Last updated: 7 September 2026
This Privacy Policy explains how the WAVE project (“WAVE,” “we,” “us,” “our”) collects, uses, and protects personal data when you visit or use wave-flow.ie (the “Site”), including registering for an account, enrolling in a course, submitting a contact form, or signing up to our newsletter.
WAVE is a research project based at the University of Limerick. The University of Limerick is the data controller for personal data processed through this Site.
1. Who we are
Data Controller: University of Limerick, on behalf of the WAVE project Postal address: Tierney Building, University of Limerick, Limerick, V94 T9PX, Ireland Contact email: wave-flow@ul.ie
University of Limerick Data Protection Officer For queries specifically about how the University handles your data, or to exercise your data protection rights, you can contact the University’s Data Protection Unit directly: Email: dataprotection@ul.ie Post: Data Protection Officer, Office of the Corporate Secretary, Room A1-073, University of Limerick, Limerick, V94 T9PX
2. What personal data we collect
We only collect personal data you provide to us directly, or that is generated automatically through your use of the Site.
Contact form
When you use our contact form, we collect: your name, email address, organisation name, current role, query type, and the content of your message. We use this to respond to your enquiry.
Account registration and course enrolment (Masteriyo LMS)
If you create an account or enrol in a course on the Site, we collect your name, email address, and password (stored in encrypted/hashed form), along with any profile details you choose to add. While you use a course, the system also records your enrolment, progress through course content, and quiz or assessment results, so that you (and, where relevant, course facilitators) can track your learning.
Newsletter sign-up
If you sign up to our mailing list, we collect your name and email address so we can send you updates about the WAVE project. You can unsubscribe at any time using the link in any email we send, or by contacting us at wave-flow@ul.ie.
Website usage data (analytics)
We use Google Analytics (via the “Site Kit by Google” plugin) to understand how visitors use the Site — for example, which pages are visited, how long visitors stay, and general location and device information (derived from IP address, which is not stored in identifiable form by Google Analytics). This data is pseudonymous/aggregated and is not used to identify you personally. Analytics cookies are only set once you have given consent through our cookie banner (see Section 3).
Security and technical logs
For security purposes, our security plugin (All-In-One Security) automatically logs certain technical information, such as IP addresses, browser type, and login attempts, in order to detect and block malicious activity (e.g. brute-force login attempts). These logs are retained only as long as needed for security purposes.
Site backups
Periodic backups of the Site (which may include the personal data described above) are taken for disaster-recovery purposes and stored securely.
We do not collect payment information, and we do not run e-commerce functionality on this Site. Comments are disabled sitewide.
3. Cookies
We use cookies and similar technologies to make the Site work, remember your preferences, and measure Site usage. Non-essential cookies (such as analytics cookies) are only placed after you provide consent, which we manage through our cookie consent tool (CookieYes). You can review or withdraw your consent at any time using the cookie preferences link in the site footer.
Because the exact cookies in use can change as plugins and features are updated, please refer to the live, auto-generated cookie list shown in our cookie banner / cookie policy for the current and complete list of cookies, their purpose, and how long each one lasts.
4. Legal basis for processing
Under GDPR, we rely on the following legal bases:
- Legitimate interests / public task — for responding to contact form enquiries and running the WAVE research project, as part of the University’s research and educational functions.
- Contract / necessary steps prior to entering a contract — for creating and managing your account and course enrolment.
- Consent — for sending newsletter emails and for setting non-essential (analytics) cookies. You may withdraw consent at any time.
5. Who we share data with
We do not sell personal data. We share limited personal data with the following categories of recipients, only as necessary to operate the Site:
- Google (Site Kit / Google Analytics) — for website analytics.
- Google (Gmail) or Microsoft (Outlook) — used to send form submissions and account/notification emails via our email delivery service.
- Masteriyo LMS — course, enrolment, and progress data is processed within this plugin, hosted on our own servers.
- CookieYes — to record and manage your cookie consent choices.
- Where required by law, or to protect the rights, property, or safety of the University, our users, or others.
Some of these providers (e.g. Google, Microsoft) may process data on servers located outside the European Economic Area (EEA). Where this occurs, we rely on appropriate safeguards recognised under GDPR, such as the European Commission’s Standard Contractual Clauses, to ensure your data remains protected.
6. How long we keep your data
We keep personal data only for as long as necessary for the purposes described above:
- Contact form enquiries: retained for as long as needed to handle your query and for a reasonable period afterwards for record-keeping.
- Account and course data: retained for as long as your account is active, and for a period afterwards in line with the University’s research and records retention requirements.
- Newsletter data: retained until you unsubscribe or ask us to delete it.
- Security logs: retained for a limited period sufficient for security monitoring purposes.
7. Your rights
Under GDPR, you have the right to:
- Access the personal data we hold about you
- Have inaccurate data corrected
- Request erasure of your data, in certain circumstances
- Restrict or object to our processing of your data
- Data portability, where applicable
- Withdraw consent at any time, where processing is based on consent
To exercise any of these rights, contact us at wave-flow@ul.ie, or the University’s Data Protection Officer at dataprotection@ul.ie. Requests are normally processed within 30 days.
If you are not satisfied with our response, you have the right to lodge a complaint with the Irish Data Protection Commission: Email: info@dataprotection.ie Post: Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
8. Children’s privacy
This Site is not specifically directed at children under 16, and we do not knowingly collect personal data from children as part of our normal operations. Children may browse publicly available content on the Site. If you believe a child has provided us with personal data (for example, through the contact form or account registration), please contact us at wave-flow@ul.ie so we can review and, if appropriate, delete it.
9. Data security
We take reasonable technical and organisational measures to protect your personal data, including firewall and login-monitoring security (via All-In-One Security), encrypted password storage, and secure, access-controlled backups. However, no method of transmission or storage over the internet is completely secure, and we cannot guarantee absolute security.
10. Changes to this policy
We may update this Privacy Policy from time to time, for example to reflect changes in the tools we use or in the law. We will post the updated version on this page with a revised “Last updated” date. We encourage you to review this page periodically.
11. Contact us
If you have any questions about this Privacy Policy or how we handle your data, please contact:
WAVE Project Tierney Building, University of Limerick, Limerick, V94 T9PX, Ireland Email: wave-flow@ul.ie
University of Limerick Data Protection Officer Email: dataprotection@ul.ie