Privacy and Data Protection Policy - NovoX (NovoX)

Last updated: February 24, 2025

Welcome to NovoX. We take the protection of your personal data and privacy very seriously. This document (the “Privacy Policy”) explains how we collect, process, retain and transfer your personal data in accordance with the EU General Data Protection Regulation (EU GDPR) and international standards.

1. Data Controller and Contact Information

The controller of your personal data within the meaning of Article 4(7) GDPR is NovoX:

• Company name: NovoX Studio
• Senior managers and owners: Pourya Daneshvar
• Data Protection Officer (DPO): [email protected]
• General contact email: [email protected]
• Support and data subject rights: [email protected]

2. Fundamental Principles of Data Processing at NovoX

We carry out all data processing activities in accordance with Article 5 GDPR and the following principles:

1. Lawfulness, fairness and transparency: Fair and fully transparent processing based on a specified legal basis.
2. Purpose limitation: Data is collected solely for specified, explicit and legitimate purposes.
3. Data minimisation: Data is collected only to the extent necessary for the relevant purposes.
4. Accuracy: Information is kept up to date and inaccurate data is corrected without delay.
5. Storage limitation: Data is not retained longer than necessary.
6. Integrity and confidentiality: Security is ensured, including protection against unauthorised access, disclosure and destruction.

3. Types of Data Collected

a) Information provided by the user

• Identity and contact information: Full name, email address, telephone number, organisation or company name.
• Messages and correspondence: Messages sent through contact forms, demo requests and project consultation requests.
• Account information: Username, encrypted password and preferences.

b) Information collected automatically

• Technical and device data: IP address, browser type and version, operating system and unique device identifier.
• Analytics and traffic data: Pages viewed, time spent on the website and links clicked.
• Cookies: Technical cookies required for platform operation.

4. Legal Basis for Processing under Article 6 GDPR

The table below sets out the data categories, processing purposes and legal bases under Article 6 GDPR:

Data category	Processing purpose	Legal basis (Article 6 GDPR)
Identity and contact information	Service delivery, communication and technical support	Paragraph 1(b) - performance of a contract or pre-contractual measures
Technical log and traffic data	Server security and prevention of cyberattacks	Paragraph 1(f) - the company’s legitimate interest in maintaining network security
Newsletter and marketing information	Sending NovoX news, discounts and event information	Paragraph 1(a) - the user’s explicit and informed consent
Financial and transaction records	Issuing invoices and complying with tax and accounting laws	Paragraph 1(c) - compliance with legal obligations

5. Data Retention Period

NovoX retains your personal data only for as long as necessary to fulfil the purposes described in this Policy:

• Active customer data: During the service period and for a maximum of 5 years after contract termination to meet legal obligations.
• Consultation and contact requests: For a maximum of 12 months after the user’s last interaction.
• Server security logs: For a maximum of 90 working days, after which they are overwritten or permanently deleted.
• Data for which consent has been withdrawn: Deleted or anonymised within a maximum of 30 working days of the request.

6. Data Sharing and International Transfers

We never sell or rent your personal data to third parties. Data is shared exclusively in the following circumstances:

• Cloud and infrastructure service providers: Secure servers located in the European Economic Area (EEA), in accordance with Standard Contractual Clauses (SCCs).
• Legal requirements: Where a valid judicial order is issued by a competent legal authority.
• Internal confidentiality: Access is strictly limited to authorised personnel under the direct supervision of NovoX.

7. Data Subject Rights under the GDPR

Under Chapter III GDPR, you have the following comprehensive rights:

1. Right of access (Article 15): To receive a copy of all personal data we hold about you.
2. Right to rectification (Article 16): To request correction without delay of incomplete or inaccurate data.
3. Right to erasure (Article 17): To request complete deletion of personal data where there is no legal obligation to retain it.
4. Right to restriction of processing (Article 18): To request temporary suspension of processing in specified circumstances.
5. Right to data portability (Article 20): To receive your data in a structured, commonly used and machine-readable format.
6. Right to object (Article 21): To object to processing based on legitimate interests or direct marketing.
7. Right to withdraw consent: To withdraw previously given consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

All such requests will be handled free of charge within a maximum of 30 calendar days.

8. Technical and Organisational Security Measures

NovoX has implemented the following measures to prevent data breaches:

• Use of advanced TLS 1.3 encryption in transit and AES-256 encryption at rest.
• Two-factor authentication (2FA) for all system and administrative access.
• Periodic security assessments, penetration tests and continuous vulnerability monitoring.
• A procedure for promptly notifying the supervisory authority of a data breach within a maximum of 72 hours under Article 33 GDPR.

9. Changes to the Privacy Policy

We may update this Privacy Policy as laws change or NovoX services develop. Any material change will be communicated by a website notice or email. Your continued use of the services after the effective date constitutes acceptance of the new version.

If you have any question, concern or request to exercise your GDPR rights, you may contact NovoX management or the data protection team directly at [email protected].