Privacy Policy

1. Controller and Contact

This Privacy Policy explains how Neho Studio SRL, trading as Novras, registration number J12/1520/2023, with its registered office at Str. Observatorului, nr. 15, Cluj-Napoca, Cluj, 400347, Romania (“Novras”, “we”, “us” or “our”), processes personal data in connection with https://www.novras.tech (the “Website”).

Neho Studio SRL is the data controller for the processing described in this Policy.

For privacy questions or requests, contact us at contact@novras.tech (the “Contact Email”).

2. Scope

This Policy applies to personal data processed in connection with the public Website, including when you visit the Website or contact Novras through its enquiry or free-assessment form.

It does not generally cover personal data that Novras processes on behalf of customers while providing contracted technical services. Such processing may instead be governed by the relevant customer agreement, data processing agreement or other applicable contractual arrangements.

3. Personal Data We Collect

Contact enquiries

When you submit the Website contact form, we may collect:

• your name;
• company name;
• work email address; and
• the contents of your message or enquiry.

We may also process subsequent correspondence relating to your enquiry.

Providing this information is voluntary, but we may be unable to respond to an enquiry without sufficient contact and enquiry details.

Please avoid submitting sensitive or special-category personal data through the contact form unless genuinely necessary.

Technical information

When you access the Website, technical information may be processed automatically as necessary to deliver and protect the Website, including:

• IP address;
• browser and device information;
• requested pages or resources;
• date and time of requests; and
• standard server, security and diagnostic information.

4. Why We Process Personal Data

We process contact enquiries to respond to requests, understand potential client requirements, arrange assessments or discussions, and take steps towards a possible business relationship.

For ordinary B2B enquiries submitted by employees or representatives of companies, this processing is generally based on our legitimate interests in communicating with prospective business customers and responding to enquiries (Article 6(1)(f) GDPR).

Where you request steps before entering into a contract with Novras in your own capacity, processing may instead or additionally be necessary to take pre-contractual steps at your request (Article 6(1)(b) GDPR).

We process technical information where necessary for our legitimate interests in operating, securing, maintaining and troubleshooting the Website (Article 6(1)(f) GDPR).

Where necessary, we may also process limited information to comply with legal obligations or to establish, exercise or defend legal claims.

We do not sell personal data.

Information submitted through the contact form is not used for unrelated direct marketing unless an appropriate legal basis exists and applicable electronic communications and data protection requirements are satisfied.

We do not use Website data for behavioural profiling or automated decision-making producing legal or similarly significant effects.

5. Service Providers and Recipients

We use a limited number of service providers in operating the Website and handling enquiries, including:

• Vercel, for Website hosting and infrastructure;
• Formspree, for transmission of Website contact-form submissions; and
• our business email provider, for receiving and storing correspondence.

These providers may process personal data on our behalf as necessary to provide their services and are subject to applicable contractual and data protection requirements.

Personal data may also be disclosed where reasonably necessary to professional advisers, public authorities or other recipients where required by law or for the establishment, exercise or defence of legal claims.

6. International Transfers

Some service providers used in connection with the Website, including Vercel and Formspree, may involve processing of personal data outside the European Economic Area, including in the United States.

Where personal data is transferred outside the EEA and GDPR requires transfer safeguards, the transfer must be made using an applicable lawful mechanism under Chapter V GDPR, such as an adequacy decision or European Commission Standard Contractual Clauses, together with any additional safeguards required in the circumstances.

You may request further information about safeguards applicable to your personal data by contacting us at the Contact Email.

7. Retention

Contact enquiries that do not result in a client relationship are generally retained for up to 24 months after our last relevant communication, unless a longer period is reasonably necessary for legal, compliance or dispute-related purposes.

Where an enquiry develops into a business relationship, relevant correspondence may be retained for the duration of that relationship and afterwards for the period necessary to comply with applicable legal obligations or to establish, exercise or defend legal claims.

Technical and server information is retained only for the period reasonably necessary for Website operation, security and troubleshooting. Where such logs are maintained by our infrastructure providers, retention may also depend on the applicable provider configuration and retention arrangements.

8. Cookies and Similar Technologies

As of the effective date of this Policy, the Website does not use analytics tools, advertising pixels, behavioural profiling or tracking cookies.

The Website does not currently use cookies or similar technologies for analytics or advertising purposes.

Fonts are served without third-party font tracking, so visiting the Website does not require your browser to connect to an external font provider for tracking purposes.

If the Website's use of cookies or similar technologies changes, we will update this Policy and obtain consent where required by applicable law.

9. Your GDPR Rights

Subject to the conditions and limitations set out in GDPR, you may have the right to:

• obtain access to your personal data;
• correct inaccurate or incomplete personal data;
• request deletion of personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive personal data in a portable format where the right to data portability applies; and
• withdraw consent at any time where processing is based on consent, without affecting processing carried out before withdrawal.

Requests may be submitted to the Contact Email.

We normally respond to valid requests within one month, subject to any extension permitted by GDPR.

You also have the right to lodge a complaint with the Romanian supervisory authority, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), including through its official website at www.dataprotection.ro, or with another competent supervisory authority where applicable.

10. Security

We use reasonable technical and organisational measures intended to protect personal data against unauthorised access, loss, alteration or disclosure.

The Website is delivered over encrypted HTTPS connections, and access to enquiry information is limited according to business need.

No method of electronic transmission or storage can, however, be guaranteed to be completely secure.

11. Changes to This Policy

We may update this Privacy Policy to reflect changes to the Website, our processing activities, service providers or applicable law.

The current version will be published on the Website with its effective date and version number.