Privacy Policy

Last updated: 12 September 2026

WAVE ENGLISH, a simplified joint-stock company with a sole shareholder, with share capital of €10,000, whose registered office is located at 10 rue de la Paix, 75002 Paris, registered with the Paris Trade and Companies Register under number 840 461 800 (hereinafter "we", "us" or the "Company"), publishes the website accessible at https://www.wave-english.com (hereinafter the "Site").

This policy explains what personal data we collect when you visit the Site, why we collect it, what we do with it, and what rights you have. It is written to comply with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR").

We have kept the Site's data collection deliberately narrow. Before you give consent, the Site sets a single cookie, which records your cookie choices and nothing else. We do not use advertising cookies, we do not sell or share data with advertisers, and we do not operate user accounts.

This policy should be read together with our Legal Notice. We may update it to reflect regulatory, technical or editorial changes. Where changes are significant, we will say so on the Site.

Article 1: What personal data do we collect?

Personal data means, in the words of the GDPR, "any information relating to an identified or identifiable natural person".

We collect personal data in three circumstances.

1.1 When you request a complimentary consultation

The consultation form asks for the following. Some of it is professional information about you and your practice, and we set it out in full so that you can see exactly what you are providing:

• first name and last name;
• email address;
• telephone number;
• country, and a free-text field if your country is not listed;
• practice area;
• firm name;
• role;
• your self-assessed level in English;
• your goals for the coaching (free text);
• your preferred start date;
• how you heard about us.

You choose what to write in the free-text fields. We ask for this information because a consultation is only useful if we understand your practice and what you want from it. We do not use it for anything else.

1.2 When you subscribe to our newsletter

The newsletter form asks for your email address only.

1.3 When you browse the Site

If — and only if — you consent to analytics cookies, we collect technical information about your visit: your IP address, browser type, operating system, the pages you view, and the date and time of access, together with a recording of how you interact with the pages. This is described in Article 10. If you do not consent, none of this is collected.

The fields marked as required on the consultation form are needed to arrange and prepare a consultation. If you prefer not to provide them, we cannot arrange one, but you are welcome to contact us by email instead. Everything else on the form is optional, and leaving it blank has no consequence.

We also use a privacy-focused analytics tool which sets no cookies and does not identify individual visitors. It is described in Article 10.

We do not collect your date of birth, your postal address, or your location.

Article 2: Why do we collect it, and on what legal basis?

• Responding to your consultation request, assessing whether we can help, and arranging a session — using the consultation form fields listed at 1.1, other than referral source. Legal basis: steps taken at your request prior to entering into a contract (GDPR Art. 6(1)(b)).
• Understanding how people find us — using the referral source field, which you may leave blank. Legal basis: our legitimate interests (GDPR Art. 6(1)(f)).
• Sending you our newsletter — using your email address. Legal basis: your consent (GDPR Art. 6(1)(a)), withdrawable at any time.
• Understanding how the Site is used, so we can improve it — using technical and interaction data. Legal basis: your consent (GDPR Art. 6(1)(a)).
• Measuring overall Site traffic without identifying visitors — aggregate and cookieless. Legal basis: our legitimate interests (GDPR Art. 6(1)(f)).
• Recording your cookie choices — consent record, anonymous identifier and region. Legal basis: our obligation to be able to demonstrate consent (GDPR Art. 6(1)(c) and Art. 7(1)).

We do not use your data to build advertising profiles, and we do not use it to train artificial-intelligence models.

Article 3: Who processes your data?

3.1 Us

WAVE ENGLISH is the data controller.

3.2 Our service providers

We use a small number of third-party providers to run the Site. Each acts as a processor on our instructions, under a data processing agreement.

• Brevo (Sendinblue), France — receives and stores form submissions; email delivery and contact management.
• Webflow, United States — hosting the Site.
• Microsoft, France — email hosting (Outlook): enquiries sent to us are received and stored here.
• Mouseflow, Denmark — analytics and session recording, only with your consent.
• Plausible Analytics, European Union — cookieless traffic measurement.
• Finsweet (Consent Pro), United States — cookie consent management.

Both the consultation form and the newsletter form submit directly to Brevo. The information you enter is therefore held by Brevo, in France, and by us.

We do not sell your personal data, and we do not share it with third parties for their own purposes.

3.3 Where the law requires it

We may disclose personal data where we are legally obliged to do so — for example in response to a request from a judicial or administrative authority acting within its powers, or to establish, exercise or defend a legal claim.

Article 4: Is your data transferred outside the European Union?

The information you submit through our forms is held in France by Brevo.

Some of the providers that support the Site are established in the United States, as set out in Article 3.2. Webflow, which hosts the Site, is certified under the EU–U.S. Data Privacy Framework, so transfers to it rest on the European Commission's adequacy decision for that framework. Where a provider is not certified, transfers are governed by the European Commission's Standard Contractual Clauses, together with any additional safeguards required.

Article 5: How is your data protected?

We apply appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration or disclosure. The Site is served over HTTPS, and access to form submissions and mailing lists is restricted to those who need it.

Article 6: How long do we keep it?

• Consultation request, where it leads to an engagement — for the duration of the engagement, and thereafter for the period required to defend a legal claim or to meet our accounting obligations.
• Consultation request, where it does not lead to an engagement — three years from your last contact with us.
• Newsletter subscription — until you unsubscribe, and deleted promptly thereafter.
• Analytics and session recordings (Mouseflow) — 12 months.
• Cookieless traffic statistics (Plausible) — aggregate only; no personal data retained.
• Cookie consent record — 1 year, being the lifetime of the consent cookie.
• Invoices and accounting records — 10 years, as required by French commercial law.

You may ask us to delete your consultation request at any time, and we will do so unless we are required to keep it.

Article 7: Children

The Site and our services are intended for practising legal professionals. They are not directed at children, and we do not knowingly collect personal data from anyone under the age of 15.

If you believe a child has provided us with personal data, please contact us using the details in Article 9 and we will delete it.

Article 8: Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• rectify it if it is inaccurate or incomplete;
• erase it, in the circumstances the GDPR provides for;
• restrict how we process it;
• object to processing carried out on the basis of our legitimate interests;
• receive data you provided to us in a structured, commonly used format (portability);
• withdraw your consent at any time, where processing is based on consent. Withdrawing consent does not affect the lawfulness of processing carried out beforehand.
• give instructions on what happens to your personal data after your death, and have those instructions followed, in accordance with Article 85 of the French Data Protection Act.

To unsubscribe from our newsletter, use the unsubscribe link at the foot of any email we send you.

To change your cookie choices at any time, use the cookie preferences button at the bottom-left of every page of the Site.

Article 9: How to contact us

For any question about this policy, or to exercise any of the rights in Article 8, write to us at privacy@wave-english.com, or by post at WAVE ENGLISH, 10 rue de la Paix, 75002 Paris, France.

We will respond within one month. If your request is complex, we may extend that period by up to two further months and will tell you if we do.

We will only ask you for proof of identity where we have genuine doubt about who is making the request.

You also have the right to lodge a complaint with a supervisory authority. In France this is the Commission Nationale de l'Informatique et des Libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.

Article 10: Cookies and similar technologies

10.1 What a cookie is

A cookie is a small text file stored on your device by your browser when you visit a website. It allows the site to recognise your browser on a later visit.

10.2 What we set, and when

The Site uses very few cookies. Before you make a choice in the cookie banner, exactly one cookie is set:

• fs-consent, set by Consent Pro. Essential. Records your cookie choices, together with an anonymous identifier and your region, so that the banner is not shown to you again on every page. Duration: 1 year.

Once you have consented to analytics, and only then, the following is set:

• mf_, set by Mouseflow. Analytics. Recognises your browser across pages so that your visit can be analysed as a single session. Duration: 12 months.

Plausible Analytics, which we use to measure overall traffic, sets no cookies at all and does not identify individual visitors. It does not require your consent, and it is not affected by your choices in the banner.

We use no advertising cookies, no targeting cookies, and no social-network sharing cookies.

The Site also stores two items in your browser's local storage while you complete the consultation form: the step you have reached, and the answers you have entered. These let the form resume where you left off if you navigate away. They are not cookies, and are cleared by your browser's usual controls for site data.

10.3 Session recording

If you consent to analytics, Mouseflow records how you interact with the Site: mouse movement, clicks, scrolling and navigation between pages. This is more detailed than conventional visitor statistics, and we think it is right to say so plainly.

Form fields are masked before any recording leaves your browser: what we receive shows the number of characters you typed, never the characters themselves.

Recordings are retained for 12 months and are used only to understand how the Site is used and to improve it.

10.4 Changing your mind

You can change or withdraw your cookie choices at any time using the cookie preferences button at the bottom-left of every page.

You can also block or delete cookies through your browser settings. Blocking the essential cookie will mean the Site cannot remember your choices, and the banner will be shown to you again on each visit.