getwaved.ai / Legal
DPA Agreement
Last updated: 14 October 2026 · Wavelink, registered in Bangladesh · applies to getwaved.ai and all Wavelink regional entities
This Data Processing Agreement ("DPA") forms part of the Wavelink Terms of Service and applies where Wavelink processes personal data on behalf of a customer — for example, when we host profile content you upload or process order data to fulfil your purchase. It is drafted to satisfy Article 28 of the EU GDPR and is supplemented by the EU Standard Contractual Clauses where transfers outside the EEA occur.
1. Roles of the parties
For customer-uploaded profile content and order fulfilment data, Wavelink acts as a data processor and the customer (profile owner or orderer) acts as the data controller. For data Wavelink collects directly for its own purposes (site analytics, marketing), Wavelink is the controller — that processing is described in the Privacy Policy, not this DPA.2. Subject matter and details of processing
Duration: for the term of the service plus the retention periods in the Privacy Policy. Nature and purpose: hosting, storage and display of profile content; manufacturing and delivery of ordered goods; provision of tap-analytics aggregates. Categories of data subjects: the customer and persons whose details the customer chooses to publish (their own professional identity). Categories of data: identification and contact data, professional data, imagery and logos, order and delivery data.3. Processor obligations
Wavelink will: process data only on documented instructions from the controller (this DPA and the order configuration being those instructions); ensure persons authorised to process the data are bound by confidentiality; apply the security measures in section 4; assist the controller with data subject requests; notify the controller without undue delay after becoming aware of a personal data breach; delete or return data at the end of the service; and make available information needed to demonstrate compliance.4. Security measures
Data is encrypted in transit (TLS 1.2+) and at rest on managed cloud databases. Access follows least privilege with named accounts for the fulfilment and support team, hardware-backed two-factor authentication, and audit logs. Card-print assets are stored in a private Cloudflare R2 bucket readable only by the print pipeline. We review access rights quarterly.5. Sub-processors
Wavelink uses the following categories of sub-processors under equivalent written obligations: cloud database hosting (Supabase / AWS), static asset and edge delivery (Cloudflare), payments (Stripe and regional providers), delivery (DHL and postal partners), and print production (our Chattogram print partner). A current list with locations is available on request. We will give 30 days' notice of additions, during which the controller may object on reasonable data-protection grounds.6. International transfers
Where data is transferred outside the EEA or UK, transfers rely on adequacy decisions where available (e.g., Japan-adequate infrastructure regions), otherwise on the EU Standard Contractual Clauses (Module Two, processor-to-processor for sub-processors; Module Three for controller-to-processor where the customer is an EEA controller).7. Data subject requests and audits
Wavelink assists the controller in responding to access, rectification, erasure and portability requests. Onward audits: the controller may audit compliance once per year on 30 days' notice, remotely and during business hours, or immediately following a reportable breach.8. Liability
Liability under this DPA is allocated per the Terms of Service, and each party remains liable to the other for breaches of this DPA in line with GDPR Article 82.Questions about this page?
Write to [email protected] or message +880 1410 809023 (WhatsApp). A human answers — usually within one business day. For the full site, return to getwaved.ai.