Privacy Policy

Effective date: 13 May 2026 · Version 1.0

This Privacy Policy explains how Techwave Pty Ltd (ABN 13 644 894 397), trading as waveMail ("waveMail", "we", "us", "our"), collects, uses, stores, discloses and otherwise handles personal information. It applies to wavemail.com.au, the waveMail application at app.wavemail.com.au, our APIs, and any other waveMail product or service.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs"). Where applicable, we also handle personal data in line with the EU General Data Protection Regulation ("GDPR") and the UK GDPR.

1. Who we are and how to contact us

waveMail is a business unit of Techwave Pty Ltd. For privacy questions, requests or complaints, contact us at:

Techwave Pty Ltd (ABN 13 644 894 397)
Attention: Privacy Officer
Level 9, 123 Epping Rd
Macquarie Park NSW 2113 Australia
Phone: 1300 168 777
Email: [email protected]

2. Scope of this policy: customer vs. recipient data

waveMail handles two distinct categories of personal information, and the way each is treated is different:

Customer data

"Customer" means a person or business who holds a waveMail account and uses the platform to send email. We are the data controller for personal information about Customers.

Recipient data

"Recipient" means a person whose contact details a Customer uploads to waveMail and to whom that Customer sends email through our platform. For Recipient data, the Customer is the data controller and waveMail is the data processor. We process Recipient data only on the documented instructions of the Customer and as required to provide the platform.

Recipients who wish to exercise their rights over their personal information should generally contact the Customer who is sending them email. We will assist Customers in responding to those requests where reasonable.

3. What personal information we collect

From Customers

• Account information: name, business name, ABN, email address, phone number, postal address, password (hashed).
• Billing information: billing address, plan tier, invoices, and limited payment metadata (full card details are handled by our payment processor and never stored by waveMail).
• Usage information: logins, IP addresses, user-agent strings, audit log entries, API usage metrics, sending volume, deliverability metrics.
• Communications: support tickets, live-chat transcripts, email correspondence with our team.

From Recipients (acting as processor on behalf of Customers)

• Contact details: email address, name, and any other custom fields the Customer chooses to store (e.g. postcode, purchase history).
• Engagement data: opens, clicks, bounces, unsubscribes, complaint flags, geolocation derived from IP at time of open or click (approximate, to city/region level).
• Consent records: source of subscription, timestamp, IP address at time of opt-in (where captured via our forms).

From website visitors

• Pages viewed, referrer, IP address (anonymised for analytics), browser type, and information submitted via the contact or newsletter form.

4. How we use personal information

We use personal information to:

• Provide, operate and improve the waveMail platform and the wavemail.com.au website.
• Authenticate users, manage accounts and provide customer support.
• Process payments, issue invoices, and prevent fraud.
• Send Customers transactional emails (account, billing, security, service notices).
• Send Customers product news and educational content, where they have opted in. Customers can unsubscribe at any time using the link in those emails.
• Comply with our legal obligations, including the Spam Act 2003 (Cth), tax and accounting laws.
• Detect and prevent abuse of the platform, including spam complaints, deliverability incidents and prohibited content.

5. Who we share information with

We do not sell personal information. We share it only with the parties listed below, and only to the extent necessary:

• Service providers ("sub-processors") who help us deliver the platform. These include cloud infrastructure (Amazon Web Services, Sydney region), email-sending infrastructure (Amazon SES), payment processing, customer-support tooling and analytics. We require each to handle personal information consistently with this policy.
• Other waveMail business units within Techwave Pty Ltd, where necessary for support, billing or compliance purposes.
• Recipient mailbox providers (e.g. Gmail, Outlook), to whom we hand off email-message envelopes containing Recipient email addresses for the purpose of delivery.
• Government, regulators and law-enforcement where we are legally required to disclose, including under a warrant, subpoena or notice issued by the Australian Communications and Media Authority ("ACMA") under the Spam Act.
• Acquirers, in connection with a merger, acquisition or sale of substantially all of our assets, in which case we will require any acquirer to honour the terms of this policy.

6. Where we store data

waveMail is built on Australian sovereign infrastructure. Customer accounts, Recipient lists, campaign content and engagement data are stored in AWS data centres in the Sydney region (ap-southeast-2). Outbound email is sent from AWS SES in Sydney.

Some operational tooling (e.g. error monitoring, support helpdesk) may process limited metadata outside Australia. Where that occurs, we put in place reasonable contractual protections, typically the European Commission Standard Contractual Clauses or an equivalent.

7. How we protect personal information

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. These include:

• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256).
• Hashed passwords (bcrypt or stronger) — we cannot see your password.
• Role-based access controls within the waveMail team, audit logging of administrative actions, and least-privilege principles.
• Regular vulnerability scanning, dependency patching and security review of our codebase.
• Sub-processors who maintain industry-recognised certifications (e.g. SOC 2, ISO 27001).

No method of transmission or storage is perfectly secure. If a notifiable data breach occurs, we will notify affected individuals and the Office of the Australian Information Commissioner ("OAIC") as required by the Notifiable Data Breaches scheme.

8. How long we keep personal information

• Customer account data: for as long as the account is active, plus up to seven years after account closure to meet tax and accounting record-keeping obligations.
• Recipient data: for as long as the Customer keeps it in their account. When a Customer deletes a Recipient or closes their account, Recipient data is deleted from production within 30 days and from encrypted backups within a further 90 days.
• Email engagement data: retained for the life of the Customer's account so that aggregate reports remain accurate, then deleted as above.
• Suppression lists (unsubscribes, bounces, complaint records): retained indefinitely as a hashed value, to prevent us from emailing those addresses again on behalf of any Customer. This is for the protection of Recipients.
• Support communications: typically retained for two years after the ticket is closed.

9. Cookies and tracking

The wavemail.com.au website uses cookies and similar technologies to:

• Keep you signed in to the waveMail application.
• Remember site preferences (e.g. light/dark interface) and your cookie choices.
• Measure how the site is used (privacy-respecting analytics, IP truncated).
• Operate the Cloudflare Turnstile anti-bot service on our forms (used to tell humans from bots and protect against spam).

On your first visit, a cookie banner asks for your consent before any non-essential cookies are set. You can accept all, reject all, or choose individual categories — and you can change your choices at any time via the Cookie settings link in the footer of any page. Your choices are stored in a first-party cookie (wm_consent) for 12 months.

For full details of the categories we use and the specific cookies in each, see our Cookie Policy. You can also clear or block cookies via your browser settings; some features of the site may not work without them.

10. Email open and click tracking

When a Customer sends an email through waveMail, the email may contain a transparent 1×1 tracking pixel and rewritten links that pass through our tracking domain. These let the Customer see open and click activity. Recipients who do not wish to be tracked can use the unsubscribe link in any email, ask the sender to remove tracking, or use a mail client that blocks remote images and prefetched links.

11. Your rights

Under the Australian Privacy Principles and (where applicable) the GDPR, you have rights in relation to your personal information, including:

• Access: request a copy of the personal information we hold about you.
• Correction: ask us to correct information that is inaccurate, out-of-date or incomplete.
• Deletion: ask us to delete your personal information, subject to legal and operational retention obligations described above.
• Restriction and objection: ask us to restrict processing, or object to processing based on our legitimate interests (GDPR).
• Portability: request a machine-readable export of your account data (GDPR).
• Withdraw consent: where we rely on consent, withdraw it at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact [email protected]. We will respond within 30 days. We may need to verify your identity before acting on the request.

If you are a Recipient (not a Customer), please contact the business that sent you the email first. We will assist that business in responding to your request.

12. Children

waveMail is a business product and is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. The "Effective date" at the top of the page will change when we do. Material changes will be notified to Customers by email or in-product notice at least 14 days before they take effect.

14. Complaints

If you have a privacy complaint, please first contact our Privacy Officer using the details in section 1. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, or with your local supervisory authority if you are based in the EU or UK.

This document is provided as part of the waveMail website and is not legal advice. If you operate a business that handles personal information through waveMail, you should obtain independent legal advice on your own privacy obligations.