Privacy Policy

Purpose of Processing

Google Analytics enables us to understand how visitors interact with our website by collecting anonymized usage data and statistics. This includes insights into page views, navigation paths, time spent on pages, user engagement, and more. The collected data is used exclusively for website optimization, performance monitoring, and audience analysis.

Data Processing and Sharing

Depending on the version (UA or GA4), the following types of data may be processed:

• IP address (anonymized)
• Browser and device information
• Operating system, screen resolution
• Referrer URL and click paths
• Session duration and user interactions (e.g., clicks, scrolls)
• Location (approximate, based on IP geolocation)
• Event and conversion data (GA4 only)

Google may process this data as our data processor under a Data Processing Agreement (DPA) in accordance with Art. 28 GDPR. However, when using GA4, certain data processing may fall under joint controllership as defined in Google's Controller-Controller Data Protection Terms.

Data may be transferred to Google LLC in the United States. These transfers are secured using Standard Contractual Clauses (SCCs) in accordance with Art. 46 GDPR.

Google does not use this data for advertising unless you have explicitly consented to such use.

Data Protection

We have configured Google Analytics in a privacy-conscious manner:

• IP anonymization (ga(‘set', ‘anonymizeIp', true))
• Automatic data retention limits (e.g., 14 months)
• No personal data stored in cookies or events
• Disabled sharing with Google products and services (unless consented)

Google implements robust technical and organizational security measures (e.g., encryption, data minimization, ISO 27001 compliance).

Data Storage

The retention period for data in Google Analytics depends on the settings we have defined:

• For UA: Data is retained for a maximum of 14 months
• For GA4: Event-level data is retained for a maximum of 14 months, with options to customize shorter periods

No personally identifiable data is stored on our servers through Google Analytics.

You can manage or withdraw your consent at any time via our cookie preferences tool.

Further details on Google's data practices are available at: https://policies.google.com/privacy

Purpose of Processing

The Global Site Tag (gtag.js) facilitates the centralized management of tracking functions and events on our website. It allows us to:

• Measure website traffic and user interactions
• Track conversions and evaluate ad campaign effectiveness
• Customize and optimize online advertising
• Set configuration settings for multiple Google services in one script

Depending on the services configured, the tag may activate other data-processing services (e.g., Google Analytics, Google Ads). Separate information is provided for each respective service within this Privacy Policy.

Data Processing and Sharing

By integrating gtag.js, the following data may be collected and transmitted to Google:

• IP address (shortened in the EU/EEA)
• Browser type and version
• Device type and operating system
• Referrer URL and click path
• Date and time of access
• Website usage behavior and interaction data
• Google advertising identifiers (if ads services are used)

Google processes this data on our behalf and may use it for its own purposes when permitted (e.g., if consent is given for personalized advertising). For services linked to gtag.js, such as

Google Analytics or Google Ads, Google may act as a joint controller under certain conditions.

Data may be transferred to Google LLC, based in the United States. Such transfers are protected using Standard Contractual Clauses (SCCs) under Art. 46 GDPR.

For more information, please see Google's Privacy Policy: https://policies.google.com/privacy

Data Protection

Google applies robust technical and organizational security measures to protect user data, including:

• TLS/SSL encryption
• Anonymization of IP addresses (for analytics)
• Strict access controls and audit logs
• Certifications under ISO 27001 and other compliance standards

We also configure the tag settings to respect privacy-friendly defaults, such as disabling data sharing unless explicitly consented to.

Data Storage

Data collected through gtag.js (via linked services) is stored:

• By Google Analytics: up to 14 months (customizable)
• By Google Ads: retention depends on user interaction and account configuration
• By Novalnet: only aggregated and anonymized usage statistics

The specific duration depends on the Google service connected through the tag. Personal data will be retained only as long as necessary for the specified purposes.

You can adjust your cookie preferences at any time via our website's cookie settings.

Purpose of Processing

Clarity helps us improve the usability, accessibility, and performance of our website by collecting aggregated data about user behavior, such as:

• Mouse movements and clicks
• Scrolling behavior
• Page transitions
• Technical diagnostics (e.g., device type, screen size, browser)

This allows us to identify areas for improvement and enhance user experience.

Data Processing and Sharing

Clarity collects and transmits the following types of data:

• IP address (anonymized in the EU/EEA)
• Pages visited, clicks, scroll depth, and interactions
• Browser, device, screen resolution, OS
• Referrer URL and session duration

Clarity does not record keystrokes or capture any personal form field input (e.g., passwords, names, payment info). Sensitive content is automatically masked.

Microsoft acts as a data processor under a Data Processing Agreement (DPA). Data may be transferred to and stored in Microsoft Azure servers, some of which may be located in the USA.

Microsoft uses Standard Contractual Clauses (SCCs) to safeguard international data transfers under Art. 46 GDPR.

No data is shared with third parties for marketing or profiling.

Data Protection

Microsoft Clarity implements industry-standard security measures, including:

• Data anonymization and masking
• TLS encryption for data in transit
• ISO/IEC 27001, SOC 2, and other compliance frameworks
• Segregated environments to isolate customer data

Clarity is GDPR-compliant and designed to prevent misuse or unauthorized access to data.

Data Storage

• Clarity retains data for a maximum of 13 months
• Data is stored securely in Microsoft Azure data centers
• Session data is aggregated and does not contain personally identifiable information

Further details are available in Microsoft's privacy documents: https://privacy.microsoft.com/en-us/privacystatement

For more information about Microsoft Clarity's privacy practices, visit:

https://privacy.microsoft.com/

https://clarity.microsoft.com/

Purpose of Processing

The CookieYes plugin helps us obtain, store, and manage consent in compliance with the General Data Protection Regulation (GDPR) and other applicable privacy laws. It ensures that non-essential cookies (e.g., for analytics or marketing) are only set with your prior, informed consent.

This tool enables:

• Display of a cookie consent banner
• Categorization of cookies (e.g., necessary, analytics, marketing)
• Storage of user choices (accept, reject, customize)
• Logging of consent for audit purposes

Data Processing and Sharing

When you interact with our cookie banner, the following data is processed:

• IP address (anonymized)
• Consent preferences (accepted, rejected, customized)
• Date and time of consent
• Browser and device information
• A unique, anonymized identifier linked to your consent status

This data is stored locally in your browser using HTTP cookies and also optionally on CookieYes servers, depending on plugin configuration.

CookieYes does not use this data for its own purposes, nor is the data shared with any unauthorized third parties.

Data may be processed on servers in the United Kingdom or European Economic Area (EEA). If any data is transferred internationally, it is protected using appropriate safeguards, such as Standard Contractual Clauses in accordance with Art. 46 GDPR.

Data Protection

CookieYes is committed to secure data processing. Measures include:

• Secure HTTPS connections
• IP anonymization
• Restricted access to consent logs
• Compliance with UK and EU data protection regulations

We configure the plugin to operate with minimal data and to automatically block non-essential cookies until consent is granted.

Data Storage

Consent logs are stored for up to 12 months, unless local legal obligations require longer retention. The cookie storing your preferences typically expires after 1 year, but you can delete or modify it at any time via your browser or our cookie settings tool.

You can change or withdraw your consent at any time by clicking the “Cookie Settings” link in the footer of our website.

For further information, you may also review the CookieYes privacy policy: https://www.cookieyes.com/privacy-policy/

Purpose of Processing

The LinkedIn Insight Tag enables us to:

• Measure conversions from LinkedIn ads (e.g., form submissions, downloads)
• Analyze campaign performance and reach
• Optimize ad targeting based on user behavior and interests
• Build retargeting audiences for future advertising

Data Processing and Sharing

When the LinkedIn Insight Tag is triggered, it collects the following information:

• IP address (truncated in the EU/EEA)
• Device and browser characteristics
• Referrer URL
• Timestamp and page views
• LinkedIn member ID (if user is logged into LinkedIn)
• Event data (e.g., page visits, conversions)

The data is encrypted and pseudonymized. LinkedIn does not share personal data with us—only aggregated, anonymous reporting.

If you are a LinkedIn member, your usage data may be linked to your profile in accordance with LinkedIn's privacy policy. Data may also be transferred to LinkedIn Corporation, USA, under the protection of Standard Contractual Clauses pursuant to Art. 46 GDPR.

LinkedIn acts as both a data processor and, in some cases, a joint controller, particularly where user profiling or ad personalization is involved. Novalnet and LinkedIn have entered into joint controllership arrangements where required.

For details, refer to:

Data Protection

LinkedIn applies strong security measures to protect personal data, including:

• IP anonymization
• Secure cookie encryption and storage
• ISO/IEC 27001 certification
• Access controls and logging

We configure the Insight Tag with privacy-first settings and disable personalized advertising unless you have provided prior consent.

Data Storage

Data collected through the LinkedIn Insight Tag is stored for a maximum of 180 days. After this period, the data is automatically deleted or anonymized.

If you have a LinkedIn account, LinkedIn may retain usage data longer based on your member settings and preferences.

You can manage or withdraw your consent through our cookie settings panel or via your LinkedIn account privacy settings: https://www.linkedin.com/psettings/

For more information, please review the LinkedIn Privacy Policy: https://www.linkedin.com/legal/privacy-policy

Purpose of Processing

Each of the Zoho tools is used for the following legitimate purposes:

Categories of Personal Data Processed

Depending on how users interact with Novalnet via our website, the following personal data may be collected and processed in Zoho:

• Identifying information: name, email address, phone number, company name, job title
• Behavioral data: click paths, form abandonment, A/B test group allocation (via PageSense)
• Form data: messages, inquiries, resumes/CVs (in job applications), attachments
• Communication data: email engagement (opens, clicks), webinar registration and participation data
• Social data: LinkedIn or other social handles if you interact with Novalnet's social posts
• Technical data: IP address, browser type, language, location, session duration (via PageSense, Analytics)

Data Transfers and International Processing

Zoho Corporation is headquartered in India with data centers located in:

• The European Economic Area (EEA) (e.g., Zoho EU data centers in the Netherlands and Ireland)
• The United States, India, and other regions (in rare cases, for support or maintenance)

When data is processed outside the EEA, it is protected by:

• Standard Contractual Clauses (SCCs) adopted by the European Commission
• Data Processing Addendum (DPA) executed between Novalnet and Zoho Corporation
• Access controls and encryption applied both in transit and at rest

Data Protection Measures

• TLS/SSL encryption for data in transit
• Secure user authentication and role-based access controls
• Regular backups and disaster recovery mechanisms
• ISO 27001, SOC 2 and GDPR-compliant policies (Zoho certifications)
• Internal procedures within Novalnet to ensure only authorized personnel access CRM and marketing data

For more information, Zoho's privacy policy is available at: https://www.zoho.com/privacy.html

Data Storage and Retention

Personal data collected through Zoho services is retained only as long as necessary for the original processing purposes, including:

• Communication history (CRM and Campaigns)
• Form and campaign data (Zoho Forms, PageSense)
• Project documentation (Zoho Projects)
• Webinar attendance and event data (Zoho Webinar)

Data may be retained longer if required by legal or contractual obligations. Campaign data and analytics logs may be retained in line with our internal data lifecycle policies.

You may request deletion of your personal data from our Zoho systems at any time.

Purpose of Processing

Calendly is used to enable visitors to book meetings or consultations directly through our website. This simplifies scheduling and helps us efficiently respond to inquiries or service requests.

Data Processing and Sharing

When you schedule a meeting using Calendly, the following personal data may be collected:

• Name
• Email address
• Appointment preferences (date/time)
• Optional message or inquiry content
• Technical metadata (e.g., IP address, browser version)

Calendly processes this data on our behalf under a Data Processing Agreement (DPA).

Data may be transferred to servers in the United States, where Calendly is headquartered. These transfers are safeguarded through Standard Contractual Clauses (SCCs) in accordance with Art. 46 GDPR.

Calendly does not use your data for its own purposes, such as advertising or profiling.

Data Protection

Calendly implements appropriate technical and organizational security measures, including:

• TLS encryption for data in transit
• Secure access controls and authentication
• Compliance with international standards (e.g., SOC 2 Type II, ISO 27001)

Calendly undergoes regular audits and assessments to ensure ongoing data protection.

Data Storage

Your personal data submitted via Calendly is:

• Stored for the duration necessary to fulfill the purpose of your meeting or follow-up communication
• Automatically deleted or anonymized after the scheduled meeting is completed, unless legal or contractual obligations require longer retention
• Log and diagnostic data (e.g., IP address, session metadata) may be stored temporarily (usually up to 30 days)

For more details, see: https://calendly.com/privacy

Purpose of Processing

We use Botsonic to:

• Provide instant responses to visitor questions
• Help users navigate our services or offerings
• Qualify leads and gather initial contact information
• Support sales and marketing automation
• Reduce manual response delays

The AI assistant interacts in real time through a chatbot interface embedded on novalnet.com.

Data Collected

Depending on how you interact with the AI chatbot, the following categories of personal data may be collected:

• Name
• Email address (if requested or provided)
• Phone (optional)
• Chat content (questions, responses, and interaction logs)
• Technical data (browser type, IP address, device type, and session information)
• Timestamps and visited pages (for context within the session)

We advise users not to share sensitive personal information (e.g., health data, financial information, login credentials) in the chatbot.

Data Processing and Sharing

The chatbot data is processed by:

Service provider: Writesonic Inc.
2261 Market Street #4451, San Francisco, CA 94114, United States
https://writesonic.com

Writesonic may process chat data on servers located in the United States or other regions. Where data is transferred to third countries, we ensure appropriate safeguards such as Standard Contractual Clauses (SCCs) under Art. 46 GDPR.

Novalnet may access chat logs to improve support quality and follow up on inquiries. However, the data is not sold or shared with third parties for advertising or profiling.

Thank you for the clarification. Based on your input, here is the updated and accurate “Data Storage” section for your privacy policy, reflecting that Novalnet does not store chat data, and only Botsonic (Writesonic) stores it, while Novalnet may access the data via Botsonic's dashboard:

Data Protection

We take reasonable measures to protect your data when using Botsonic, including:

• Secure HTTPS encryption during transmission
• Access restrictions to chat logs and CRM integrations
• No usage of chatbot data for profiling, automated decision-making, or unsolicited marketing unless explicitly permitted

Writesonic implements its own security protocols, which are described in its privacy policy: https://writesonic.com/privacy

Data Storage

Novalnet does not store chatbot conversation data on its own servers or systems.

All chat interactions are stored by Writesonic Inc., the provider of the Botsonic platform, on their secure infrastructure. Novalnet may access and view these chat records via the Botsonic dashboard solely for the purpose of:

• Responding to user queries
• Following up on sales or support requests
• Improving the quality of automated interactions

Writesonic may retain chat data for a limited period, typically ranging from 30 to 90 days, in accordance with its own data retention policies. After this period, data may be anonymized or deleted.

Novalnet does not download, export, or independently process chatbot conversations outside of the Botsonic environment, unless explicitly required to fulfill your request.

Purpose of Processing

Google reCAPTCHA helps us verify whether a form submission is made by a natural person rather than an automated program. This is essential for:

• Preventing spam and fraudulent submissions
• Ensuring system security and availability
• Protecting our online services from malicious use

Data Processing and Sharing

When reCAPTCHA v2 is used, it may collect and analyze the following data from the website visitor:

• IP address
• Browser and device information (e.g., user agent, screen resolution)
• Operating system
• Mouse movements and keyboard input behavior
• Time spent on the page
• Previously set cookies from Google services
• Referrer URL

This information is automatically sent to Google and processed on its servers, which may include servers located in the United States.

Google acts as an independent data controller for reCAPTCHA and processes this data in accordance with its own privacy policies.

More information:

https://policies.google.com/privacy

https://policies.google.com/terms

Data Protection

Google employs strong technical and organizational measures to protect the data processed via reCAPTCHA. However, as reCAPTCHA is embedded in our website as a third-party service, Google may set cookies or link reCAPTCHA usage with other Google services if you are logged into a Google account.

We have no control over how Google further processes this data once it has been transmitted. You may limit tracking by logging out of Google services before visiting our website or using private/incognito browser sessions.

Great question. Regarding Google reCAPTCHA v2, here is a factually accurate and GDPR-aligned explanation of data storage and retention:

Data Retention and Storage

When you interact with Google reCAPTCHA v2 on our website, no personal data is stored on Novalnet's servers as part of this process. However, data is collected and processed directly by Google, which may include:

• IP address
• Browser and device metadata
• User behavior data (mouse movements, clicks, etc.)
• Cookies previously set by Google services (if any)
• Referrer URL and timestamp

This data is transmitted to and processed by Google Ireland Limited and may also be stored on servers in the United States or other third countries.

Google does not publicly disclose exact retention periods for the data collected through reCAPTCHA. However, based on Google's general policies:

• Some data (e.g., logs or analytics related to reCAPTCHA) may be retained for a limited period to improve security and combat abuse.
• Cookies such as NID, _GRECAPTCHA, and others may persist in your browser for 6 months or longer, depending on your browser settings and whether you are logged into Google services.

Google acts as an independent data controller, and the data collected through reCAPTCHA is subject to Google's own data retention and deletion policies.

For more details, see:

Google Privacy Policy

Google Terms of Service

Purpose of Processing

Cloudflare is a Content Delivery Network (CDN) and security service that helps us:

• Deliver content efficiently through globally distributed servers
• Secure our site from malicious traffic (e.g., DDoS attacks, bots)
• Improve website availability, reliability, and loading speed

Data Processing and Sharing

When you visit our website, Cloudflare automatically processes the following categories of data:

• IP address
• Accessed domain names and resources
• DNS query data
• System configuration information (e.g., browser type, device, OS)
• HTTP headers and performance metrics

Cloudflare acts as a data processor under a Data Processing Agreement (DPA). It processes data solely on our behalf and not for its own purposes.

Data may be routed through Cloudflare's servers outside the European Economic Area (EEA), including the USA. In such cases, Cloudflare ensures adequate protection through Standard Contractual Clauses (SCCs) in line with Art. 46 GDPR.

Cloudflare does not use personal data for advertising or profiling.

Data Protection

Cloudflare applies comprehensive security measures including:

• TLS encryption
• Bot and DDoS protection mechanisms
• Rate limiting and Web Application Firewall (WAF)

Regular third-party security audits and compliance with:

• ISO/IEC 27001
• SOC 2 Type II
• PCI DSS, where applicable

Data Retention and Storage

Cloudflare temporarily stores certain logs for the following durations:

• Edge logs (e.g., IP address, request metadata): usually retained for no more than 7 days
• Longer retention may occur only in exceptional cases (e.g., for abuse mitigation or compliance with legal obligations)
• Cached static content (images, CSS, JS) is stored temporarily in Cloudflare's edge servers and does not contain personal data

Cloudflare is committed to data minimization and does not store more information than necessary.

For more information, see Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/

Purpose of Processing

WP Engine processes data on our behalf to:

• Host and deliver the content of our website
• Store user interactions and form submissions (e.g., contact forms, log data)
• Provide necessary backend infrastructure such as databases and caching
• Monitor and improve website uptime, security, and performance

Data Processing and Sharing

In the course of providing hosting services, WP Engine may process the following types of data:

• IP addresses and user agent information
• Server logs (access times, requested pages, errors)
• Form submission data (e.g., contact requests, support inquiries)
• Content management and backup data
• Cookies and session identifiers (where applicable)

WP Engine acts as a data processor on our behalf, governed by a Data Processing Agreement (DPA) in compliance with Art. 28 GDPR.

Data may be processed on servers located in the European Union (for EU-based clients), but under certain conditions, limited data transfers to the United States may occur. These are protected by Standard Contractual Clauses (SCCs) in accordance with Art. 46 GDPR.

WP Engine does not access or use your data for its own purposes.

More information:

https://wpengine.com/legal/dpa/

https://wpengine.com/legal/privacy/

Data Protection

WP Engine implements advanced technical and organizational measures, including:

• End-to-end TLS/SSL encryption
• Secure server and network architecture
• Daily backups and recovery tools
• ISO/IEC 27001-certified data centers
• Access control and activity logging

These measures help ensure the protection and confidentiality of personal data hosted on their infrastructure.

Data Storage

Website data (including any personal data submitted via forms or stored via cookies) is retained only as long as necessary to fulfill the stated purposes or comply with legal retention obligations.

Log data may be stored for 30 to 90 days, depending on server configuration and security practices.

Purpose of Processing

The plugin is used to manage user-submitted data through the following forms:

• Contact forms
• Job application forms
• Sales/lead generation forms
• Partnership and support request forms

This data is used solely for handling your request or inquiry, including:

• Responding to contact or support queries
• Evaluating job applications
• Processing partnership interest or collaboration requests
• Following up on sales or service-related leads

Data Collected and Stored

Depending on the form type, the following categories of personal and business data may be collected:

Contact / General Inquiry Form:

• Name
• Company website URL
• Email
• Phone number
• Company turnover range
• Message content

Job Application Form:

• Name
• Email address
• Phone number
• Message
• Uploaded attachments (e.g., CV, cover letter)
• Country and City
• Desired Pay
• Linkedin Profile link
• Avaiable date

Feedback / Complaints Form:

• Name
• Email
• Phone number
• TID
• Message content

Partnership / Support / Integration Request Form:

• Name
• Email
• Phone number
• Company name
• Website
• Country
• Message content

Data Protection and Storage

WP Engine implements advanced technical and organizational measures, including:

• Submitted data is temporarily stored on our web server, protected by secure file permissions and database access controls.
• Data is not visible to or accessed by third parties.
• Every 5 minutes, the stored form entries are transmitted to our internal CRM system using a secure server-to-server POST request.
• Once transmitted, the entries are flagged for archival or deletion on the web server in accordance with our retention policy.

No data is used for profiling, advertising, or tracking purposes.

Data Protection Measures

We implement the following measures to ensure the security of your data:

• Secure HTTPS transmission and SSL encryption
• Server-side validation and access restrictions
• Role-based access control for CRM data
• Regular deletion of processed records from the web server
• Internal logging and access auditing

The plugin is developed and maintained in-house by Novalnet, with regular security reviews.

Data Sharing and Third Parties

The collected data is not shared with any third parties outside of Novalnet. It is processed exclusively by authorized internal personnel for the purposes listed above.

No external analytics, advertising, or third-party CRM platforms receive your data.

Data Retention

The data collected through our forms is stored on our web server and transmitted to our internal CRM system every 5 minutes. At present, this data is not automatically deleted or archived from the web server after successful transmission.

As a result, submitted form entries may remain stored on the server for an indefinite period, unless manually removed. We are in the process of reviewing our retention practices to align with data minimization and storage limitation principles under the GDPR.

Data within our internal CRM system is retained in accordance with our internal retention schedules and applicable legal obligations.

If you wish to have your submitted data deleted or reviewed, you may contact us at any time using the information provided below.

To exercise any of your rights or inquire about your data, please contact: datenschutz@novalnet.de