Privacy Policy

1.1 The data controller

This notice applies to personal data processed by not yet confirmed: the registered legal entity name (“WebNuvexa”, “we”, “us”). We are the data controller for that data: we decide why it is collected and how it is used.

• Registered in: not yet confirmed: the country of establishment
• Company registration number: not yet confirmed: the company registration number
• Tax identification number: not yet confirmed: the tax or VAT identification number
• Registered address: not yet confirmed: the registered address
• Privacy contact: hello@webnuvexa.com

1.2 What this notice covers

This notice covers every page served from webnuvexa.com and its sub-pages, including the contact form, the request-a-quote form, the blog and any page published under the /legal/ routes. It applies to visitors, prospective clients, existing clients and anyone who emails us.

It does not apply to third-party websites we link to (see the disclaimer), nor to systems we operate on a client’s behalf inside a client project. Where we process personal data on a client’s instructions — for example data flowing through an application we built for them — the client is the controller and we act as their processor under a written data processing agreement. That arrangement is governed by the relevant statement of work, not by this notice.

We do not operate a mobile app, a customer login portal or a community or messaging platform under this notice. If we ever add one, this notice will be updated to say so before it launches.

1.3 Children

This website and our services are directed at businesses and business professionals. We do not knowingly collect personal data from anyone under 16. If you believe a child has sent us personal data by using a form or by emailing us, contact us at hello@webnuvexa.com and we will delete it.

2.1 Data you give us directly

This is the only category of personal data we actively ask for. It comes from the contact form on the contact page, the request-a-quote form, and the call-to-action form that appears at the foot of most pages.

Please do not send us anything we do not need. In particular, do not email or paste in special-category data (health, biometrics, political opinions, religious or philosophical beliefs, sex life or orientation, trade-union membership) or other people’s personal data, unless the engagement genuinely requires it and we have agreed in writing how it will be protected. If you send it anyway, we will delete or redact it as soon as we see it.

2.2 Data our servers record automatically

Like any web server, ours writes an access log for each request. This is created by our hosting infrastructure, not by anything on the page, and you cannot switch it off from your browser.

• Your IP address at the time of the request.
• Your user-agent string, which describes your browser and operating system.
• The URL or page you asked for, and the referring page if your browser sends one.
• The timestamp of the request and the HTTP status code returned.

These entries are used to keep the site running and secure: diagnosing errors, blocking abuse and automated abuse, and investigating incidents. They are not merged with your enquiry records or used to build a profile of you.

2.3 Data stored in your browser session

To make the forms safe to use, the server places a small amount of state in a session that lives only as long as your browser session is open. This includes an anti-forgery token, a short record of recent submission times used to slow down automated abuse (we cap form submissions at five per hour per browser session), and any confirmation message waiting to be shown after a redirect.

None of this is readable by other websites and none of it is used to track you across sites. See the Cookie Policy for the detail on the one cookie this involves.

2.4 What we do not collect

• No payment card data. This site does not take card payments. If an engagement involves a deposit or an invoice, the payment arrangement is set out in your statement of work and handled by that provider under its own privacy policy.
• No advertising or behavioural tracking cookies. We do not run cross-site advertising pixels or third-party ad tags. See the Cookie Policy.
• No behavioural analytics or session replay. There is no analytics script, no heat-mapping tool and no session-recording tool on this site.
• No profiles from social platforms. We do not use social login, social pixels or “like” tracking.

3.1 Consent, and withdrawing it

Where we rely on consent, you may withdraw it at any time without affecting anything we did before you withdrew it. Every marketing email contains a one-click unsubscribe link; using it stops marketing to that address immediately and does not unsubscribe you from service messages about an engagement you hold with us.

Ticking the box on a form is an acknowledgement that you have read this notice, not a subscription to marketing. Submitting a form is treated as that acknowledgement.

• To answer your enquiry and, if we can help, to propose work.
• To prepare, negotiate, deliver and invoice for agreed engagements.
• To keep the site available, fast and free from abuse.
• To detect and block spam, scraping and automated abuse of our forms.
• To keep records we are legally required to keep.
• To investigate and respond to security incidents.
• To detect conflicts of interest before we accept an engagement.
• To send you a reply when you ask for one.

We do not run our own servers or our own mail servers. The categories of vendor we rely on are below. Each acts as a processor, is bound by contract to our documented instructions, and is contractually prohibited from using your data for its own purposes.

On systems we build for clients. Depending on what a client asks for, a project we deliver may involve further processors — for example a payment provider, an email platform, an error-reporting service or a cloud provider chosen by the client. Those are documented in the project’s statement of work or data processing schedule, and the client chooses them. WebNuvexa does not decide that list on the client’s behalf.

When a retention period ends, the data is deleted or anonymised. Where a deletion request is delayed because a record must be kept for a legal reason, we will tell you which record and why.

7.1 Where the data is held

WebNuvexa is established in not yet confirmed: the country of establishment. This site is hosted by not yet confirmed: hosting provider and data region, so enquiry records and server logs are held in that provider’s region, which is not necessarily your country. Transactional email is relayed through not yet confirmed: SMTP or email provider.

7.2 Safeguards for those transfers

Where personal data is transferred outside the EEA or the UK, we rely on a lawful transfer mechanism. In order of preference that is:

1. An adequacy decision — a regulator’s finding that the destination country provides an adequate level of protection.
2. Standard Contractual Clauses adopted under the applicable law, together with a transfer impact assessment and any supplementary measures that assessment identified as necessary.
3. Another derogation available in an exceptional situation, such as an explicit instruction from you.

The mechanism relied on for each vendor is recorded in the relevant data processing agreement. You may request a copy of the safeguards relied on, including a summary of the relevant transfer impact assessment, by emailing hello@webnuvexa.com.

8.1 The rights you have

Subject to the conditions and exceptions in the applicable law, you may:

• Access. Ask whether we process personal data about you, and get a copy of it.
• Rectification. Ask us to correct data that is inaccurate or incomplete. In most cases this is a simple correction.
• Erasure. Ask us to delete your data. We will do it where we have no overriding legal reason to keep it.
• Restriction. Ask us to pause processing while a dispute about accuracy or legitimate interests is resolved.
• Portability. Receive the data you gave us, in a structured, commonly used, machine-readable format, where processing is based on consent or on a contract. This usually means a .csv or .json file.
• Objection. Object to processing based on legitimate interests, and to direct marketing, in each case on grounds relating to your particular situation.
• Withdraw consent at any time, without affecting processing carried out before withdrawal.
• Complain. Lodge a complaint with your data protection supervisory authority. We would rather you told us first, but you are not required to.
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

8.2 How to exercise a right

Email hello@webnuvexa.com with the subject line “Data request”, or use the form at the end of this page and say which right you are exercising. A postal request may be sent to hello@webnuvexa.com; email is faster and simpler for both of us.

Please include enough for us to find the record — the email address you used, and the approximate date and subject of the enquiry — and the right you want exercised. We aim to acknowledge within 5 working days and to respond substantively within one month, which is the statutory period. If a request is genuinely complex we will tell you, explain why, and allow up to a further two months; we will not simply go quiet.

Where it is reasonable to do so, we will confirm that you are the person the data belongs to before we release it. If we ask for identification, we will explain what we need and why, and we will not ask for more than is necessary.

We do not charge for a first request. Where a request is manifestly unfounded or excessive, or where you are asking for the same thing repeatedly, the law allows us to charge a reasonable fee or to decline — we will explain any such decision and, where the law requires it, you can complain.

8.3 Complaining to a regulator

If you are not satisfied with how we have handled your data, you can complain to the data protection authority for your country or region. For not yet confirmed: the country of establishment, the relevant authority is not yet confirmed: supervisory authority; use the contact details published by that authority.

If you are in the EEA but outside not yet confirmed: the country of establishment, the authority you may complain to is the one in the member state where you live or work, not necessarily ours. Every EEA member state has a supervisory authority with a published contact address.

WebNuvexa does not retaliate against anyone who raises a concern in good faith, and asking us a difficult question about your data will not affect whether we work with you.

This site sets one cookie: a strictly necessary session cookie, needed to make the forms work and to protect them from cross-site request forgery. It is not used for advertising, profiling or analytics, and it does not require consent because the site cannot operate without it.

We do not set any analytics, advertising or marketing cookies, and we do not load any third-party tracker. If that ever changes, non-essential cookies will not be set until you consent, and the Cookie Policy will be updated before they appear.

You can also read or delete the session cookie yourself at any time through your browser’s cookie controls. See the Cookie Policy for how.

10.1 Measures in place

• Encrypted transport. All pages and form submissions are served over HTTPS. The session cookie is marked Secure automatically when the connection is HTTPS.
• HttpOnly and SameSite cookies. The session cookie cannot be read by client-side JavaScript and is not sent on cross-site requests, which limits the impact of a cross-site scripting or request-forgery attack.
• Per-request anti-forgery tokens. Every form carries a cryptographically random token that is checked server-side on submission and rotated afterwards. Submissions without a valid token are rejected.
• Honeypot field. Forms include a field that is visually hidden from people but attractive to naive bots. Submissions that fill it in are silently discarded without being stored.
• Rate limiting. Form submissions are capped at five per hour per browser session.
• Server-side validation. All input is validated and stored using parameterised queries, so submitted values cannot alter the database query that stores them.
• Security headers. Responses carry Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy headers, and Strict-Transport-Security over HTTPS.
• Restricted file access. Configuration, includes, database and storage directories are blocked from direct web access, and the administration area requires an authenticated session with password hashing and account lockout after repeated failed sign-ins.
• Error isolation. Application errors are logged server-side and are never printed to visitors, so a failure cannot leak internal detail.

10.2 What these measures cannot do

No security system is perfect. Controls reduce risk; they do not eliminate it. If you discover a vulnerability on this site, tell us at hello@webnuvexa.com and we will work on it in good faith and credit you in our acknowledgement if you would like us to. Please do not access data that is not yours, degrade the service, or act in a way that affects other people while testing — see the Acceptable Use Policy.

We do not hold or process card numbers, so a compromise of this site should not put your payment credentials at risk. It could still put your name, email address and the content of a business enquiry at risk, and we treat that as seriously as you would expect us to.

We do not sell, rent, trade, licence or share your personal data for money. There is no data broker relationship here. Nobody pays us for your name, your email address or the content of your enquiry, and we do not accept payment for it in any other form.

We disclose personal data in only three circumstances, and never for advertising:

1. To processors, under contract and only on our documented instructions, so the site can run at all. Listed in section 05.
2. To professional advisers — lawyers, accountants, auditors — where we need advice or where the law requires disclosure.
3. Where the law requires it. If we are compelled to disclose data, we will disclose only what is required, will tell you unless legally prohibited from doing so, and will challenge an over-broad request where we are able to.

On systems we build for clients, the client decides what happens with the data in that system. Where a client instructs us to share data with a party they have chosen, that is the client’s instruction and the client’s responsibility, documented in the relevant agreement.

We will update this notice when our practices change, and we will change the “Last updated” date at the top of the page when we do. Where a change is significant — a new category of data, a new processor, a new purpose — we will take reasonable steps to bring it to the attention of people affected, which may include a notice on this page or an email to contacts where we hold your address.

Prior versions are not archived publicly. If you need to show what a notice said on a particular date, ask us and we will send you a copy.

Data controller

• not yet confirmed: the registered legal entity name, established in not yet confirmed: the country of establishment
• Registered address: not yet confirmed: the registered address
• Privacy email: hello@webnuvexa.com
• Data protection officer: not yet confirmed: data protection officer contact
• EU / UK representative: not yet confirmed: EU or UK representative details, if one is required — omit this line entirely if Article 27 does not apply

The simplest way to exercise a right, ask a question about this notice, or report a concern is to email us. If your request is urgent, put “URGENT” in the subject line and say why. You can also use the form at the foot of this page.

Please note that we are not lawyers and are not a data protection advisory service. We can act on a request that concerns data we hold; we cannot advise you on your own obligations as a controller.