Privacy policy

1. Who is responsible for your data?

The controller for the personal data collected through this website is:

For any question about this policy or about how your data is handled, use the email address above. Novasar has not appointed a data protection officer, because the nature and scale of its processing don’t make one a legal requirement. Your questions come straight to Novasar.

2. What this policy covers

This policy covers the personal data Novasar handles as controller: your visit to novasar.be, the messages you send, and the data of clients, prospects, and their contacts.

Some work is different. When Novasar handles personal data on a client’s instructions as part of a project, it acts as a processor rather than a controller, and the data processing agreement with that client applies instead of this policy.

3. What Novasar collects, and why

3.1 What you send through the contact form

When you fill out the contact form or email Novasar directly, it collects:

• Your name, so you can be addressed properly and Novasar knows who it is talking to.
• Your email address, so Novasar can reply.
• Your company (optional), to understand the context of your question.
• Your message,to understand what you’re asking and answer it.

Novasar uses all of this to handle your message and reply to it. If that leads to a conversation or a project, the same data is used to follow up. None of it goes into automated marketing without your consent.

3.2 Technical data from your visit

Like any website, novasar.be records some technical data automatically when you visit: your IP address, your browser and device type, and the time of the visit. Novasar’s hosting provider processes this to serve the site, keep it secure, and track down faults. It isn’t used to identify you or follow you around.

3.3 Cookies

Novasar sets no cookies without your consent. Analytics cookies (Google Analytics) are set only after you accept them in the cookie banner. The full detail is in the cookie policy.

3.4 Clients, prospects, and their contacts

If you’re a client, a prospect, or someone’s contact at a client, Novasar keeps what it needs to run the relationship and the work: your name and role, contact details, the correspondence between you, and where relevant, quotes and invoices. Most of that comes straight from you or from the company you work for, and occasionally from public professional sources. Your rights under section 9 apply to all of it.

Again, this is data Novasar controls itself. Personal data sitting inside a client’s financial or operational records that Novasar analyzes on that client’s instructions is a separate matter, governed by a data processing agreement with that client rather than by this policy.

4. The legal basis for processing

The GDPR requires a valid legal basis for every use of personal data. Novasar relies on four:

• Performing a contract, or taking steps at your request (art. 6.1.b GDPR): when you reach out for information or to explore working together, and when Novasar carries out a project for you.
• Novasar’s legitimate interests (art. 6.1.f GDPR): answering and following up on incoming messages, and keeping the website secure and running. Novasar weighs that interest against your rights and collects no more than it needs.
• Your consent (art. 6.1.a GDPR): for anything that requires it, such as analytics or marketing cookies. You can withdraw consent at any time.
• A legal obligation (art. 6.1.c GDPR): where the law requires Novasar to keep or hand over certain records.

5. How long data is kept

Novasar keeps data no longer than the purposes above require.

• Contact messages:as long as it takes to answer your question and close out the follow-up. If nothing comes of it, your message and the data with it are deleted no later than 12 months after the last contact. If a project does come of it, that project’s retention periods apply.
• Technical logs: a limited period, generally weeks to months, for security and troubleshooting.
• Client and contact data: for the length of the engagement and afterward, as long as needed for follow-up and to meet legal obligations.
• Statutory retention: if your message relates to services quoted or delivered, tax and accounting rules may require Novasar to keep certain records longer. In Belgium that is generally seven years.

6. Who else sees your data

Novasar never sells your data and never shares it with anyone for their own purposes. It does rely on a small number of vendors that act as processors, working only on Novasar’s instructions and under the data processing agreements the law requires:

• Scaleway SAS(France): runs the email service that carries your message from the website to Novasar’s inbox. Processing stays inside the European Economic Area, in the Paris region.
• Vercel Inc. (United States): hosts and serves the website, and handles the technical data in section 3.2 in doing so.
• Google Ireland Limited: only if you accept analytics cookies. Decline, and nothing is shared with Google. See the cookie policy.

Beyond that, Novasar hands over data only where the law requires it, to the authorities entitled to it.

7. Transfers outside the European Economic Area

Some vendors are based in, or process data in, the United States: Vercel, and Google if you turn analytics on. For those transfers Novasar relies on the safeguards the GDPR provides for, specifically the EU-US Data Privacy Framework and the standard contractual clauses approved by the European Commission. Your data keeps an equivalent level of protection outside the EEA. Novasar will share more detail about these safeguards on request.

8. How your data is protected

Novasar takes appropriate technical and organizational measures against loss, misuse, and unauthorized access. The contact form posts through Novasar’s own server, so your data never goes from your browser to a third party. The connection to the site is encrypted over HTTPS, and access to your messages is limited to whoever needs it. No transfer or storage is ever entirely risk-free, but the level of protection is matched to how sensitive the data is.

9. Your rights

The GDPR gives you the following rights over your personal data:

• Access: find out whether Novasar holds data about you, what it is, and get a copy.
• Rectification: have incorrect or incomplete data corrected.
• Erasure: have your data deleted once Novasar no longer needs it.
• Restriction: have processing paused in certain situations.
• Objection:object to processing based on Novasar’s legitimate interests.
• Portability: receive the data you provided in a common, machine-readable format.
• Withdrawing consent: at any time, without affecting anything processed before you withdrew it.

To exercise any of these, email contact@novasar.be. Novasar may ask you to confirm your identity first, which protects you rather than Novasar. You’ll get a response within the statutory one-month deadline, which can be extended for complex requests. There is no charge.

10. Filing a complaint

If you think Novasar is handling your data wrongly, contact Novasar first. Most issues are quickest to fix directly. You also have the right to lodge a complaint with the Belgian supervisory authority at any time:

11. Minors

Novasar’s website and services are meant for businesses, not for children, and Novasar does not knowingly collect data from minors. If you believe a minor has sent something anyway, get in touch and it will be deleted.

12. Automated decision-making

Novasar makes no decisions based solely on automated processing, including profiling, that produce legal effects for you or affect you in a similarly significant way.

13. Changes to this policy

Novasar updates this policy when its practices or the rules change. The current version is always on this page, dated at the top. If a change is substantial, Novasar will say so directly where that makes sense.

14. Contact

Questions or comments about this policy? Email contact@novasar.be. Novasar is glad to help.