WebWave

GDPR overview

GDPR implementation is concrete. WebWave is established in Poland, so the regulation applies directly and no Article 27 representative is needed. The controller is named in full — WebWave Sp. z o.o., ul. Postępu 14, Warsaw — with its KRS, NIP and REGON numbers. The terms give a legal basis for each purpose (Article 6(1)(b), (c), (f) and consent), list the categories of recipients and enumerate the full set of data subject rights, including a complaint to the Polish supervisory authority. Transfers outside the EEA are described as exceptional and covered by the European Commission's standard contractual clauses. A data processing agreement is published openly, with a customer audit right answered within thirty days. The privacy policy itself is thin and cites only Article 6(1)(f); the substance sits in the terms.

Who owns the data?

The terms draw a clear line. WebWave Sp. z o.o. is the controller of the account holder's own personal data. For everything published through the platform — site visitors, store customers, contact-form submissions, mailbox contents — the customer is the controller and WebWave is only the processor, under a data processing agreement accepted together with the terms. Content the customer uploads stays theirs; the code, graphics and templates of the service itself belong to the vendor and may not be copied. One clause deserves attention: by accepting the terms, users consent to WebWave reusing their logo and their site for its own promotion, a consent revocable by email.

Reuse rights

Customers keep the right to reuse whatever they put into the platform: their texts, images and product data remain theirs, and site export exists (one customer review published on the homepage notes that exporting is a paid option). Content produced by the AI features is handed over as a suggestion — the vendor guarantees neither its accuracy, its completeness nor its uniqueness, and the terms place the duty to check it before publication on the user. Copying elements of the service itself, such as its templates, graphics or source code, is expressly forbidden. On the vendor's side, personal data serves to conclude and perform the contract, meet legal obligations, send direct marketing, run statistical and technical analysis and register domains; it is shared with hosting and IT providers, the payment operators Stripe and Autopay, domain registration partners and professional advisers. Nothing on the site says whether customer content is used to train AI models, and no opt-out is documented.

Data retention & training

Hosting summary

WebWave names no hosting country and no hosting provider anywhere on the site. What it does commit to is a region: the terms state that, as a rule, personal data is not transferred outside the European Economic Area, and that where a transfer does occur the controller relies on the standard contractual clauses approved by the European Commission. Hosting and IT service providers appear only as a category of recipients, never by name. The data processing agreement adds that data is deleted when the account is closed unless Polish or European Union law requires it to be kept, which anchors the arrangement in EU jurisdiction. For customer sites, WebWave supplies the hosting itself, with a free SSL certificate, daily backups, round-the-clock monitoring and an advertised 99.9% server uptime. Anyone with a hard requirement on data location should ask the vendor directly: the published documents give a region and a jurisdiction, not a data centre.