Privacy Policy

Critical Path Consulting & Training ("Critical Path", "company", "we", "us", "our") is the company that has created and manages the PMWaves online project management application ("Service", "application", "platform", "software"). Critical Path provides training, consulting, and software for project management.
The company is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use the PMWaves project management platform.

By using our Service, you agree to the collection and use of information in accordance with this policy.

1. Data Controller

2. Data We Collect

We collect and process data with the sole purpose of lawful, orderly, and effective operation of the application and providing the best possible services to users.
Some of the data is collected automatically, while other data is entered by the user during login to the application or use of the application.

2.1 Account Data

When you create an account or accept an invitation, we collect:

• Email Address
• Password (stored only as a cryptographic hash, never in readable form)
• Full Name
• Organization/Company Name (optional)
• Profile photo (optional)
• Optional information at sign-up (e.g. planned team size, what you want to achieve)
• Your settings in the application (e.g. language, appearance theme, email notification choices)

When a user invites someone to an organization or workspace, we store the invitee's email address so that the invitation can be sent.

2.2 Project Data

When you use our Service, we store data you enter such as:

• Project names and descriptions
• Tasks, milestones, and deliverables
• Project schedules and Gantt chart data
• Resource assignments and allocations
• Budget and cost information
• Risk register entries
• Stakeholder information
• Documents and attachments you upload
• Comments and communications
• Requirements and deliverables

For a complete description of the Service and its capabilities, refer to section 2 of the Terms of Service.

Project data may also contain personal data of third parties entered by users (e.g. names and contact details of stakeholders or resources). For that data the customer, i.e. the Organization that enters it, is the data controller, and Critical Path processes it as a data processor, only to provide the Service. A Data Processing Agreement (DPA) is available on request at privacy@pmwaves.com.

2.3 Technical Data

We automatically collect:

• In the application: for every sign-in attempt, the IP address, the browser type (user agent), the time and the result (success, wrong password, lockout); the date of your last sign-in and the number of sign-ins; the IP address and browser type at sign-up; error reports.
• On the website www.pmwaves.com: for every page view, the page, the language, the IP address and the browser type, for basic visitor statistics without analytics cookies.
• On the server: the usual access logs of the hosting provider (IP address, page, time).

2.4 Usage Data

We record only what the Service needs in order to work: who created or changed a record and when, the history of assignment publications, bulk actions and deletions, and the support requests you submit. We do not record the time you spend on each page or your searches.

2.5 Website Forms

When you fill in a form on the website (contact, demo request, newsletter sign-up), the details you give (e.g. name, email, message) are sent by email to the company so that we can reply to you.

3. Legal Basis for Processing (Article 6 GDPR)

Legal Basis	Purposes
Contract Performance (Article 6(1)(b))	Account creation and management, Service provision, invoicing, support provision
Legitimate Interests (Article 6(1)(f))	Service improvement, security monitoring and sign-in protection (e.g. recording sign-in attempts, Google reCAPTCHA), fraud prevention, basic website visitor statistics (without analytics cookies), and service-related communications where applicable.
Consent (Article 6(1)(a))	Marketing emails, non-essential cookies, participation in beta features
Legal Obligation (Article 6(1)(c))	Tax requirements, legal requests, regulatory compliance

4. How We Use Your Data

We use your data to:

• Provide Service: Provision and maintenance of the PMWaves platform, account creation, project data processing, collaboration enablement
• Improve Service: Development of new features, beta testing, analysis of website traffic
• Communication: Sending Service-related notifications, responding to requests, customer support
• Security: Protection against unauthorized access, monitoring suspicious activity, fraud prevention

4.1 Email Communications (Transactional vs Marketing)

We use your email address to send you communications that are necessary for the operation of the Service (“Service / Transactional Emails”), and, only where permitted and with your consent, promotional communications (“Marketing Emails”).

Service Emails (Transactional) – required to provide the Service

These emails are sent regardless of marketing preferences, as they relate to your account and security:

• confirmation of your email address at sign-up
• invitations to an organization or workspace, and the notice that you were added to a workspace
• password reset emails
• confirmation of an account deletion request, with a restore link
• notifications about task assignments and a morning summary; you can switch them off on the email settings page or with the link included in each such message
• reminders before the end of the free period, the trial or the subscription (7 and 3 days before, and when it ends)
• important updates on the operation of the Service or on changes to the Terms of Service and this Policy
• support communications in response to your requests

Marketing Emails – consent required (opt-in)

Emails containing product news, promotions, newsletters or offers are sent only if you have provided explicit consent, for example with the newsletter sign-up form on the website. Creating an account in the application does not subscribe you to such emails. You may withdraw your consent at any time using the unsubscribe link included in each such message or by contacting us.

5. Data Disclosure and Sharing

We may disclose your information only in the following limited circumstances:

• With Your Consent: When you explicitly authorize us to disclose information
• Service Providers (data processors):
  • top.host: hosting of the application, the website, the database, the files and the backups, and sending of all emails through its mail server
  • Google (reCAPTCHA v3): protection of the sign-in page and the password reset page against automated attacks; Google receives the IP address and details of your browser and device
  • YouTube (Google): the help videos are loaded from youtube-nocookie.com only when you click to watch them
  • Cloudflare (cdnjs): loading of the icon library on the Gantt pages; it receives the IP address and the browser type
  We do not use payment processors (payments are made by bank transfer, outside the application) or external analytics providers.
• Legal Requirements: When required by law, court order, or legal process
• Business Transfers: In connection with any merger or acquisition (you will be notified)

6. Data Retention

• Active Accounts: Data is retained as long as your account is active
• After an Account Deletion Request:
  • The account is moved to "pending deletion" status for 7 days
  • Within these 7 days, you can restore the account with the link in the email you will receive
  • After 7 days, the identifying details of the account (name, email, photo, password) are permanently anonymised. Anything you added to projects of other organizations stays with them, without your name
  • Organizations you own are deleted together with the account: nobody can access their workspaces, projects and files any more, which remain stored without any access until they are permanently erased at your request
  • You can request the complete and permanent erasure of all your data and of the content of your organizations at privacy@pmwaves.com. Before the erasure, a copy of the erased data is kept for 30 days so that it can be restored in case of a mistake
• Workspace Deletion: When a workspace is deleted together with its content, its data is removed from the active database at once; a copy is kept for 30 days, for restoration in case of a mistake, and is then deleted.
• Backups: A backup of the database and the files is taken every day. The last 30 daily backups are kept; older ones are deleted automatically. Deleted data may therefore remain in backups for up to 30 days. In addition, the hosting provider (top.host) keeps its own backups of the server for up to 28 days (daily for 14 days and weekly points at 15, 21 and 28 days). Backups are used only to recover from a failure or for a restoration you request.
• Legal Requirements: Tax records are retained for 5 years according to Greek law, unless there are legal reasons requiring extension of retention.
• End of the Free Period or Subscription: Data is not deleted when the free period, the trial or the subscription ends. The organization becomes view-only and the data stays available for reading and export until you upgrade or ask for it to be deleted.
• Logs: Records of sign-in attempts, website visits and cookie choices, as well as sign-up requests that were not completed, are kept for up to 12 months.
• Email delivery records: The recipient and the text of task assignment notifications are deleted 30 days after sending. Other delivery records (e.g. the date and type of a reminder) are kept for up to 12 months for security, compliance, and troubleshooting purposes.

7. Your Rights under GDPR

8. Data Security

Technical Measures

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit (HTTPS/TLS)
• Passwords stored only as a cryptographic hash
• Access control and user authentication systems, with a temporary account lockout after repeated failed sign-in attempts
• Secure server infrastructure with physical and digital protection
• Daily backups with an automatic integrity check
• Continuous monitoring and security updates
• Error reporting for debugging and service improvement
• Alignment with international security best practices

Despite extensive security measures, no transmission over the internet is 100% secure. We are committed to promptly notifying users and competent authorities in the event of a data breach, in accordance with GDPR requirements.

Incident Response

In the event of a data breach, the company will act in accordance with Articles 33 and 34 of the GDPR, specifically:

• We will notify the Personal Data Protection Authority within 72 hours from the moment we become aware of the incident, when the breach is likely to result in a risk to users' rights and freedoms (Article 33 GDPR)
• We will notify affected users without undue delay when the breach is likely to result in a high risk (Article 34 GDPR)
• We will take immediate measures to contain and address the breach
• We will document the incident and all measures taken, as required by GDPR

9. Cookies and Tracking Technologies

PMWaves uses cookies to ensure proper platform functionality and improve user experience. Cookies are small text files that are stored on your device and allow us to recognize basic settings, such as session, language, and display preferences.

Cookie Categories

Cookie Name	Category	Purpose	Duration	Required?
pmw_sid	Essential	Session identifier for functionality, navigation, and user authentication	Until browser closes	Yes (Always active)
pmw_cookie_consent	Essential	Stores your cookie usage preferences	365 days	Yes (Always active)
pmw_language	Functional	Stores the preferred language of the website (e.g., Greek, English)	30 days	No – with consent
pmw_theme	Functional	Stores the display theme preference of the website (the application's theme is saved in your account, not in a cookie)	30 days	No – with consent

Local Storage on Your Device

The application stores some view settings, e.g. of the diagrams, and form drafts in your browser (localStorage), so that they are not lost when you change page. This information stays on your device, is not sent to us or to third parties, and is used only for features you ask for.

Third-Party Cookies

On the sign-in page and the password reset page, Google reCAPTCHA may store its own cookies or other data on your device in order to detect automated attacks. The help videos are loaded from youtube-nocookie.com only when you click to watch them. Google's use of this information is governed by the Google Privacy Policy.

Analytics & Marketing Cookies

Currently, PMWaves does not use analytics cookies (e.g., Google Analytics) or marketing cookies (e.g., Facebook Pixel). The website's visitor statistics are kept by us, without cookies (see section 2.3). If such services are added in the future, they will only be activated after your explicit consent via the cookie banner.

Cookie Consent Management

Consent Banner

On your first visit, a banner appears allowing you to:

• Accept all cookies
• Reject all non-essential cookies
• Customize your preferences individually by category

Technical Details

• All PMWaves cookies are set with SameSite=Strict for enhanced protection
• On HTTPS connections, the Secure flag is automatically used
• Consent choices are stored both on your device and on the server for compliance logging purposes
• If the cookie system version or policy changes, you will be asked for consent again

Changing Preferences

You can at any time delete cookies and local storage through your browser settings.

Automatic Deletion

If you reject a cookie category, PMWaves automatically deletes all cookies in that category. Essential cookies cannot be deleted as they are critical for platform functionality.

Consequences of Rejecting Cookies

• Essential: Platform use is not possible without these
• Functional: The website's language and theme preferences will not be saved; the application's theme is not affected, because it is saved in your account

10. International Data Transfers

Your data (database, files, backups) is stored on servers within the European Union, hosted by top.host.

Use of Third-Party Services

The application's libraries, including Bryntum Gantt, are hosted on our own server. Three third-party services are loaded from servers that may be located outside the EU/EEA, so your IP address and browser details are transferred to them:

• Google reCAPTCHA, on the sign-in page and the password reset page (Google LLC, USA)
• YouTube, only when you choose to watch a help video (Google LLC, USA)
• Cloudflare cdnjs, for the icons of the Gantt pages (Cloudflare, Inc., USA)

These transfers rely on the EU–US Data Privacy Framework, under which the above companies are certified, or on Standard Contractual Clauses (SCCs). If in the future the need arises for any other transfer of data outside the EU/EEA, it will be carried out only with equivalent legal safeguards.

11. Children's Privacy

11.1 General Requirements

PMWaves allows account creation and free use of the platform by individuals aged 16 years and older, in accordance with Article 8 of the GDPR (Regulation EU 2016/679), which sets the minimum age for consent to the processing of personal data in the context of information society services.

11.2 Differentiation by Type of Use

Free Plan (16+ years)

Individuals aged 16-17 can use the free plan without parental consent, as data processing is based on their personal consent according to GDPR. This includes:

• Account creation and management
• Use of all free platform features
• Access to all their rights under GDPR (access, rectification, erasure, portability, etc.)

Paid Plans (18+ years)

For purchasing subscriptions (Basic, Advanced, Enterprise), age 18 and above is required, as this involves entering into a contract requiring full transactional capacity according to the Greek Civil Code (Article 127).

If an individual aged 16-17 wishes to upgrade to a paid plan, the following is required:

• Explicit consent of a parent or legal guardian
• The parent/guardian must create the account and enter into the contract
• The parent/guardian must be the holder of the payment method
• The parent/guardian has full legal responsibility for use of the service

11.3 Protection of Younger Minors (under 16 years)

The service is not intended for individuals under 16 years of age, and we do not knowingly collect personal data from individuals under 16 years of age.

If we discover that we have collected personal data from an individual under 16 years of age without verifiable parental consent, we will take steps to delete this information as soon as possible.

11.4 Rights of Minors Aged 16-17

Users aged 16-17 have the same GDPR rights as adult users, including:

• Right of access to their data
• Right to rectification of inaccurate data
• Right to erasure (right to be forgotten)
• Right to data portability
• Right to object to processing
• Right to withdraw consent at any time

To exercise these rights, minor users can contact us directly at privacy@pmwaves.com.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our operations or legal requirements. In case of substantial changes, we will:

• update the "Last Updated" date,
• send notification via email (where required),
• where feasible, display a relevant announcement in the application.

Earlier versions of this Policy remain available in the section Updates and Change History.

If you do not wish to continue using the service after changes, you have the option to export your data and terminate your account.

13. Supervisory Authority

Before contacting the Authority, we would appreciate the opportunity to address your issue. Contact us at privacy@pmwaves.com for immediate support.

14. 📋 Updates and Change History

Version 1.3 (October 19, 2026)

This version updates only the retention of backups:

The full text of the previous version remains available: Privacy Policy, version 1.2.

Version 1.2 (October 16, 2026)

This version aligns the Policy with the way the Service works today:

The full text of the previous version remains available: Privacy Policy, version 1.1.

Version 1.1 (January 14, 2026)

This version introduces clarifications to improve transparency:

15. Contact Information

16. Acknowledgment

By using PMWaves, you accept this Privacy Policy and agree to the data processing practices described herein. If you have any questions or concerns, you can contact us at privacy@pmwaves.com.

Last Updated: October 19, 2026 | Version 1.3