Wavedd Privacy Policy
Last updated: 13 November 2025
Welcome to Wavedd and our website at www.wavedd.com. This Privacy Policy describes our practices for collecting, using, protecting and disclosing the Personal Data we collect from you when you visit our website and use our services.
General Information
What law applies?
In principle, we will only use your Personal Data in accordance with the applicable data protection laws, in particular the UK’s Data Protection Act (“DPA”) and the UK GDPR.
What is Personal Data?
Personal Data is any information relating to personal or material circumstances that relates to an identified or identifiable individual. This includes, for example, your name, date of birth, e-mail address, postal address, or telephone number as well as online identifiers such as your IP address.
What is processing?
“Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means. The term is broad and covers virtually any handling of data.
Who is responsible for data processing?
The Data Controller within the meaning of the DPA and the UK GDPR is Isho Creative Ltd of 128 Kennington Park Road, London, SE11 4DJ, England (“Wavedd”, “we”, “us”, or “our”).
If you have any questions about this policy or our data protection practices, please contact us at help@wavedd.com.
What are the legal bases of processing?
In accordance with the DPA and UK GDPR, we must have at least one of the following legal bases to process your Personal Data:
- Consent – Where you have given us explicit permission to process your data for a particular purpose.
- Contract – Where we process your information to fulfil a contractual arrangement we have with you or to respond to your messages, emails, posts or calls.
- Legitimate Interests – Where we rely on our interests in providing and improving our services in a secure and appropriate way. We balance our interests against your rights and only rely on this basis where it is not overridden by your interests.
- Legal Obligation – Where we have a legal or regulatory obligation to process the information (for example for tax, accounting, or crime prevention purposes).
Data We Collect Automatically
Log data
Even if you do not log in or register on our website, but simply browse our website, certain data is collected, stored and processed by us. This includes, for example:
- IP address of your device
- Date and time of access
- Name and URL of the accessed file or page
- Browser type and version
- Referrer URL (the previously visited page)
- Amount of data transferred
- Session ID and technical error codes (if any)
The legal basis for this processing is our legitimate interest in ensuring the security, stability and proper functioning of our website.
Hosting
We use third-party hosting providers to operate, display and secure our website and marketplace. All data collected on our website is processed on servers operated on our behalf. The legal basis for this data processing is our legitimate interest in providing a secure, reliable and efficient online service.
Cookies
We use cookies and similar technologies on our website. Cookies are small text files that are stored on your device and can be read by our servers or those of third parties. Cookies can be categorised as:
- Essential Cookies – Necessary for the proper and secure operation of the website (e.g. to maintain log-in sessions, shopping basket functionality).
- Non-essential Cookies – For example, cookies used for analytics (to understand how the website is used) or for marketing/advertising.
As set out in the UK’s Privacy and Electronic Communications Regulations (“PECR”), we must obtain your consent for the use of non-essential cookies. For further information on the cookies we use, please refer to our Cookie Policy. The legal bases for the use of cookies are our legitimate interests and, where required, your consent.
Cookie consent tool
Our website uses a cookie consent tool to obtain and record your consent to the use of cookies. When you visit our website, the following Personal Data may be processed:
- Your consent(s) or withdrawal of consent(s)
- Your IP address
- Information about your browser
- Information about your device
- Date and time of your visit and consent decision
The legal bases for this processing are our legitimate interests and your consent.
Analytics (e.g. Google Analytics / MonsterInsights)
We use analytics tools (such as Google Analytics, implemented via plugins like MonsterInsights) to help us understand how visitors use our website and to improve our services. These tools may use cookies and similar technologies to collect information such as your IP address, device information, pages visited and time spent on the site.
Where required by law, we only use non-essential analytics cookies with your consent via our cookie consent tool. The legal bases for this processing are our legitimate interests and, where applicable, your consent.
Rank Math (SEO)
We use the Rank Math plugin to manage on-site search engine optimisation (SEO) settings such as meta tags and sitemaps. Rank Math itself does not set additional tracking cookies for visitors nor does it independently collect Personal Data beyond what is already processed by our website and hosting environment. The legal basis for this processing is our legitimate interest in improving the visibility and technical performance of our website.
Google Fonts
We may integrate fonts provided by Google, so that they are displayed in your browser when you visit our website. The integration is based on our legitimate interests in a technically secure, maintenance-free and efficient use of fonts, their uniform display and taking into account possible licensing restrictions. The legal basis for this processing is our legitimate interest.
Font Awesome
We may use Font Awesome icons provided by Fonticons Inc. The user’s data is used solely for the purpose of displaying the icons in the browser. The legal basis for this processing is our legitimate interest in an attractive and consistent design.
Content Management System (WordPress)
We use the WordPress Content Management System (CMS), provided by Automattic Inc., to create, publish and manage our website content and forms. Any data you submit through forms on our website (for example, contact forms or account registration) is processed via WordPress. The legal basis for this processing is our legitimate interest in operating a functional website and fulfilling our contractual obligations.
WooCommerce
To provide our online marketplace and shop, we use WooCommerce, a service developed by Automattic Inc. WooCommerce provides the e-commerce platform through which we offer products and services for sale. Your account data, order details and usage data related to purchases are stored and processed on servers used by WooCommerce and our hosting providers. The legal bases for this processing are performance of a contract and our legitimate interests.
Links to other websites
Our website may contain links to third-party websites. If you follow these links, the respective providers may set their own cookies and collect Personal Data. These activities are governed by the privacy policies of those third parties. We recommend that you review the privacy and cookie policies of each website you visit.
Data We Collect Directly
Contacting us
If you contact us (for example by email, contact form or telephone), we process the Personal Data you provide, such as your name, e-mail address, telephone number and the content of your message. We use this data solely to respond to your enquiry and to manage any follow-up. The legal bases for this processing are performance of a contract (or pre-contractual measures) and our legitimate interests.
Creator Account and Store
For the creation of a Creator Account and Creator Store, we require contact details such as your name, store name, address and email address (we may also send you a verification code by e-mail), as well as information on the type of membership you have chosen. You can store and update this data in your user account. We use this data to manage your creator profile and maintain an accurate database of Creators on Wavedd. The legal bases for this processing are performance of a contract and our legitimate interests.
When using our services
The protection of your Personal Data is particularly important to us in the performance of our services. We only process Personal Data that is necessary for the operation of our marketplace and the fulfilment of our contractual obligations.
Provision of our Marketplace Services and third-party fulfilment
We process the data of our Buyers and Creators to operate the Wavedd marketplace. This includes enabling you to select, purchase, sell and licence digital audio products and merchandise, manage orders and transactions, and communicate with us and other users.
When you purchase from a Creator, we share your relevant Personal Data (for example your name, e-mail address and order details, and where applicable your shipping address) with that Creator so that they can fulfil your order and provide customer support. For physical merchandise, we also share your data with third-party fulfilment providers, such as Printful, so that they can produce and deliver your order.
Creators and fulfilment providers are independent controllers or processors (depending on the arrangement) and are responsible for their own compliance with data protection law in relation to the Personal Data they receive. The legal bases for this processing are performance of a contract, legal obligations and our legitimate interests in operating a multi-creator marketplace and fulfilling your orders.
Purchasing audio files and other digital products
When you purchase digital products from us or from Creators on the marketplace, we process your first name, last name, e-mail address (for delivery of your order), billing address and information relating to your contract with us to handle and record the transaction. You may also register for an account, which allows you to reuse your details for future purchases and to access your delivered products. We store your data for as long as you maintain an account with us or as long as required by law. The legal bases for this processing are performance of a contract and our legitimate interests.
When making a purchase (payments)
To make a purchase, you may need to provide a valid payment method (e.g. credit or debit card). Your payment information is collected and processed by our authorised payment provider (for example, Stripe). We do not directly collect or store full card numbers in the ordinary course of processing transactions. The legal basis for the provision of this payment system is the establishment and fulfilment of the contract.
Administration, financial accounting, office organisation, contact management
We process data in the context of administrative tasks, financial accounting and the organisation of our business as well as for compliance with legal obligations (for example, tax and accounting rules). In this context, we may process the same data that we process in the course of providing our services. Based on our business interests, we may also store information on Creators and business partners for later contact. The legal bases for this processing are our legal obligations and our legitimate interests.
Marketing
If you have given us separate consent to process your data for marketing and advertising purposes, we are entitled to contact you for these purposes via the communication channels you have consented to.
Your consent may be obtained, for example, by ticking a box on a form or signing up to a newsletter. Sometimes your consent may be implied from your interactions or contractual relationship with us where you would reasonably expect marketing communications.
Direct marketing generally takes the form of email using tools such as Mailchimp (or similar email service providers), but may also include other channels. Every direct marketing message we send will include a way for you to unsubscribe or opt out. The legal bases for this processing are your consent and our legitimate interests.
Social Media
We are present on social media (currently including platforms such as Facebook, Instagram, TikTok and X/Twitter). If you contact or connect with us via these platforms, we and the relevant platform providers may jointly process your Personal Data. The legal bases for this processing are our legitimate interests, your consent or, in some cases, the initiation or performance of a contract.
When you visit our profiles and interact with us
When you visit our social media profiles and interact with us (e.g. by sending messages, posting comments, liking or sharing our content), we process the actions and content you submit as well as publicly accessible profile information (such as your name and profile picture). Which of your profile details are publicly visible depends on your own settings with the respective social media provider.
We recommend that you do not send sensitive or confidential information (such as payment or health information) via social media. Please use more secure channels such as e-mail instead.
Principles of Processing Personal Data
Storage and retention
We process and store your Personal Data for as long as is necessary for the purposes described in this Privacy Policy, in particular for the duration of our business relationship with you. We are also subject to statutory retention and documentation obligations, for example under Companies House and HMRC rules. These retention periods are usually between two and six years.
Security
Our website uses SSL or TLS encryption to protect the transmission of confidential content, such as orders, login data or contact requests that you send to us. We have implemented appropriate technical and organisational measures (for example, access controls, encryption and regular security reviews) to protect Personal Data against unauthorised access, loss or misuse.
However, no method of transmission over the internet or method of electronic storage is completely secure. In the event of a Personal Data breach, we will inform you and the relevant supervisory authority without undue delay where required by law.
Special Category Data
Unless specifically required for a particular service and with your explicit consent, we do not intentionally collect or process special categories of Personal Data (such as data relating to health, religion or ethnicity).
Automated decision-making
We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.
Do Not Sell
We do not sell your Personal Data.
Sharing and Disclosure
We will not disclose or otherwise distribute your Personal Data to third parties unless:
- it is necessary for the performance of our services (e.g. sharing data with Creators, fulfilment partners such as Printful, payment providers, shipping providers);
- you have given your consent;
- we are legally obliged to do so (for example, by court order or to support criminal or legal investigations); or
- we need to do so to protect our legitimate interests (for example, to enforce our rights or defend against legal claims).
Third-party fulfilment (e.g. Printful)
For orders that include physical merchandise, we share your Personal Data (such as your name, shipping address and order details) with third-party fulfilment providers, such as Printful, so that they can produce and deliver your order. These providers act as independent controllers or processors and are responsible for their own compliance with data protection law. The legal bases for this processing are performance of a contract and our legitimate interests.
International Transfers
We may transfer your Personal Data to organisations located outside the UK or the European Economic Area (EEA), for example to our payment providers, email marketing tools, analytics providers and fulfilment partners (such as Printful), some of whom may be based in the USA or other countries.
Where we transfer Personal Data outside the UK/EEA, we take all reasonable measures to ensure an adequate level of protection, such as using standard contractual clauses approved by the European Commission or UK authorities, or transferring to countries with an adequacy decision.
Your Rights
Under the DPA and UK GDPR, you have the following rights in relation to your Personal Data:
- Right to information – To obtain confirmation and information about the Personal Data we hold about you.
- Right to rectification – To request correction of inaccurate or incomplete data.
- Right to deletion – To request deletion of your Personal Data in certain circumstances.
- Right to data portability – To receive your Personal Data in a structured, commonly used and machine-readable format and to transmit it to another controller where technically feasible.
- Right to object – To object to processing based on our legitimate interests or for direct marketing.
- Right to withdraw consent – To withdraw your consent at any time where processing is based on consent.
- Right to complain to a supervisory authority – To complain to the Information Commissioner’s Office (ICO) or another competent authority.
- Right not to be subject to a decision based solely on automated processing – Where such a decision would have legal or similarly significant effects.
Children’s data
Our services are not directed at children and we do not knowingly collect Personal Data relating to individuals under the age of 18. If you believe that we have collected Personal Data about a child, please contact us and we will delete that information as required by law.
Updating your information
If you believe that the information we hold about you is inaccurate or incomplete, or if your details change, please contact us so that we can update our records.
Withdrawing your consent
You can withdraw any consent you have given us at any time by contacting us. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
Access requests
If you wish to exercise your rights (for example, to access your data or request deletion), please contact us in writing. We will respond as soon as reasonably possible and within the timeframes set by law, usually within one month. If we are unable to comply with your request, we will explain why.
Complaint to a supervisory authority
You have the right to complain about our processing of your Personal Data to a supervisory authority responsible for data protection. In the UK, this is the Information Commissioner’s Office (ICO):
Information Commissioner’s Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
www.ico.org.uk
Validity and Questions
This Privacy Policy is the current and valid version as of 13 November 2025. From time to time, it may be necessary to revise this policy, for example due to changes in our services or legal requirements. We will publish any updates on this page and may notify you by email or through the platform where appropriate.
If you have any questions about this policy or our data protection practices, please contact us at help@wavedd.com.