Privacy Policy

For any request about how we handle your data, or to exercise your rights, write to privacy@novrith.com.

• Contact and identity data: first name, last name, company name, company website, work email and phone number you provide when you fill in the contact form.
• Message content: what you write in the contact form.
• Enriched and verified business data: information about your company and professional context (for example industry and company size, publicly available professional contact details) and the result of checking whether your email address is valid, which our processor Cargo compiles from public and third-party business sources based on the details you send us. Some of this information therefore comes from sources other than you (Art. 14 GDPR).
• Booking data: name, email, timezone, optional phone and any answers to booking questions, when you book a discovery call through the Cal.com widget.
• Navigation and technical logs: IP address, browser and operating system, pages visited, date, time and duration of the visit, and referring URL, collected automatically by the server and network logs of our host.
• Campaign source data: any UTM parameters present in the URL when you submit a form, which help us understand which channel you came from.
• Aggregate, non-identifying statistics: visit counts not attributable to an identifiable person, collected through Vercel Web Analytics without cookies and without any persistent identifier.
• Visitor identification data (only with your consent): the IP address you visit from, which our provider Snitcher matches against its business databases to work out which company or organisation you are visiting from, together with the pages you view, how long you stay, the page you arrived from, campaign parameters, and a technical fingerprint of your device, built from readings of your browser, screen, processor and graphics hardware. That fingerprint is a device-level identifier: it tells one device apart from another and does not by itself attach a name to anyone. Snitcher provides no setting that turns it off, so your consent is the only control over it. This is collected only if you accept it through the cookie banner, and only for as long as that consent stands. See section 8 and our Cookie Policy (/cookies).

Data may be shared with the following IT service providers, appointed as data processors under Art. 28 GDPR, only as needed to deliver the service. Data is never disclosed or sold to third parties for marketing purposes.

An up-to-date list of processors can be requested at any time by writing to privacy@novrith.com.

Some providers are based in, or process data in, countries outside the European Union. In those cases the transfer relies on the safeguards under Chapter V of the GDPR:

A copy of the safeguards in place can be requested at privacy@novrith.com.

• Contact-form requests that do not lead to a relationship: deleted within 24 months of the last contact.
• Leads and clients (requests that turn into a pre-contractual or contractual relationship): kept for the duration of the relationship and then within the ordinary 10-year limitation period (Art. 2946 of the Italian Civil Code).
• Bookings: for as long as needed to manage the meeting and any follow-up; if they turn into a commercial contact, as above.
• Technical navigation logs: up to 12 months for security and diagnostics.
• Aggregate statistics: non-identifying data, not attributable to an identifiable person.
• Campaign source data (UTM): retained together with the request it relates to, under the terms set out above.
• Enriched and verified business data: retained together with the request or lead it relates to, under the terms set out above.
• Visitor identification data: the identifier stored on your device lasts up to 12 months, and processing stops as soon as you withdraw consent. Where a visit is linked to a company that becomes a lead, the resulting company-level record follows the terms for leads above.

The newsletter is sent only with your explicit prior consent and is delivered through Resend (Plus Five Five, Inc.). You can unsubscribe at any time using the link in every message. The processing of data for the newsletter is described in its dedicated notice (/privacy/newsletter), shown at the point of signup.

This site uses technical cookies, which need no consent, and one consent-based tool (Snitcher visitor identification), which is not loaded unless you accept it through the banner and can be switched off at any time. We use no advertising cookies. See the Cookie Policy (/cookies) for the full list and for the control to change your choice.

Data is processed with electronic tools, for no longer than needed for the purposes described. We apply appropriate technical and organisational measures (encryption of communications in transit via HTTPS, access controls, data minimisation) to protect it against unauthorised access, loss or disclosure.

You can exercise the rights under Articles 15-22 GDPR at any time:

• Access (Art. 15): confirmation of processing and access to your data.
• Rectification (Art. 16): correct inaccurate or incomplete data.
• Erasure (Art. 17): request deletion of your data.
• Restriction (Art. 18): request restriction of processing.
• Portability (Art. 20): receive your data in a structured, readable format.
• Objection (Art. 21): object to processing based on legitimate interest.
• Withdraw consent: where processing relies on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise these rights, write to privacy@novrith.com. We respond within 30 days.

We do not take decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on you within the meaning of Art. 22 GDPR. Every assessment of a request, and every reply, is made by a person.

Two of our tools do analyse data automatically, and we want to be precise about what they do. Verifying and enriching the business-contact data received through the form helps us assess inbound requests. Visitor identification, if you consent to it, tells us which company a visit came from and which pages were viewed, which does build a picture of an organisation's interest in us over time. Both inform how a person decides to follow up; neither decides anything on its own, and neither produces legal or similarly significant effects on you.

We aim visitor identification at organisations rather than named individuals: automatic capture of form fields, the feature that would most directly tie a visit to a specific person, is switched off, as are automatic capture of clicks, of downloads and of browser errors. The tool does build a technical fingerprint of the device you visit from, a device-level identifier that tells one device apart from another. We cannot switch it off, because Snitcher provides no setting for it, so it is taken only from visitors who have consented: without consent the script never loads. The fingerprint does not by itself attach a name to anyone. We do not use it to build profiles of named individuals, and we do not combine it with any tool that would. Usage statistics from Vercel Web Analytics are aggregate and non-identifying and do not constitute profiling.

You have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la Protezione dei Dati Personali (Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it, protocollo@gpdp.it), under Art. 77 GDPR and Art. 141 of Legislative Decree 196/2003.

This notice may be updated over time. The version published on this page is the one in force; the last-updated date is shown at the top.