How WaveProxy processes personal data on behalf of business clients using WaveProxy services.
Effective Date: February 28, 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between WaveProxy (operating as WaveProxy, "Service Provider", "Processor", "we", "us") and the client business entity ("Client", "Controller", "you") using WaveProxy's proxy services.
This DPA applies where the Client, in using WaveProxy's datacenter proxy and/or residential proxy services, instructs WaveProxy to process personal data on the Client's behalf. Both parties agree to comply with applicable data protection law in connection with such processing.
For questions regarding this DPA, contact us at [email protected].
For the purposes of this DPA:
2.1 The Client acts as the Controller and WaveProxy acts as the Processor in respect of Personal Data processed through the use of WaveProxy's proxy services.
2.2 In connection with the provision of proxy services (including routing of internet traffic through datacenter and residential proxy infrastructure), WaveProxy may process Personal Data such as source IP addresses, connection metadata, and bandwidth usage data on behalf of the Client.
2.3 WaveProxy also processes certain Client data (such as account information and payment data) in its capacity as an independent Controller, which is governed by the WaveProxy Privacy Policy available at https://www.waveproxy.com/privacy.
3.1 Subject Matter: The processing of Personal Data through the use of WaveProxy's proxy routing infrastructure.
3.2 Duration: For the duration of the Client's active subscription and use of the Services, plus any retention period required by applicable law or this DPA.
3.3 Nature of Processing: Routing internet traffic through proxy servers; collection and temporary storage of connection logs including IP addresses, connection timestamps, and bandwidth data.
3.4 Purpose of Processing: Delivery of proxy services as subscribed by the Client; bandwidth monitoring; abuse prevention; compliance with legal obligations.
3.5 Types of Personal Data: IP addresses (source and destination), connection timestamps, data volumes, and related connection metadata.
3.6 Categories of Data Subjects: End users of the Client whose internet traffic is routed through WaveProxy's proxy infrastructure.
4.1 WaveProxy agrees to:
5.1 The Client, as Controller, agrees to:
6.1 WaveProxy implements the following technical and organizational security measures to protect Personal Data:
6.2 WaveProxy regularly reviews and updates its security measures to address new and emerging threats.
7.1 The Client provides general authorization for WaveProxy to engage Sub-Processors in connection with the delivery of the Services.
7.2 WaveProxy's current Sub-Processors include the following categories of providers:
7.3 WaveProxy will ensure that any Sub-Processor is bound by data processing obligations no less protective than those in this DPA.
7.4 WaveProxy will notify the Client of any intended changes to Sub-Processors (additions or replacements) by updating this DPA or our Privacy Policy. The Client may object to such changes by contacting [email protected] within 14 days of notification.
8.1 WaveProxy is based in the United States (Wyoming) and may process Personal Data in, or transfer it to, countries outside the European Economic Area (EEA) or UK.
8.2 Where such transfers occur, WaveProxy will ensure appropriate safeguards are in place in accordance with Applicable Data Protection Law, including but not limited to:
8.3 The Client may request copies of applicable transfer mechanisms by contacting [email protected].
9.1 Taking into account the nature of the processing, WaveProxy will reasonably assist the Client in fulfilling its obligations to respond to Data Subject rights requests under Applicable Data Protection Law (including rights of access, rectification, erasure, restriction, portability, and objection).
9.2 WaveProxy will promptly forward to the Client any Data Subject requests received that relate to Personal Data processed under this DPA.
9.3 The Client is responsible for responding to Data Subject requests in its capacity as Controller.
10.1 WaveProxy will notify the Client without undue delay (and in any event within 72 hours where feasible) upon becoming aware of a Security Incident involving Personal Data processed under this DPA.
10.2 Notification will include, to the extent available: a description of the nature of the Security Incident, the categories and approximate number of Data Subjects affected, the categories and approximate volume of Personal Data records concerned, likely consequences of the Security Incident, and measures taken or proposed to address the incident.
10.3 Security Incidents should be reported to the Client at the contact email address provided in the Client's account settings. Clients should report their primary contact email to [email protected].
11.1 WaveProxy will make available to the Client all information reasonably necessary to demonstrate compliance with this DPA.
11.2 The Client may request an audit of WaveProxy's data processing practices no more than once per year, upon providing at least 30 days' prior written notice, at the Client's cost and subject to reasonable confidentiality obligations. In lieu of an on-site audit, WaveProxy may provide relevant certifications, security assessments, or third-party audit reports.
12.1 Connection logs processed under this DPA are retained for a maximum of 30 days from the date of creation, after which they are permanently deleted or anonymized.
12.2 Upon termination of the Services, WaveProxy will, at the Client's choice, delete or return all Personal Data processed under this DPA within a reasonable timeframe, unless applicable law requires WaveProxy to retain the data for a longer period.
13.1 This DPA is effective from the date the Client accepts the Terms of Service and remains in effect for the duration of the Services.
13.2 This DPA automatically terminates upon expiration or termination of the Terms of Service agreement between the parties.
13.3 Sections 6, 8, 10, and 12 survive termination of this DPA.
14.1 This DPA is governed by the laws of the State of Wyoming, USA, consistent with the Terms of Service, unless otherwise required by Applicable Data Protection Law (e.g., GDPR provisions may apply to EU data subjects regardless of governing law).
For all queries, notices, or requests regarding this DPA, please contact:
WaveProxy
Email: [email protected]
Website: https://www.waveproxy.com