Book a demo

Privacy Policy

Last updated:

WAX IO, a French société par actions simplifiée with a share capital of 4 050 €, whose registered office is located at 8 rue Voltaire, 93100 Montreuil, France, registered with the Trade and Companies Register of Bobigny under number 951 944 479 (“WAX”, “we” or “us”), cares about the protection of your personal data.

This policy explains what personal data we collect when you visit our website, contact us, take part in our events or use the WAX platform, why we collect it, how long we keep it, who we share it with and how you can exercise your rights. It is written to comply with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the French Data Protection Act.

1. Who is responsible for your data

WAX acts as data controller for the personal data it processes for its own purposes: the visitors of its website, its prospects and business contacts, and the users of its clients’ accounts on the platform.

WAX acts as data processor for the personal data its clients import into the platform or exchange with their own customers through it (for example the phone numbers and messages of a brand’s customers on WhatsApp, RCS or SMS). Our client, the brand, is then the data controller: it decides why and how those data are used, and its own privacy policy applies. These processing operations are governed by our Data Processing Agreement (DPA). If you are the customer of a brand that uses WAX, please contact that brand first to exercise your rights; we will help it answer you.

2. The data we collect

2.1 When you visit our website or contact us.

  • Demo request: first name, last name, professional email address, phone number and your company’s website. Once your email address is valid, the details you have already entered may be saved before you send the form, so that our team can get back to you if the request is interrupted.
  • Newsletter and SMS offer: your email address.
  • Personalised presentations (pages our sales team prepares for a company and shares by link): first name, last name, professional email address, job title and company, then the actions you take on that page (opening it, sharing it, clicking on a link to book a meeting or to write to us).
  • Meeting booking: the details you give the scheduling tool (name, email address, chosen slot).
  • Campaign data: when you arrive from one of our advertisements or emails, the campaign parameters of the link (UTM parameters) and the click identifier added by the advertising platform (Google, Meta, LinkedIn), sent along with your request.
  • Technical data: IP address, browser type, pages requested and dates, recorded in the logs of our hosting provider to run and secure the website.

2.2 When you are a client or a user of the platform. Identity and professional contact details (first name, last name, professional email address, phone number, job title), login credentials (your password is stored encrypted), connection and activity logs, messages exchanged with our support team, and billing information for the company you represent.

2.3 When you are a business contact. We may collect the professional contact details of people working for companies that could benefit from WAX (name, job title, company, professional email address or phone number) from public sources such as company websites and professional networks, from business data providers, or when we meet you at a trade show or event.

2.4 When you are the customer of a brand that uses WAX. On behalf of that brand, we process your phone number, the information it holds about you in its CRM or online shop (for example your name, orders or preferences), the content of the messages you exchange with it, and statistics on those messages (deliveries, reads, clicks, replies). See section 1.

3. Why we use your data and on what legal basis

  • To answer your demo request, organise the meeting and follow up on it with you: our legitimate interest in answering the people who contact us and in developing our business.
  • To send you our newsletter: your consent, which you can withdraw at any time through the unsubscribe link in each email.
  • To contact professionals about our services (business-to-business prospecting by email, phone or professional networks): our legitimate interest. You can object at any time.
  • To measure the effectiveness of our advertising campaigns, including by informing the advertising platform that a click led to a request: our legitimate interest, or your consent where it is required by law.
  • To create and manage client accounts, provide the platform, its support and its invoicing: the performance of the contract with our client.
  • To secure the website and the platform, prevent fraud and abuse, and produce anonymised usage statistics: our legitimate interest.
  • To keep our accounting records and answer the authorities: our legal obligations.

We do not sell your personal data, and we do not make any decision about you based solely on automated processing that produces legal effects concerning you.

4. How long we keep your data

  • Prospects and business contacts: three (3) years from our last contact with you.
  • Newsletter subscribers: until you unsubscribe.
  • Clients and users: for the duration of the contract, then archived for five (5) years for evidentiary purposes; invoices are kept ten (10) years, as required by French accounting law.
  • Website logs: twelve (12) months at most.
  • Data processed on behalf of our clients: as set out in our contract with the client and the DPA, and in any case deleted or returned to the client at the end of the contract.

5. Who receives your data

Your data is only accessible to the WAX teams who need it (sales, support, product and engineering) and to the service providers we rely on, each bound by a contract that requires it to protect your data and to use it only on our instructions:

  • Google Cloud (Google Ireland Limited): hosting of this website, in Belgium.
  • HubSpot (HubSpot Ireland Limited): customer relationship management, the website’s forms and meeting scheduling.
  • Slack (Slack Technologies Limited): internal notification of new requests to our team.
  • Amazon Web Services and Heroku: hosting of the platform, in the European Union.
  • Intercom: support chat with platform users.
  • Stripe (Stripe Payments Europe Limited): payment and invoicing.
  • Sentry and New Relic: monitoring of errors and performance.
  • Meta Platforms Ireland Limited: delivery of WhatsApp messages sent through the platform.
  • OpenAI (OpenAI Ireland Ltd): artificial intelligence features, only for clients who activate them.

The complete and up-to-date list of the sub-processors of the platform is in our DPA. We may also disclose data when the law requires it, or to a buyer in the event of a merger or acquisition of WAX, which would then remain bound by this policy.

6. Transfers outside the European Union

We favour providers that keep data in the European Union. When one of them, or its parent company, processes data outside the European Economic Area (for example in the United States), the transfer is covered by an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework) or by the Standard Contractual Clauses adopted by the Commission, together with additional safeguards where necessary. You can ask us for a copy of these safeguards.

7. Security

We implement technical and organisational measures appropriate to the risks to protect your data against loss, misuse and unauthorised access: encryption of data in transit and of passwords, access restricted to the people who need it, strong authentication, logging, backups and regular testing.

8. Cookies and similar technologies

On your first visit, a banner asks whether you accept audience-measurement and advertising cookies. Until you accept, none of them is set; the website only stores what it needs to work.

  • Necessary. NEXT_LOCALE, a cookie set when you choose a language with the language switcher, so that the website opens in that language on your next visit; it lasts twelve (12) months. Your browser’s storage keeps the progress of the demo request form for the duration of your visit, and, on a personalised presentation, the fact that you have already filled in its form, so that you do not have to fill it in again. The consent tool, CookieHub, keeps your choice for up to twelve (12) months.
  • Audience measurement, if you accept: Google Analytics and HubSpot measure visits and the pages viewed, to improve the website and to link a demo request to the visits that led to it.
  • Advertising, if you accept: Google Ads, Meta, LinkedIn and OpenAI (advertising in ChatGPT) measure which campaigns lead to a demo request or a sign-up, and Google Ads, Meta and LinkedIn show our ads to people who have visited the website. When you send a demo request, your email address and phone number are shared with Google and Meta in hashed (pseudonymised) form, so that they can match the request to their campaigns.

While you have not accepted, Google’s tags only send signals without cookies or identifiers, which Google uses to estimate the results of campaigns as a whole.

Videos are played from YouTube in its privacy-enhanced mode, which does not store anything before you start a video. The meeting scheduler on the demo page is provided by HubSpot, which may store its own cookies when you use it, under its own privacy policy.

You can change your choice at any time with the Cookie settings link at the bottom of every page, and delete or block cookies in your browser’s settings; the website will keep working.

9. Your rights

Under the GDPR, you have the right to access your personal data, to have it rectified or erased, to restrict its processing, to object to it (and at any time to its use for prospecting), to receive it in a portable format, and to withdraw your consent where the processing is based on it. Under French law, you can also give instructions on what happens to your data after your death.

To exercise these rights, write to us at contact@getwax.io or by post to WAX IO, 8 rue Voltaire, 93100 Montreuil, France. We will answer within one month, and may ask you for proof of identity if we have a reasonable doubt about it.

If you believe your rights have not been respected, you can lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the authority of the country where you live.

10. Changes to this policy

We may update this policy to reflect changes to our services or to the law. The date of the latest version appears at the top of this page; if a change significantly affects how we use your data, we will let you know by email or through the platform.

11. Contact

For any question about this policy or the protection of your data, write to us at contact@getwax.io.