Privacy Notice

Last updated: 5 November 2026

Introduction

Wavecast Pro Ltd (“Wavecast”, “we”, “us” or “our”) is a company registered in England and Wales under company number 08114530, with its registered office at 260/8 Chapel Street, Salford, Manchester, M3 5JZ.

This Privacy Notice explains how we collect, use, store and share personal data when we act as a data controller.

Wavecast provides technology and services that help organisations plan, deliver, publish and manage live and recorded content, events, audience communications and related digital experiences.

Our business clients may use Wavecast services and technologies to manage registrations, audiences, communications, broadcasts, events, content, replays, memberships and integrations with other business systems.

In many cases, when we process personal data through our services on behalf of a client, that client is the data controller and Wavecast acts as its data processor. In those circumstances, the client’s privacy notice will explain how and why your personal data is being processed. Wavecast processes that information in accordance with the client’s instructions, our agreement with the client and applicable data protection law.

Contacting Us

If you have questions about this Privacy Notice or would like to exercise your data protection rights, please contact us via https://marketing.wavecast.io/contact-us

Please state that your enquiry relates to privacy or a Data Subject Request so that it can be directed appropriately.

Personal data we collect

The personal data we process depends on how you interact with Wavecast and how our clients use our services.

This may include:

• your name and contact details;
• your organisation, job title and professional information;
• registration and account details;
• event attendance and participation information;
• communication preferences;
• information you submit through forms, surveys or questionnaires;
• information relating to content you view or interact with;
• device, browser and technical information;
• website usage information;
• communications you send to us;
• service, contract and billing information;
• information received through integrations with authorised third-party platforms; and
• other information you choose to provide.

Where our services are used by a client, additional information may be processed on that client’s behalf according to the configuration of their Wavecast service.

How do we use personal data?

If you visit our website

When you visit our website, we may process information about your device, browser, pages visited, interactions and timestamps.

We use this information to operate, secure, monitor and improve our website and services and to understand how they are being used.

Where appropriate, we rely on our legitimate interests in managing and improving our business and services.

Website analytics data is generally retained for up to six months unless a longer period is reasonably required for security, legal or operational purposes.

Our websites may also use cookies and similar technologies. Please refer to our Cookie Notice for further information.

If you contact us

If you send us a message, make an enquiry or otherwise communicate with us, we will process the information you provide so that we can respond to you and manage any subsequent correspondence.

We generally retain this information for up to six months after the conversation ends, unless it forms part of an ongoing client, supplier, contractual or legal relationship.

If you subscribe to or purchase our services

If you subscribe to our services, either personally or on behalf of an organisation, we may process your:

• contact information;
• organisation details;
• role and professional information;
• service requirements and preferences;
• account information;
• contractual information; and
• communications with us.

We process this information to establish and manage our business relationship, provide our services, administer accounts and contracts, provide support and meet our legal obligations.

We may retain relevant contractual and account information for up to six years following the end of the relevant contract where this is necessary to manage contractual, financial or legal matters.

If your organisation helps us deliver our services

If you work for a supplier, production partner, contractor, venue, technology provider or other organisation involved in delivering our services, we may process your business contact information and relevant professional details.

We do this where necessary for our legitimate interests in managing our operations, suppliers and business relationships.

Relevant business records may be retained for up to ten years following the last substantive business interaction where reasonably necessary to maintain records of our working relationship.

If you apply to work with us

If you apply for employment or other work with Wavecast, we will process information about your professional background, qualifications, experience and application.

We process this information for the purpose of considering whether to enter into an employment or contractual relationship with you.

If your application is unsuccessful, we will normally retain your information for up to six months after the recruitment process ends, unless you agree that we may retain it for longer in relation to future opportunities.

If you join Wavecast, our internal privacy arrangements for colleagues will apply.

When we process data for our clients

Wavecast frequently processes personal data on behalf of business clients.

For example, a client may use Wavecast to:

• manage event registrations;
• communicate with delegates or customers;
• deliver live or recorded broadcasts;
• operate event websites or media hubs;
• manage speakers, sponsors or participants;
• publish replay content;
• collect survey or engagement information;
• analyse event or content performance; or
• connect Wavecast to the client’s CRM, marketing, communications or other business systems.

In these circumstances, the client will normally determine why the information is processed and how it is used.

The client is therefore normally the data controller and Wavecast acts as a data processor.

We process this personal data only for the purpose of providing our services, in accordance with our client’s documented instructions and our contractual obligations.

If you wish to exercise your rights in relation to personal data held by one of our clients, you should normally contact that organisation directly. Where appropriate, we will assist our client in responding to your request.

Third-party platforms and integrations

Wavecast services may connect with third-party services selected or authorised by our clients.

These may include:

• customer relationship management systems;
• marketing automation platforms;
• advertising platforms;
• social media services;
• webinar and video platforms;
• email and communications platforms;
• identity and authentication services;
• audience and registration systems; and
• other business applications.

Where an authorised user connects a third-party platform to Wavecast, we may receive data from that platform or send data to it as required to provide the requested integration.

The data processed will depend on the service, the integration, the permissions granted and the way the client has configured Wavecast.

We do not use information obtained through a third-party integration for purposes that are unrelated to providing our services, except where we are required to do so by law.

LinkedIn integrations

Where available and where authorised by a client, Wavecast services may integrate with LinkedIn.

An authorised client user may connect an eligible LinkedIn account, organisation or advertising account to Wavecast so that information made available through LinkedIn’s APIs can be used within the client’s authorised workflow.

Depending on the integration and permissions granted, Wavecast may process information including:

• LinkedIn Lead Gen Form details;
• responses submitted through LinkedIn Lead Gen Forms;
• names;
• business contact details;
• organisation names;
• job titles;
• answers provided through form fields or custom questions;
• consent information associated with a form;
• campaign, form or advertising account identifiers;
• organisation identifiers; and
• technical information required to operate and maintain the integration.

Wavecast may process this information on behalf of a client to:

• create or update event or audience registrations;
• transfer leads into an authorised CRM or marketing automation system;
• manage delegate or audience communications;
• support marketing and event workflows;
• route enquiries or registrations appropriately;
• maintain records relating to the relevant campaign or event;
• measure the operation or performance of the integration; and
• provide related reporting and support.

Wavecast does not sell personal data received through LinkedIn APIs.

We do not use LinkedIn-derived personal data for unrelated Wavecast marketing or to create independent profiles of LinkedIn members.

Where Wavecast receives LinkedIn Lead Gen Form information on behalf of a client, that client will normally be the data controller and Wavecast will act as its data processor.

The relevant client’s privacy notice and the information presented in or alongside the LinkedIn Lead Gen Form should explain the client’s purposes for collecting and using that information.

Connecting LinkedIn accounts

A LinkedIn integration may require an authorised user to authenticate with LinkedIn and grant Wavecast specific permissions.

Wavecast will only request access necessary to provide the relevant integration.

The permissions requested and information accessed may vary according to the services being enabled.

Access may be subject to LinkedIn’s own account permissions, organisation roles, advertising account roles and API requirements.

Disconnecting LinkedIn

An authorised user may disconnect an integration or withdraw Wavecast’s access to a connected LinkedIn service.

Disconnecting an integration will prevent Wavecast from obtaining new information through that connection, subject to any technical processing already underway.

Information previously received through the integration may continue to be retained where necessary to provide the client’s services, maintain required business records, respond to data subject requests or meet contractual, regulatory or legal requirements.

Where applicable, personal data will otherwise be deleted in accordance with our retention arrangements, our client’s instructions and applicable law.

How we share personal data

We do not sell or trade personal data.

We may share personal data where reasonably necessary with:

• the Wavecast client responsible for the relevant service;
• technology providers and subprocessors that help us provide our services;
• hosting, cloud infrastructure and communications providers;
• authorised integration providers;
• professional advisers;
• regulators, courts, law enforcement agencies or public authorities where required by law; and
• parties involved in a corporate transaction such as a merger, acquisition, restructuring or sale of assets.

Where third parties process personal data on our behalf, we require appropriate contractual and data protection arrangements.

When Wavecast acts as a processor, personal data is shared or transferred only in accordance with our client’s instructions and our contractual obligations, except where otherwise required by law.

International transfers

Wavecast operates services for clients internationally and may use service providers that process data in different countries.

Where personal data is transferred outside the United Kingdom or another jurisdiction that provides an equivalent level of protection, we take appropriate steps to protect that information as required by applicable data protection law.

These measures may include appropriate contractual safeguards, approved data transfer mechanisms and technical and organisational security controls.

How we protect personal data

We maintain technical and organisational measures designed to protect personal data against:

• unauthorised access;
• loss;
• misuse;
• alteration;
• disclosure; and
• destruction.

Access to personal data is restricted to people and service providers who require access for legitimate business or service-delivery purposes.

Our security arrangements include appropriate access controls, authentication, system monitoring and operational security measures proportionate to the nature of the information being processed.

No system can guarantee absolute security, but we continually assess and improve the measures used to protect information processed through our services.

How long we keep personal data

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including providing services, fulfilling contractual obligations and satisfying legal, accounting, regulatory or reporting requirements.

Retention periods vary according to the nature of the information and the context in which we process it.

Where we act as a processor for a client, retention will normally be determined by the client’s instructions and our agreement with that client.

When an integration is disconnected, a service ends or information is otherwise no longer required, we will delete or anonymise personal data when appropriate, subject to:

• our client’s instructions;
• contractual requirements;
• data subject requests;
• applicable platform requirements; and
• any legal obligation or legitimate requirement to retain the information.

Where data has been received through an API or third-party integration, our systems and processes are designed to allow relevant information to be identified and managed in accordance with applicable deletion requirements.

Legal claims and regulatory requirements

If information is relevant to an existing or reasonably anticipated legal claim, dispute, investigation or regulatory matter, we may retain it where necessary to establish, exercise or defend legal rights or comply with legal obligations.

Where appropriate, this information may be retained for six years following the relevant event or until two years after the conclusion of relevant proceedings, whichever is later.

Your Rights

Where Wavecast acts as the data controller, depending on the circumstances and applicable law, you may have the right to ask us to:

• tell you whether and how we process your personal data;
• provide you with a copy of your personal data;
• correct inaccurate or incomplete information;
• erase your personal data;
• restrict the way your personal data is processed;
• object to certain processing, including direct marketing;
• provide your data in a portable format where applicable;
• withdraw consent where processing is based on consent; and
• explain and request human review of certain automated decisions where applicable.

These rights are not absolute and may be subject to legal exemptions.

Before responding to a request, we may need to verify your identity to protect your information.

We will normally respond within one month of receiving a valid request, although additional time may be permitted where a request is particularly complex.

We do not normally charge a fee for exercising data protection rights, although applicable law may allow us to do so in limited circumstances.

To exercise your rights, please contact us via https://marketing.wavecast.io/contact-us and state that you are making a Data Subject Request.

Requests relating to our clients

Where Wavecast processes your information solely on behalf of one of our clients, that client is normally responsible for responding to your request.

You may therefore be directed to contact the relevant client.

If we receive a request concerning data for which one of our clients is the controller, we will handle that request in accordance with our obligations to that client and applicable data protection law.

Marketing

Where Wavecast sends marketing communications about our own services, we will do so in accordance with applicable marketing and data protection laws.

You may opt out of Wavecast marketing communications at any time using the unsubscribe mechanism included in the communication or by contacting us.

Where Wavecast sends communications on behalf of one of our clients, the client determines the purpose and lawful basis for those communications.

Automated decision-making

Wavecast does not ordinarily make decisions about individuals that produce legal or similarly significant effects based solely on automated processing.

If this changes in relation to processing for which Wavecast is the controller, we will provide the information and safeguards required by applicable law.

Our clients may configure their own workflows or use third-party services alongside Wavecast. Where a client is the controller, its own privacy notice should explain any relevant automated decision-making.

Third-party websites

Our websites and services may contain links to websites or services operated by other organisations.

If you follow one of these links, the other organisation’s privacy notice will apply to its processing of your personal data.

Wavecast is not responsible for the privacy practices of independent third-party websites or services.

Complaints

If you are concerned about how we have handled your personal data, please contact us first so that we have an opportunity to investigate and resolve the matter.

You also have the right to complain to the UK Information Commissioner’s Office.

Further information is available at ico.org.uk.

If you are located outside the United Kingdom, you may also have the right to complain to the data protection authority responsible for your jurisdiction.

Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes to our services, integrations, legal obligations or data processing practices.

The date at the top of this page shows when this Privacy Notice was last updated.

Where a change materially affects the way we process personal data, we will take reasonable steps to notify affected individuals or clients where required.