems.
- Your Rights: Your rights to request correction, erasure, restriction, or objection to the processing of your personal data.
- Complaint Filing: Your right to lodge a complaint with a European data protection authority.
- Data Source Information: Details about the source of your data if we did not collect it directly from you.
- International Transfers: How your personal data is protected when transferred to countries outside the European Economic Area.
How to Exercise Your Right of Access?
To do so, simply contact us via email atprivacy@thewave.digital or by postal mail at the address below: rue Middelbourg 66, 1170 Bruxelles, Belgique.
If you send your request by email, and unless you specify otherwise, you will receive the requested information in an electronic format. If you send your request by postal mail, please indicate the address where the response should be sent.
An answer will be provided within 1 month of receiving the request. This period may be extended by 2 months if the request requires extensive research or if there are a large number of requests. You will be informed if this is the case.
You can also directly consult your personal data at any time by clicking on a dedicated hyperlink provided in the messages we send you, allowing access to your Privacy Dashboard.
The Right to Rectification
You can request that The Wave correct and/or update your personal data.
How to Exercise Your Right to Rectification?
To do so, simply contact us via email atprivacy@thewave.digital or by postal mail at the address below: rue Middelbourg 66, 1170 Bruxelles, Belgique.
If you send your request by email, and unless you specify otherwise, you will receive the response in an electronic format. If you send your request by postal mail, please specify the address where the response should be sent.
An answer will be provided within 1 month of receiving the request. This period may be extended by 2 months if the request requires extensive research or if there are a large number of requests. You will be informed if this is the case.
You can also directly consult and update your personal data at any time by clicking on a dedicated hyperlink provided in the messages we send you, granting access to your Privacy Dashboard.
The Right to Erasure (Right to Be Forgotten)
You can contact us at any time to request the deletion of personal data we process about you if one of the following applies:
Your personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
You have withdrawn your consent on which the processing of your personal data by The Wave was based.
For a personal reason, you believe that a specific processing activity infringes your privacy and causes you excessive harm.
You no longer wish to receive commercial solicitations from us.
Your personal data is not being processed in compliance with the GDPR or Belgian law.
Your personal data must be deleted to comply with a legal obligation under European Union law or national law applicable to The Wave.
How to Exercise Your Right to Erasure?
To request the deletion of your personal data, simply contact us via email at privacy@thewave.digital or by postal mail at the address below: rue Middelbourg 66, 1170 Bruxelles, Belgique
If you send your request by email, and unless you specify otherwise, you will receive the response in an electronic format. If you send your request by postal mail, please specify the address where the response should be sent.
A response will be provided within 1 month of receiving the request. This period may be extended by 2 months if the request requires extensive research or if there are a large number of requests. You will be informed if this is the case.
You can also consult and manage your personal data directly at any time by clicking on a hyperlink provided in the messages we send you, allowing access to your Privacy Dashboard.
Once your request is processed, your personal data will no longer be shared with our partners. However, if you request erasure after having directly accepted offers from third parties, your request will only apply going forward.
The Right to Object
You have the right to object to the processing of your personal data if, for personal reasons, you believe that a specific processing activity infringes your privacy and causes you excessive harm. You can also object to the use of your personal data for commercial solicitations, particularly advertising activities.
If you object to such processing, this also includes profiling to the extent that it is related to such solicitations (e.g., when we send you personalized content).
However, you cannot prevent us from processing your data in the following cases:
- If the processing is necessary for the conclusion or execution of your contract (e.g., validating your participation in our contests).
- If the processing is required by law or regulation.
- If the processing is necessary to establish, exercise, or defend legal claims.
How to Exercise Your Right to Object?
You can exercise this right by contacting us via email at privacy@thewave.digital or by postal mail at the address below: rue Middelbourg 66, 1170 Bruxelles, Belgique
If you send your request by email, and unless you specify otherwise, you will receive the response in an electronic format. If you send your request by postal mail, please specify the address where the response should be sent.
A response will be provided within 1 month of receiving the request. This period may be extended by 2 months if the request requires extensive research or if there are a large number of requests. You will be informed if this is the case.
You can also directly manage your personal data and preferences at any time by clicking on the hyperlink provided in our messages, which grants you access to your Privacy Dashboard.
Additional Information
- Emails or newsletters sent to you will include a link that allows you to opt out of receiving promotional information from The Wave.
- Regarding your right to object to commercial solicitations or withdraw consent for such purposes, please note that our commercial partners are responsible for the use of your personal data and respecting your rights, including the right to no longer receive offers from them.
You can modify your preferences for The Wave’s platforms at any time within your Privacy Dashboard under the section dedicated to managing offers from third parties. Your data will no longer be shared with our partners once your request is processed. However, your request will only apply going forward.
The Right to Withdraw Consent
When you have given your consent for the processing of your data, you have the right to withdraw it at any time and at no cost. The withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.
Specifically, regarding the withdrawal of your consent for processing related to commercial prospecting, please note that our commercial partners are responsible for their use of your personal data and for respecting your rights, including your right to no longer receive offers from them.
How to Exercise Your Right to Withdraw Consent?
To do so, simply contact us via email at privacy@thewave.digital or by postal mail at the address below: rue Middelbourg 66, 1170 Bruxelles, Belgique.
If you send your request by email, and unless you specify otherwise, you will receive the response in an electronic format. If you send your request by postal mail, please specify the address where the response should be sent.
A response will be provided within 1 month of receiving the request. This period may be extended by 2 months if the request requires extensive research or if there are a large number of requests. You will be informed if this is the case.
You can also manage your personal data directly at any time by clicking on the hyperlink provided in the messages we send you, which gives you access to your Privacy Dashboard.
Your personal data will no longer be shared with our partners from the moment your consent withdrawal request is processed. However, if your consent withdrawal occurs after accepting offers from third parties, your request will only apply to future actions.
The Right to Data Portability
This right allows you to have greater control over your personal data by:
- Retrieving your personal data processed by us for your personal use, such as storing it on a device or private cloud.
- Transferring your personal data from us to another company, either by yourself or directly by us, provided such a transfer is technically feasible.
This right applies to both:
- Data you have actively and consciously provided us with, such as during contest participation (e.g., email address, name, surname, age).
- Data collected by The Wave.
How to Exercise Your Right to Portability?
You can exercise this right by contacting us via email at privacy@thewave.digital or by postal mail at the address below: rue Middelbourg 66, 1170 Bruxelles, Belgique.
If you send your request by email, and unless you specify otherwise, you will receive the requested information in an electronic format. If you send your request by postal mail, please specify the address where the response should be sent.
A response will be provided within 1 month of receiving the request. This period may be extended by 2 months if the request requires extensive research or if there are a large number of requests. You will be informed if this is the case.
Exceptions to the Right of Portability
The Wave may deny your portability request under certain circumstances:
This right applies only to personal data based on your consent or on the execution of a contract concluded with you. For more details on the data subject to this right, see the "Purposes and Legal Basis" section.
This right must not infringe on the rights and freedoms of third parties whose data might be included in the information transmitted following your portability request.
The Right to Restriction of Processing
You have the right to request that we limit the processing of your personal data. This involves marking your data (e.g., temporarily moving it to another processing system or locking it to make it inaccessible) to restrict its future processing.
You can exercise this right in the following cases:
- The accuracy of the data in question is disputed.
- Your personal data is not being processed in compliance with the GDPR or Belgian law.
- The data is no longer necessary for the purposes initially intended but cannot yet be deleted for legal reasons (e.g., to establish, exercise, or defend your legal rights).
- A decision regarding your objection to processing is pending.
What Happens During Restriction?
While processing is restricted, your personal data will not be processed in any way without your prior consent, except for storage purposes.
However, your data may still be processed for the following purposes:
- To establish, exercise, or defend legal claims.
- To protect the rights of another legal or natural person.
- For important public interest reasons in the Union or Member State.
If the restriction of some of your personal data is lifted, we will notify you in advance.
How to Exercise Your Right to Restriction?
To request the restriction of processing your data, contact us via email at privacy@thewave.digital or by postal mail at the address below: rue Middelbourg 66, 1170 Bruxelles, Belgique.
If you send your request by email, and unless you specify otherwise, you will receive the response in an electronic format. If you send your request by postal mail, please specify the address where the response should be sent.
A response will be provided within 1 month of receiving the request. This period may be extended by 2 months if the request requires extensive research or if there are a large number of requests. You will be informed if this is the case.
Are Your Personal Data Transferred Abroad?
Data Transfers Within Europe
Yes, some data is transferred to our processors located in or with servers within the European Economic Area (EEA). Within the EEA (the 27 EU Member States, Iceland, Norway, and Liechtenstein), personal data is subject to the same level of protection.
Data Transfers Outside of Europe
The Wave generally does not transfer your data outside the EEA, except in the following cases:
- To a Service Provider in the United Kingdom:The UK is recognized as providing an adequate level of data protection.
- Occasional Transfers Outside the EEA: On rare occasions, The Wave may:
- Use a processor located outside the EU.
- Share your data with a partner headquartered outside Europe, intending to send you communications about commercial activities in Europe.
In all cases, The Wave ensures that:
- Adequate Protection Is Guaranteed:<br>The processor/partner is based in a country recognized by a European Commission adequacy decision as offering a sufficient level of personal data protection (e.g., the UK or U.S. companies compliant with the Privacy Frameworks).
- Appropriate Safeguards Are Applied:<br>If no adequacy decision applies, the transfer is governed by the European Commission’s Standard Contractual Clauses (SCCs) and additional appropriate safeguards, which can be provided upon request.
Do You Want to Contact Us About This Data Protection Charter and/or File a Complaint with a Data Protection Authority?
If you have any questions or suggestions regarding this Data Protection Charter, feel free to reach out to us:
- By email: privacy@thewave.digital
- By mail: The Wave Attn: Louis RAES rue Middelbourg 66, 1170 Bruxelles, Belgique
We would be delighted to hear from you and will respond as soon as possible.
Filing a Complaint
You can also file a complaint with the Belgian Data Protection Authority at:
- Address: Rue de la Presse, 35 – 1000 Brussels, Belgium
- Phone: +32 2 274 48 00
- Website: https://www.autoriteprotectiondonnees.be/citoyen/agir/introduire-une-plainte
How Will You Know if This Data Protection Charter Has Been Updated?
This Data Protection Charter may be modified at any time, particularly to reflect legislative or regulatory changes or updates to our services. Any significant changes will be notified via our website or by email, wherever possible, at least thirty days before they take effect.
When changes to this Charter are published, we will:
Update the "last updated" date at the top of the privacy policy.
Describe the changes on the "Change History" page.
We encourage you to review this Charter regularly to stay informed about how The Wave protects your personal data.
Third-Party Websites
Our websites may contain hyperlinks to third-party websites and related information. If these are not operated by The Wave, we have no control over these websites and are not responsible for their privacy policies. We encourage you to review the privacy policies of these third-party websites.