Privacy Policy

1. Information We Collect

We collect and process the following categories of personal data:

• Identity Data: Name and organization, where provided
• Contact Data: Email address, phone number, postal address, where provided
• Inquiry Data: Information you voluntarily include in website forms or correspondence
• Technical Data: IP address, browser and device information, and security signals needed to operate and protect the website
• Usage Data: How you interact with our website and services
• Communication Data: Your preferences and correspondence with us

2. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Consent: For optional communications and non-essential cookies where required
• Legitimate Interests: To respond to inquiries, operate the website, improve content, and maintain security
• Legal Obligation: To comply with applicable corporate, tax, and regulatory obligations

3. How We Use Your Information

We use your personal data for:

• Responding to information requests and partnership inquiries
• Providing educational resources and corporate updates
• Operating, securing, and improving the website
• Complying with legal and regulatory requirements

4. Sensitive Information

This website is not intended for clinical intake and does not request genetic, biometric, or medical-record data. If you voluntarily include sensitive information in an inquiry:

• We will use it only as needed to respond to your inquiry or meet legal obligations
• We may advise you to discuss medical matters with a qualified provider
• We will avoid requesting unnecessary sensitive information through public website forms

5. Data Sharing and International Transfers

We may share your data with:

• Vercel, which hosts the website and provides privacy-oriented web analytics
• Cloudflare Turnstile, which helps verify that contact-form submissions are legitimate
• Formspree, which processes, stores, and delivers contact-form inquiries to our designated mailbox
• Professional advisers and compliance partners where needed
• Partner clinics or organizations only when you request or consent to an introduction
• Regulatory authorities when required by law

These providers may process technical or inquiry data outside the EU/EEA. Where required, international transfers are governed by the safeguards described in the relevant provider agreement and applicable law.

6. Data Retention

We retain your personal data for:

• Inquiries: In Formspree and the receiving mailbox for as long as needed to respond and maintain a reasonable business record
• Technical logs: For a limited period needed for security and diagnostics
• Business records: As required by applicable law
• Optional communications: Until you unsubscribe or withdraw consent

7. Your Rights Under GDPR

You have the following rights regarding your personal data:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion (subject to legal retention requirements)
• Right to Restriction: Limit processing of your data
• Right to Data Portability: Receive your data in a structured format
• Right to Object: Object to certain types of processing
• Right to Withdraw Consent: Withdraw consent at any time

To exercise these rights, contact our Data Protection Officer at dpo@novagengroup.com.

8. Cookies and Tracking

This website does not intentionally use advertising or marketing cookies. Vercel Web Analytics is configured as a cookie-free analytics service. Cloudflare Turnstile processes limited technical and security signals when the contact form is used. If the website configuration changes to use non-essential cookies, this policy and the available consent controls will be updated before those cookies are enabled.

9. Data Security

We implement appropriate technical and organizational measures:

• Access controls and role-based permissions
• Encryption in transit where supported
• Security review and incident response procedures
• Staff training on data protection
• Incident response procedures

10. Children's Privacy

This website is intended for adults. We do not knowingly collect personal data from children through this website.

11. Automated Decision-Making

We do not use fully automated decision-making through this website that produces legal or similarly significant effects. Any AI-assisted content is informational and does not replace professional judgment.

12. Complaints

If you have concerns about our data processing, you can:

• Contact our Data Protection Officer: dpo@novagengroup.com
• Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): autoriteitpersoonsgegevens.nl

13. Changes to This Policy

We may update this privacy policy to reflect changes in our practices or legal requirements. We will notify you of significant changes via email or website notice.