NovaGate

    Privacy Policy

    Last updated: 8 October 2026

    This Privacy Policy explains how NovaGate handles personal data when you visit www.novagate-solutions.com (the “Site”), contact us, use an interactive tool, apply for a role, or work with us. It also explains your rights under the EU General Data Protection Regulation (“GDPR”).

    1. Who Is Responsible for Your Data

    The controller for personal data collected through this Site is:

    NovaGate Solutions OÜ
    Registry code 17566705
    Kreegi tn 6, Assaku alevik
    75301 Harju maakond, Estonia
    Email: david@novagate-solutions.com

    NovaGate Solutions ApS (CVR 45666328, Akademivej 1 E, 1. 22, 2800 Kongens Lyngby, Denmark) continues to serve certain clients under their existing agreements. Where that company is named in your agreement or invoice, it is responsible for the data it processes to manage and perform that engagement. “NovaGate”, “we”, and “us” refer to the relevant NovaGate entity in the context concerned.

    2. Personal Data We Collect

    2.1 Data You Give Us

    Depending on how you interact with us, this may include:

    • Your name, work email, telephone number, company, and role
    • The content of enquiries, consultation requests, and correspondence
    • Business and operational inputs submitted to the ROI calculator or report workflow
    • Requests sent to our public AI tools (our MCP servers, NovaGate plugins in ChatGPT and other AI assistants, and our estimate API), including the business details you or your assistant provide
    • Application materials and information supplied during recruitment
    • Billing, contract, and project information when you become a client

    2.2 Data Collected When You Use the Site

    When you use the Site we record the pages you view, the links and buttons you click, how far you scroll, how long you stay, what you type into forms and other fields, technical errors, and the page that referred you. From each request we derive, at the moment it arrives, your approximate location (country, region and city, with the city's coordinates), your internet provider or organisation network and, where it can be inferred, the company name, as well as your browser, operating system and device type. Your full IP address is not stored: we keep it only with the last block removed.

    3. Why We Process Personal Data

    • To respond and take pre-contractual steps: handling an enquiry, consultation request, proposal, or application at your request.
    • To perform a contract: delivering professional services, managing a client relationship, and administering billing.
    • For legitimate interests: operating and securing the Site, measuring its effectiveness, improving our services, managing business relationships, and establishing or defending legal claims.
    • To meet legal obligations: including accounting, tax, compliance, and lawful authority requests.
    • With consent: where we specifically ask you to opt in to an optional communication or use that requires consent. You may withdraw it at any time.

    Where we rely on legitimate interests, we assess those interests against your rights and reasonable expectations. You are not required to provide personal data, but we may be unable to respond or provide a requested service without information marked as necessary.

    4. Service Providers and Recipients

    We do not sell personal data. We disclose it only where necessary to:

    • Hosting, infrastructure, security, email, and professional advisers
    • Our own self-hosted analytics database
    • n8n-powered form, report, and workflow infrastructure
    • Cal.com when you choose to open or use its scheduling service
    • The other NovaGate entity where required to administer the relevant client engagement
    • Courts, regulators, authorities, or a transaction counterparty where lawfully required

    Providers acting for us receive only the information needed for their task and are required to protect it. Third-party sites and services apply their own privacy terms when you choose to use them.

    5. Analytics and Local Storage

    We run our own analytics on infrastructure we control. We do not use cookies for analytics or advertising, and we do not share browsing behaviour with advertising networks.

    To recognise a returning visitor without cookies, we derive a pseudonymous key from the shortened IP address and the browser's user-agent. A session identifier is kept in your browser's session storage for the duration of a visit.

    Everything you enter in our forms and calculators is saved on our servers as you type, including contact details, even if you never submit it. Each form says so next to its fields. The ROI calculators also keep a copy in your browser's local storage, so you can pick up where you left off.

    Our legal basis is our legitimate interest in understanding how the Site is used, improving it and following up on interest in our services. You can object at any time by contacting us, and we will stop and delete the data linked to you.

    IP geolocation is provided by DB-IP (db-ip.com) under a Creative Commons Attribution 4.0 licence.

    6. International Transfers

    We aim to process data within the European Economic Area (“EEA”). If a provider makes personal data available outside the EEA, we use a lawful transfer mechanism, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, and supplementary safeguards where appropriate.

    7. How Long We Keep Data

    • General enquiries: normally up to 24 months after the last meaningful interaction
    • Unsuccessful recruitment applications: normally up to 6 months after the process ends, unless a longer period is agreed
    • Site analytics, calculator input and technical event data: kept for as long as they help us improve the Site and our services; we review this at least once a year and delete what is no longer needed
    • Client, contract, invoice, and accounting records: for the engagement and the period required by applicable law or to resolve claims

    We may keep data for a shorter or longer period where its nature, a legal requirement, a dispute, or a documented business need makes that appropriate. We delete or anonymise it when it is no longer needed.

    8. Security

    We use proportionate technical and organisational measures, including encrypted transport, access controls, maintained infrastructure, and restricted internal access. No online service can guarantee absolute security, but we review our safeguards as our systems and risks develop.

    9. Your GDPR Rights

    Subject to the conditions in applicable law, you may ask us to:

    • Provide access to your personal data
    • Correct inaccurate or incomplete data
    • Delete data or restrict its processing
    • Provide certain data in a portable format
    • Stop processing based on legitimate interests
    • Stop direct marketing at any time
    • Withdraw consent without affecting earlier lawful processing

    Send a request to david@novagate-solutions.com. We may need to verify your identity. We normally respond within one month, subject to the extensions permitted by the GDPR.

    10. Complaints

    Please contact us first so we can try to resolve your concern. You may also complain to the Estonian Data Protection Inspectorate or the supervisory authority where you live or work:

    Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)
    Tatari 39, 10134 Tallinn, Estonia
    Email: info@aki.ee
    Website: www.aki.ee/en

    11. Children

    This Site is intended for business users and is not directed at children. We do not knowingly collect personal data from children through the Site.

    12. Changes and Contact

    We may update this policy when our practices or legal obligations change. The date at the top shows the latest revision. Questions or requests can be sent to david@novagate-solutions.com or to NovaGate Solutions OÜ at the address in section 1. The conditions governing your use of the Site are in our Website Terms of Use.