Operators and joint controllers
NovaraCode is jointly operated by two independent individuals. For the website, enquiries and contact-chat service, they jointly determine the purposes and essential means of processing and therefore act as joint controllers.
Requests may be sent to the shared contact address below. The controllers coordinate responses and remain responsible for complying with applicable data-protection obligations. This notice summarizes that practical allocation for visitors.
Joint controller 1
- Legal name
- Németh Ádám E.V.
- Registered address
- 2100 Gödöllő, Isaszegi út 82.
- Registration number
- 57868389
- Tax number
- 59822352-1-33
- Contact email
- info@novaracode.com
Joint controller 2
- Legal name
- Lakatos Krisztián E.V.
- Registered address
- 2209 Péteri, Ady Endre utca 48/A
- Registration number
- 54233434
- Tax number
- 55537542-1-33
- Contact email
- info@novaracode.com
Shared privacy contact: hello@novaracode.com. Unless legally required by the nature of a request, visitors do not need to contact both controllers separately.
Scope of this notice
This notice applies to the public NovaraCode website, Website Inspector, WordPress Exposure Scanner, shared reports, optional tool newsletter, embedded contact chat, email enquiries initiated through the website, and the technical systems used to operate and secure them. A separate agreement or notice may apply if an enquiry develops into a client engagement.
Data that may be processed
Website and technical data
IP address, request time, requested page, browser and device information, language, technical error and security information may be processed in server and application logs. If optional analytics consent is granted, Google Analytics may also process generated browser and session identifiers, page path and title, referrer, selected campaign parameters, language, approximate location, device and browser characteristics, and the interaction events described in this notice. Chat text, names and email addresses are not sent to Google Analytics.
Contact-chat data
The chat may process an anonymous browser identifier, session and verification state, selected language, privacy-notice version and acknowledgement time, chat messages, message and read timestamps, presence and operational events, first-entry page and scroll position, conversation status, and internal notes needed to handle the enquiry.
Email and identity data
An email address is optional when starting a chat. If provided, the service may process the email address, verification status, a username derived from the address, verification and delivery events, message subject, provider identifier and related timestamps so the conversation can be continued across devices and followed up by email.
Website-scanner data
When a public tool is used, the submitted website address, normalized hostname, public scan results, detected technical evidence, scan and module status, timestamps, scanner and ruleset versions, an HMAC-derived client identifier, and a limited user-agent summary may be processed. The scanner retrieves only publicly available website and DNS information. When the optional PageSpeed module is enabled, the submitted public website origin is sent to Google PageSpeed Insights to obtain a mobile laboratory report. Shared reports are created only when requested and can be viewed by anyone who has their unlisted link.
Tool newsletter data
If a visitor explicitly subscribes to tool updates, the service stores the normalized email address, selected language, signup source, consent time, subscription status, an HMAC-derived client identifier and related timestamps. Scanning, results and report sharing do not require newsletter subscription.
Operational metrics
The system records counts and aggregated statistics about chat openings, selected contact methods, consent-notice acknowledgements, messages, response times, first-entry pages, conversation outcomes and service reliability. Individual operational records may remain linked to a conversation until they are aggregated or deleted.
Purposes of processing
Responding to enquiries
To receive questions, understand a potential project, reply to the visitor, continue a conversation and take requested steps before a possible contract.
Operating the chat
To maintain a browser session, deliver and synchronise messages, show availability and read states, send requested verification or summary emails, and restore a conversation on another device.
Providing the public scanners
To validate submitted targets, queue and perform passive checks, produce and compare reports, reuse recent results, prevent duplicate work, operate the local vulnerability catalogue, and keep the main website responsive when scanner demand is high.
Security and abuse prevention
To rate-limit requests, prevent spam and misuse, investigate errors, maintain audit information and protect the website, infrastructure, operators and visitors.
Service improvement
To understand navigation and campaign performance, determine whether contact functions work, measure aggregate usage and response performance, identify technical problems and improve the website and contact process. Optional Google Analytics measurement is performed only after consent.
Legal bases
Processing required to respond to an enquiry or take requested steps before entering into a contract is based on Article 6(1)(b) GDPR. General business correspondence and the effective handling of enquiries may also rely on the controllers’ legitimate interests under Article 6(1)(f) GDPR.
Service security, necessary operational logging, abuse prevention and proportionate service metrics rely on the controllers’ legitimate interests under Article 6(1)(f) GDPR. The necessary chat cookie supports a function expressly requested by the visitor.
Processing needed to run a scan or create a requested report is performed to provide the service expressly requested by the visitor and, where applicable, to take requested steps before a possible contract under Article 6(1)(b) GDPR. Scanner security, caching, abuse prevention and proportionate operational metrics rely on the controllers’ legitimate interests under Article 6(1)(f) GDPR.
Sending optional tool and product updates is based on explicit consent under Article 6(1)(a) GDPR. Subscription is voluntary and consent may be withdrawn at any time.
Google Analytics and any other non-essential analytics, advertising measurement, remarketing or comparable marketing technology are based on prior consent under Article 6(1)(a) GDPR where consent is required. Consent may be refused or withdrawn without affecting the core website and contact functions.
Cookies and local storage
The contact chat uses one technically necessary, HTTP-only first-party cookie after a visitor starts a chat or email continuation flow. Draft text and interface preferences may also be stored locally in the browser to provide the requested chat functionality. The analytics-consent choice is stored locally for up to one year. Google Analytics and its cookies remain disabled until analytics consent is granted.
Retention periods
Contact-chat conversations, related email events, enquiry records and directly connected operational data are retained for up to one year after the last relevant activity, unless earlier deletion is requested and no overriding legal or security reason requires continued retention.
Temporary scans are retained for up to 30 days under the current service configuration. A shareable report is created only on request and is retained for up to 365 days. It is an unlisted snapshot available to anyone with its link; rescanning does not overwrite the original report.
Newsletter subscription records are retained while the subscription remains active and afterwards only for as long as needed to record withdrawal, honour suppression requests, resolve disputes or meet legal obligations.
Technical and security logs are retained for no longer than 90 days. Individual log channels may use a shorter operational period. Temporary rate-limit, presence and delivery records may expire substantially sooner.
Google Analytics event-level and user-level data is configured for a maximum retention period of 14 months. Analytics cookies are configured for up to 12 months, and the consent choice is requested again after one year.
If an enquiry results in a contract, personal data required for contractual, invoicing, accounting, legal-claim or statutory compliance purposes may be retained for the period required by applicable law.
Processors and recipients
Access is limited to the two operators and service providers required to host, secure and deliver the website, public tools, chat and email communication. Data is not sold.
Hetzner Online GmbH
Cloud server, network and infrastructure hosting. The Laravel application, MySQL database, isolated scanner services, public reports, newsletter records and operational logs are hosted on privately administered Hetzner infrastructure. Provider address: Industriestr. 25, 91710 Gunzenhausen, Germany. Contact: info@hetzner.com.
Google Workspace
Business email delivery and mailbox services provided through Google Workspace under the applicable Google contracting entity and data-processing terms. Email content and delivery metadata may be processed by Google and its authorised subprocessors.
Google Analytics 4
Optional website analytics provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and its authorised subprocessors. Data is sent only after consent. Advertising storage, Google Signals and personalised-advertising signals are disabled in the site implementation.
Google PageSpeed Insights
When enabled for Website Inspector scans, the submitted public website origin is sent to Google PageSpeed Insights to request a mobile Lighthouse laboratory report. No chat message, subscriber email address or scanner client identifier is included in this request.
Where a provider processes data outside the European Economic Area, the controllers rely on the provider’s applicable adequacy mechanism, Standard Contractual Clauses or other safeguards required by Chapter V GDPR. Provider and transfer details are reviewed whenever services change.
Analytics and advertising measurement
The operators may run small-scale advertisements that link to this website. After analytics consent, Google Analytics measures page navigation, campaign parameters and selected contact-chat funnel events. Analytics does not receive chat messages, names, email addresses or conversation identifiers. No Meta Pixel, remarketing or personalised-advertising storage is currently enabled.
Consent can be refused or changed at any time through the analytics settings on this page. If additional advertising measurement or remarketing tools are introduced, this notice and the consent controls will be updated before activation.
Rights of data subjects
Depending on the circumstances and legal basis, a visitor may exercise the following rights:
- Request confirmation and access to personal data being processed.
- Request correction of inaccurate or incomplete personal data.
- Request deletion where the legal conditions are met.
- Request restriction of processing where the legal conditions are met.
- Object to processing based on legitimate interests.
- Request data portability where processing is automated and based on consent or contract.
- Withdraw consent at any time for processing based on consent, without affecting earlier lawful processing.
- Lodge a complaint with the competent supervisory authority or seek a judicial remedy.
Requests may be sent to hello@novaracode.com. The controllers may request proportionate information needed to verify the requester’s identity and normally respond within one month, subject to extensions permitted by law.
Supervisory authority
If a visitor believes that personal data has been processed unlawfully, a complaint may be submitted to the Hungarian National Authority for Data Protection and Freedom of Information or another competent supervisory authority.
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)1055 Budapest, Falk Miksa utca 9–11., Hungaryugyfelszolgalat@naih.huwww.naih.huData security
The service uses access controls, encrypted network connections, restricted administrative access, hashed authentication tokens, security logging, rate limiting and maintained application infrastructure. No system can guarantee absolute security; incidents are handled in accordance with applicable legal obligations.
Automated decision-making
The website and contact chat do not make decisions producing legal or similarly significant effects through automated processing, and do not perform such profiling. Automated rate limiting and spam protection may temporarily restrict abusive technical activity.
Changes to this notice
This notice may be updated when the website, providers, retention rules or legal requirements change. The effective date shown above identifies the current version. Material changes affecting an active chat or consent-based processing will be communicated where required.
Privacy contact
Questions, requests and objections concerning this notice or the processing of personal data may be sent to:
hello@novaracode.com