--- title: "Privacy | Novatra" description: "What Novatra collects when you use this site or send a message, who processes it, how long it's kept, and your rights under UK GDPR. The site sets no cookies and runs no analytics." canonical: "https://novatra.org/privacy.html" last_updated: "2026-07-28" --- # What this site collects, and what happens to it. Short, because there isn't much. This site sets no cookies, runs no analytics and carries no third-party scripts. The only personal data it collects is what you type into the contact form. ## Who is responsible for your data Novatra LTD is the data controller: a company registered in England and Wales, number 16258517, based in London. Its registered office is on the public [Companies House record](https://find-and-update.company-information.service.gov.uk/company/16258517). Novatra is registered with the Information Commissioner's Office. To ask anything about this notice, or to exercise any of the rights below, email hello@novatra.org. ## No cookies, no analytics, no tracking This site sets no cookies and stores nothing on your device. There are no analytics scripts, no advertising pixels, no embedded third-party content and no tracking of any kind. That's why you were never asked to accept a cookie banner: there is nothing to consent to. Search Console and Bing Webmaster Tools report on searches people run on Google and Bing. Those searches happen on Google's and Bing's own websites, under their own privacy policies, and the reports Novatra receives are aggregated with individual queries stripped out. Nothing about that reaches this site or your browser. ## The contact form If you send a message, the form collects your name, your email address, your company if you choose to give it, and whatever you write in the message. Name and email are required so Novatra can reply; company and message are optional. It is used for one thing: reading your enquiry and replying to it. It is never sold, never shared for marketing, and never added to a mailing list. Novatra doesn't run one. The lawful basis is legitimate interests under Article 6(1)(f) UK GDPR. The interest is straightforward: you asked Novatra a question about its services and would like an answer. Where the exchange turns into discussing an actual engagement, Article 6(1)(b) also applies, since that's a step toward a contract. Please don't send anything sensitive through the form. It's a first-contact channel, not a secure one, and Novatra doesn't need health, financial or personal details about anyone to answer a question about scope. ## Your IP address The contact form is rate-limited to stop it being used to send spam, which means the server briefly holds the IP address a submission came from in memory in order to count requests. It is discarded automatically once the rate-limiting window has passed, a matter of hours at most, and it is never written to disk or linked to anything you sent. The server's request logs record the method, path, status code and response time of each request. They deliberately do not record IP addresses, so the logs identify nobody. The lawful basis for both is legitimate interests: keeping the site available and free of abuse. ## Who else handles it Four providers are involved in running this site and getting a message from the form to the Novatra inbox, each acting on Novatra's instructions under a contract: - Cloudflare sits in front of the site, providing TLS and protection against attacks. It processes visitors' IP addresses as part of that. - OVHcloud provides the server the site runs on, so everything described above happens on hardware they operate. - Resend delivers the form submission as an email, so it processes everything you typed into the form. - Zoho Mail hosts the mailbox the message arrives in and where the reply is stored. Beyond these, nobody. No CRM, no marketing platform, no data brokers. ## Data leaving the UK Cloudflare and Resend are US companies and may process data outside the UK. Both transfers are made under the European Commission's standard contractual clauses as amended by the UK Addendum issued by the Information Commissioner, which is the safeguard UK GDPR requires under Article 46. The mailbox itself is hosted in Zoho's European data centre. Transfers to the EEA are covered by the UK's adequacy regulations and need no additional safeguard. ## How long it's kept Enquiries that don't lead anywhere are deleted within 24 months. If the enquiry leads to an engagement, the correspondence is kept for its duration and for six years afterwards, which is the period Novatra needs it for tax and legal purposes. IP addresses held for rate limiting are discarded within hours. Request logs contain nothing that identifies anyone, so there is no personal data in them to delete. ## Your rights Under UK GDPR you can ask Novatra for a copy of what it holds about you, have it corrected if it's wrong, have it deleted, restrict what is done with it, or have it sent to you in a portable format. You can also object to processing carried out on the basis of legitimate interests, and if you do, Novatra has to stop unless it can show compelling grounds not to. Email hello@novatra.org and Novatra will respond within one month. There's no charge, and in practice it takes a good deal less than a month. There is no automated decision-making or profiling here. Nothing is decided about you by a machine. ## Complaints If you think Novatra has handled your data badly, raise it directly first and it will be put right where possible. You also have the right to complain to the Information Commissioner's Office at [ico.org.uk/make-a-complaint](https://ico.org.uk/make-a-complaint/), or on 0303 123 1113. Raising it with Novatra first is not a precondition. ## Changes If this notice changes, the new version goes up here and the date below changes with it. There's no archive of previous versions; the site is small enough that this one page is the whole story. Last updated 28 July 2026.