Privacy notice
Effective as of 1 September 2026
This notice explains how personal data is handled when you use the Wave investor portal (the “Portal”).
1. Who is responsible
The Portal is operated by Wave Corporate Finance B.V., Koningsweg 9, 5211 BD 's-Hertogenbosch, the Netherlands, Chamber of Commerce no. 68049528 (“Wave”, “we” or “us”).
Wave is the controller for personal data used to operate and secure the Portal, including your Portal account, authentication and security information, service communications and support.
The company, foundation or other entity through which your investment is administered (your “Issuer”) is the controller for your investment records, including your holdings, transactions, distributions and investment documents. Wave processes this information on the Issuer’s behalf, as its processor.
The relevant Issuer is identified in the Portal. Its own privacy information applies to its processing of your investment data.
For questions about this notice or Wave’s processing of your personal data, contact privacy@wavecorporatefinance.com.
2. What information we process
When operating the Portal, we may process:
- Account and contact information, such as your name, email address and information needed to administer your Portal account.
- Authentication and security information, such as authentication details, two-factor authentication status, session information, IP addresses and sign-in activity.
- Support and service communications that you exchange with us.
- Technical information generated when you use the Portal, such as browser information, timestamps and pages requested.
We also process the investment information displayed in the Portal on behalf of your Issuer.
We receive information from you when you use the Portal, from your Issuer when it gives you access to an investment, and automatically when you use the Portal.
The account and security information requested during registration and sign-in is necessary for secure Portal access. If you do not provide it, you cannot use the Portal.
3. Why Wave processes your information
Wave processes personal data for the following purposes:
Operating the Portal
We administer accounts, authenticate users, provide access to the Portal, send necessary service messages and provide support. We do this based on our legitimate interest in operating the Portal for our clients and their investors.
Security
We use authentication information and technical logs to protect accounts, prevent unauthorised access and investigate security incidents. We do this based on our legitimate interest in keeping the Portal and the information it contains secure.
Legal obligations and legal claims
We may process information where necessary to comply with laws that apply to Wave, or to establish, exercise or defend legal claims. The legal basis is compliance with a legal obligation or our legitimate interest in protecting our legal rights, as applicable.
Investment information that Wave processes solely on behalf of an Issuer is processed under that Issuer’s instructions. The Issuer is responsible for determining the purposes and legal basis for that processing.
4. Who receives your information
Personal data may be shared with:
- your Issuer, where relevant to your investment;
- providers that support our hosting, database, authentication, document storage, email delivery and security services;
- professional advisers such as lawyers, auditors and notaries, where necessary; and
- public authorities, where disclosure is required by law.
Our service providers may use personal data only as permitted under our agreements with them and applicable data protection law. The providers that process personal data to operate the Portal are named on our subprocessors page, with the purpose and the processing location of each.
Some providers may process limited personal data outside the European Economic Area, including in the United States. Where required, we rely on an applicable adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
You may contact us for information about the safeguards applied to a particular transfer.
5. How long we keep information
We retain Portal account information while your account is active and, afterwards, only for as long as necessary for security, legal claims or applicable legal obligations.
Technical and security information is retained only for as long as reasonably necessary for the relevant security and operational purpose.
Investment records displayed through the Portal are retained according to the instructions and retention requirements of the relevant Issuer.
When personal data is no longer required, it is deleted or anonymised.
6. Your rights
Depending on the circumstances, you may have the right to request access to, correction of or deletion of your personal data, restriction of processing, or to object to processing. You may also have a right to data portability where the applicable legal requirements are met.
To exercise your rights in relation to processing by Wave, contact privacy@wavecorporatefinance.com. If your request concerns information controlled by your Issuer, we will direct it to, or coordinate with, the relevant Issuer where appropriate.
You also have the right to lodge a complaint with a supervisory authority, including the Dutch Autoriteit Persoonsgegevens.
7. Cookies and usage statistics
The Portal uses functional cookies that are necessary for authentication, security and remembering Portal preferences.
We may also collect aggregated, cookie-free usage statistics to understand how the Portal is used. We do not use advertising or cross-site tracking cookies.
Contact
Email: privacy@wavecorporatefinance.com
Mail: Wave Corporate Finance B.V., Koningsweg 9, 5211 BD 's-Hertogenbosch, the Netherlands