1. When GDPR applies
The EU GDPR and UK data-protection rules apply in defined circumstances, including relevant establishment, offering or monitoring activities. A website being accessible worldwide does not alone establish every jurisdiction’s applicability. These rights are described subject to applicable law; this page is not a GDPR certification.
2. Rights you may exercise
Subject to applicable conditions and exemptions, you may request access and a copy of your personal data, correction of inaccurate data, erasure, restriction of processing or portability. You may object to processing based on legitimate interests and have a distinct right to object to direct marketing. You can withdraw consent where consent is the basis. Not every right applies to every record or purpose.
3. How to make a request
Email info@wavekartdigital.com with the subject “Privacy rights request”. Describe the request and the email address or project reference associated with the interaction. Do not send identity documents, passwords or sensitive records with the initial request. Proportionate verification may be needed to protect information from unauthorised disclosure.
4. Response time and cost
Where the GDPR applies, requests generally require a response without undue delay and within one month. A permitted extension of up to two further months may apply for complexity or the number of requests, with notice and reasons within the initial month. Requests are ordinarily free; the law provides limited exceptions. Where another law governs the request, its requirements apply.
5. Exceptions and client-held data
Some information may need to be retained to comply with law or establish, exercise or defend legal claims. A response should explain any relevant restriction. If Wavekart handles the data only for a client, the request may need to be coordinated with that client as controller rather than independently changing its records.
6. Complaints and contact
You may raise a concern with info@wavekartdigital.com and may also contact the appropriate data-protection authority. Under the GDPR, this may include the authority where you habitually reside, work or consider an infringement to have occurred. UK individuals can find information at the ICO. EU information is available from the European Commission.
7. Operational responsibilities
Handling requests requires a monitored contact point, ownership of the process, an appropriate identity-check procedure and a record of responses. Processor contracts, transfer safeguards, retention schedules, breach response and any required EU/UK representation or data-protection officer must be assessed separately. Publishing this page does not complete those tasks.