Privacy policy

When this policy applies

This policy covers the situations where we are the controller of your data.

• When you visit wehave.io or interact with our marketing channels.
• When you fill in a form, request a demo, subscribe to our communications or contact us.
• When you use the wehave platform as an authorised user of a customer organisation, for example as a club administrator, sponsorship manager or sponsor user.

What we collect, and why

Nothing here asks for more than it needs, and nothing here is sold to anybody.

Legal basis for processing

These are the grounds we rely on under Article 6 of the GDPR.

Performance of a contractArt. 6.1.b

To give authorised users access to the platform under their organisation's subscription, to answer your direct enquiries, and to enforce our terms.

ConsentArt. 6.1.a

For marketing emails, for optional cookies and pixels, and for anything else you have explicitly opted into. You can withdraw it at any time.

Legitimate interestsArt. 6.1.f

To improve and secure the website and the platform, to prevent fraud and abuse, and to run our business. We weigh those interests against your rights.

Legal obligationArt. 6.1.c

Where the law requires us to keep or hand over data, for example for tax and accounting.

How long we keep it

Longer than needed is a liability, not an asset. These are the periods we hold ourselves to.

Marketing leads and newsletter subscribers

Until you unsubscribe, and up to 24 months after that for re-engagement, after which the record is deleted or anonymised.

Platform user accounts

For as long as the customer's subscription runs, plus 12 months, after which the account and the personal data in it are deleted, unless the law requires us to keep something longer.

Support communications

Up to 24 months after our last contact.

Website analytics, cookies and pixels

A maximum of 13 months from the day it was collected, in line with cookie consent guidance.

Accounting and tax records

Seven years, as Belgian law requires.

Who else sees it

We do not sell personal data and we do not share it for anyone else’s marketing. We share it with the sub-processors and partners who help us run the business, each under a written agreement that binds them to data protection obligations equivalent to our own.

Sub-processors for wehave.io

Sub-processors for the wehave platform

A note on these lists. These reflect our current set-up and are not exhaustive. We may engage additional or replacement sub-processors from time to time. Where we act as a processor on a customer's behalf, we give that customer at least 30 days' written notice before a new sub-processor is engaged, as our data processing agreement requires. Where we act as controller, we update this page.

International transfers

Personal data is processed within the EU and the EEA. Some of our sub-processors' parent companies are outside it, usually in the United States. Where data does leave the EEA we rely on the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914) and, where it applies, on further safeguards such as the EU to US Data Privacy Framework.

We will also hand data to the authorities where the law requires it, and to a professional adviser where we need one.

Your rights

Under the GDPR you can do all of the following, free of charge. We may ask you something to check it is really you.

Access

Ask for a copy of the personal data we hold about you.

Correct

Have anything inaccurate or incomplete put right.

Erasure

Ask us to delete your data.

Restrict or object

Have certain processing paused, or object to it outright.

Portability

Receive what you gave us in a machine-readable file.

Withdraw consent

Change your mind at any time, which does not affect processing that was lawful before you did.

Email us and we will come back to you within one month of receiving it. Write to hello@wehave.io or to dpo@wehave.io.

You can also lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, +32 (0)2 274 48 00, contact@apd-gba.be.

Two more things worth stating plainly. Nothing on this website makes an automated decision about you, and this site is not aimed at children: it is sold to commercial departments at sports clubs and rights holders.

Complaints and disputes

If you have a complaint about how we process your personal data, write to hello@wehave.io or dpo@wehave.io. We log it in our internal dispute and complaint register and respond within one month.

Where your complaint concerns data we received from a third-party source or identity provider, such as an authentication provider, a connected partner system or a contracting and signing platform, we forward it to that party within five business days with a factual description and our proposed handling. We work with them and with the relevant customer to resolve it, and we come back to you with the outcome.

You can go to the Belgian Data Protection Authority at any time, whether or not you come to us first.

Services where we act as a processor

We provide ticketing portals, contracting and signing workflows, hospitality management, sponsorship activation and similar tools to clubs, event organisers, brands, agencies and other rights holders. When you use one of those services as it is operated by one of our customers, that customer is the controller of your personal data and we process it as their processor, on their documented instructions, under our standard data processing agreement.

For how your data is handled in that flow, read the privacy notice published by that organisation, and contact them directly to exercise your rights over it.