Privacy Policy

Critical Path Consulting & Training ("Critical Path", "company", "we", "us", "our") is the company that has created and manages the PMWaves online project management application ("Service", "application", "platform", "software"). Critical Path provides training, consulting, and software for project management.
The company is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use the PMWaves project management platform.

By using our Service, you agree to the collection and use of information in accordance with this policy.

1. Data Controller

2. Data We Collect

We collect and process data with the sole purpose of lawful, orderly, and effective operation of the application and providing the best possible services to users.
Some of the data is collected automatically, while other data is entered by the user during login to the application or use of the application.

2.1 Account Data

When you create an account, we collect:

• Email Address
• Password (encrypted)
• Full Name
• Organization/Company Name (optional)
• Phone Number (optional)

2.2 Project Data

When you use our Service, we store data you enter such as:

• Project names and descriptions
• Tasks, milestones, and deliverables
• Project schedules and Gantt chart data
• Resource assignments and allocations
• Budget and cost information
• Risk register entries
• Stakeholder information
• Documents and attachments you upload
• Comments and communications
• Requirements and deliverables

For a complete description of the Service and its capabilities, refer to section 2 of the Terms of Service.

2.3 Technical Data

We automatically collect data such as: IP address, browser type and version, operating system, device information, time zone settings, login timestamps, session data, and error information.

2.4 Usage Data

We collect information about how you use the Service such as: Features accessed, actions performed, time spent on pages, usage patterns, and search queries within the application.

3. Legal Basis for Processing (Article 6 GDPR)

Legal Basis	Purposes
Contract Performance (Article 6(1)(b))	Account creation and management, Service provision, payment processing, support provision
Legitimate Interests (Article 6(1)(f))	Service improvement, security monitoring, fraud prevention, basic operational analytics (without analytics cookies), and service-related communications where applicable.
Consent (Article 6(1)(a))	Marketing emails, non-essential cookies, participation in beta features
Legal Obligation (Article 6(1)(c))	Tax requirements, legal requests, regulatory compliance

4. How We Use Your Data

We use your data to:

• Provide Service: Provision and maintenance of the PMWaves platform, account creation, project data processing, collaboration enablement
• Improve Service: Development of new features, beta testing, usage pattern analysis
• Communication: Sending Service-related notifications, responding to requests, customer support
• Security: Protection against unauthorized access, monitoring suspicious activity, fraud prevention

4.1 Email Communications (Transactional vs Marketing)

We use your email address to send you communications that are necessary for the operation of the Service (“Service / Transactional Emails”), and, only where permitted and with your consent, promotional communications (“Marketing Emails”).

Service Emails (Transactional) – required to provide the Service

These emails are sent regardless of marketing preferences, as they relate to your account and security:

• welcome and trial activation emails
• getting-started and onboarding instructions
• security notifications (e.g. password changes, suspicious logins)
• important service updates (e.g. downtime, critical changes)
• trial-related notifications (e.g. trial ending reminders, plan changes)
• support communications in response to your requests

Marketing Emails – consent required (opt-in)

Emails containing product news, promotions, newsletters or offers are sent only if you have provided explicit consent. You may withdraw your consent at any time using the unsubscribe link or by contacting us.

5. Data Disclosure and Sharing

We may disclose your information only in the following limited circumstances:

• With Your Consent: When you explicitly authorize us to disclose information
• Service Providers: Hosting provider (top.host), email service providers, payment processors, analytics providers - all contractually bound to protect your data
• Legal Requirements: When required by law, court order, or legal process
• Business Transfers: In connection with any merger or acquisition (you will be notified)
• Email delivery providers: Used to send service emails (e.g. welcome, security notifications) and, where consent has been given, marketing emails. These providers act as data processors under contractual obligations.

6. Account Data Retention

• Active Accounts: Data is retained as long as your account is active
• After Account Deletion:
  • The account is moved to "pending deletion" status for 7 days
  • Within these 7 days, you can restore the account via the email you will receive
  • After 7 days, the account is deleted from the active database
  • Backups are retained for an additional 30 days (total: 37 days from initial request)
  • During the 30-day backup period, you can request restoration by contacting us
  • After 37 days total, all data is permanently deleted
• Legal Requirements: Tax records are retained for 5 years according to Greek law, unless there are legal reasons requiring extension of retention.
• Free Plan Data: Warning after 6 months of inactivity, deletion after 12 months of inactivity
• Email delivery and communication logs: May be retained for up to 12 months for security, compliance, and troubleshooting purposes.

7. Your Rights under GDPR

8. Data Security

Technical Measures

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption during data transmission and storage
• Access control and user authentication systems
• Secure server infrastructure with physical and digital protection
• Regular backups and recovery plan
• Continuous monitoring and security updates
• Error reporting for debugging and service improvement
• Alignment with international security best practices

Despite extensive security measures, no transmission over the internet is 100% secure. We are committed to promptly notifying users and competent authorities in the event of a data breach, in accordance with GDPR requirements.

Incident Response

In the event of a data breach, the company will act in accordance with Articles 33 and 34 of the GDPR, specifically:

• We will notify the Personal Data Protection Authority within 72 hours from the moment we become aware of the incident, when the breach is likely to result in a risk to users' rights and freedoms (Article 33 GDPR)
• We will notify affected users without undue delay when the breach is likely to result in a high risk (Article 34 GDPR)
• We will take immediate measures to contain and address the breach
• We will document the incident and all measures taken, as required by GDPR

9. Cookies and Tracking Technologies

PMWaves uses cookies to ensure proper platform functionality and improve user experience. Cookies are small text files that are stored on your device and allow us to recognize basic settings, such as session, language, and display preferences.

Cookie Categories

Cookie Name	Category	Purpose	Duration	Required?
pmw_sid	Essential	Session identifier for functionality, navigation, and user authentication	Until browser closes	Yes (Always active)
pmw_cookie_consent	Essential	Stores your cookie usage preferences	365 days	Yes (Always active)
pmw_language	Functional	Stores preferred language (e.g., Greek, English)	30 days	No – with consent
pmw_theme	Functional	Stores preferred display theme (light/dark)	30 days	No – with consent

Analytics & Marketing Cookies

Currently, PMWaves does not use analytics cookies (e.g., Google Analytics) or marketing cookies (e.g., Facebook Pixel). If such services are added in the future, they will only be activated after your explicit consent via the cookie banner.

Cookie Consent Management

Consent Banner

On your first visit, a banner appears allowing you to:

• Accept all cookies
• Reject all non-essential cookies
• Customize your preferences individually by category

Technical Details

• All cookies are set with SameSite=Strict for enhanced protection
• On HTTPS connections, the Secure flag is automatically used
• Consent choices are stored both on your device and on the server for compliance logging purposes
• If the cookie system version or policy changes, you will be asked for consent again

Changing Preferences

You can at any time:

• Delete cookies through your browser settings
• Enable "Do Not Track" feature in your browser

Automatic Deletion

If you reject a cookie category, PMWaves automatically deletes all cookies in that category. Essential cookies cannot be deleted as they are critical for platform functionality.

Consequences of Rejecting Cookies

• Essential: Platform use is not possible without these
• Functional: Language and theme preferences will not be saved

10. International Data Transfers

Your data is stored on servers within the European Union, hosted by top.host. If in the future the need arises to transfer data outside the EU/EEA, we will ensure that the transfer is carried out only based on appropriate legal safeguards, such as Standard Contractual Clauses (SCCs) or through providers certified under the EU–US Data Privacy Framework or equivalent compliance mechanism.

Use of Third-Party Services

Certain features use external JavaScript libraries (e.g., Bryntum Gantt Charts) that may be loaded from CDNs outside the EU. These libraries do not collect personal data.

11. Children's Privacy

11.1 General Requirements

PMWaves allows account creation and free use of the platform by individuals aged 16 years and older, in accordance with Article 8 of the GDPR (Regulation EU 2016/679), which sets the minimum age for consent to the processing of personal data in the context of information society services.

11.2 Differentiation by Type of Use

Free Plan (16+ years)

Individuals aged 16-17 can use the free plan without parental consent, as data processing is based on their personal consent according to GDPR. This includes:

• Account creation and management
• Use of all free platform features
• Access to all their rights under GDPR (access, rectification, erasure, portability, etc.)

Paid Plans (18+ years)

For purchasing subscriptions (Basic, Advanced, Enterprise), age 18 and above is required, as this involves entering into a contract requiring full transactional capacity according to the Greek Civil Code (Article 127).

If an individual aged 16-17 wishes to upgrade to a paid plan, the following is required:

• Explicit consent of a parent or legal guardian
• The parent/guardian must create the account and enter into the contract
• The parent/guardian must be the holder of the payment method
• The parent/guardian has full legal responsibility for use of the service

11.3 Protection of Younger Minors (under 16 years)

The service is not intended for individuals under 16 years of age, and we do not knowingly collect personal data from individuals under 16 years of age.

If we discover that we have collected personal data from an individual under 16 years of age without verifiable parental consent, we will take steps to delete this information as soon as possible.

11.4 Rights of Minors Aged 16-17

Users aged 16-17 have the same GDPR rights as adult users, including:

• Right of access to their data
• Right to rectification of inaccurate data
• Right to erasure (right to be forgotten)
• Right to data portability
• Right to object to processing
• Right to withdraw consent at any time

To exercise these rights, minor users can contact us directly at privacy@pmwaves.com.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our operations or legal requirements. In case of substantial changes, we will:

• update the "Last Updated" date,
• send notification via email (where required),
• display a relevant notification within the application.

If you do not wish to continue using the service after changes, you have the option to export your data and terminate your account.

13. Supervisory Authority

Before contacting the Authority, we would appreciate the opportunity to address your issue. Contact us at privacy@pmwaves.com for immediate support.

14. 📋 Updates and Change History

Version 1.1 (January 14, 2026)

This version introduces clarifications to improve transparency:

15. Contact Information

16. Acknowledgment

By using PMWaves, you accept this Privacy Policy and agree to the data processing practices described herein. If you have any questions or concerns, you can contact us at privacy@pmwaves.com.

Last Updated: January 14, 2026 | Version 1.1