This notice sets out details of the information that we collect about you, how we process it, to whom we disclose it, and your rights under data protection law in relation to our processing of your data. This data protection notice covers personal data that is collected through our websites (wavecollective.co)
Who collects your data?
What kind of data does Wave Collective collect?
In order for us to process your booking we will ask you for certain information, such as your name, your email address, your payment information and booking details. We also collect certain information from the device you use to access our website, such as your IP address, what browser you use and what type of device you are using. In addition to the information that we collect ourselves, we sometimes receive information that is collected on our behalf by third parties, such as when you see a Wave Collective advert displayed on a third party site.
Information that you give to us:
Most of the personal data that we collect about you will be information that you have given to us yourself. This might include:
Account - If you set up an account with us, we will store details of your username and password, your settings preferences (e.g. language) and your past bookings.
Booking Details - When you make a booking we will ask you for information that we need in order to process the booking. This can include your name, email address, billing address, gender, mobile number, passport number, and date of birth.
Reviews - If you leave a review in relation to your stay at a property, this will be linked to your Wave Collective account, which means we will treat it as containing your personal data.
Email Marketing - When we collect your email address we will record your preferences regarding receipt of marketing emails from us in relation to our own products and services and those of third parties.
Location Data - we use your IP address to determine what country you are in when you are on our website.
Personal information that we collect automatically:
When you use our websites we use various technologies to automatically capture details about the device you are using and how you interact with our platforms. This information includes:
Device Details - We automatically collect details about the device you are using, including its IP address, its device ID, the browser you are using, and the operating system that the device uses.
How You Interact With Our Site - We record details about how you use our websites, like the date and time that you visit, what pages you visit, how long you stay on the pages, where you have clicked on a page, and details of any crashes or system bugs you might encounter.
How You Got Here - Where we can, we record how you arrived on our website (e.g. from a search engine, or by clicking on one of our adverts).
Personal information we receive from other sources:
Although we mainly collect information directly from you, there are circumstances where we collect information from third party sources. These circumstances include:
Affiliates - We operate an affiliate programme under which third parties advertise our website on our behalf. If you click on one of those advertisements you are directed to our website using a technology that allows us to understand which affiliate referred you. We then track if you make a booking, and if you do we attribute that booking to the affiliate for the purposes of paying them a commission. However, we don't provide the affiliate with any personal information in relation to you.
Property - If there are any issues with your stay at a property, the property might contact us with information about the issue.
Advertisements - When we work with third parties to display advertisements we may use technologies like cookies or pixel tags to record details of your interaction with those advertisements. This data is sometimes sent to us through cookies and pixel tags that are set on our behalf by those third parties.
Our cookies help us:
Make our website work as you'd expect
Save you having to login every time you visit the site
Remember your settings during and between visits
Improve the speed/security of the site
Allow you to share pages with social networks like Facebook
Continuously improve our website for you
Make our marketing more efficient (ultimately helping us to offer the service we do at the price we do)
Collect any personally identifiable information (without your express permission)
Collect any sensitive information (without your express permission)
Pass personally identifiable data to third parties
You can learn more about all the cookies we use below
Types of Cookies we use
Website Function Cookies
Making our shopping basket and checkout work
Determining if you are logged in or not
Remembering your search settings
Remembering if you have accepted our terms and conditions
There is no way to prevent these cookies being set other than to not use our site.
Social Website Cookies
So you can easily “Like” or share our content on the likes of Facebook and Twitter we have included sharing buttons on our site.
The privacy implications on this will vary from social network to social network and will be dependent on the privacy settings you have chosen on these networks.
Visitor Statistics Cookies
You may notice that sometimes after visiting a site you see increased numbers of adverts from the site you visited. This is because advertisers, including ourselves pay for these adverts. The technology to do this is made possible by cookies and as such we may place a so called “re-marketing cookie” during your visit. We use these adverts to offer special offers etc to encourage you to come back to our site. Don't worry we are unable to proactively reach out to you as the whole process is entirely anonymised. You can opt out of these cookies at anytime as explained above.
We have a number of partners who promote our service on a success-only basis (i.e. instead of paying for advertising, we pay them commissions on sales). Cookies are required to allow us to reward these partners and these cookies are usually provided by specialist companies (known as affiliate networks). Neither us, the networks, or the partner advertising or recommending our services are able to identify you personally. We ask you to support us by allowing these cookies which ultimately help us to offer you the service we do at the price we do.
Why does Wave Collective collect and use personal data?
As you probably expect, the main reason we use your personal data is in order to process your requests and bookings, and to deal with any queries or issues that arise in relation to those bookings. We also use your personal data for tailoring adverts and our marketing emails so they are relevant to you, and monitoring your use of our websites to help us make improvements.
Bookings - We use your personal data in order to process bookings with properties, and to let you manage your bookings through our platform. Where we process personal data for this purpose we will do so either on the basis that we have a contractual duty to do so, or on the basis of our legitimate interests in providing the booking service.
Queries and Complaints - When you send us a query in relation to a booking, or if you have a complaint in relation to a property, we will process your personal data in order to answer your query or in order to resolve your complaint. Where we process personal data in the context of a query or complaint we will do so on the basis of our legitimate interest in resolving customer queries and complaints. If you volunteer data in relation to your health, we will process that personal data on the basis that you consent to us using it in order to resolve your query or complaint.
Reviews - When you provide a review for a property we will publish this on the property's page on our website. We will display the text of your review, alongside of your first name. Our processing of your personal data in order to make reviews available is on the basis of our legitimate interest in making the review system available to our users.
Providing and Improving our Services - Where we collect data in relation to your use of our services, such as your device details and how you interact with our services, we use this data in order to deliver our services and personalise your experience. We also use the data to test new features that we are thinking about introducing, to analyse how our website is used, and to evaluate and improve our services. If we find a problem on our websites, we will use your data in order to fix any bugs that we find. We may also process your personal data as part of our development work, where we take a copy of our database and test our code on that before rolling it out to the live version of the database. Where possible we use this data on an anonymous basis, but sometimes this might not be possible. All of this processing of your personal data is on the basis of our legitimate interests in operating, improving and securing our services.
Analysis/Reporting - We use data in relation to requests and bookings in order to create internal reports regarding how our business is operating, such as determining how what we have spend on advertising affects the number of bookings that are made. We also use this data for other commercial analysis purposes, and to try to predict future trends that may affect our business. This processing is undertaken on an aggregated basis, so you are not identifiable from the reports or analysis that is produced.
Advertising - We always want to ensure that when you see a Wave Collective advert it will be relevant to you and your interests, whether the advert appears on a website we operate, in our marketing emails or on a third-party site. We may also use the same information to show you adverts for carefully selected third-party products and services. We do this in a number of ways, either ourselves or through the use of third-party advertisers:
Making Adverts Relevant To You - When you are using our websites we use the searches you have made and the properties that you have looked at in order to tailor our adverts to your interests. For example, if you have been searching for Surf Resorts in Maldives, we might use this information to display adverts to you on our websites and on third party websites for Surf Resorts in Maldives that you might be interested in. We may also use this information in order to tailor the adverts that appear in our email newsletter. We may also use data about your past transactions on the website to tailor our advertising. For example, if we notice you haven't made any bookings for a while, we might send you a credit to your account as an incentive to make a new booking. We process your personal data in connection with tailoring our adverts on the basis of our legitimate interests in ensuring that our advertising is effective.
Segmentation - When we develop some of our advertising campaigns we have certain groups of people in mind who we want to see the advert. This might be people in a particular age range, people who have made a booking recently, or people from a particular geographic location or who speak a particular language. We use the data that we hold in order to create groups of people that we then display an advert to, or ask our third-party advertising partners to display an advert to. We process your personal data in connection with creating these groups of people on the basis of our legitimate interests in ensuring that our advertising, or the advertising of third parties, is effective.
Audience Matching - Some of our advertising partners, like Facebook, provide a feature that helps us to identify if we have customers or users in common. Rather than sharing personal data with our advertising partners in order to find out if we have customers or users in common, we actually share what is known as a "hash" of the data that we hold (such as an email address). A hash is created by a computer programme that converts data into a string of numbers and letters, but only operates in one direction. This means that you can't use a hash to find out the underlying information, but if you run the hash on the same data you always get the same results. Our advertising partners compare their hashes with the hashes we send them, and if there is a match you are added to our custom audience. The hashes are then deleted by the advertising partner. We use audience matching to enable us to show you more relevant adverts, or to ensure that we don't show you an advert that isn't relevant to you. We process your personal data in connection with audience matching on the basis of our legitimate interests in ensuring that our advertising, or the advertising of third parties, is effective.
Emails Notifications - Where we have collected your email address in the context of providing you with a service and you have not opted out of receiving email marketing, we may send you emails that we think will be useful to you. This may include our regular e-newsletter, special offers, travel tips and information about products and services offered by us. These emails may include advertising that has been tailored using other information that we hold about you, as set out above in the 'Advertising' section. You may opt out of receiving email messages at any time by clicking on the link provided in the email messages. Although when we send you an email notification this may in certain circumstances be on the basis of your consent, for all other purposes our processing of your personal data in connection with those emails is on the basis of our legitimate interests in ensuring that our advertising is effective.
Affiliate Programme - We operate an affiliate programme under which third parties advertise our website on our behalf. If you click on one of those advertisements you are directed to our website using a technology that allows us to understand which affiliate referred you. We then track if you make a booking, and if you do we attribute that booking to the affiliate for the purposes of paying them a commission. However, we don't provide the affiliate with any personal information in relation to you. We process your personal data in connection with our affiliate programme on the basis of our legitimate interest in operating an effective commission based affiliate advertising programme.
Competitions - We often run competitions on our website and on our social media channels. When we operate a competition we may take the opportunity to also ask you some market research questions, so that we can better understand our business and your needs. We will therefore process your personal data in order to operate the competition, and for market research purposes. We process your personal data in connection with operating competitions on the basis of our legitimate interest in operating the competition and conducting market research. Please note that competitions may be subject to their own data protection notices and separate terms and conditions.
Who do we share your personal data with?
In order to process your booking we have to send your details to the property that you have booked.
As part of our online advertising programmes we may share your personal data with third parties, who will combine it with data that they hold about you in order to tailor adverts that appear on third-party websites (which may be our own adverts, or adverts we serve on behalf of third parties). Where this data is shared you are not directly identifiable from the information itself, as we use technologies that use non-personally identifiable codes and tags.
We also use a number of service providers to assist us in providing our services, some of whom will have access to your data (e.g. we use various software service providers who host our data as part of their services). Where we engage a third party to process your data on our behalf, we make sure that they respect your privacy rights and that they process data in accordance with data protection law.
Although we hope it never happens, on very rare occasions our customers can get into difficulties whilst travelling. Where we think that there is a risk to your health or wellbeing, we may share your personal data with third parties in order to get you help (e.g. we might be asked to assist with locating a missing person). We may also receive requests from law enforcement agencies for personal data that we hold. In such circumstances we will only share your personal data with such law enforcement agencies in compliance with data protection law.
Properties - We share the following details of your booking with properties: your name, gender, email address and booking details. In some cases we may also need to share the information about your flights, traveling companions and nationality. We also share details of any reviews that you provide in relation to the property, so that they can address any complaints or make sure that they keep up the good work. If you contact us with a query or complaint in relation to a property we may also share details of the query or complaint with the property so that we can resolve it.
Service Providers - We use several specialist service providers to assist us in operating our business and to provide us with specialist services. Not all of these service providers will have access to your personal data, but where they do we make sure that they are carefully selected by us to ensure that they respect your privacy rights. The categories of service providers that we currently engage include the following:
Hosting Providers - We use various cloud service providers to help us host and manage our data. This means that the data is hosted remotely by the third party, and access by us at Wave Collective, rather than sitting on our systems.
Payment Processors - We use third-party payment processors in order to assist us with taking payments on our website.
Customer Relationship Management - We use a third-party provider to host our customer relationship management system, which our team uses to record all contacts that you have with us and how we have resolved your requests, queries and complaints.
Technology Providers - This includes service providers who provide services that help us to secure our network, systems and emails. It also includes providers of services that enable us to undertake particular tasks, such as surveys or market research, or to implement our advertising programme.
Consultants - We sometimes engage consultants to help us implement new technology or services, or to provide us with insights into how we run our business and how we might improve it. This sometimes requires us to provide access to our systems to those third parties, which means that they may have access to where your personal data is stored. We always make sure that any such access is limited to what is strictly necessary, and subject to appropriate security procedures.
Third-Party Advertisers - When we purchase advertising on third-party websites we may share information with them about your use of our services, which they then combine with the information that they hold about you in order to implement the particular advertising campaign. The data that is shared with third-party advertisers relates to how you use our websites and apps, such as the pages you have visited, the searches you have made, and whether you have made a booking. We use specialist service providers to help us purchase advertising, and to transfer the information about your use of our services to third party advertisers that is required for those third party advertisers to be able to show you the correct advert.
There are certain circumstances where we will transfer your personal data outside of the European Union to a country which is not recognised by the European Commission as providing an equivalent level of protection for personal data as is provided for in the European Union. The most common of these is where we transfer personal data to an accommodation provider so that they can fulfil your booking. We may also transfer your personal data outside of the European Union in connection with the operation of our business, such as when we use a service provider that is based in another jurisdiction. If we transfer your personal data outside of the European Union please rest assured that we will ensure that appropriate measures are in place to protect your personal data and to comply with our obligations under applicable data protection law.
When we transfer your personal data outside of the European Union, if required under data protection law we will either enter into contracts in the form approved by the European Commission with the entity that we transfer data to, or we will ensure that the company to which we transfer your personal data has agreed to abide by an approved transfer mechanism, such as the EU-US Privacy Shield framework. If you would like further details about the measures we have taken in relation to the transfer of your personal data, or copies of the agreements that we have put in place in relation to the transfers, please contact us using the details at the bottom of this page.
Information you are required to provide
You are not obliged to provide us with any of your personal data. However, if you want to send us a request or make a booking you will need to provide us with the information that is indicated as required on our website. If you don't provide us with this information, we won't be able to process your request or booking. Similarly, you may be required to provide certain information if you want to enter into a competition, or if you contact our support team with a query or complaint. We will inform you where such information is required.
How long does Wave Collective store the data?
We retain your personal data in accordance with our record retention policy. The record retention policy operates on the principle that we keep personal data for no longer than is necessary for the purpose for which we collected it, and in accordance with any requirements that are imposed on us by law. This means that the retention period for your personal data will vary depending on the type of personal data.
Transaction Data - If you are an active user of our website (i.e. you have made a booking in the last 18 months) we want to ensure that you have access to data in relation to your previous bookings, and that we have access to this data for our own business purposes. We therefore won't delete your transaction data whilst you remain an active customer, unless you ask us to do so. If you cease to be an active customer, we will retain your personal data for a period of 4 years, in case you return to our website and want to continue using your account, and also so that we can continue to use transaction data to improve our services and undertake business analysis. After this 4 year period we anonymise the data, so that it is no longer possible for us to link it to you. However, our anonymisation process does let us re-identify you if you return to our site and use the same email address to make a booking. Please also note that if you are subscribed to our marketing database we will retain certain details even after the 4 year period expires, as set out below.
Email Marketing - We will keep a copy of personal data that is required in order to send you marketing messages for as long as you are subscribed to receive those marketing messages. We will also retain certain information in relation to your transactions in order to allow us to customise our marketing messages. If you are subscribed to receive marketing messages and your transaction data is anonymised in our main database, we will continue to retain certain details in relation to your transactions, such as where you have booked properties before, what types of property you have booked, your average length of stay, and what countries you have made bookings for and in.
For personal data that is not transaction data or related to email marketing, we will apply the following criteria:
Managing legal claims – When we assess how long we keep personal data we take into account whether that data may be required in order to defend any legal claims which may be made. If such data is required, we may keep it until the statute of limitations runs out in relation to the type of claim that can be made (which varies from 2 to 12 years).
Business requirements – As we only collect personal data for defined purposes, we assess how long we need to keep personal data for in order to meet our reasonable business purposes.
Important Information about Consent
When we process your personal data on the basis of your consent, you are free to withdraw that consent at any time. You can withdraw your consent by contacting us using the contact details at the bottom of this page. If your consent relates to receiving email marketing you can use the unsubscribe link in the email. Please note that if you withdraw your consent we may not be able to continue to provide the related service to you.
What rights do you have?
You have various rights under data protection law in connection with our processing of your personal data. For example, you have the right to request a copy of your personal data that we hold and to request that we correct any errors in the personal data that we hold. These rights are subject to certain exceptions and exemptions.
You have the following rights under data protection law:
Right to access your personal data - You have the right to request a copy of the personal data that we hold about you, together with other information about our processing of that personal data.
Right to rectification – You have the right to request that any inaccurate data that is held about you is corrected, or if we have incomplete information you may request that we update the information so that it is complete.
Right to erasure – You have the right to request us to delete personal data that we hold about you. This is sometimes referred to as the right to be forgotten.
Right to restriction of processing or to object to processing – You have the right to request that we no longer process your personal data for particular purposes, or to object to our processing of your personal data for particular purposes.
Right to data portability – You have the right to request us to provide you, or a third party, with a copy of your personal data in a structured, commonly used machine readable format.
Questions and Complaints
If you have any queries or complaints in connection with our processing of your personal data, you can get in touch with us using the following contact details: