Privacy Policy

1. Data Controller

Essentiel Outsourcing SL ("BPOWave", "we", "us") is the data controller responsible for your personal data collected through this website and our services.

2. What Data We Collect

Data you provide directly

• Contact information: name, email address, phone number, company name
• Inquiry details: the service you are interested in, your message content
• Account data (for SaaS platform users): login credentials, usage data, content you create within our platforms

Data collected automatically

• Technical data: IP address, browser type and version, operating system, device type
• Usage data: pages visited, time spent, referral source, click patterns
• Cookie data: see our Cookie Policy for details

3. Why We Process Your Data

We process personal data for the following purposes and legal bases:

• To respond to your inquiries and provide requested services (contractual necessity)
• To create and manage your SaaS platform account (contractual necessity)
• To send service-related communications such as updates, maintenance notices, and security alerts (legitimate interest)
• To improve our website and services through analytics (legitimate interest)
• To comply with legal obligations such as tax and accounting requirements (legal obligation)
• To send marketing communications, only with your explicit consent (consent)

4. Who We Share Data With

We do not sell your personal data. We may share data with:

• Hosting and infrastructure providers (EU-based servers)
• Payment processors (Stripe) for subscription management
• Email service providers for transactional communications
• Analytics tools (anonymized data only)
• Third-party integrations you explicitly enable within our SaaS platforms (e.g., Microsoft 365, Apollo.io)

All third-party processors are bound by data processing agreements and GDPR-compliant safeguards.

5. International Transfers

BPOWave operates from Tunisia, Spain, Portugal, Mexico, and Argentina. When your data is processed outside the European Economic Area, we ensure adequate safeguards through Standard Contractual Clauses (SCCs) or equivalent mechanisms approved by the European Commission.

6. How Long We Keep Your Data

• Contact form inquiries: 24 months from last interaction
• SaaS platform accounts: duration of the service agreement plus 12 months
• Invoicing and financial records: as required by applicable tax law (typically 5–10 years)
• Analytics data: 26 months (anonymized)

7. Your Rights

Under the GDPR, you have the right to:

• Access your personal data and receive a copy
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten") where no legal obligation requires retention
• Restrict processing in certain circumstances
• Data portability — receive your data in a structured, machine-readable format
• Object to processing based on legitimate interest
• Withdraw consent at any time, without affecting prior processing

To exercise any of these rights, contact us at info@bpowave.com. We will respond within 30 days.

8. Security

We implement appropriate technical and organizational measures to protect your data, including 256-bit TLS encryption for data in transit, encrypted storage at rest, role-based access controls, and regular security reviews. Our servers are located within the European Union.

9. Children

Our services are not directed at individuals under the age of 16. We do not knowingly collect data from children.

10. Changes to This Policy

We may update this policy to reflect changes in our practices or legal requirements. Material changes will be communicated via email to active users and posted on this page with an updated date.

11. Contact & Complaints

For questions about this policy or to exercise your rights:

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local supervisory authority. For EU residents, you can find your authority at edpb.europa.eu.