Privacy Policy
Last updated: 5 October 2026
1. Introduction
Wavertech Ltd. (“Wavertech”, “we”, “us” or “our”) is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose and protect personal data when you visit wavertech.com and docs.wavertech.com, purchase products from our online store, contact us, or interact with us as a customer, partner or supplier.
This Privacy Policy does not apply to:
- WAVER+ and PointX CM, which are governed by their own privacy policies; or
- personal data processed on WAVER devices by their operators, such as guest WiFi data. Each operator acts as the controller of that data and is responsible for informing its own users.
2. Data Controller
The controller responsible for the processing of your personal data is:
Wavertech Ltd.
Vasil Mechkuevski 22, 2700 Blagoevgrad, Bulgaria
UIC (EIK): 204530090 · VAT: BG204530090
Email: [email protected]
Telephone: +359 249 12399
3. Personal Data We Process and Legal Bases
We process personal data only for specified purposes and on a lawful basis under Article 6(1) of the General Data Protection Regulation (EU) 2016/679 (“GDPR”).
| Purpose | Categories of personal data | Legal basis |
|---|---|---|
| Processing and fulfilling orders, including delivery, warranty and returns | Name, company name, VAT number, billing and delivery address, email address, telephone number, order details | Performance of a contract (Art. 6(1)(b)) |
| Invoicing, accounting and tax compliance | Billing and order details | Legal obligation (Art. 6(1)(c)) |
| Responding to enquiries and providing technical support | Name, contact details, correspondence, device serial numbers | Contract or pre-contractual steps (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Managing relationships with partners, resellers and suppliers | Business contact details, correspondence | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Sending newsletters and product updates | Email address | Consent (Art. 6(1)(a)) |
| Website analytics and advertising measurement | Cookie identifiers, IP address, browsing data | Consent (Art. 6(1)(a)) |
| Securing our websites and preventing fraud and abuse | IP address, server and security logs | Legitimate interests (Art. 6(1)(f)) |
| Referencing customers in our customer lists | Company name and logo | Legitimate interests (Art. 6(1)(f)) |
| Establishing, exercising or defending legal claims | Relevant records | Legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, those interests are the secure and efficient operation of our business, responding to business enquiries, demonstrating the use of our products and protecting our legal rights.
We do not store or process payment card data. Payments are processed directly by our payment service providers.
The personal data required to process an order is necessary for the conclusion and performance of the contract; without it, we are unable to fulfil your order. The provision of any other personal data is voluntary. We do not carry out automated decision-making, including profiling, within the meaning of Article 22 GDPR.
4. Recipients of Personal Data
We do not sell personal data. We disclose personal data only to the extent necessary for the purposes described above, to the following categories of recipients:
- hosting, content delivery and security providers, including Cloudflare;
- payment service providers, including Stripe;
- our fulfilment warehouse and delivery carriers, including DHL, FedEx, DPD and GLS;
- analytics and advertising providers (Google), subject to your consent;
- email service providers;
- our accountants, legal advisers and auditors; and
- public authorities, where required by law.
Our service providers process personal data on our behalf under data processing agreements, except where they act as independent controllers, for example payment service providers and carriers in respect of their own legal obligations.
5. International Data Transfers
Some of our service providers, including Google and Cloudflare, may process personal data outside the European Economic Area, in particular in the United States. In such cases, we ensure an adequate level of protection through the EU–US Data Privacy Framework, where the recipient is certified under it, or through the Standard Contractual Clauses adopted by the European Commission. A copy of the relevant safeguards is available on request.
6. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law:
- invoices and accounting records: for the periods prescribed by Bulgarian accounting and tax legislation;
- order, warranty and support records: up to five (5) years after the order or support case is closed;
- enquiries that do not result in an order: two (2) years after our last communication;
- newsletter subscriptions: until you unsubscribe or withdraw your consent; and
- cookie data: as specified in our Cookie Policy.
Upon expiry of these periods, personal data is deleted or anonymised.
7. Cookies
Our websites use cookies and similar technologies. Non-essential cookies, including analytics and advertising cookies, are used only with your prior consent, which you may withdraw at any time via the “Cookie settings” option. Further information is available in our Cookie Policy.
8. Your Rights
Subject to the conditions set out in the GDPR, you have the right to:
- access your personal data (Art. 15);
- have inaccurate personal data rectified (Art. 16);
- have your personal data erased (Art. 17);
- restrict the processing of your personal data (Art. 18);
- receive your personal data in a portable format (Art. 20);
- object at any time to processing based on legitimate interests and to direct marketing (Art. 21); and
- withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal (Art. 7(3)).
To exercise any of these rights, please contact us at [email protected]. We will respond within one month of receiving your request and may ask you to verify your identity.
9. Right to Lodge a Complaint
You have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни), www.cpdp.bg, or with the supervisory authority of the EU Member State in which you habitually reside or work.
10. Data Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration and disclosure.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. The current version is always available on this page, and the date of the latest revision is shown at the top. If you have any questions about this Privacy Policy, please contact us at [email protected].