Privacy Policy

PeakWave ("we", "us", "our") is operated by PeakWave Ltd, a company registered in England and Wales. We provide an online platform at peakwave.co that connects seasonal workers ("candidates") with employers in the ski, yacht, and watersports industries ("employers").

If you have any questions about this policy, you can reach us at hello@peakwave.co.

We collect the following categories of personal data:

Candidates

• Account information: name, email address, phone number, date of birth, nationality, gender
• Profile data: positions, preferred locations, qualifications, visa status, experience level, bio, languages, availability dates, profile photo, video introduction
• Activity data: last active timestamp, placement status, referral activity

Employers

• Account information: contact name, company name, email address, website
• Business data: business type, locations, roles hiring for

All users

• Messages: content of messages exchanged through the platform
• Technical data: IP address, browser type, device information, pages visited (collected via PostHog analytics)
• Newsletter: email address and signup source (if subscribed)

We use your personal data to:

• Create and maintain your account and profile on the platform
• Display candidate profiles to employers for the purpose of recruitment
• Enable messaging between candidates and employers through the platform
• Send transactional emails (account confirmation, message notifications, remain-available nudges)
• Send the Season Edit newsletter (only if you subscribe; you can unsubscribe at any time)
• Track referrals and administer the referral programme
• Analyse usage patterns to improve the platform (via PostHog, no data is sold to third parties)
• Prevent fraud and maintain the security of the platform

Under UK GDPR, we process your data on the following bases:

• Contract: processing necessary to provide the platform services you signed up for (account creation, profile display, messaging)
• Consent: newsletter subscriptions and optional analytics cookies
• Legitimate interest: platform security, fraud prevention, and service improvements

We do not sell your personal data to anyone. We share data with the following categories of recipients only as necessary to operate the platform:

• Supabase (database and authentication hosting, EU West region)
• Vercel (website hosting)
• Resend (transactional email delivery)
• PostHog (privacy-focused product analytics)
• Cloudflare (DNS and security)

Candidate profile data (name, positions, locations, qualifications, photo, bio, video) is displayed to authenticated employers on the platform. Email and phone number are hidden by default and only shared at the candidate's discretion.

We retain your account and profile data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where we are required by law to retain it.

Messages are retained for 12 months after the conversation ends, then permanently deleted.

Newsletter subscription data is retained until you unsubscribe.

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten")
• Restrict processing of your data
• Object to processing based on legitimate interest
• Data portability: receive your data in a structured, machine-readable format
• Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, email us at hello@peakwave.co. We will respond within 30 days.

We use PostHog for product analytics. PostHog uses first-party cookies to understand how you interact with the platform. We do not use third-party advertising cookies or trackers.

You can opt out of analytics by disabling cookies in your browser settings or by using a browser extension such as uBlock Origin.

We take reasonable technical and organisational measures to protect your data, including:

• Encryption in transit (HTTPS/TLS) and at rest
• Row-level security on all database tables (Supabase RLS)
• Authentication via secure password hashing (bcrypt)
• Regular security reviews of code and infrastructure

PeakWave is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at hello@peakwave.co and we will delete it promptly.

We may update this privacy policy from time to time. If we make significant changes, we will notify you via email or a notice on the platform. The "last updated" date at the top of this page indicates when the policy was last revised.

If you have any questions or concerns about this privacy policy or how we handle your data, please contact us:

Email: hello@peakwave.co

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been handled unlawfully.