Privacy Policy

PEOPLETECH W.L.L (trading as Wave1)
Website: https://wave1.co/
Last updated: September 2026

1 Introduction

PEOPLETECH W.L.L, trading as Wave1 (“Wave1”, “our”, “we” or “us”), is committed to maintaining the confidentiality, integrity and security of personal data collected from visitors to our website, prospective and existing clients, and other contacts, in accordance with all applicable laws.

This Privacy Policy defines our procedures in respect of maintaining the confidentiality, integrity and security of personal data collected and stored by us through our website at https://wave1.co/ (the “Website”), our corporate communications, and other interactions with Wave1, either directly or through our data processors.

Wave1 is a professional services firm. We provide on-demand People and Talent technology consulting, including the deployment, optimisation, integration and automation of HR and talent systems.

This Privacy Policy also covers additional personal information that we may collect and process during or through other interactions, either directly with Wave1 or through our data processors.

We take the protection of your personal and sensitive data seriously, and treat your data in accordance with applicable data protection regulations.

This policy should be read in conjunction with any other privacy notices or fair processing notices and product or service terms and conditions we may provide on specific occasions when we are collecting or processing Personal Data. Where Wave1 acts as a data processor for a client, that client’s instructions and privacy notice, together with our contract with that client, govern the processing of the client’s personal data.

This privacy policy has been developed in line with the provisions of the Bahrain Personal Data Protection Law (Law No. 30 of 2018) (“PDPL”) which came into effect on 1 August 2019.

This Privacy Policy was last updated in September 2026 and will continue to be updated as required. Whenever an update occurs, we will post it on our Website, and we will inform affected individuals of any significant updates where required.

2 Definitions

2.1 Data or Personal Data

Any information in any form relating to an identifiable individual, or an individual who can be identified, directly or indirectly, particularly through his/her personal ID number, or one or more of his/her physical, physiological, intellectual, cultural or economic characteristics or social identity.

In order to determine whether an individual could be identified, all the means used by, or that may be available to, the Data Manager or any other person shall be taken into consideration.

Personal data that we collect may include names, job titles, company names, email addresses, telephone numbers and other business contact details. The type of personal data we obtain from you is typically as set out in our Website enquiry forms and related communications.

2.2 Sensitive Personal Data

Any personal information that reveals, directly or indirectly, the individual’s race, ethnicity, political or philosophical views, religious beliefs, union affiliation, criminal record or any data related to his/her health or sexual life.

2.3 Data Manager

The person who decides, solely or in association with others, the purposes and means of processing certain personal data. Where such purposes and means are prescribed by Law, the Data Manager shall be the person responsible for processing all relevant personal data.

For processing described in this Privacy Policy in relation to the Website and Wave1’s own business contacts, Wave1 is the Data Manager (controller).

2.4 Data Processor

The person who processes personal data for and on behalf of the Data Manager, not including persons who work for the Data Manager or Data Processor.

2.5 Processing

Any operation or set of operations carried out on personal data by automated or non-automated means, such as collecting, recording, organising, classifying in groups, storing, modifying, amending, retrieving, using or revealing such data by broadcasting, publishing, transmitting, making them available to others, integrating, blocking, deleting or destroying them.

2.6 Direct Marketing

Any communication, by any means, through which a marketing or advertising material is directed to a specific person.

3 Data we collect

3.1 Information requested and collected by us

As part of our legitimate business use, and for the purpose of providing our services and operating our Website, we may collect and process the following categories of personal data about past, existing and prospective clients and other business contacts:

Personal data collected and processed by us is restricted to the minimum information that we require in order to respond to enquiries, provide services, operate the Website, or comply with any regulatory provisions or directions as may apply. Not having this information could result in our inability to respond to a request or to provide the services requested, or could affect the quality of those services.

In addition to processing personal data we may also aggregate, stratify and analyse anonymised personal data. As personal data that is aggregated and analysed in this manner is rendered anonymous (i.e. it cannot identify or be linked to individuals) such data is not considered personal data for the purposes of this Privacy Policy.

When Wave1 delivers professional services to a client, we may access personal data inside the client’s own systems as a Data Processor, on the client’s documented instructions. In line with Wave1 Compliance Policies v3.0, Wave1 does not as a standard model store or retain client personal data on Wave1 systems, and does not copy such data into Wave1 corporate email, chat, tickets or local devices. That processing is governed by the client contract and the client’s privacy notice, not by this Website Privacy Policy alone.

3.2 Information that you provide voluntarily

We collect personal data that you provide voluntarily through our Website: for example, when completing online forms to contact us, requesting a call, or otherwise corresponding with us. Personal data we collect may include:

• Name
• Job title, level, job function or role
• Company or organisation
• Contact information, including email address and telephone numbers
• Demographic or business information, such as industry, country, preferences and interests
• Other information relevant to client surveys or similar research (if we invite you to take part)
• Information pertinent to fulfilling our services to you
• Any other personal data that you voluntarily provide to us

We do not intentionally collect sensitive personal data through the Website. Please do not include sensitive personal data in enquiry forms or emails unless we have expressly asked for it for a lawful reason.

Information provided by you on behalf of a wholly or partially incompetent data owner shall be considered within the limits of the law if you are the legal guardian, executor or custodian.

3.3 Information that we collect automatically

When you visit our Website, we collect certain personal data automatically from your device such as:

• Your IP address
• Device type
• Unique device identification numbers where available
• Browser type, broad geographic location (on a country or city level)
• Other technical information

We also collect information about how your device has interacted with our site, including webpages accessed and links clicked. Collecting this information enables us to better understand visitors who come to our Website, such as where they come from and what content on our Website is of interest to them. We use this information for internal analytics and to improve the quality and relevance of our Website for our visitors.

Please note that Wave1 is not responsible for any personal data that may be collected and processed by any third party (i.e. any party other than Wave1) as a result of any person accessing any third party plugin or website through Wave1’s Website.

3.4 Information Collected Through Surveys

Surveys may be conducted by us or on our behalf by third parties. You will voluntarily provide us with Personal Data when participating in and completing a survey (“Survey”). Where you choose not to participate in a Survey, you may not qualify for certain optional benefits we may offer in connection with that Survey. Upon completion of a Survey, we may use the information provided by you and other respondents to analyse preferences and contact you to enhance your experience with us.

Following your feedback, we may contact you to verify the accuracy of a Survey, to verbally deliver a Survey, to provide customer service, or to award any benefit earned as a consequence of completing a Survey.

Third parties collecting personal data on our behalf will have undertaken, in advance and in writing, to maintain the confidentiality, integrity and security of the personal data provided by you, in accordance with applicable laws. Such third parties may also use the personal data provided by you, upon completion of a Survey, for purposes described in their privacy policies. You may discontinue participating in Surveys at any time.

4 Our use of your Personal Data

We may process your personal data for any or all of the following purposes:

• To respond to enquiries and provide information about our services
• To administer our relationship and maintain contractual relations
• For billing, accounting and tax purposes
• For marketing and business development
• To comply with our legal and regulatory obligations
• To establish, exercise or defend legal rights
• To operate, secure and improve our Website and services
• For historical and statistical purposes
• For research, analytics and enhancement of our services

4.1 Legitimate bases for processing personal data of a contact of Wave1

We rely upon the following legitimate bases to process your personal data:

• Explicit consent from you
• Compliance with a legal or regulatory obligation
• To perform our obligations under a contractual arrangement with you, or to take steps at your request prior to entering into a contract
• Our legitimate interests in the effective delivery of information and services to you and in the effective and lawful operation of our business (provided these do not interfere with your rights)

4.2 Marketing

We will provide you with choices regarding certain personal data uses, particularly around marketing and advertising.

We may use your identity, contact, technical, usage and profile data to identify potential services which may be of interest to you.

We may share your personal data with other members of our group (if any) for the purpose of marketing tailored to you, where applicable.

We may provide third parties with aggregated and anonymised data to enable analysis or improvement of our services, without revealing any personally identifiable information.

Opt-in

Where required by law, we will provide you an option to opt-in to our marketing activities (including newsletters, service updates and similar communications) at the time of registering an interest in our services or otherwise contacting us. Existing contacts who are already registered in our systems may continue to receive our marketing communications unless they choose to opt-out, where permitted by law.

Third-party marketing

We will request your express consent before we share your personal data with any company outside Wave1 for that third party’s own marketing purposes.

Opting out

You can ask us to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you (where provided) or by contacting us at any time at security@wave1.co.

You may still receive messages for a short period of time until updated marketing preferences are set. Opting out of marketing does not stop messages needed to respond to an active enquiry or to administer a contract.

4.3 Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to know how processing for any new purpose is compatible with the original purpose, please contact us.

If we need to use your personal data for an unrelated purpose, we will notify you to explain the legal basis which allows us to do so or, where required by law, to seek your consent.

5 Data disclosure

We will only disclose your personal data to third parties outside of Wave1 in the following circumstances:

• When explicitly requested or consented by you
• To perform our obligations under a contractual arrangement with you, or
• As compelled by a court order or by any other legal or regulatory requirement

Third-party recipients of personal data may include:

• Professional advisors such as law firms, tax advisors or auditors
• Insurers
• Audit regulators
• Tax and customs and excise authorities
• Regulatory and other professional bodies
• Providers of identity verification services (where used)
• The courts, police and law enforcement agencies
• Government departments and agencies
• Service providers (including Website hosting, analytics, email and collaboration tools)
• Emergency services (where applicable)
• Other members of our group (if any)
• Sub-processors and delivery contractors engaged to support delivery of our services, under written contracts

This Website may include links to third-party websites, plug-ins and applications which are not maintained or controlled by Wave1. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you look at other websites, we encourage you to read the Privacy Policy of every website you visit.

We may also receive personal data about you from third parties. Prior to using such information for a new purpose, we will communicate with you and obtain your explicit consent where required by law.

6 Data retention

Once collected, your personal data will be stored with us in digital formats (and in physical formats where applicable).

Our policy is to retain personal data only for as long as it is needed. Retention periods are set in accordance with local regulatory and professional retention requirements to meet our professional and legal requirements, to establish, exercise or defend our legal rights, and for archival purposes.

For historical statistical analysis, we may need to retain information for significant periods of time after suitably anonymising the information.

7 Transfer of data outside Bahrain

Bahrain’s Personal Data Protection Law 2018 sets out the circumstances under which personal data may be transferred outside of Bahrain. Except in the circumstances described in Section 5 above (“Data Disclosure”), where you have explicitly consented to your personal data being disclosed to any third party or parties, we will only disclose your personal data to such third party or parties where they have undertaken, in advance and in writing, to maintain the confidentiality, integrity and security of the personal data concerned, in accordance with applicable laws.

Certain personal data may be transferred outside Bahrain in order to operate our Website and corporate systems, or to deliver services to clients (for example where our personnel, service providers or a client’s systems are located outside Bahrain). We minimise the quantity and type of personal data that must be transferred in this manner.

8 Our data security measures

Our Data Managers are responsible for ensuring the application of technical and organisational measures capable of protecting personal data against unintentional or unauthorised destruction, accidental loss, unauthorised alteration, disclosure or access, or any other form of processing.

We have instituted security measures for providing an appropriate level of security aligned to the nature of the data being processed, and the risks that may arise from this processing. Our various security measures include encryption, access controls, multi-factor authentication, managed endpoints, staff training and contractual confidentiality. Data is shared within Wave1 (including employees, contractors and agents) on a need-to-know basis and under strict confidentiality arrangements.

Notwithstanding this, despite our best efforts, we cannot absolutely guarantee the security of data against all threats. We have implemented suitable measures to identify, monitor and report any breaches to personal data in line with the requirements of the law and, for client processing, our contractual notification commitments.

9 Your legal rights

Under the provisions of the law, you are provided with the following rights in relation to the processing of your personal data. To exercise your rights under the law, you may be required to authenticate yourself with adequate proof of identity.

9.1 Right to enquire

You have the right to request and obtain information on your personal data that we hold and the purpose for which it is maintained by us.

9.2 Right to object

You have the right to object to being contacted by us for direct marketing purposes. On receipt of such objection, we will ensure that you are removed from the relevant marketing databases, as applicable.

To opt-out from receiving direct marketing communications, please contact us at any time through the following channels:

• Email: security@wave1.co
• Click the unsubscribe link at the end of a marketing email, where provided

9.3 Right to Demand Rectification, Blocking or Erasure

You may submit an application to request to rectify, block or erase your personal data, as the case may be, if the processing thereof is done in contravention of the provisions of the law, and in particular, if the data is incorrect, incomplete or not updated, or if the processing thereof is illegal.

9.4 Right to withdraw consent

At any time, subsequent to providing consent, you have the right to withdraw the consent provided. Withdrawal of consent will be applicable to future use of the personal data and will not in any way impact legitimate use of the personal information prior to the withdrawal of the consent.

Withdrawal of consent to process certain personal data related to services provided by Wave1 may result in our inability to continue the provision of those services.

9.5 Right to complain

You may submit a complaint to the Authority, if you have reason to believe that any violation of the provisions of this privacy law has occurred or that we are processing personal data in contravention of its provisions.

10 Your responsibilities

We are required by law to confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights) prior to processing any requests from you, to ensure that your personal data is not disclosed to any person who has no right to receive it.

We may also contact you to ask you for further information in relation to your request to speed up our response.

It is important that the Personal Data we hold about you is accurate and up-to-date. It is your obligation to keep us informed if your Personal Data changes during your relationship with us, by contacting us at security@wave1.co.

If your request relates to personal data held in a client’s systems that Wave1 accesses only as a Data Processor, please contact that client (the Data Manager). Wave1 will assist the client where contractually required.

11 Complaints and objections

We take your privacy seriously. If you believe that there has been an alleged breach of privacy of your personal data, please reach out to us on any of the undermentioned channels:

• Email: security@wave1.co
• Post: PEOPLETECH W.L.L (trading as Wave1), Building 2102, Road 2825, Block 428, Seef, Kingdom of Bahrain

We appreciate the chance to deal with your concerns and are committed to resolving them in an efficient and timely manner.