Legal
Privacy policy
Last updated 4 October 2026
This policy explains what personal information Endless Waves collects through our website, why, who we share it with and the rights you have. We keep it short and in plain English.
Who we are
Endless Waves Ltd is the controller of the personal information described here. That means we decide how it is used and we are responsible for looking after it.
| Detail | Value |
|---|---|
| Company | Endless Waves Ltd |
| Company number | 17223582 (registered in England and Wales) |
| Registered office | 20 Farleigh Road, Backwell, Bristol, England, BS48 3PA |
| Privacy contact | support@endlesswaves.co.uk |
We do not have a data protection officer. Questions about this policy go to the privacy contact above.
What we collect
We only collect what you type into one of our three forms, plus the basic technical data any website receives when you visit.
| Form | What you give us |
|---|---|
| Newsletter | First name, email address, your consent to receive emails |
| Location enquiry (for landowners and venues) | Name, email, and optionally phone number and organisation; your role; the type of water; anything you tell us about the site; whether you also want the newsletter |
| Investor interest | Name, email, and optionally organisation and a message; whether you also want the newsletter |
With each submission we also record the date and time, which form you used, the page address and the consent wording you were shown, so we can prove what you agreed to.
When you visit the site, our hosting provider receives your IP address, browser type and the pages requested, as part of serving the page and keeping it secure. Your browser also requests our fonts from Google, which receives your IP address. We do not use analytics or advertising tools.
Please don't send us special category information (such as health details) through the forms. We don't need it.
How we use it and why we're allowed to
UK data protection law (the UK GDPR and the Data Protection Act 2018) says we need a lawful basis for each use. Ours are below.
| What we do | Lawful basis |
|---|---|
| Send you our newsletter | Your consent. You can withdraw it at any time |
| Reply to a location enquiry and talk with you about hosting waves on your site | Our legitimate interests in finding sites, and taking steps you ask for before any agreement |
| Reply to an investor enquiry and keep you updated on that conversation | Our legitimate interests in talking with people who want to support the business |
| Keep a record of each submission and the consent wording shown | Our legal obligation to show valid consent, and our legitimate interests in keeping accurate records |
| Host the site, keep it secure and stop spam | Our legitimate interests in running a safe, working website |
Where we rely on legitimate interests, we have checked that they are not outweighed by your rights. We only ever contact enquirers about the subject they raised, unless they also ticked the newsletter box.
We don't sell your information, and we don't use it for automated decisions that have legal or similarly significant effects on you.
Marketing emails
We only send our newsletter to people who have ticked the box to say yes. The box is never ticked for you.
You can stop the emails at any time by clicking unsubscribe in any email, or by emailing support@endlesswaves.co.uk. We'll stop within a few days. After you unsubscribe, we keep just your email address on a suppression list so we never email you by mistake again.
Sending a location or investor enquiry does not sign you up to the newsletter, unless you also tick that box.
Who we share it with
We use three suppliers to run the website. They process your information on our instructions and under data processing terms.
| Supplier | What they do for us | Where data may be processed |
|---|---|---|
| HubSpot, Inc. | Stores our contacts and enquiries, and sends our newsletter | Our account is hosted in HubSpot's EU data centre; HubSpot staff and sub-processors may access it from the US |
| Vercel Inc. | Hosts the website and runs the code that passes form entries to HubSpot | United States and other Vercel regions |
| Google LLC (Google Fonts) | Serves the fonts the site uses; receives your IP address | United States and other Google locations |
When information leaves the UK, we rely on the protections UK law allows: UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where the supplier is certified), or the UK International Data Transfer Addendum to the supplier's standard contractual clauses.
We may also share information with professional advisers (such as lawyers and accountants), with a buyer or investor if the business is sold or restructured, or where the law requires it. We never sell personal information.
How long we keep it
We keep information only as long as we need it, then delete it.
| Information | How long |
|---|---|
| Newsletter subscribers | Until you unsubscribe; we then keep only your email on a suppression list |
| Location enquiries | 2 years after our last contact, or longer if it leads to an agreement with you |
| Investor enquiries | 2 years after our last contact, or longer if you go on to invest (company law then sets the period) |
| Consent records | As long as we email you, plus 2 years, so we can show the consent was valid |
| Website server logs | A short period set by our host, usually days |
We review stored contacts at least once a year and delete any we no longer need.
Your rights
You have the right to:
- access the information we hold about you and get a copy
- correct anything that is wrong or incomplete
- delete your information, where we have no good reason to keep it
- restrict how we use it while a concern is looked into
- object to our use of it based on legitimate interests, and to direct marketing at any time
- move information you gave us with consent to another organisation (data portability)
- withdraw consent at any time, without affecting what we did before
To use any of these rights, email support@endlesswaves.co.uk. It's free, and we'll reply within one month. We may need to confirm who you are first.
If you're unhappy with how we've handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, helpline 0303 123 1113.
Cookies
Our website does not set any cookies and does not use analytics or advertising trackers, so there's no cookie banner. If that changes, we'll update this policy and ask for your consent first where the law requires it.
Keeping it safe
Form entries travel over an encrypted (HTTPS) connection straight to our CRM, and only people at Endless Waves who need them can see them. Access to our accounts is protected, and our suppliers keep their own security certifications.
Children
The forms are meant for adults. We don't knowingly collect information from anyone under 16; if you think a child has sent us their details, contact us and we'll delete them.
Changes to this policy
We'll update this page when our website or the way we use information changes, and change the date at the top.