Operators and joint controllers
NovaraCode is jointly operated by two independent individuals. For the website, enquiries and contact-chat service, they jointly determine the purposes and essential means of processing and therefore act as joint controllers.
Requests may be sent to the shared contact address below. The controllers coordinate responses and remain responsible for complying with applicable data-protection obligations. This notice summarizes that practical allocation for visitors.
Joint controller 1
- Legal name
- [FULL LEGAL NAME – OPERATOR 1]
- Registered address
- [REGISTERED ADDRESS – OPERATOR 1]
- Registration number
- [SOLE-TRADER OR OTHER REGISTRATION NUMBER, IF APPLICABLE]
- Tax number
- [TAX NUMBER, IF APPLICABLE]
- Contact email
- [PUBLIC CONTACT EMAIL – OPERATOR 1]
Joint controller 2
- Legal name
- [FULL LEGAL NAME – OPERATOR 2]
- Registered address
- [REGISTERED ADDRESS – OPERATOR 2]
- Registration number
- [SOLE-TRADER OR OTHER REGISTRATION NUMBER, IF APPLICABLE]
- Tax number
- [TAX NUMBER, IF APPLICABLE]
- Contact email
- [PUBLIC CONTACT EMAIL – OPERATOR 2]
Shared privacy contact: hello@novaracode.com. Unless legally required by the nature of a request, visitors do not need to contact both controllers separately.
Scope of this notice
This notice applies to the public NovaraCode website, the embedded contact chat, email enquiries initiated through the website, and the technical systems used to operate and secure them. A separate agreement or notice may apply if an enquiry develops into a client engagement.
Data that may be processed
Website and technical data
IP address, request time, requested page, browser and device information, language, technical error and security information may be processed in server and application logs. These records are used to deliver, troubleshoot and protect the service.
Contact-chat data
The chat may process an anonymous browser identifier, session and verification state, selected language, privacy-notice version and acknowledgement time, chat messages, message and read timestamps, presence and operational events, first-entry page and scroll position, conversation status, and internal notes needed to handle the enquiry.
Email and identity data
An email address is optional when starting a chat. If provided, the service may process the email address, verification status, a username derived from the address, verification and delivery events, message subject, provider identifier and related timestamps so the conversation can be continued across devices and followed up by email.
Operational metrics
The system records counts and aggregated statistics about chat openings, selected contact methods, consent-notice acknowledgements, messages, response times, first-entry pages, conversation outcomes and service reliability. Individual operational records may remain linked to a conversation until they are aggregated or deleted.
Purposes of processing
Responding to enquiries
To receive questions, understand a potential project, reply to the visitor, continue a conversation and take requested steps before a possible contract.
Operating the chat
To maintain a browser session, deliver and synchronise messages, show availability and read states, send requested verification or summary emails, and restore a conversation on another device.
Security and abuse prevention
To rate-limit requests, prevent spam and misuse, investigate errors, maintain audit information and protect the website, infrastructure, operators and visitors.
Service improvement
To understand whether contact functions work, measure aggregate usage and response performance, identify technical problems and improve the website and contact process.
Legal bases
Processing required to respond to an enquiry or take requested steps before entering into a contract is based on Article 6(1)(b) GDPR. General business correspondence and the effective handling of enquiries may also rely on the controllers’ legitimate interests under Article 6(1)(f) GDPR.
Service security, necessary operational logging, abuse prevention and proportionate service metrics rely on the controllers’ legitimate interests under Article 6(1)(f) GDPR. The necessary chat cookie supports a function expressly requested by the visitor.
Any future non-essential analytics, advertising measurement, remarketing or comparable marketing technology will be based on prior consent under Article 6(1)(a) GDPR where consent is required. Consent may be refused or withdrawn without affecting the core website and contact functions.
Cookies and local storage
At publication, the website does not use advertising or general analytics cookies. The contact chat uses one technically necessary, HTTP-only first-party cookie after a visitor starts a chat or email continuation flow. Draft text and interface preferences may also be stored locally in the browser to provide the requested chat functionality.
Retention periods
Contact-chat conversations, related email events, enquiry records and directly connected operational data are retained for up to one year after the last relevant activity, unless earlier deletion is requested and no overriding legal or security reason requires continued retention.
Technical and security logs are retained for no longer than 90 days. Individual log channels may use a shorter operational period. Temporary rate-limit, presence and delivery records may expire substantially sooner.
If an enquiry results in a contract, personal data required for contractual, invoicing, accounting, legal-claim or statutory compliance purposes may be retained for the period required by applicable law.
Processors and recipients
Access is limited to the two operators and service providers required to host, secure and deliver the website, chat and email communication. Data is not sold.
Hetzner Online GmbH
Cloud server, network and infrastructure hosting. The Laravel application, MySQL database and operational logs are hosted on a privately administered Hetzner cloud server. Provider address: Industriestr. 25, 91710 Gunzenhausen, Germany. Contact: info@hetzner.com. Production data-centre country: [VERIFY HETZNER DATA-CENTRE COUNTRY].
Google Workspace
Business email delivery and mailbox services provided through Google Workspace under the applicable Google contracting entity and data-processing terms. Email content and delivery metadata may be processed by Google and its authorised subprocessors.
Where a provider processes data outside the European Economic Area, the controllers rely on the provider’s applicable adequacy mechanism, Standard Contractual Clauses or other safeguards required by Chapter V GDPR. Current provider and transfer details should be reviewed before publication and whenever services change.
Advertising and future marketing measurement
The operators may run small-scale advertisements that link to this website. At publication, arriving from an advertisement does not activate a Meta Pixel, Google Analytics or another non-essential marketing tracker on this website.
If advertising measurement, campaign attribution, analytics or remarketing tools are introduced later, they will remain disabled until the required consent is obtained. This notice and the cookie controls will be updated before activation, including the provider, data categories, purposes, duration, transfer information and withdrawal method.
Rights of data subjects
Depending on the circumstances and legal basis, a visitor may exercise the following rights:
- Request confirmation and access to personal data being processed.
- Request correction of inaccurate or incomplete personal data.
- Request deletion where the legal conditions are met.
- Request restriction of processing where the legal conditions are met.
- Object to processing based on legitimate interests.
- Request data portability where processing is automated and based on consent or contract.
- Withdraw consent at any time for processing based on consent, without affecting earlier lawful processing.
- Lodge a complaint with the competent supervisory authority or seek a judicial remedy.
Requests may be sent to hello@novaracode.com. The controllers may request proportionate information needed to verify the requester’s identity and normally respond within one month, subject to extensions permitted by law.
Supervisory authority
If a visitor believes that personal data has been processed unlawfully, a complaint may be submitted to the Hungarian National Authority for Data Protection and Freedom of Information or another competent supervisory authority.
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)1055 Budapest, Falk Miksa utca 9–11., Hungaryugyfelszolgalat@naih.huwww.naih.huData security
The service uses access controls, encrypted network connections, restricted administrative access, hashed authentication tokens, security logging, rate limiting and maintained application infrastructure. No system can guarantee absolute security; incidents are handled in accordance with applicable legal obligations.
Automated decision-making
The website and contact chat do not make decisions producing legal or similarly significant effects through automated processing, and do not perform such profiling. Automated rate limiting and spam protection may temporarily restrict abusive technical activity.
Changes to this notice
This notice may be updated when the website, providers, retention rules or legal requirements change. The effective date shown above identifies the current version. Material changes affecting an active chat or consent-based processing will be communicated where required.
Privacy contact
Questions, requests and objections concerning this notice or the processing of personal data may be sent to:
hello@novaracode.com