Privacy Policy

1. Who We Are

ShopyWave ("we", "us", or "our") is headquartered at 2534 W Ridge Rd, Rochester, NY 14626. We are the data controller for personal data processed in connection with our website and POS platform services.

Our Data Protection Officer can be contacted at: contact@shopywave.com

2. What Data We Collect

We collect and process the following categories of personal data:

• Contact information: Name, email address, phone number, and business address when you complete a contact form, request a demo, or create an account.
• Business information: Business name, type, size, number of locations, and industry sector.
• Account data: Login credentials, usage logs, transaction records, and system configuration for platform customers.
• Payment data: Billing information for subscription payments. We do not store full card numbers — payments are processed by our PCI-compliant payment provider.
• Technical data: IP address, browser type, operating system, referral URLs, and pages visited, collected automatically via cookies and server logs.
• Communications: Emails, chat logs, and support tickets when you contact us.

3. How We Use Your Data

We use your personal data for the following purposes:

• To provide, operate, and improve our POS platform and hardware products
• To process enquiries, demo requests, and sales consultations
• To manage your account and deliver customer support
• To send product updates, security notices, and service communications (where you are a customer)
• To send marketing communications (where you have consented or we have a legitimate interest)
• To comply with legal obligations including tax, anti-fraud, and financial regulations
• To analyse usage patterns and improve our products and services

4. Legal Basis for Processing

We process your personal data under the following legal bases under UK GDPR:

• Contract performance: Processing necessary to deliver our platform and services to customers.
• Legitimate interests: Marketing to prospective customers, fraud prevention, product improvement, and business analytics — where these interests are not overridden by your rights.
• Consent: Marketing communications where you have opted in. You may withdraw consent at any time.
• Legal obligation: Compliance with applicable laws and regulations.

5. Who We Share Your Data With

We do not sell your personal data. We share data only with trusted third parties necessary to operate our services:

• Cloud infrastructure providers (AWS, Google Cloud) for data hosting
• Payment processors for subscription billing
• CRM and email platforms for customer communications
• Analytics providers (with anonymisation where possible)
• Legal and regulatory authorities where required by law

All third-party processors are subject to data processing agreements and are contractually required to protect your data in accordance with UK GDPR.

6. Data Retention

We retain personal data for as long as necessary to fulfil the purposes described in this policy, or as required by law. Specifically:

• Customer account data: retained for the duration of the contract plus 7 years (for legal and tax purposes)
• Marketing contact data: retained until you unsubscribe or request deletion
• Website analytics data: retained for 26 months
• Support communications: retained for 3 years

7. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your data in certain circumstances.
• Right to restrict processing: Request that we limit how we use your data.
• Right to data portability: Receive your data in a machine-readable format.
• Right to object: Object to processing based on legitimate interests or for direct marketing.
• Rights related to automated decision-making: We do not make solely automated decisions with significant legal effects.

To exercise any of these rights, contact us at contact@shopywave.com. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Cookies

We use cookies to improve your experience on our website. Cookies we use include:

• Essential cookies: Required for the website to function. Cannot be disabled.
• Analytics cookies: Help us understand how visitors use our site (e.g. Google Analytics). Can be disabled.
• Marketing cookies: Used to show relevant advertisements. Only set with your consent.

You can manage your cookie preferences at any time via your browser settings or our cookie consent banner.

9. International Transfers

Some of our service providers operate outside the UK. Where we transfer data internationally, we ensure appropriate safeguards are in place — including standard contractual clauses approved by the ICO — to protect your data to the same standard as within the UK.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include encryption in transit and at rest, access controls, regular security audits, and staff data protection training. We are PCI DSS Level 1 certified for payment data.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify customers by email and update the "last updated" date at the top of this page. Continued use of our services after notification constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us:

• Email: contact@shopywave.com
• Post: Data Protection Officer, ShopyWave Ltd, 2534 W Ridge Rd, Rochester, NY 14626
• Phone: 612-515-8279