Privacy notice

1. The data controller

The data controller is the operator of the NOVA service (the "Controller"). This notice covers the data processing of the licence management, the dashboards, the company portal and the NOVA Edge on-premise servers (together: the "System").

2. Data we process

• Administrators: name, e-mail address, password (stored only irreversibly encrypted).
• Company contacts and portal users: company name, tax number, contact name and e-mail, sign-in credentials.
• Contact form: name, company, e-mail address and message content.
• Technical logs: IP address, browser type, sign-in and operation events, security incidents.
• Operational data: inventory, service and device data stored by the company in the System — for these the company is the controller and the Controller acts as processor.

3. Purpose and legal basis

Processing aims to provide the service, manage access, answer inquiries and protect the System's security. Legal basis: performance of a contract (GDPR Art. 6(1)(b)), consent given by inquiring (Art. 6(1)(a)), and legitimate interest (Art. 6(1)(f)) for security logging and abuse prevention.

4. Retention

Account and contract data is kept while the account or contractual relationship exists, and afterwards as required by accounting law. Contact form messages are kept for up to 12 months; security logs for a limited period justified by incident investigation.

5. Data sharing and processors

Personal data is disclosed to third parties only where required by law. Hosting and infrastructure providers act as data processors under contractual safeguards; data stays within the European Union.

6. Data security

Passwords are stored with one-way encryption, traffic runs over TLS. Access is role-based, operations are logged, and critical API endpoints are protected by message signatures and rate limits. Local Edge servers store data on the customer's network, under the customer's control.

7. Your rights

You may request access to your data, rectification, erasure, restriction of processing, object to processing, request data portability, and withdraw consent at any time. Submit your request to the operator in writing; we answer without undue delay.

8. Complaints

If you believe the processing does not comply with the law, you may lodge a complaint with the competent data protection authority.

9. Cookies

The System uses only session and language-preference cookies; no marketing, analytics or tracking cookies are used.

10. Changes to this notice

The Controller reserves the right to modify this notice; the current version is always available on this page.