Privacy Policy

Wave Break Media Limited (trading as Wavebreak Media) ("Wavebreak Media", "we", "us" or "our") is an Irish company, company registration number 426883. We are the controller of the personal data described in this Privacy Policy.

This notice covers personal data processed in connection with wavebreakmedia.com, dataset and licensing enquiries, custom production, meetings, business-to-business prospecting, supplier and partner contacts, and related business relationships. It covers information provided directly to us as well as professional information obtained from other sources.

Our business address and contact details are provided in Section 21. This notice is not a licence to process personal data in datasets and does not replace any project-specific privacy information, data-processing agreement or confidentiality agreement.

For information about people appearing in our licensed or produced content, see our Privacy Notice for Models.

The categories of personal data we collect depend on the nature of our interaction. We seek to limit personal data to what is relevant and necessary for the stated purpose.

• Professional identity: name, employer, job title, business responsibilities, professional profile and business location.
• Business contact details: corporate email address, business telephone number and work-related contact preferences.
• Enquiry and transaction information: project description, dataset or licensing requirements, technical specifications, sample or quote requests, meeting details and correspondence.
• Business development records: source of professional contact details, relevance assessments, dates and outcomes of contact, meeting records and opt-out status.
• Website information: device and browser information, IP address, security logs, requested pages, referring pages and analytics identifiers where permitted.
• Information you provide voluntarily: messages, files and other relevant materials submitted through approved channels.

We do not intentionally collect special-category personal data, private email addresses or information about children for ordinary B2B prospecting. Information about a person remains personal data under the GDPR even when it relates to their professional role or uses a corporate email address.

If a form marks information as required, it is ordinarily necessary to respond to the relevant request; without it, we may be unable to deal with the enquiry.

We obtain information directly when you submit a form, email us, request a dataset or quote, book a meeting, attend a call, supply information for a project or otherwise communicate with our team.

For legitimate business development, we may also obtain relevant professional information from third-party and publicly accessible sources, including:

• An employer's website, team pages, company announcements and other corporate information.
• Professional networking services, including LinkedIn, and publicly accessible professional profiles.
• Trade publications, events, conference speaker lists, professional directories and referrals.
• Business contact and professional data providers such as RocketReach, where used.
• Existing customer, supplier and partner relationships and information provided during business discussions.

We may combine limited professional information from these sources to establish whether a person is an appropriate business contact. We keep or are able to identify the relevant source of prospect information where reasonably practicable.

The fact that a work email address appears online or in a commercial contact database does not by itself establish consent to marketing or remove other applicable legal requirements.

We use relevant personal data for the following business and operational purposes:

• Answering requests for dataset information, samples, prices, licensing terms and custom production.
• Evaluating feasibility, scope, rights, release requirements, formats, annotation, delivery and project timelines.
• Managing meetings, proposals, negotiations, orders, contracts, customers, suppliers and partners.
• Identifying professional contacts and preparing individually relevant B2B communications where lawful.
• Keeping records of replies, objections, opt-outs and existing relationships to avoid unwanted repeat approaches.
• Providing technical support, securing our site and systems, detecting abuse and meeting legal obligations.
• Understanding website performance and usage through analytics when the required consent and other legal conditions are satisfied.
• Establishing, exercising or defending legal claims.

We do not use information submitted in a dataset enquiry as permission to send unrelated marketing communications. Any additional direct marketing must independently meet the applicable requirements.

Our lawful basis depends on the processing activity; no single lawful basis applies to every use of information.

• Legitimate interests (Article 6(1)(f)): dealing with business enquiries made by employees of organisations; maintaining professional relationships; proportionate B2B contact research and prospecting where the contact is professionally relevant and electronic marketing is separately permitted; website security; internal business administration; and preventing repeat contact after an objection.
• Pre-contractual steps or performance of a contract (Article 6(1)(b)): where processing is necessary for an agreement with you as an individual or for steps you personally request before entering that agreement. For representatives of a corporate customer, our lawful basis will usually be legitimate interests rather than Article 6(1)(b).
• Legal obligation (Article 6(1)(c)): complying with applicable accounting, tax, regulatory and other legal requirements.
• Consent (Article 6(1)(a)): where we ask for your consent, including applicable non-essential cookies or optional electronic marketing that requires prior consent.

Where we rely on legitimate interests, we assess the purpose, necessity and effects on individuals, including the source and sensitivity of the data, professional context, reasonable expectations and ability to object. You may ask for further information about the interests relied on.

A legitimate-interest basis for processing personal data does not, on its own, permit us to send unsolicited electronic marketing. We also comply with the ePrivacy and direct-marketing requirements applicable to each communication and recipient.

We may contact appropriately selected professional representatives of AI, technology, research, enterprise and other organisations where a communication about our licensed datasets, rights-cleared media, AI training and evaluation data, custom data production or related services is relevant to their work.

Our outbound communications are intended to be individually relevant, identify Wavebreak Media as the sender and provide a valid way to stop future marketing messages.

For recipients in Ireland, our approach takes account of Regulation 13 of the Irish Privacy and Electronic Communications Regulations (S.I. No. 336/2011), including the rules on electronic marketing to corporate subscribers and work addresses used primarily in a commercial or official capacity. The applicable rule may differ for personal accounts, sole traders, partnerships and other categories of recipient.

For recipients outside Ireland, we assess the electronic-marketing requirements of the relevant country rather than assuming Irish rules permit every cross-border message. We obtain prior consent where it is required and do not send messages where the applicable legal conditions are not met.

We do not use personal contact details obtained for prospecting for unrelated consumer advertising.

Your right to object to direct marketing is unconditional. You may object at any time, without charge, as described in Section 15. We will not continue processing your personal data for direct marketing after receiving your objection.

When we have not obtained your personal data directly from you, we provide the transparency information required by Article 14 GDPR within the applicable time limits, normally within one month of collection and, where we use the data to contact you sooner, no later than our first communication, unless a lawful exception applies.

Our initial direct marketing communication makes this Privacy Policy accessible and identifies our organisation and how to object. You may contact us to ask where we obtained your professional contact information, including whether it came from a publicly available source or a business-contact provider.

The categories of indirectly collected information are described in Section 2; typical sources are described in Section 3. Our relevant purposes and legal bases are described in Sections 4 to 6.

When you ask us for samples, a quotation, a dataset, licensing information or a production discussion, we use the details provided to assess your request, check availability, evaluate rights or provenance requirements and prepare the requested response.

We may refer an enquiry to the appropriate colleague, including a member of our management or commercial team, so it can be dealt with properly. We may use email and meeting-scheduling providers to organise a requested conversation.

The submission of a commercial enquiry is not, by itself, consent to unrelated newsletters or promotional campaigns. Separate consent or another valid legal permission will be used for any additional marketing where required.

Please do not include passwords, personal financial details or sensitive information in normal enquiry forms.

Do not send government identifiers, passwords, payment credentials, health or patient information, biometric or special-category personal data, children's data, confidential third-party records or other restricted materials through ordinary forms or unprotected email unless we have agreed an appropriate handling process in advance.

If your dataset project may require confidential or regulated material, initially describe the requirement at a high level so that the necessary legal, contractual and security arrangements can be considered before any detailed information is transferred.

Information relating to identifiable people in filmed, photographed or other licensed content is subject to separate notices, release terms and applicable production procedures; this general business privacy notice does not replace those arrangements.

We use CookieHub as our cookie consent management platform. The CookieHub banner and preference centre let visitors accept or reject non-essential cookie categories, make more detailed choices and consult our Cookie Declaration, which lists the technologies detected and configured for our website.

CookieHub provides two cookie categories: Necessary and Analytical. Necessary cookies support essential website functionality, including remembering your cookie choices, and cannot be disabled through the preference centre. Analytical cookies are optional and help us understand how visitors use our website. You can reject Analytical cookies while continuing to use the website.

Our Cookie Declaration lists the following Necessary and Analytical cookies, their purposes and their stated storage periods:

• Necessary - cookiehub: CookieHub; first-party cookie on .wavebreakmedia.com; remembers consent choices and categories; stated expiry: 365 days. This helps us apply your choices on subsequent visits.
• Analytical - _ga: Google Analytics (Google LLC); first-party cookie on .wavebreakmedia.com; distinguishes browser visits for statistical analysis; stated expiry: 400 days.
• Analytical - _ga_*: Google Analytics (Google LLC); a family of cookies with an identifier-specific suffix, presented in our declaration under _ga_; supports session and visit measurement; stated expiry: 400 days.

If you consent to Analytical cookies, Google Analytics 4 may process page views, browser and device information, approximate location, referral data, online identifiers and interaction events so that we can analyse website usage and improve our services.

In Ireland, cookies and similar technologies that are not covered by a limited statutory exemption generally require consent before information is stored on or accessed from your device. We do not treat continued browsing, silence or preselected optional settings as consent. Analytical cookies are enabled only after you give the required consent.

The CookieHub banner provides Allow all cookies, Deny all and Cookie settings choices. The Cookie Declaration in its preference centre provides provider, purpose and storage details. You can refuse optional categories without disabling Necessary cookies. You can review and change or withdraw your choice through the CookieHub preference centre. Please use the website's Cookie Settings control to reopen it; if you need assistance, contact us using the details in Section 21. Browser controls can also remove cookies and stored site data.

Cookie settings govern optional website tracking and are separate from our processing of professional contact information for B2B communications. We will review and update our Cookie Declaration, this notice and the relevant consent controls before introducing any additional non-essential tracking technologies.

Personal data may be accessible to authorised members of our team and, where necessary for the purposes set out in this notice, to selected service providers and professional advisers.

• Email, productivity and cloud services, including Google Workspace where used for correspondence and enquiry handling.
• Website hosting, infrastructure, form processing, security and technical support providers.
• Cookie consent management providers, including CookieHub, and website analytics providers such as Google LLC where analytics are enabled and permitted by your choices.
• Tag-management services, including Google Tag Manager where used.
• Business contact data providers, including RocketReach, where involved in relevant contact-discovery workflows.
• Meeting scheduling providers, such as Calendly, when you use a scheduling link.
• Customer relationship, business administration, file storage and communications providers where used.
• AI-assisted research or drafting services, where used to prepare or organise business communications, subject to appropriate data-minimisation and vendor safeguards.
• Legal, financial or other professional advisers, regulators or authorities where necessary or required by law.

Depending on the activity, a recipient may be a processor acting under instructions or an independent controller with its own responsibilities. We seek appropriate contractual arrangements with processors and limit disclosure to what is needed.

We do not sell or trade lists of business contacts covered by this notice. This statement does not describe the separate licensing of images, videos or other media content governed by their own notices and contractual terms.

Wavebreak Media operates from Ireland, but some technology providers, professional contacts and business partners may be located outside the European Economic Area (EEA), including in the United States.

Where an international transfer of personal data requires a Chapter V GDPR transfer mechanism, we rely on a valid mechanism appropriate to that transfer. Depending on the recipient, this may be a European Commission adequacy decision, participation in the EU-U.S. Data Privacy Framework by an appropriately certified recipient, the European Commission's Standard Contractual Clauses together with supplementary measures where necessary, or another lawful mechanism.

We assess the applicable arrangements for relevant providers and can provide further information about safeguards, or how to obtain a copy of them where required, on request.

We keep personal data only for a period justified by the purpose of processing, taking account of business relevance, legal obligations, objections and the need to protect legitimate rights.

• Unresponsive business prospecting records: ordinarily deleted or anonymised within 12 months of collection or the most recent substantive two-way business engagement, unless a documented reason justifies a different period. Repeated unreturned marketing emails alone do not indefinitely extend retention.
• Active enquiries, quotations, project negotiations and business relationships: kept while necessary for the relationship and subsequently for applicable record-keeping, limitation or legal obligations.
• Accounting and statutory records: retained for the periods required by applicable law.
• Marketing opt-out records: the minimum information necessary to honour an objection may be retained for as long as reasonably necessary to prevent further unwanted marketing.
• Website security and technical records: retained only according to operational need, security risk and applicable provider settings.
• Cookie identifiers: CookieHub currently declares 365 days for cookiehub and 400 days for _ga and _ga_* analytical identifiers, subject to whether the analytics cookies are actually set, browser behaviour and any later changes reflected in the Cookie Declaration. Analytics report and event-data retention is controlled separately by the relevant analytics configuration.

We review the records we hold and delete, anonymise or restrict information when it is no longer necessary. These are our stated retention standards and must be reflected in our actual internal procedures.

You may object at any time to processing of your personal data for direct marketing, including any related profiling. We will stop such processing once we receive your objection.

You may opt out by replying "unsubscribe" to a marketing message or emailing info@wavebreakmedia.com. You do not need to explain your decision or pay a fee.

We may retain only the minimum data needed to record your request and prevent your address from being added again to a marketing list. An opt-out from marketing does not prevent necessary non-marketing communications about an existing contract, an active request or a legal obligation.

If you believe we have contacted you after an objection, please tell us using the contact details in Section 21.

Subject to the conditions and exceptions in applicable data protection law, you may have the following rights:

• Access: obtain confirmation of processing and a copy of your personal data.
• Rectification: request correction of inaccurate information.
• Erasure: request deletion where the legal requirements are met.
• Restriction: request that certain processing be limited.
• Objection: object to processing based on legitimate interests in appropriate circumstances, and object unconditionally to direct marketing.
• Portability: obtain relevant data in a portable format when the legal conditions apply.
• Withdrawal of consent: withdraw consent at any time where it is the basis for processing, without affecting processing previously carried out lawfully.
• Complaint: lodge a complaint with the Irish Data Protection Commission or another competent data protection supervisory authority.

For requests, contact info@wavebreakmedia.com. We may ask for proportionate identity verification where necessary and ordinarily respond without undue delay and within one month, subject to legally permitted extensions.

The Irish Data Protection Commission can be contacted through www.dataprotection.ie.

We may use limited professional information such as company sector, publicly described responsibilities and an assessment of potential business relevance to prioritise B2B communications. Research or drafting tools may assist our team, but these business-development assessments are not intended to produce legal or similarly significant effects on individuals.

We do not use the personal data addressed by this business and website notice for solely automated decisions that have legal or similarly significant effects on individuals. Where data is used for direct-marketing profiling, you may object to that use at any time.

We apply technical and organisational measures appropriate to the information and risks involved, including access controls, use of approved services and processes intended to reduce unauthorised access, loss, misuse or disclosure.

No website, email system or electronic storage service is risk-free. If a personal data breach occurs, we assess and handle it in accordance with applicable legal requirements, including notification to the relevant authority and affected individuals when required.

Our general website, dataset procurement communications and B2B outreach are intended for adults acting in a professional or business capacity. They are not directed at children, and we do not knowingly collect children's personal details for routine prospecting.

The handling of identifiable people, including children, appearing in produced or licensed content is outside the ordinary business-contact scope of this policy and is addressed through relevant production and privacy arrangements, including our Privacy Notice for Models.

Where a specific job application process has its own privacy notice, that notice governs the recruitment information covered by it.

Our site and business communications may link to services operated by other organisations, including professional networking sites and meeting-booking platforms. Their own privacy information may apply when you independently use those services.

We are not responsible for the privacy policies or security of unrelated third-party sites.

We may update this Privacy Policy when our processing activities, service providers or applicable requirements change. We will show the date of the current version on this page and provide additional notice where required by law.

For questions about this notice, the sources of your professional information, access requests or objections to direct marketing, contact:

Wave Break Media Limited (trading as Wavebreak Media)

Company Registration No. 426883
Unit 3, Westpoint Business Centre
Westpoint Business Park
Ballincollig
Co. Cork
P31 KV67
Ireland

Email: info@wavebreakmedia.com

Website: wavebreakmedia.com