Privacy policy

This policy applies to the public N0VA website (the “Website”), the project enquiry form and any communication following an enquiry. It also covers call booking if that function is made available on the Website.

The entity identified above is the controller of personal data. If a data protection officer is appointed, their contact details will be provided here.

When you submit an enquiry, we process:

• your name and email address;
• your phone number and company name, if provided;
• the selected service, detailed scope, indicative budget and planned timeline;
• your message, form language and confirmation that we may contact you;
• the date on which the enquiry record is created or updated.

When you browse the Website, technical infrastructure may record operational data such as your IP address, request time, requested resource, browser type and error information. We use this information to keep the Website secure and operational.

Please do not include special-category data or any information that is not needed for us to respond or prepare a proposal.

• Handling your enquiry, preparing a proposal and taking steps before entering into a contract — Article 6(1)(b) GDPR.
• Communicating with a person acting for a business and managing a business relationship — Article 6(1)(f) GDPR; our legitimate interest is communicating with a prospective or current client.
• Protecting the Website, preventing abuse, and establishing, exercising or defending legal claims — Article 6(1)(f) GDPR.
• Complying with legal obligations related to a contract — Article 6(1)(c) GDPR where applicable.

The checkbox next to the form confirms that we may reply to the enquiry. Processing the information needed to handle the enquiry is generally based on steps taken at your request before entering into a contract, rather than on marketing consent. N0VA does not use this form to subscribe you to a newsletter or send unsolicited marketing.

We may engage providers of hosting, databases, file storage, IT maintenance, email, security, legal or accounting services. They receive only the information needed for their role and process it on an appropriate legal basis.

We do not sell personal data. We disclose it to public authorities only where applicable law requires us to do so.

If an infrastructure provider processes data outside the European Economic Area, the transfer takes place under a GDPR-compliant mechanism, such as an adequacy decision or Standard Contractual Clauses. You may contact the controller for information about the mechanism used.

We keep enquiry data for as long as needed to discuss the project and prepare a proposal. If no engagement begins, we delete or anonymise it no later than 12 months after the last contact, unless we need to retain it to defend against legal claims.

If we enter into a contract, we may keep the data throughout its performance and subsequently until relevant claims expire and for any period required by tax or accounting law. Technical logs are kept only as long as needed for security and diagnostics.

The Website distinguishes between the following categories:

• Necessary — support security, core Website functions and storage of your privacy choice. Consent is not required where the technology is essential to provide a service you requested.
• Analytics — help measure traffic and understand how the Website is used. They may include Google Analytics 4 or Google Tag Manager only when the relevant identifier is configured and you consent.
• Marketing — support advertising measurement and audience creation. They may include Meta Pixel and advertising tags deployed through Google Tag Manager only when configured and you consent.

If an identifier for a particular tool is not configured, that tool is not loaded. The public Website does not run analytics or marketing scripts before consent. The administration area may use a technical authentication mechanism available only to authorised users.

You can refuse optional technologies, consent separately to analytics and marketing, or later change or withdraw your choice through the “Cookie settings” button. Withdrawal does not affect processing that was lawful before it. You can also delete cookies in your browser settings.

Depending on the legal basis and circumstances, you may request access, correction, erasure, restriction or portability of your data. You may also object to processing based on legitimate interests.

Send your request to the controller’s contact address. We may ask for information needed to verify your identity before acting on it.

You may lodge a complaint with the supervisory authority in the country of your habitual residence, place of work or place of the alleged infringement. The controller’s lead authority in Poland is the President of the Personal Data Protection Office.

Your name, email address, project scope, budget, timeline and message are required to submit the form and receive a useful response. Your phone number and company name are optional. Without the required information, we cannot process the enquiry.

We do not use your data for solely automated decisions that produce legal or similarly significant effects, or for profiling within the meaning of the GDPR.

N0VA uses technical and organisational measures appropriate to the risk, including restricted access to enquiries, transmission security and access controls for administration systems.

The Website and enquiry form are not directed to children. We may update this policy when the Website, processing activities or applicable law changes. The current version is always published at this address.