Privacy & Cookie Policy

01Introduction

Nova Design Yorkshire Ltd respects your privacy and is committed to protecting your personal data. This Privacy & Cookie Policy sets out how we handle personal data when you visit novadesignyorkshire.co.uk (the "Website"), make an enquiry, or work with us as a client or supplier.

We process personal data in accordance with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 ("PECR"). Please read this policy carefully. If anything is unclear, contact us using the details in section 18.

02About us

Nova Design Yorkshire Ltd ("Nova Design", "we", "us" or "our") is a brand identity, web design, graphic design, web development and hosting studio. For the purposes of UK data protection law, we are the controller of the personal data described in this policy, which means we are responsible for deciding how and why it is used.

We have not appointed a Data Protection Officer, as we are not required to do so. Questions about this policy or your personal data should be sent to the email address above.

03Scope of this policy

This policy applies to personal data relating to:

• visitors to our Website;
• prospective clients and others who contact us or make an enquiry;
• our clients and their representatives; and
• our suppliers, contractors and business contacts.

Data we process on behalf of our clients

When we design, build, host or maintain a website or other service for a client, we may have access to personal data belonging to that client's customers or website users. In those circumstances the client is the controller and we act as a processor, handling the data only on the client's documented instructions and under the terms of our agreement with them. If your personal data is held on a website we build or host for one of our clients, please refer to that organisation's own privacy policy and direct any requests to them.

04Personal data we collect

Depending on how you interact with us, we may collect and process the following categories of personal data:

We do not intentionally collect special category data (such as information about health, ethnicity, religious beliefs or sexual orientation) or data relating to criminal convictions. Please do not include such information in your messages to us.

05How we collect personal data

• Directly from you, when you complete our contact form, email or telephone us, attend a meeting, become a client, or supply goods or services to us.
• Automatically, when you use the Website, through server logs, security systems and essential cookies (see section 12).
• From third parties or public sources, such as a person who refers you to us, your colleagues when you are named as a contact for a project, or public registers such as Companies House.

06How we use your data and our lawful bases

We will only use your personal data where the law allows us to. The table below describes the purposes for which we use personal data and the lawful basis we rely on for each one.

Where we rely on legitimate interests, we have considered and balanced any potential impact on you and your rights. You can ask us for more information about this balancing exercise.

If you do not provide personal data that we need to perform a contract with you, we may be unable to provide our services.

07Marketing

We do not sell your personal data and we do not send unsolicited marketing. We will only send you marketing communications if you have asked to receive them or, where you are an existing client, about similar services where the law allows. Every marketing email will include a simple way to unsubscribe, and you can opt out at any time by emailing info@novadesignyorkshire.co.uk. Opting out of marketing does not affect service messages relating to work we are carrying out for you.

08Sharing your data

We share personal data only where necessary and with organisations that are required to keep it secure and confidential. These include:

• Hostinger, which provides our website hosting, content delivery network and email services, including the delivery of contact form messages;
• Defiant, Inc. (Wordfence), which provides website security and firewall services and may process IP addresses to detect and block malicious activity;
• Google, which serves the Google Fonts used on the Website. Your browser connects to Google's servers to download them, which means your IP address is shared with Google. Google does not set cookies for this service;
• professional advisers, including accountants, insurers and legal advisers, where required for the running of our business;
• banks and payment providers, to process payments;
• platforms we use to deliver client work, such as domain registrars, hosting control panels, WordPress or Shopify, where this is necessary to provide the services you have asked for; and
• public authorities, regulators or law enforcement agencies, where we are required to do so by law.

Our service providers act as processors on our behalf and may only use your data for the purposes we specify. If our business is sold or restructured, personal data may be transferred to the new owner, who will be bound by this policy.

09International transfers

Some of our service providers are based, or store data, outside the United Kingdom, including in the European Economic Area and the United States. Whenever personal data is transferred outside the UK, we ensure it receives an equivalent level of protection by relying on at least one of the following safeguards:

• the destination country is covered by UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it; or
• the transfer is made under the International Data Transfer Agreement or the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the Information Commissioner.

You can contact us for more information about the safeguards used for a particular transfer.

10Data retention

We keep personal data only for as long as necessary for the purposes we collected it for, including to meet legal, accounting or reporting requirements.

We may retain data for longer where required by law or where it is reasonably necessary in connection with a potential or actual legal claim. When data is no longer needed, it is securely deleted or anonymised.

11Data security

We have put appropriate technical and organisational measures in place to protect personal data against accidental loss, unauthorised access, alteration or disclosure. These include encrypted HTTPS connections, a web application firewall, regular software updates, strong access controls and limiting access to personal data to those who need it.

No method of transmission over the internet is completely secure. We have procedures to deal with any suspected personal data breach and will notify you and the Information Commissioner's Office where we are legally required to do so.

12Cookies

Cookies are small text files placed on your device when you visit a website. Under PECR, we may only store or access information on your device where it is strictly necessary to provide the service you have requested, or where you have given your consent.

When you first visit the Website, a banner asks you to choose which cookies we may use. Optional cookies remain switched off unless you select "Accept all" or enable them through "Manage".

Strictly necessary cookies

Analytics cookies (optional)

We do not currently use analytics, advertising or other non-essential cookies. If we introduce them in future, they will only be set with your consent and this policy will be updated to list them.

You can also manage cookies through your browser settings, including blocking or deleting them. Blocking strictly necessary cookies may affect how the Website works.

13Your rights

Under UK data protection law you have the following rights in relation to your personal data:

• Right of access: to request a copy of the personal data we hold about you.
• Right to rectification: to have inaccurate or incomplete data corrected.
• Right to erasure: to ask us to delete your data where there is no good reason for us to continue processing it.
• Right to restrict processing: to ask us to suspend the use of your data in certain circumstances.
• Right to object: to object to processing based on our legitimate interests, and to object at any time to direct marketing.
• Right to data portability: to receive data you have provided to us in a structured, machine-readable format, or to have it transmitted to another organisation, where technically feasible.
• Right to withdraw consent: where we rely on consent, to withdraw it at any time. This does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please email info@novadesignyorkshire.co.uk. We may need to verify your identity before responding. We will respond within one month of receiving your request, which may be extended by up to two further months for complex or numerous requests, in which case we will let you know. There is normally no fee, although we may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive.

14Automated decision-making

We do not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects. The "Ask Nova" assistant on our homepage gives pre-written answers to common questions and does not collect or store your personal data.

15Children

Our Website and services are intended for businesses and are not directed at children. We do not knowingly collect personal data from anyone under the age of 13. If you believe a child has provided us with personal data, please contact us and we will delete it.

16Third-party websites

The Website may contain links to other websites, including examples of our work and platforms we use. We are not responsible for the content or privacy practices of those websites. We encourage you to read the privacy policy of every website you visit.

17Changes to this policy

We keep this policy under regular review and may update it to reflect changes in the law, our services or the technologies we use. The current version will always be published on this page, with the effective date shown at the top. Where changes are significant, we will take reasonable steps to let you know.

18Contact and complaints

If you have any questions about this policy or wish to exercise your rights, please contact us:

If you are unhappy with how we have handled your personal data, we would appreciate the chance to resolve your concerns first. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection: