Privacy Policy
WAVO attaches particular importance to respecting your privacy and protecting your personal data. We are committed to processing the data entrusted to us in accordance with applicable data protection laws, in particular the General Data Protection Regulation (“GDPR”) and the French Data Protection Act (Loi Informatique et Libertés).
This privacy policy (the “Policy”) is intended to provide you with clear information about the personal data we may collect, the purposes for which we use it, how long we retain it, the persons to whom it may be disclosed, and the rights available to you.
Last updated: 24 August 2026.
1. Who are we?
The data controller for the processing activities described in this Policy is WAVO, a French simplified joint-stock company (société par actions simplifiée) with share capital of €29,499.09, whose registered office is located at Tour Part Dieu, 129 rue Servient, 69003 Lyon, France, registered with the Lyon Trade and Companies Register under number 921 951 232 (hereinafter “WAVO” or “we”).
WAVO provides businesses with a solution enabling them to unlock the value of their inventory: WAVO temporarily purchases certain goods held in stock, which remain physically at the company’s premises and are progressively repurchased as they are sold, in accordance with the applicable contractual terms.
2. What is personal data?
Personal data means any information relating to an identified or identifiable natural person, directly or indirectly. This may include, for example, a person’s first and last name, professional email address, telephone number, IP address or information relating to their professional activity.
Information relating solely to a legal entity does not, in itself, constitute personal data. However, it may become personal data where it is associated with an identifiable natural person, such as a director, employee, representative, supplier or customer.
3. Who does this Policy apply to?
This Policy applies in particular to:
- visitors to www.wavo.fr and, more generally, to websites or applications operated by WAVO;
- persons who contact us or request an assessment of their company’s eligibility for WAVO services;
- directors, corporate officers, beneficial owners, representatives, employees or contacts of our prospects, customers, partners, suppliers and service providers;
- users of the services, interfaces or applications made available by WAVO;
- persons directly or indirectly involved in a transaction carried out with WAVO;
- persons receiving professional or commercial communications from WAVO;
- candidates applying for a position at WAVO.
4. When do we collect your personal data?
We may collect personal data in particular when:
- you browse our Website;
- you complete a contact or eligibility form;
- you schedule a meeting with a member of our team;
- you communicate with WAVO by email, telephone, video conference or any other means of communication;
- you request an assessment of your company or your inventory;
- you create or use an account or interface made available by WAVO;
- you provide us with documents or connect certain tools or data sources to WAVO where required for the provision of our services;
- your company enters into or performs a transaction with WAVO;
- you subscribe to a newsletter or receive communications from WAVO;
- you participate in an event, survey or initiative organised by WAVO;
- you apply for a position or take part in a recruitment process at WAVO.
Certain information may be required in order for us to process your request or provide our services. Where relevant, mandatory fields are identified at the time the information is collected. If you do not provide certain required information, WAVO may be unable to process your request, assess a transaction or provide all or part of its services.
5. What personal data may we collect?
Depending on your relationship with WAVO and the services concerned, we may process the following categories of data.
5.1. Identification and contact details
- first and last name;
- job title and professional responsibilities;
- professional email address;
- telephone number;
- company or organisation;
- professional address.
5.2. Information relating to the company and its representatives
- company name, SIREN and SIRET numbers and registration details;
- legal form and corporate structure;
- information relating to directors, representatives or beneficial owners where its collection is necessary;
- documents used to verify a person’s identity or authority where required for a transaction or legal obligation.
5.3. Financial, accounting and transactional data
In connection with the assessment, implementation and monitoring of a transaction with WAVO, we may in particular process:
- accounting and financial information;
- purchase and sales history;
- invoices and other commercial or accounting documents;
- information relating to cash flows and transactions;
- bank details required for payments;
- data originating from management tools, ERP systems, accounting software or other professional systems to which you choose to grant WAVO access;
- where applicable, banking or transactional data accessible through a connection expressly established in order to provide WAVO services.
5.4. Data relating to inventory and commercial activity
- type, references and characteristics of products;
- inventory volumes and valuation;
- purchase and sale prices;
- inventory turnover and sales history;
- location and storage arrangements;
- logistics information;
- information relating to suppliers, purchasers or other counterparties where necessary for the relevant transaction.
5.5. Data relating to our relationship with you
- requests submitted to WAVO;
- history of communications;
- email correspondence;
- information shared during meetings;
- meeting notes;
- where applicable, recordings or transcripts of meetings where you have been informed of such recording or transcription;
- complaints and support requests;
- information relating to the performance of a transaction or contract.
5.6. Technical and browsing data
When you use our websites, applications or digital services, we may in particular process:
- IP address;
- device and browser type;
- login data and technical logs;
- pages viewed and interactions with the Website;
- technical identifiers;
- data collected through cookies or similar technologies under the conditions set out below.
5.7. Recruitment data
If you apply for a position at WAVO, we may in particular process:
- your contact details;
- your CV;
- your academic and professional background;
- your professional online profile where relevant;
- your skills and experience;
- your salary expectations or information relating to remuneration;
- information provided during interviews;
- the results of exercises, tests or case studies completed as part of the recruitment process;
- assessments required to evaluate your application.
6. Where does your data come from?
We primarily collect data directly from you or from the company for which you act.
We may also receive or collect certain information:
- from other employees or representatives of your company;
- from partners or business introducers;
- from service providers acting on your behalf or on behalf of WAVO;
- from public registers, official databases or publicly available professional sources;
- from professional websites and networks where relevant to our relationship with you;
- from tools or systems that your company has authorised us to access;
- in the context of recruitment, from recruitment firms, platforms or partners, as well as from publicly available professional sources.
Where your data is not collected directly from you, WAVO ensures that its use complies with applicable data protection laws and provides you, where required, with the information prescribed by the GDPR.
7. Why do we use your data and what are the legal bases?
WAVO processes your data only where a legal basis provided for by applicable data protection laws permits us to do so.
| Purpose | Main legal basis |
|---|---|
| Responding to your requests for contact, meetings or information | Pre-contractual measures and WAVO’s legitimate interest in responding to enquiries |
| Assessing a company’s eligibility and analysing a proposed transaction | Pre-contractual measures and WAVO’s legitimate interest in assessing transactions it may enter into |
| Analysing inventory, cash flows, financial position and the characteristics of a transaction | Pre-contractual measures, performance of a contract and WAVO’s legitimate interest in managing its risks |
| Entering into, managing and performing contracts and transactions with WAVO | Performance of a contract |
| Administering accounts, interfaces and digital services provided by WAVO | Performance of a contract and WAVO’s legitimate interest in providing and securing its services |
| Monitoring inventory and transactions | Performance of a contract |
| Managing customer relationships, support, enquiries and complaints | Performance of a contract and WAVO’s legitimate interest in managing its customer relationships |
| Issuing invoices, processing payments and complying with accounting and tax obligations | Performance of a contract and compliance with legal obligations |
| Preventing and detecting fraud, misuse, security incidents or unlawful activities | WAVO’s legitimate interest in protecting its activities, systems and assets and, where applicable, compliance with legal obligations |
| Complying with legal or regulatory obligations applicable to WAVO | Compliance with a legal obligation |
| Establishing, exercising or defending legal claims | WAVO’s legitimate interest in protecting and defending its rights |
| Conducting B2B commercial prospecting | WAVO’s legitimate interest where permitted by applicable law, or consent where required |
| Sending newsletters or other marketing communications | Consent where required, or legitimate interest where permitted by applicable law |
| Measuring Website traffic and improving our content and services | Consent where required for the relevant trackers; legitimate interest for certain strictly necessary or consent-exempt audience measurement activities |
| Ensuring the security, diagnosis and maintenance of our systems | WAVO’s legitimate interest in ensuring the security and proper functioning of its services |
| Managing job applications and recruitment processes | Pre-contractual measures and WAVO’s legitimate interest in recruiting and assessing candidates |
8. How long do we retain your data?
WAVO retains personal data only for as long as necessary to fulfil the purposes for which it was collected, extended where necessary by retention periods required or permitted by law.
The main retention periods applied are as follows:
| Category of data | Indicative retention period |
|---|---|
| Data relating to a contact request or a prospect who has not entered into a transaction with WAVO | Up to 3 years from collection or from the last contact initiated by the prospect, unless longer retention is necessary for the defence of legal rights |
| Data required to assess a transaction which does not proceed | For the period required to review the request, followed by limited archiving where necessary for evidentiary purposes, risk prevention or the defence of WAVO’s rights |
| Data relating to a customer and the performance of WAVO services | For the duration of the contractual relationship, followed by any periods necessary to comply with legal obligations and defend WAVO’s rights |
| Accounting records and supporting documents subject to statutory retention requirements | 10 years in accordance with applicable accounting obligations |
| Data used for marketing purposes relating to a former customer | Up to 3 years following the end of the commercial relationship, unless you object |
| Data required to manage an objection to direct marketing | Limited to the information necessary to ensure that your objection continues to be respected; a minimum period of 3 years may in particular be applied |
| Technical data and security logs | For a period proportionate to their security, diagnostic or evidentiary purpose |
| Cookie and tracker preferences | For a period proportionate to the relevant purpose; consent and refusal choices may in particular be retained so that you are not asked to provide your preferences on every visit |
| Unsuccessful job application | For the duration of the recruitment process and, where relevant, for up to 2 years following the last contact so that we may contact you regarding future opportunities, unless you object or request deletion |
Once the applicable retention periods have expired, the data is deleted, anonymised or placed in restricted-access intermediate archives where continued retention remains necessary to comply with a legal obligation or to establish, exercise or defend legal claims.
9. Direct marketing and communications
WAVO may use your professional contact details to send you information about its services where permitted under applicable law and where such communications are relevant to your professional activity.
Where your consent is required, no relevant communication will be sent unless valid consent has first been obtained.
You may object to commercial communications or withdraw your consent at any time, as applicable, including by using the unsubscribe link contained in the relevant emails or by contacting us.
Opting out of commercial communications will not prevent WAVO from sending you messages strictly necessary for managing a request, account, transaction or contract, or for providing its services.
10. Cookies and other trackers
When you browse the Website, cookies or similar technologies may be stored on or accessed from your device.
Certain trackers are strictly necessary for the operation, security or provision of a service expressly requested by you and may therefore not require your consent.
Other trackers, in particular those used for audience measurement, personalisation or marketing purposes, are subject to your consent where required by applicable law.
Where the Website provides a cookie management tool, you may use it to accept or reject the relevant trackers and change your preferences at any time.
11. Who may receive your data?
WAVO does not sell your personal data.
To the extent necessary for the performance of their duties, your data may be accessed by or disclosed to the following categories of recipients:
- WAVO employees authorised to access the data as part of their duties;
- hosting, IT infrastructure and data storage providers;
- providers of software, management, customer relationship or communication tools;
- payment service providers and banking partners where their involvement is necessary for a transaction;
- providers enabling the connection to or analysis of financial, accounting, banking, commercial or inventory data where used in connection with WAVO services;
- audience measurement, marketing and communication providers in accordance with applicable rules;
- providers involved in scheduling meetings or facilitating professional communications;
- WAVO’s legal, accounting and financial advisers, auditors and other professional advisers;
- recruitment partners, providers or agencies where you are a candidate;
- administrative or judicial authorities where WAVO is required to disclose information or where such disclosure is necessary to defend its rights.
These recipients are granted access only to the data necessary for the performance of their duties and are subject, where required, to contractual obligations relating to confidentiality, security and data protection.
In the event of a reorganisation, acquisition, merger, sale or other transaction affecting all or part of WAVO’s business, certain data may also be disclosed to persons involved in assessing or carrying out that transaction, in accordance with applicable data protection laws.
12. Data relating to third parties provided by our customers
As part of WAVO services, a customer company may provide us with information relating to its directors, employees, suppliers, customers, partners or other contacts.
The company providing such data to WAVO must ensure that it is authorised to do so and, where necessary, that the individuals concerned have received the information required regarding the processing of their data.
Depending on the nature of the relevant processing activity, the respective roles and responsibilities of WAVO and the customer company in relation to personal data protection may be specified contractually.
13. Is your data transferred outside the European Economic Area?
Where possible, WAVO favours processing and hosting within the European Economic Area (“EEA”).
However, some of our service providers, or their own subprocessors, may be established in or process certain data from countries located outside the EEA.
Where such transfers are subject to the GDPR, WAVO ensures that they rely on an appropriate legal mechanism, including:
- an adequacy decision issued by the European Commission;
- standard contractual clauses approved by the European Commission, supplemented where necessary by additional safeguards;
- binding corporate rules;
- or any other transfer mechanism permitted under applicable data protection laws.
You may contact us to obtain further information regarding the safeguards applicable to a transfer involving your personal data.
14. How do we protect your data?
WAVO implements technical and organisational measures appropriate to the nature of the data processed and the risks associated with the processing in order to protect personal data against, in particular, destruction, loss, alteration, unauthorised disclosure or unauthorised access.
These measures may include:
- authentication and access-control mechanisms;
- restricting access to persons who require the data in order to perform their duties;
- securing communications and data transfers;
- logging and monitoring certain security events;
- appropriate backup and business continuity mechanisms;
- internal security incident management procedures;
- security and confidentiality requirements imposed on relevant service providers.
As no information system can guarantee absolute security, WAVO regularly adapts its measures to the risks identified and to changes in its systems.
In the event of a personal data breach, WAVO complies with the applicable documentation requirements and, where required, notification obligations towards the relevant supervisory authority and affected individuals.
15. What are your rights?
Subject to the conditions set out in applicable law and depending on the legal basis and nature of the relevant processing activity, you may have the following rights:
- right of access: to obtain confirmation as to whether personal data concerning you is being processed and to receive a copy of such data;
- right to rectification: to request the correction of inaccurate or incomplete data;
- right to erasure: to request, in certain circumstances, the deletion of your data;
- right to restriction of processing: to request, in certain circumstances, that the use of your data be temporarily restricted;
- right to object: to object, on grounds relating to your particular situation, to certain processing activities based on legitimate interests;
- right to object to direct marketing: to object at any time and without justification to the use of your data for direct marketing purposes;
- right to data portability: to receive certain data you have provided to us in a structured, commonly used and machine-readable format where the conditions set out in the GDPR are met;
- right to withdraw your consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before such withdrawal;
- right to define instructions concerning the use of your personal data after your death, under the conditions provided for by French law.
16. How can you exercise your rights?
You may exercise your rights by contacting WAVO:
- through our contact form;
- or by post at: WAVO SAS – Personal Data Protection – Tour Part Dieu, 129 rue Servient, 69003 Lyon, France.
Please specify the nature of your request and provide sufficient information to enable us to identify the data concerned.
WAVO may request additional information to confirm your identity only where reasonably necessary, in particular where there are doubts regarding the identity of the person making the request.
We respond to requests within the time limits prescribed by applicable law, in principle within one month of receipt. This period may be extended in accordance with the GDPR depending on the complexity or number of requests.
17. Complaints to the CNIL
If, after contacting us, you believe that your rights have not been respected or that the processing of your personal data does not comply with applicable data protection laws, you have the right to lodge a complaint with the French data protection authority, the Commission Nationale de l’Informatique et des Libertés (“CNIL”), including through its website at www.cnil.fr.
18. Services intended for professionals
The commercial services offered by WAVO are intended for businesses and their professional representatives. They are not intended to be subscribed to or used by minors.
19. Changes to this Policy
WAVO may amend this Policy in order to reflect changes to its services, practices or applicable laws and regulations.
The version currently in force is the version published on the Website. In the event of a material change affecting a processing activity for which specific information is required, WAVO will take appropriate steps to inform the individuals concerned.
20. Contacting WAVO
If you have any questions regarding this Policy or how WAVO processes your personal data, you may contact us through our contact form or write to us at:
WAVO SAS
Personal Data Protection
Tour Part Dieu
129 rue Servient
69003 Lyon
France