Privacy Policy
Last updated: 17 July 2026
This policy explains what personal data BlueWave collects, why, what we do with it, and the rights you have over it. We've written it in plain English on purpose — if anything here is unclear, that's a defect, and we'd like to hear about it. Last reviewed against the Data (Use and Access) Act 2025 changes in force from February and June 2026.
Who we are
BlueWave is field-service software for UK water-hygiene companies: scheduling, field data capture, compliance records and billing in one platform.
BlueWave is a trading name of Compliance Digital Ltd · Registered in England & Wales · Company No. 17305889 · Registered office: 20 Devonshire Road, Burnham-on-Crouch CM0 8DR. Compliance Digital Ltd is the controller for the personal data this policy covers.
For anything about your personal data, contact privacy@usebluewave.com. We have not appointed a Data Protection Officer — at our size and with the data we process, UK GDPR doesn't require one — but that address reaches the people responsible for data protection decisions.
We offer BlueWave to the UK market only. We don't set out to offer services to, or monitor, people in the EU or EEA, so the EU GDPR doesn't apply to us and we haven't appointed an EU representative. If we ever take BlueWave to Europe, we'll revisit that before we do.
The two hats we wear
This matters more than anything else on this page, so it goes first.
For this website and our own business records, we are the controller. Visitor data, demo requests, contact-form messages, the account details of people who sign in, and the billing records of the businesses that pay us — we decide why and how that data is used, and this policy governs it.
For the operational data our customers put into the platform, we are a processor. Job records, site and asset registers, engineers' field reports, photos, signatures, sampling results — that data belongs to the water-hygiene company that uploaded it. They are the controller; we process it on their documented instructions under our data processing agreement, and their privacy policy (not this one) governs what they collect from their own staff and clients. If you're an engineer using BlueWave because your employer asked you to, your employer is the controller of your field data.
The data we collect
- Site visitors. Our hosting infrastructure keeps short-lived server logs (IP address, user agent, requested pages) for security and reliability. We run no site analytics today. If we add any, it will be cookieless and aggregate, and this policy will name the provider before it collects anything.
- People who book a demo or contact us. Your name, email address, company name if you give one, and your message — all straight from the form you filled in.
- Account users. Name, work email, role, and sign-in activity. If a colleague invited you, your name and email came from your employer rather than from you — that's the only data we routinely receive about you from someone else.
- Billing contacts. If you handle your company's BlueWave subscription: your name and email on invoices, the invoice history, and payment status. Card and bank details go directly to Stripe, our payment provider — they never touch our servers.
- Engineers' field data. Collected through the app as part of the service — job records, photos, locations, signatures. We hold it as a processor, on your employer's instructions (see the two hats above).
You don't have to give us anything. But without contact details we can't answer an enquiry, and without basic account details your employer can't give you access to the platform — account data is needed to perform our contract with your company. We don't seek special-category data and ask that you don't put any in a contact-form message.
Why we use it, and our lawful bases
| Purpose | Data | Lawful basis (UK GDPR Art 6) |
|---|---|---|
| Answering enquiries and demo requests | Name, email, company, your message | Legitimate interests — responding to people who contact us about the product |
| Providing and administering accounts | Name, work email, role, sign-in activity | Contract |
| Service emails — invites, password resets, confirmations | Email address | Contract |
| Billing and collecting subscription fees | Billing contact details, invoices, payment status | Contract; legal obligation for the accounting records |
| Security, fraud and abuse prevention | Server logs, audit trails | Legitimate interests — network and information security, an interest UK GDPR itself now names |
| Meeting legal obligations | Whatever the obligation requires | Legal obligation |
We don't send marketing emails today — our email provider delivers transactional messages only. If that ever changes, we'll ask for consent first, and you'll be able to withdraw it as easily as you gave it.
Who we share it with
We never sell personal data. We share it with a short list of service providers who help us run BlueWave, under contracts that bind them to protect it:
| Provider | What they do for us | Where |
|---|---|---|
| Google Cloud | Cloud hosting and infrastructure | United Kingdom — London region |
| Stripe | Subscription payments and payment fraud prevention — Stripe acts as its own controller for this | United States |
| Resend | Transactional email delivery | United States |
| HERE | Address lookup and geocoding — addresses only, no names | Not yet confirmed — ask us |
Sign-in itself runs on software we host on our own infrastructure, so no third party sits behind the login box. Beyond the table: our professional advisers, where we genuinely need advice, and authorities or regulators where the law requires it — and only what it requires. A dedicated sub-processor page with change notifications is being finalised; it will be linked from here and from our data processing agreement.
International transfers
We aim to keep personal data in the UK and EEA, and our hosting lives there. Two providers process data in the United States, and each transfer has a named safeguard:
- Stripe (payments) and Resend (transactional email) are both certified under the UK Extension to the EU-US Data Privacy Framework — the "UK-US Data Bridge" — verified against the official framework list on 17 July 2026.
- If the Data Bridge is ever struck down (it faces live legal challenges), the fallback is already in place: both providers' contracts carry standard contractual clauses with the UK Addendum, and we'd rely on those from that day.
Data flowing the other way — from the EU to us — moves freely: the European Commission renewed the UK's adequacy decisions on 19 December 2025, valid to 27 December 2031. You can ask us for details of any safeguard at privacy@usebluewave.com.
How long we keep things
| Data | Kept for |
|---|---|
| Demo requests and enquiries | 12 months after our last exchange |
| Account data | Life of the account, then deleted within 30 days of closure — except records the law makes us keep |
| Invoices and payment records | 6 years after the end of the financial year they relate to — UK tax and company law requires it |
| Server and security logs | 30 days |
| Customer operational data (we're the processor) | Per your company's instructions and contract — exportable for 90 days after the subscription ends, then returned or deleted. Water-hygiene businesses typically instruct long retention because their own compliance rules (such as LCA guidance) expect records kept for five years. |
Your rights
Under UK GDPR you can ask us to:
- Access the personal data we hold about you, with a copy
- Rectify anything inaccurate or incomplete
- Erase your data, where there's no good reason for us to keep it
- Restrict what we do with it while a dispute is resolved
- Port data you gave us to another provider, in a usable format
- Object to processing based on legitimate interests
Where we rely on consent, you can withdraw it at any time without affecting what happened before. Email privacy@usebluewave.com to exercise any of these — we'll respond within one month. We may need to verify who you are, or ask you to narrow a very broad request; the clock pauses while we wait, and the law asks us to make searches that are reasonable and proportionate rather than infinite. If your data sits in a customer's tenant (the processor hat), we'll pass your request to your employer without undue delay, because the decision is legally theirs.
Automated decisions
We don't make decisions about you with legal or similarly significant effects based solely on automated processing. No profiling, no scoring. One nuance worth knowing: when your business pays by card, Stripe runs automated fraud screening on the payment — that's Stripe acting as its own controller, under its own privacy policy, and a declined payment always reaches a human at our end before anything happens to your account.
How to complain
If you think we've handled your data badly, complain to us and we'll deal with it properly — this is now a legal duty, and one we'd meet anyway. Email privacy@usebluewave.com: we'll acknowledge your complaint within 30 days, investigate without undue delay, and tell you the outcome and why.
If you're not satisfied with our answer — or you'd simply rather go straight to the regulator — you have the right to complain to the UK's supervisory authority:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
0303 123 1113 · ico.org.uk
Cookies and similar storage
We don't use tracking cookies. On almost every page, the only things stored in your browser are strictly necessary and set by us: your theme preference, and your sign-in session if you have an account. The one exception is the payment page: Stripe sets two fraud-prevention cookies there (__stripe_mid, roughly a year, and __stripe_sid, about 30 minutes) so the payment you're making can be screened for fraud. Stripe's scripts load only on that page, never site-wide. We run no analytics on this site today. The full storage-by-storage detail lives in our cookie policy.
Security
Data is encrypted in transit, access is role-based and least-privilege, and every tenant's data is isolated from every other tenant's by design. If a personal data breach ever happens, we assess it immediately, notify the ICO within 72 hours where the law requires, and tell affected customers without undue delay. The fuller picture lives on our security page. We claim no certifications we don't hold.
Children
BlueWave is a business tool for water-hygiene companies. It isn't directed at children and we don't knowingly collect children's data.
Changes to this policy
When this policy changes, we'll update it here and change the date at the top. If a change materially affects account holders, we'll email them before it takes effect.