Contact
+39 02 36714501
Follow us:
Request a Demo
Tel: +39 02 36714501
Follow us:
Request a Demo
Request a Demo

PRIVACY POLICY

I – GENERAL INFORMATION 

General information

  • WaveUp Globe S.r.l. recognizes the importance of protecting the personal data of natural persons and therefore considers their protection to be a fundamental element of its business activities. Accordingly, it ensures that data are processed in compliance with the applicable legislation.
  • This section contains information regarding the processing of personal data (the “Privacy Notice”) of persons who access and browse the website https://wavup.com (the “Website”) of WaveUp Globe S.r.l. (“WAVUP Export Made Easy”).
  • This Privacy Notice is also provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR - General Data Protection Regulation),concerning the protection of the personal data of natural persons (“Data Subject/Data Subjects”) who interact with the Website and with the services of WaveUp Globe S.r.l. accessible electronically. The purpose of this Privacy Notice is therefore to inform Data Subjects about the processing of data following access to the Website, the types of data processed, and the periods for which such data are retained by the Data Controller.
  • The Website is intended exclusively for persons of legal age. By accessing the Website and providing data, users declare that they are of legal age. Should data relating to minors be collected inadvertently, such data will be promptly deleted.
  • This Privacy Notice applies solely to the Website and not to any other websites that may be accessed through links by users visiting the Website.
  • No fully automated decision-making processes, including profiling, are used where such processes produce legal effects concerning the persons providing the data (Article 22 GDPR).

II – PARTIES INVOLVED IN THE DATA PROCESSING

Data Controller

  • The Data Controller (“Data Controller”) is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
  • With reference to the Website, the Data Controller is WaveUp Globe S.r.l., with registered office in Milan (MI), 20121, Via San Raffaele 1, Italy.
  • Pursuant to Article 32 of the GDPR, the Data Controller is required to identify and adopt appropriate technical and organisational measures to ensure a level of security of personal data appropriate to the risk arising from the processing operations carried out, as well as consistent with the specific circumstances of the case.
  • Data Subjects may contact the Data Controller for any clarification or to exercise the rights granted to them under Articles 15–22 of Regulation (EU) 2016/679, using the following contact details:

email: mailto:info@waveupglobe.com

Tel.: +39 02 36714501

  • The Data Processor (“Data Processor”) is the natural or legal person, public authority, agency or other body which processes personal data on behalf of the Data Controller, hosting provider, cloud providerCRM provider, IT consultants, provider payment provider, provider or telephone service provider.
  • In carrying out personal data processing activities connected with the management of the Website, the Data Controller makes use of services provided by third parties that process data on its behalf. Such parties have been formally appointed as Data Processors pursuant to Article 28 of the GDPR.

Personal data may be disclosed, within the limits of the Purposes, to parties authorised by the Data Controller, to Data Processors appointed pursuant to Article 28 of the GDPR, to professional advisers, IT service providers, hosting providers, payment providers, banking institutions, as well as to public authorities in the cases provided for by law.

III – PLACE OF DATA PROCESSING

  • Personal data are recorded and stored in electronic databases owned by the Data Controller or, where applicable, by the Data Processors.
  • Processing operations connected with the management of the Website are carried out at the Data Controller’s registered office, as well as at the premises of third parties providing services essential to the operation of the Website (such as, for example, the hosting service provider).

DATA PROCESSED DATI TRATTATI

Types of data processed:

  • Log files (Browsing data).
    The IT systems and software procedures used to operate the Website collect certain personal data whose transmission is implicit in the use of Internet communication protocols. Such data may include, for example, the IP address, the domain names of the devices used by the Data Subject, the time of the request, the method used to submit the request to the server, and other parameters relating to the Data Subject’s operating system and IT environment.
    Browsing data may include data relating to the browser and other technical identifiers collected automatically while browsing the Website. Such data are processed in order to ensure the proper functioning of the Website, guarantee the security of IT systems, carry out technical maintenance activities, prevent unlawful or fraudulent use, and obtain aggregated statistical information regarding the use of the Website. The processing of such data is based on the Data Controller’s legitimate interest pursuant to Article 6(1)(f) of the GDPR. The data are retained for the period strictly necessary to pursue the relevant Purposes and in compliance with the retention periods provided for under applicable legislation.

  • Data voluntarily provided by users accessing the Website..
    Through the Website, the following personal data may also be collected and subsequently processed by the Data Controller and the Data Processors:

    • First name, last name and/or e-mail address (only if voluntarily provided by the Data Subject), for example by sending an e-mail to the Data Controller or by completing the contact form.
    • Additional personal data relating to the User (only if voluntarily provided by the Data Subject).
    • Any other data provided for marketing purposes, such as profession, areas of interest, position held within the company, and job title.
  • Data provided when requesting a demo of the services.
    Where the Data Subject requests a demo of the services offered by the Data Controller through the dedicated form available on the Website, identification and contact data may be collected, such as first name, last name, e-mail address, telephone number, company, professional role, and any other information voluntarily provided by the Data Subject and necessary to manage the request.
  • Data provided when registering for the restricted area of the Website or for services provided through an application made available by the Data Controller..
    In such cases, the Data Controller may collect the Data Subject’s identification and contact data, such as first name, last name, e-mail address, login credentials, and any other information necessary for the activation and management of the personal account. Such data are processed to enable access to restricted services, account management, the provision of the requested services, and compliance with contractual and legal obligations.
  • Data provided to the customer support service.
    Identification data and the contents of communications exchanged with the customer support service, including, where expressly permitted and only after obtaining the Data Subject’s consent, the audio recording of calls for training purposes and for the improvement of the service.
  • Profiling, marketing and tracking data (subject to prior consent).
    Where the Data Subject has given their express consent (through the cookie banner or dedicated checkboxes in the relevant forms), the Data Controller may collect and process:
    • Data relating to browsing habits, interactions with the pages of the Website, content viewed and clicks made (collected through profiling cookies and third-party tracking tools, such as, for example, Meta Pixel).
    • Data relating to preferences and interests inferred from interactions with the Website, demo requests or use of the services, for the purpose of creating a user profile, sending personalised commercial communications and displaying targeted advertising.
  •  Data provided through the customer support chat/chatbot.
    Personal, identification or contact data, as well as information voluntarily provided by the Data Subject during interaction with the chatbot available on the Website. Such data are processed solely for the purpose of providing a timely response to the user’s requests, arranging a demo or providing information about the services offered. The chatbot is a proprietary tool developed for the Data Controller. Data exchanged within the conversation are processed securely and are neither disclosed to third parties nor used for purposes other than customer support, unless the user has expressly provided consent, where applicable, for marketing or profiling purposes. Users are nevertheless advised not to enter data belonging to special categories into the chatbot window (e.g. health-related data, political opinions or religious beliefs).

  • Payment-related data.
    For payment processing, the Website uses specialised third-party providers (for example, Stripe, PayPal, GoCardless or similar payment providers). The Data Controller does not store complete payment card details or the Data Subject’s banking credentials, but receives only the information necessary to confirm that payment has been successfully made and to manage the related administrative and tax obligations.

V – PURPOSES OF THE PROCESSING

Personal data are collected and processed for the following purposes (the “Purposes”):

  • Provision of the services offered through the Website and proper navigation of the Website.
  • Responding to contact requests submitted by Data Subjects by sending an e-mail or using the contact form (the “Contact Form”).
  • Management of Website registration for the purposes of managing the contractual or pre-contractual relationship and contact requests.
  • Fulfilment of obligations relating to the Contract entered into with the Data Controller, activities ancillary to the contract, or the performance of pre-contractual measures requested by the Data Subject (Article 6(1)(b) GDPR), such as the use of services through the Website accessible following registration in the restricted area; the use of any applications developed to enable the Data Subject to manage their personal area more easily; requested support services; the management of any complaints; and the sending of information and/or updates regarding the status of activated services, complaints or disputes.
  • Compliance with legal obligations imposed by applicable Italian or European legislation (e.g. accounting, administrative, tax, anti-money laundering and document-retention obligations) or by order of a public authority.
  • Marketing activities, such as sending commercial offers and newsletters to Data Subjects who have given their explicit consent to such processing. Such activities may be carried out by e-mail, telephone, SMS, WhatsApp or similar means.
  • Legitimate interest. Unless the Data Subject expressly objects, the Data Controller, on the basis of its legitimate interest and provided that the interests, rights or fundamental freedoms of the Data Subject do not override such interest, may use personal data to improve the services offered, including through surveys aimed at assessing user satisfaction, or to ensure and enhance IT security (Articles 21, 6 and 32 GDPR).
  • Management of requests for service demos, organisation of introductory meetings, commercial presentations and pre-contractual activities requested by the Data Subject.

Where the Data Controller intends to process personal data for purposes other than those indicated above and for which the data were originally collected, the Data Controller will provide information regarding the different purpose and any further relevant information before such data are used. In any event, where required by law, the Data Controller will obtain the necessary consent.

VI – LEGAL BASIS FOR PROCESSING

The legal bases for the processing of personal data are as follows:

  • Provision of services and management of contact and demo requests for the Purposes: the legal basis is the performance of a contract to which the Data Subject is a party or the implementation of pre-contractual measures taken at the Data Subject’s request, pursuant to Article 6(1)(b) of the GDPR ((contractual or pre-contractual basis).).
  • Compliance with legal obligations for the Purposes: the legal basis is compliance with a legal obligation to which the Data Controller is subject, pursuant to 6, par. 1, lett. c) del GDPR (legal obligation).
  • Legitimate interest for the Purposesthe legal basis is the pursuit of the Data Controller’s legitimate interest pursuant toArticle 6(1)(f) of the GDPRBy way of example, such interest consists in ensuring the security of the network and IT systems, preventing fraudulent activities or improper use of the Website, managing any disputes, improving the quality of the services offered, and carrying out statistical analyses in aggregated form regarding the use of the Website. Processing is carried out in compliance with the Data Subject’s fundamental rights and freedoms. The Data Subject has the right to object to the processing in the circumstances provided for under Article 21 of the GDPR.
  • Marketing activities, (purpose referred to in Article 6.1.3): the legal basis is the Data Subject’s freely given, specific, informed and unambiguous consent, expressly provided pursuant to Article 6(1)(a) of the GDPR (consent).

DATA RETENTION PERIOD PERIODO DI CONSERVAZIONE DEI DATI.

Personal data will be retained for the period strictly necessary to achieve the purposes indicated above and, more specifically:

  • For contact requests, data will be retained for the time necessary to process the request and for subsequent ordinary management activities.
  • For marketing purposes, personal data will be retained for 24 (twenty-four) months from the date consent is collected or from the last useful contact with the Data Subject, unless consent is withdrawn earlier.
  • For compliance with legal obligations (e.g. administrative and tax obligations), data will be retained for the periods provided for by the applicable sector-specific legislation (generally 10 years);
  • Data may also be retained for the time necessary – by the Data Controller or the Data Processors – to establish, exercise or defend a legal claim in judicial or extrajudicial proceedings, in accordance with the limitation periods provided for by law.
  • Data relating to a registered account will be retained for the entire duration of the registration and subsequently for the time necessary to comply with legal obligations or to protect the rights of the Data Controller.

Where the processing of personal data is based on the Data Subject’s consent, the Data Controller may retain the personal data until such consent is withdrawn.

VIII – PLUGIN SOCIAL NETWORK

  • The Website does not incorporate plugin and/or buttons for social networks; rather, it contains exclusively textual or graphic links redirecting users to the pages of the Data Controller and its main collaborators on various social networks. By clicking on such links, the Data Subject leaves the Website and, consequently, the scope of application of this Privacy Notice.
  • With regard to personal data processing operations carried out by such third-party platforms, over which the Data Controller exercises no control and assumes no responsibility, reference is made exclusively to the respective privacy notices concerning the processing of personal data (provided pursuant to Article 13 of the GDPR) made available by each platform.
  1.  

IX – RIGHTS OF THE DATA SUBJECT

Pursuant to Article 13(2) of the GDPR, the Data Controller informs the Data Subject of the rights granted to them under Articles 15–22 of the GDPR..

 

In particular, the Data Subject has the right to obtain from the Data Controller:

  • Right of access (Article 15 GDPR): to obtain confirmation as to whether or not personal data concerning the Data Subject are being processed and, where that is the case, to obtain access to such data and to the information provided for under Article 15 of the GDPR, including, for example, the purposes of the processing and the categories of Personal Data processed.
  • Right to rectification (Article 16 GDPR): to obtain the correction of inaccurate data or the completion of incomplete data.
  • Right to erasure / “Right to be forgotten” (Article 17 GDPR): to obtain the erasure of personal data where the grounds provided for by law apply, including, for example, where the Personal Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed, or where the consent on which the processing is based has been withdrawn and there is no other legal ground for the processing. Personal data may not be erased where their processing is necessary, for example, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims.
  • Right to restriction of processing (Article 18 GDPR): to obtain restriction of the processing of data in specific circumstances, including, for example, where the accuracy of the data being processed is contested.
  • Right to data portability (Article 20 GDPR): to receive the personal data concerning the Data Subject in a structured and readable format, or to request that such data be transferred to another data controller.
  • Right to object (Article 21 GDPR): to object at any time, on grounds relating to the Data Subject’s particular situation, to the processing of personal data concerning them; the Data Controller shall refrain from further processing the personal data unless there are legitimate grounds for continuing the processing (grounds which override the interests, rights and freedoms of the Data Subject), or unless the processing is necessary for the establishment, exercise or defence of legal claims.
  • Right to withdraw consent (Article 7(3) GDPR): to withdraw at any time any consent previously given, without affecting the lawfulness of processing based on consent before its withdrawal.
  • Right to be informed of the existence of appropriate safeguards relating to the transfer of data to third countries.
  • Right to lodge a complaint (Article 77 GDPR). Without prejudice to the right to seek any other administrative or judicial remedy, where the Data Subject considers that the processing of personal data concerning them carried out through the Website infringes applicable personal data protection legislation, they have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) (www.garanteprivacy.it) or with the competent supervisory authority of the European Union Member State in which they habitually reside, work, or where the alleged infringement occurred.

Where processing is based on the Data Subject’s consent, such as for marketing purposes, the Data Subject has the right to withdraw such consent at any time, without affecting the lawfulness of processing based on consent given before its withdrawal.

HOW TO EXERCISE YOUR RIGHTS:

Requests to exercise the above rights may be addressed to the Data Controller without any particular formalities, or by using the specific form made available by the Italian Data Protection Authority, by sending an e-mail to: mailto:info@waveupglobe.com

X – NATURE OF THE PROVISION OF DATA

Nature of the provision of the Data Subject’s data

  • Data necessary for the provision of services and for contact purposes.
    The provision of personal data is mandatory for the purposes indicated above (provision of the Website’s services and responding to the Data Subject’s requests). Failure to provide such data will make it impossible for the Data Controller to provide the requested services or respond to communications.
  • Data for marketing purposes.
    The provision of personal data, as well as consent to their processing, is optional for the purpose of sending commercial offers and newsletters. Failure to provide such data or consent does not affect the Data Subject’s ability to use the Website’s services, but will prevent them from receiving promotional communications and newsletters.
  • Data necessary for compliance with legal obligations.
    The provision of personal data is required by law for purposes relating to compliance with legal, tax or accounting obligations. Any refusal to provide such data will make it impossible for the Data Controller to comply with the legal obligations imposed on it by applicable legislation and, consequently, will make it impossible for the Data Subject to use the Website’s services.

XI - TRANSFER OF DATA TO NON-EU COUNTRIES

Transfer of User data to non-EU countries

Some service providers used by the Data Controller may transfer personal data to countries located outside the European Economic Area. In such cases, the transfer will take place in compliance with Articles 44 et seq. of the GDPR, through adequacy decisions or other appropriate safeguards provided for by the applicable legislation.

XII- SECURITY

Security measures implemented by the Data Controller

The Website processes Data Subjects’ data lawfully, fairly and transparently, adopting appropriate technical and organisational security measures to ensure the protection of the data and the related processing operations. Such measures are identified taking into account the mapped risk profiles, in order to prevent and counter the risk of personal data breaches (data breach), such as unauthorised access, disclosure, alteration or unauthorised destruction of the data.

Authorised persons and Data Processors

In addition to the Data Controller, access to the processed data may be granted to persons authorised to process such data, such as employees and/or collaborators of the Data Controller who have been duly instructed and authorised and who are responsible for managing the Website or carrying out the processing of data collected through it. Third parties may also have access to the processed data, such as companies, professionals and consultants engaged to provide outsourced services to the Data Controller that are necessary for the operation of the Website and related activities.

XIII – AMENDMENTS

This Privacy Notice is subject to periodic updates. In order to make it easier to check for any changes, the date of the latest update is indicated below.
Where possible, the Data Controller reserves the right to notify the User of any changes to this Policy using the contact details provided by the User.

Last amended: 19 August 2026
Version: 2