About This Privacy Policy
This Privacy Policy governs how Epicwave Technologies (“we,” “us,” or “our”) collects, uses, stores, shares, and protects personal data when you interact with our website, mobile applications, and messaging services — including communications conducted through the WhatsApp Business Platform powered by Meta.
By using our services, you acknowledge you have read and understood this policy. If you do not agree, please discontinue use of our services.
Data Controller & Contact Information
The data controller responsible for your personal information is:
WhatsApp Business API — Specific Disclosures
We use the WhatsApp Business API (provided by Meta Platforms, Inc.) to communicate with users. The following disclosures are required under Meta's WhatsApp Business Policy and applicable law.
We only message users who have given explicit, documented opt-in consent. You may withdraw consent at any time by:
- Replying STOP to any WhatsApp message from us
- Emailing privacy@epicwave.tech with subject “WhatsApp Opt-Out”
- Using the opt-out link in any message we send
We will cease WhatsApp communications within 24 hours of your request.
Data Shared with Meta via WhatsApp
When you communicate with us via WhatsApp, Meta Platforms, Inc. processes certain data as a sub-processor, including:
- Your WhatsApp phone number and profile information
- Message content (end-to-end encrypted in transit; we receive and store content you send us)
- Message metadata: timestamps, delivery receipts, read receipts
- Device information associated with your WhatsApp account
Meta's use of this data is governed by Meta's Privacy Policy. We recommend reviewing it independently.
Message Templates
All outbound WhatsApp messages we initiate use pre-approved Message Templates reviewed and approved by Meta. We do not use WhatsApp to send unsolicited commercial communications.
Personal Data We Collect
Data You Provide Directly
- Full name and contact details (phone number, email address, postal address)
- Account credentials (username, hashed password — we never store plaintext passwords)
- Payment information (processed via PCI-DSS Level 1 compliant processors; raw card data is never stored by us)
- Communications sent via WhatsApp, email, or contact forms
- Feedback, survey responses, and support requests
Data Collected Automatically
- IP address, browser type, operating system, and device identifiers
- Pages visited, links clicked, time spent, referral URLs
- Cookie data and similar tracking technologies (see Section 10)
- Approximate geolocation derived from IP address
Data from Third Parties
- Social login providers (Google, Apple, Meta) — only with your consent
- Analytics and advertising partners
- Fraud prevention and identity verification services
Legal Basis for Processing
Under GDPR and India's DPDP Act 2023, we process personal data only where a lawful basis exists:
| Processing Activity | Legal Basis (GDPR) | DPDPA Basis |
|---|---|---|
| Delivering requested services | Art. 6(1)(b) — Contract | §7(a) — Consent |
| WhatsApp marketing messages | Art. 6(1)(a) — Consent | §7(a) — Consent |
| Transactional WhatsApp messages | Art. 6(1)(b) — Contract | §7(b) — Legitimate Use |
| Fraud prevention & security | Art. 6(1)(f) — Legitimate Interests | §7(g) — Legal Obligation |
| Legal compliance & tax records | Art. 6(1)(c) — Legal Obligation | §7(d) — Legal Obligation |
| Analytics & service improvement | Art. 6(1)(f) — Legitimate Interests | §7(a) — Consent |
How We Use Your Personal Data
- To provide, operate, and improve our products and services
- To process transactions and send related notices (receipts, invoices)
- To send service updates, security alerts, and support messages via WhatsApp or email
- To send marketing and promotional content (only with your explicit opt-in consent)
- To analyse usage patterns and improve user experience
- To detect, investigate, and prevent fraudulent or illegal activities
- To comply with legal obligations and respond to lawful requests from authorities
- To enforce our Terms of Service and other agreements
Data Sharing & Third-Party Disclosure
We do not sell your personal data. We may share data in the following limited circumstances:
Service Providers (Sub-processors)
All sub-processors are bound by Data Processing Agreements (DPAs) and must implement equivalent data protection measures.
Legal Disclosures
We may disclose data when required by law, court order, or governmental authority, or to protect the safety and rights of our users and company.
Business Transfers
In the event of a merger, acquisition, or asset sale, personal data may be transferred. You will be notified at least 30 days in advance via email or prominent website notice.
International Data Transfers
Your data may be processed outside your home country (including the US and EEA). Where such transfers occur, we use appropriate safeguards:
- EU Standard Contractual Clauses (SCCs) — for transfers from the EEA
- UK International Data Transfer Agreements (IDTAs) — for UK transfers
- Adequacy decisions where applicable
- Binding Corporate Rules or equivalent frameworks
For transfers from India under the DPDPA 2023, we comply with all Government of India-approved frameworks and do not transfer data to jurisdictions restricted by notification.
Data Retention
We retain personal data only as long as necessary for the stated purposes or as required by law:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account & profile data | Duration of account + 2 years | Contract / Legal |
| WhatsApp message logs | 12 months from last interaction | Legitimate interest |
| Financial / transaction records | 7 years | Tax & legal obligation |
| Marketing consent records | Until withdrawal + 5 years | GDPR Art. 7(1) |
| Security / access logs | 90 days | Legitimate interest |
| Cookies (analytics) | Up to 13 months | Cookie consent |
After retention periods expire, data is securely deleted or anonymised in accordance with NIST SP 800-88 or equivalent standards.
Cookies & Tracking Technologies
We use cookies and similar technologies. You may control preferences via our Cookie Consent Manager shown on your first visit.
- Strictly Necessary — Required for site functionality; cannot be disabled
- Performance / Analytics — Help us understand usage patterns
- Functional — Remember your preferences and settings
- Marketing / Targeting — Deliver relevant advertising (only with consent)
For users in the EU, UK, and India, non-essential cookies are set only after explicit opt-in consent in accordance with the ePrivacy Directive, UK PECR, and DPDPA.
Your Privacy Rights
GDPR Rights — EU/EEA Residents
- Right to Access — request a copy of your personal data
- Right to Rectification — correct inaccurate or incomplete data
- Right to Erasure (“Right to be Forgotten”)
- Right to Restriction of processing
- Right to Data Portability in a machine-readable format
- Right to Object to processing based on legitimate interests
- Right to withdraw consent at any time without affecting prior lawful processing
- Right to lodge a complaint with your supervisory authority (e.g., ICO, CNIL, BfDI)
CCPA / CPRA Rights — California Residents
- Right to Know what personal information we collect, use, disclose, or share
- Right to Delete your personal information
- Right to Opt-Out of Sale or Sharing of personal information
- Right to Correct inaccurate personal information
- Right to Limit Use of Sensitive Personal Information
- Right to Non-Discrimination for exercising privacy rights
California residents may submit requests via privacy@epicwave.tech. We will respond within 45 days.
India DPDP Act 2023 Rights — Indian Residents
- Right to access a summary of personal data processed and identities of data fiduciaries
- Right to correction, completion, updating, and erasure of personal data
- Right to grievance redressal within a reasonable time period
- Right to nominate another individual to exercise rights on your behalf
Other Jurisdictions
Residents of Brazil (LGPD), Canada (PIPEDA), Thailand (PDPA), and other jurisdictions have analogous rights under their applicable laws. We honour all such requests. Contact us at privacy@epicwave.tech.
To exercise any right, email us at privacy@epicwave.tech. We will verify your identity and respond within 30 days (or as required by applicable law).
Data Security
We implement industry-standard technical and organisational measures to protect your personal data:
- TLS 1.2+ encryption for all data in transit
- AES-256 encryption for sensitive data at rest
- Role-based access controls (RBAC) and principle of least privilege
- Regular penetration testing and vulnerability assessments
- Multi-factor authentication (MFA) for all staff accessing personal data
- SOC 2 Type II aligned security controls
- Documented incident response plan with defined notification procedures
In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify the appropriate supervisory authority within 72 hours (GDPR) and affected individuals without undue delay.
Children's Privacy
Our services are not directed to individuals under 18 years of age (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us immediately at privacy@epicwave.tech and we will promptly delete it.
Automated Decision-Making & Profiling
We may use automated processing for fraud detection, service personalisation, and risk assessment. Where such processing produces significant legal or similarly significant effects, you have the right under GDPR Article 22 to:
- Request human review of automated decisions
- Contest the decision and obtain an explanation of the logic involved
We do not use fully automated decision-making for WhatsApp message routing. All message templates are human-initiated and Meta-approved.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Material changes will be communicated by:
- Email notification to your registered address (at least 14 days before changes take effect)
- Prominent banner notice on our website
- WhatsApp message to opted-in users, where appropriate
Continued use of our services after the effective date constitutes acceptance of the revised policy. Where required by law, we will seek fresh consent.
Complaints & Supervisory Authorities
You have the right to lodge a complaint with your local data protection authority:
- EU/EEA: Your national DPA — edpb.europa.eu
- UK: Information Commissioner's Office (ICO) — ico.org.uk
- India: Data Protection Board of India (established under DPDPA 2023)
- USA (California): California Privacy Protection Agency — cppa.ca.gov
- Brazil: ANPD — gov.br/anpd
We encourage you to contact us first at privacy@epicwave.tech so we can address your concern directly and promptly.
Contact Us
For any privacy-related questions, data subject requests, or concerns, please contact our Data Protection Officer: