Data Protection

GeoReach is designed to provide geographic intelligence while limiting the personal information collected through its public website. The public postcode explorer should use authorised datasets and avoid exposing private customer records or live worker locations.

The early-access form requests a limited set of information needed to respond to an enquiry. Phone number is not mandatory. Postcode search should be limited to geographic lookup and should not invite personal information.

The website does not create a separate database for enquiries. Form submissions are forwarded by a Next.js server route to the WaveSync backend configured for lead management.

Browser requests are sent to internal Next.js API routes. Those routes validate input and make server-to-server requests to the configured backend. Backend credentials are held in server-side environment variables and must never be exposed through public client configuration.

Production deployment should use HTTPS, secret management, access controls, dependency updates, rate limiting, appropriate logging and incident-response procedures.

For each production dataset, GeoReach should document its source, licence, geography level, coverage date, update frequency and known limitations.

Modelled estimates must be distinguished from directly observed counts. Postcode-level information must not be presented as address-level facts unless the source and methodology support that precision.

If GPS tracking is offered in a future product workflow, the responsible organisation must establish an appropriate lawful basis, provide clear notices to workers, define access permissions and retention periods, and assess the impact of monitoring. Public website previews must never expose identifiable live worker locations.

For data-protection requests, contact support@wavesync.dev. The relevant controller and processor roles, backend retention arrangements and provider contracts must be confirmed for each service before launch.