Privacy notice

Updated 6 October 2026

This notice covers WAYF's Payload CMS agency directory, its shortlist form and correspondence about listings.

Who handles your information

WAYF Digital sp. z o.o., Złota 75A/7, 00-819 Warsaw, Poland, is the controller. Contact [email protected] about your data.

Your shortlist

When you request a shortlist, we process your email, selected agencies, attachment preference, request time and optional marketing choice. Resend sends the PDFs and a request record to our inbox. Our legitimate interest is fulfilling your request (GDPR Article 6(1)(f)). The email field is required for delivery; you can browse and compare agencies without providing it.

Marketing is optional and based on your separate consent (Article 6(1)(a)). Leaving the box unticked does not affect your shortlist. Withdraw consent or object to marketing by replying to an email or contacting us. Requests and consent records follow WAYF's resource-request retention schedule: up to 24 months, with earlier deletion where applicable on request.

Applications, profile claims and corrections

If you email an application, claim or correction, we process your name, work email, role, correspondence and the supporting information you provide. We use this to assess submissions, verify authority to represent an agency, maintain accurate listings and handle rights requests. These are our legitimate interests under Article 6(1)(f). Please send only information needed for the request.

Correspondence is retained for up to 24 months after the request is resolved. Records needed to establish permission to use an asset are retained while it is used and, where necessary, to handle legal claims. Applying or claiming a profile does not subscribe you to marketing. Public listings identify businesses; contact us if a listing contains personal information you would like reviewed.

Hosting and abuse prevention

Cloudflare hosts the directory and processes connection data, including IP addresses. Turnstile loads when the form comes into view or receives focus and uses browser signals and a challenge token to check for automated abuse. WAYF verifies the token without retaining it. Short-lived rate-limit records use IP addresses and hashed email addresses. This processing protects the service under Article 6(1)(f).

Providers and links

Cloudflare, Resend and our email provider Google Workspace process the data needed to operate this service. Provider processing may take place outside the EEA; contact us for the applicable transfer safeguards and agreement details. WAYF does not sell your data.

The directory has no advertising trackers or session recordings. Agency selections appear in shareable links; email addresses do not. Links to WAYF carry referral parameters. Visiting WAYF or another agency takes you to a separate site governed by its own privacy notice.

Your choices and rights

You can request access, correction, deletion, restriction or portability where applicable, object to legitimate-interest processing, and withdraw consent without affecting earlier lawful processing. Contact us using the address above. You can also complain to your supervisory authority, including Poland's UODO. We do not use shortlist requests for automated decisions with legal or similarly significant effects.

See WAYF's main privacy notice for enquiries, bookings and activity on wayf.ai. Directory terms,credits and agency applicationsare available separately.