Governed digital operations for UK businesses.
Five practices under one accountable CTO, on UK and EEA infrastructure, against controls published before you sign rather than described after you ask.
TicketWave HQ Ltd is a UK professional services company, registered in England and Wales, number 17143167.
It sells consulting, implementation, agency delivery and managed services through five client-facing practices. It is not a SaaS company and does not operate a commerce platform — those belong to separate entities in the group and are run separately.
| Practice | Promise | Trades as |
|---|---|---|
| Growth & Digital | Be found, be chosen, and keep the customer | VerySEOly |
| Technology Services | Systems that hold up, and someone who answers when they do not | JorTech |
| Cybersecurity & Assurance | Know what your exposure is before somebody else finds it | Dacros |
| Creative Studio | Work that looks like the company you intend to be | — |
| Strategy & Transactions | Make, rescue, scale or exit a digital investment | — |
Procurement asks for a capability statement and gets prose. These are the working documents instead — public, licensed, and usable by people who will never hire us.
| Repository | What it is |
|---|---|
eu-sovereignty-checklist |
The checklist we apply to our own estate before a vendor is approved, plus a verification script that runs. CC BY 4.0 |
eu-sovereign-stack |
EEA and UK alternatives to common US SaaS, with the trade-offs each choice carries written down |
uk-gdpr-dpa-templates |
Article 28 data processing agreements, sub-processor disclosure, and an AI processing addendum |
website-care-checklist |
What ongoing website maintenance should actually include, so a client can check whether they are getting it |
astro-performance-budget |
A performance budget that fails the build rather than filing a warning nobody reads |
UK and EEA infrastructure by default. Anything outside it requires a written exception with a named owner and an expiry date. Undocumented is not one of the available options, because it means nobody ever decided.
The exceptions are published, not buried. Every processor is named at /data-processors with its region and its data protection agreement — including the ones outside the EEA and the reason each is there. A sovereignty claim with no exception list is not one anyone experienced will believe.
Sixteen registers, named individually at /governance: entities, intercompany agreements, transfer pricing, vendors and sub-processors, data processing, DPIAs, AI systems, model risk, open-source IP, IP assignment, incidents, product portfolio, retention, domains, international transfers, and social presence.
AI governance treated as operational, not forthcoming. EU AI Act Article 50 transparency obligations apply now; where a decision is automated we record whether it is wholly or partly so, and human review has to be capable of reaching a different answer.
| For | Where |
|---|---|
| Press and partnerships | hello@ticketwavehq.com |
| Data protection requests | privacy@ticketwavehq.com |
| Security disclosure | security@ticketwavehq.com · scope and policy |