Governed digital operations for UK businesses.
Five practices under one accountable CTO, on UK and EEA infrastructure, against controls published before you sign rather than described after you ask.
TicketWave HQ Ltd is a UK professional services company, registered in England and Wales, number 17143167.
It sells consulting, implementation, agency delivery and managed services through five client-facing practices. It sits in a wider group of which it is, for now, the only incorporated company. The rest of the group is planned rather than registered.
A practice is a capability and a brand is a shop front, so one brand can sell into more than one practice.
| Practice | Promise | Sold through |
|---|---|---|
| Growth & Digital | Be found, be chosen, and keep the customer | VerySEOly: websites built and run, search, marketing automation and CRM |
| Technology Services | Systems that hold up, and someone who answers when they do not | JorTech: repairs and tech help for homes and small offices · Dacros: managed IT, networks and telecoms for businesses · TicketWave HQ directly: integrations and migrations |
| Cybersecurity & Assurance | Know what your exposure is before somebody else finds it | Dacros: small-business security and Cyber Essentials readiness · TicketWave HQ directly: vendor vetting, DPIAs, due diligence |
| Creative Studio | Work that looks like the company you intend to be | VerySEOly: photography, video, brand identity · JorTech: event tech and live streaming |
| Strategy & Transactions | Make, rescue, scale or exit a digital investment | TicketWave HQ directly · fractional CTO |
Procurement asks for a capability statement and gets prose. These are the working documents instead — public, licensed, and usable by people who will never hire us.
| Repository | What it is |
|---|---|
eu-sovereignty-checklist |
The checklist we apply to our own estate before a vendor is approved, plus a verification script that runs. CC BY 4.0 |
eu-sovereign-stack |
EEA and UK alternatives to common US SaaS, with the trade-offs each choice carries written down |
uk-gdpr-dpa-templates |
Article 28 data processing agreements, sub-processor disclosure, and an AI processing addendum |
website-care-checklist |
What ongoing website maintenance should actually include, so a client can check whether they are getting it |
astro-performance-budget |
A performance budget that fails the build rather than filing a warning nobody reads |
UK and EEA infrastructure by default. Anything outside it requires a written exception with a named owner and an expiry date. Undocumented is not one of the available options, because it means nobody ever decided.
The exceptions are published, not buried. Every processor is named at /data-processors with its region and its data protection agreement — including the ones outside the EEA and the reason each is there. A sovereignty claim with no exception list is not one anyone experienced will believe.
Sixteen registers, named individually at /governance: entities, intercompany agreements, transfer pricing, vendors and sub-processors, data processing, DPIAs, AI systems, model risk, open-source IP, IP assignment, incidents, product portfolio, retention, domains, international transfers, and social presence.
AI governance treated as operational, not forthcoming. EU AI Act Article 50 transparency obligations apply now; where a decision is automated we record whether it is wholly or partly so, and human review has to be capable of reaching a different answer.
| For | Where |
|---|---|
| Press and partnerships | hello@ticketwavehq.com |
| Data protection requests | privacy@ticketwavehq.com |
| Security disclosure | security@ticketwavehq.com · scope and policy |