What we do with your data, and who can see it.

Who we are

NOVARO, Ambachtsweg 1, 3161 GL Rhoon, the Netherlands, is the controller for the processing described here. Our Dutch Chamber of Commerce (KvK) number is shown at the foot of every page, including this one. Questions about this statement, and requests about your data, can be sent to [email protected]. We have not appointed a data protection officer; your question therefore reaches us directly and not an intermediary.

What we process, why, and for how long

Below is every processing operation that belongs to this website, with the data involved, the purpose, the legal basis and the retention period. What is not listed does not happen: this site has no accounts, no profiles and no shopping basket, and it does not store your message itself.

The contact form

We receive what you fill in: your name, your e-mail address, the company you mention (that field is optional), the subject you pick and the text of your message. Purpose: answering your message and, if you request a scan, preparing that conversation. Legal basis: your consent, and once we discuss an engagement, the steps preceding an agreement. Retention: as long as we need it to handle your question and to hold the conversation that follows from it. Ask us to delete it and we delete it. If an engagement follows, the statutory retention obligation applies to the administration afterwards.

The abuse limit on that form

To stop the form being used to send unsolicited bulk messages, the website keeps track of which IP address is submitting and when. Purpose: keeping the form usable. Legal basis: our legitimate interest in that. Retention: this sits in the web server's working memory only and never on disk; it disappears by itself once the time window has passed, and in any case on every restart of the site.

Delivering the page itself

To show you a page and to protect the site against attacks, the network layer in front of our server processes your IP address, the time and technical details of your request. Purpose: delivering the site and keeping it available. Legal basis: our legitimate interest in availability and security. Retention: at that supplier, according to the periods it applies. We keep no visitor statistics of our own.

When delivery of your message fails

If your message cannot be delivered, the website writes the content of your submission to the technical log of our server, so that your message does not quietly disappear and we can still answer you. In that case you see an error on screen rather than a successful send. Purpose: not losing your message. Legal basis: our legitimate interest in a reliable front door, and your interest in an answer. Retention: no fixed period is set for that log; we delete it when we no longer need it.

What this website does not do

This website places no advertising or analytics cookies and uses no tracking pixels. We measured that on the public pages on 1 August 2026: no cookie is set, no script from an advertising or statistics service is loaded, and no fonts or images are fetched from a third party. We do not sell your data and do not share it for marketing, we do not add you to a mailing list, and we take no decisions about you based solely on automated processing. What you send us is not used to train AI models, and we do not pass it to third parties for that purpose.

That picture is only complete with this caveat. The network layer that handles our traffic adds something to the page itself: it obscures e-mail addresses from address harvesters with a small script, it can load a script that tells ordinary visits apart from automated abuse, and it receives a report when your browser hits a network error on our site. That is not an advertising or statistics function, but it is processing by a third party, and so it belongs here.

Who is involved in this website

These parties may process personal data relating to this website in the course of their work for us. The list covers the website; once your message has been delivered to us, it sits in our mailbox and we handle it as ordinary correspondence.

Hetzner Online GmbH, Germany

Hosting of the server this website runs on, and therefore of everything that server processes. On 1 August 2026 we looked up in the RIPE registry who holds the network block of that server: it is registered to this supplier, with Germany as the country.

Cloudflare, Inc., United States, with infrastructure in Europe

The authoritative name servers for novaro.nl, the connection to our server, and terminating the encrypted traffic. This party processes your request first and sees the content of the traffic between you and us; it is therefore more than a name server, and that is how we describe it.

Resend, Inc., United States

Delivering to us, by e-mail, the message you send through the form. In doing so this party processes your name, your e-mail address, your organisation, the chosen subject and the full text of your message.

Amazon Web Services (Amazon Simple Email Service), United States

The sending infrastructure underneath the previous party, and therefore a sub-processor in the same mail chain. We name it separately because a link you cannot see is still a link.

Data outside the European Economic Area

Delivery of your form message passes through parties in the United States. We therefore describe that processing as a transfer outside the European Economic Area. The network layer in front of our server is likewise an American supplier, with infrastructure in Europe: we measured that a request to novaro.nl was handled in Amsterdam, but we have not established whether the data localisation setting on our zone is switched on, and so we do not write that this processing takes place solely within the European Union. We do not name a transfer mechanism here that we cannot show per supplier; ask us and we will tell you what has been recorded for that supplier.

Security

All traffic to this site is encrypted, and the server the site runs on has no open port to the internet for it: the network layer comes in over a connection the server itself opens outwards. We are not certified against ISO 27001, SOC 2 or any other information security standard, and we do not suggest otherwise.

Reporting a data breach

If you see something indicating that data from this site has leaked, or you believe we have a weak spot, e-mail it to [email protected] with "datalek" in the subject. We confirm your report, investigate it and tell you what we did. If it concerns a personal data breach, we report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within the statutory deadline, and we inform you directly where the GDPR requires it.

Your rights

You can ask us to give you access to the personal data we hold about you, to correct it, to delete it, or to restrict its use. You can object to processing based on our legitimate interest, and you can ask for the transfer of what you sent us yourself. If you gave consent, you can withdraw it at any time; what happened before that stays lawful. Send your request to [email protected] and we will respond within one month. We only ask for additional details if we cannot otherwise establish that the request comes from you, and never for more than that requires. If you disagree with how we handle your request, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).