1. Introduction and Scope
This Privacy Policy explains how WaveVision GmbH (“WaveVision”) collects, uses, stores, and discloses personal data in connection with the WaveVision online learning management system (the “Platform”). It applies to all personal data processed through the Platform, including account registration, course enrolment, certification, payment, and technical operation.
This policy covers the Platform only. The WaveVision marketing website (wavevision.at) is governed by a separate privacy policy.
Controller
The controller responsible for data processing under Article 4(7) of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) is:
WaveVision GmbH
Gassergasse 29/12,
1050 Wien, Austria
Firmenbuchnummer: FN 618685 g
Firmenbuchgericht: Handelsgericht Wien
UID-Nummer: ATU80250309
E-Mail: office@wavevision.at
Telefon: +43 660 407 1406
Website: www.wavevision.at
For questions or requests relating to data protection, contact: office@wavevision.at.
2. Categories of Personal Data Processed
2.1 Account and Identity Data
When you register for an account on the Platform, WaveVision collects and processes:
- Full name
- Email address
- Login credentials (password or authentication tokens)
- Professional credentials and licence evidence (where required for certification eligibility; see Terms of Use §2.2)
- Country and jurisdiction of professional practice
Authentication is handled by the Platform’s built-in account system. Login credentials are stored as salted password hashes in the Platform database, together with session identifiers. No third-party identity provider or single-sign-on service is used.
2.2 Learning Data
As you use the Platform, WaveVision processes data relating to your educational activity:
- Course enrolment records
- Module progress and completion status
- Quiz and assessment results and grades
2.3 Certification Data
Where you complete a course and are eligible for certification:
- Professional data forwarded to ISMST for certificate issuance (see Terms of Use §7.1)
- Certification status and validity
- ISMST membership status (automatic one-year membership unless you opt out; see Terms of Use §7.1, §7.7, §7.8)
2.4 Payment and Billing Data
When you purchase a course or subscription:
- Transaction records and purchase history
- Invoice data (name, address, amounts, VAT)
- Subscription status and renewal dates
WaveVision does not store your full payment card details. Payments are processed by Stripe, which handles card data directly (see Terms of Use §8.2).
2.5 Technical and Usage Data
When you access the Platform, the following data is collected automatically:
- IP address
- Device type, operating system, and browser version
- Pages visited and actions taken on the Platform
- Date and time of access
- Server log data
- Usage statistics collected without cookies and with anonymised IP addresses (see Section 3 — Analytics)
2.6 Communications
If you contact WaveVision for support or other enquiries:
- Content of your correspondence (email to office@wavevision.at)
- Metadata (date, time, sender address)
2.7 Special-Category Data
The Platform does not process patient data, health data of third parties, or any special-category data within the meaning of Article 9 GDPR. Users are expressly prohibited from uploading any patient data, protected health information, or personally identifiable information of third parties to the Platform (see Terms of Use §6.6, §11.2(f)).
A user’s own professional credential data (e.g., evidence of a professional licence) is not health data; it is processed as account and identity data under Section 2.1 above.
3. Purposes and Legal Bases
WaveVision processes your personal data for the following purposes, each paired with its legal basis under Article 6(1) GDPR:
| Purpose | Legal basis | Details |
|---|---|---|
| Account creation and platform access | Art. 6(1)(b) — performance of contract | Necessary to provide the service you registered for. |
| Course delivery and progress tracking | Art. 6(1)(b) — performance of contract | Core service delivery. |
| Forwarding professional data to ISMST for certificate issuance | Art. 6(1)(b) — performance of contract | The certification is part of the purchased course (Terms §7.1). |
| Automatic one-year ISMST membership (opt-out) | See counsel note below | Triggered automatically unless you opt out (Terms §7.1, §7.8). |
| Payment processing via Stripe | Art. 6(1)(b) — performance of contract | Processing the transaction for the purchased course. |
| Invoice retention and tax compliance | Art. 6(1)(c) — legal obligation | Austrian §132 BAO and §212 UGB require retention of financial records. |
| Analytics (Matomo, self-hosted, cookieless) | Art. 6(1)(f) — legitimate interest | Understanding how the Platform is used in order to improve it. Matomo runs on WaveVision’s own infrastructure (stats.wavevision.at) in cookieless mode: no cookie or other identifier is stored on your device, your IP address is anonymised before storage, and the data is not shared with third parties. You may object at any time (see Section 7). |
| Server logs, security, and fraud prevention | Art. 6(1)(f) — legitimate interest | Protecting the Platform and its users from unauthorised access and abuse. |
| Responding to support enquiries | Art. 6(1)(b) — performance of contract; Art. 6(1)(f) — legitimate interest | Answering questions about your account or the service. |
| Marketing emails (if applicable) | Art. 6(1)(a) — consent | Only with your explicit prior consent; you may withdraw at any time. |
4. Recipients and Third Parties
WaveVision shares your personal data with the following recipients, each for a specified purpose:
| Recipient | Role | Purpose | Location | Transfer basis |
|---|---|---|---|---|
| ISMST (International Society for Medical Shockwave Treatment, Ebelsberger Schlossweg 5, A-4030 Linz, shockwave@ismst.com) | Separate controller (see note) | Certificate issuance, one-year membership administration | Austria (intra-EU) | Not applicable (intra-EU) |
| Stripe, Inc. (stripe.com) | Processor | Payment processing | US / IE | EU–US Data Privacy Framework |
| Vimeo (vimeo.com) | Processor | Video content hosting and delivery | US | EU–US Data Privacy Framework |
| Sketchfab (sketchfab.com) | Processor | 3D model hosting and display | US | Standard Contractual Clauses |
| Google LLC (Google Fonts) | Processor | Delivery of web fonts (IP address transmitted on page load) | US | EU–US Data Privacy Framework |
| Hetzner Online GmbH | Processor | Platform infrastructure and hosting | Germany / Finland (EU) | Not applicable (intra-EU); Data Processing Agreement |
| MailerLite (mailerlite.com) | Processor | Email marketing and newsletters (consent-based only) | Lithuania (EU) | Not applicable (intra-EU); Data Processing Agreement |
Web analytics on the Platform is performed by Matomo, self-hosted on WaveVision’s own infrastructure (stats.wavevision.at). Analytics data therefore remains with WaveVision and is not disclosed to any third-party analytics provider.
5. International Transfers
Some of WaveVision’s processors are based in the United States. Where personal data is transferred outside the European Economic Area, WaveVision relies on the following safeguards:
- EU–US Data Privacy Framework (DPF): Where the US recipient is certified under the DPF (adequacy decision of 10 July 2023), the transfer is permitted under Article 45 GDPR.
- Standard Contractual Clauses (SCCs): Where the recipient is not DPF-certified, WaveVision uses the European Commission’s Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) as the transfer mechanism under Article 46(2)(c) GDPR.
Certification status (verified against the vendors’ published framework statements, June 2026): Stripe, Inc. and Vimeo are certified under the EU–US DPF. Sketchfab does not claim DPF certification and relies on Standard Contractual Clauses; executed SCCs must be in place for this transfer. Google LLC (relevant only to web-font delivery) is DPF-certified.
6. Retention Periods
WaveVision retains your personal data only for as long as necessary to fulfil the purposes described in this policy, or as required by law:
| Data category | Retention period | Basis |
|---|---|---|
| Account and identity data | For the duration of your account, plus 3 years after account closure | Contractual necessity; general limitation period under §1486 ABGB for post-termination claims |
| Learning data (progress, results, completion records) | For the duration of your account, plus 3 years after account closure | Terms §10.2; contractual and legitimate interest |
| Certification records | For the validity period of the certification, archived in line with the ISMST certificate validity | Coordination with ISMST validity periods |
| Financial and invoice data | 7 years from the end of the relevant financial year | Austrian §132 BAO, §212 UGB (statutory retention obligation) |
| Server and access logs | 90 days after collection | Legitimate interest in security and incident investigation |
| Analytics data | Collected without cookies and with IP addresses anonymised before storage; retained as usage statistics on WaveVision’s own infrastructure | Legitimate interest (see Section 3) |
| Support correspondence | For the duration of the enquiry, plus a reasonable retention period | Legitimate interest |
After the applicable retention period expires, personal data is securely deleted or anonymised.
7. Data Subject Rights
Under the GDPR, you have the following rights in relation to your personal data:
- Right of access (Article 15): You may request confirmation of whether WaveVision processes your personal data and, if so, access to that data and related information.
- Right to rectification (Article 16): You may request correction of inaccurate personal data or completion of incomplete data.
- Right to erasure (Article 17): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent.
- Right to restriction of processing (Article 18): You may request that WaveVision restrict the processing of your personal data in certain circumstances.
- Right to data portability (Article 20): You may request to receive the personal data you have provided to WaveVision in a structured, commonly used, and machine-readable format, and to transmit that data to another controller. In accordance with Terms of Use §19.7, WaveVision will provide a digital export of your learning history, assessment results, and earned certifications upon written request.
- Right to object (Article 21): You may object to the processing of your personal data where WaveVision relies on legitimate interest as the legal basis.
- Right to withdraw consent (Article 7(3)): Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.
How to exercise your rights
Submit your request by email to: office@wavevision.at
WaveVision will respond to your request without undue delay and in any event within one month. If the request is complex or if WaveVision receives a large number of requests, this period may be extended by a further two months, in which case WaveVision will inform you of the extension.
Where the Platform provides self-service tools for managing your data (e.g., profile editing, account deletion), you may also use those features directly.
Right to lodge a complaint
If you believe that WaveVision’s processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the competent supervisory authority:
Österreichische Datenschutzbehörde (Austrian Data Protection Authority) Barichgasse 40–42, 1030 Wien, Austria E-Mail: dsb@dsb.gv.at Website: www.dsb.gv.at
8. Cookies and Tracking Technologies
The Platform uses cookies and similar technologies. Essential cookies (such as the Moodle session cookie and the cookie recording your consent choice) are strictly necessary for the Platform to function and do not require consent. Non-essential cookies — set by third-party content embedded in courses (videos, 3D models) — are only activated with your prior consent; until then, embedded content is shown as inactive placeholders.
The Platform’s web analytics (self-hosted Matomo) operates without cookies and stores no identifier on your device (see Section 3).
For a detailed description of the cookies used, their purposes, and how to manage your preferences, please refer to the Cookie Policy.
9. Automated Decision-Making
WaveVision does not subject you to decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR. Course assessments are evaluated against defined criteria and do not involve profiling or automated decision-making.
10. Security
WaveVision implements appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include, but are not limited to:
- Encryption of data in transit (TLS/HTTPS)
- Access controls and authentication requirements
- Regular security updates and monitoring
- Contractual obligations on processors to maintain equivalent security standards
No method of electronic transmission or storage is completely secure. While WaveVision takes reasonable precautions, it cannot guarantee absolute security.
11. Changes to This Policy
WaveVision may update this Privacy Policy from time to time to reflect changes in data processing practices, legal requirements, or the services offered.
Where changes are material, WaveVision will notify you by email or by a prominent notice on the Platform at least thirty (30) days before the changes take effect, consistent with the amendment process described in the Terms of Use §17.
The date of the most recent revision is indicated at the top of this document. The current version is always available on the Platform.
12. Contact
For any questions about this Privacy Policy or the processing of your personal data, please contact:
WaveVision GmbH Gassergasse 29/12, 1050 Wien, Austria Firmenbuchnummer: FN 618685 g Firmenbuchgericht: Handelsgericht Wien UID-Nummer: ATU80250309 E-Mail: office@wavevision.at Telefon: +43 660 407 1406 Website: www.wavevision.at