Privacy policy

1. Data controller

Novantrek has no data protection officer because its activity is not among the cases that require one (Article 37 of the GDPR and Article 34 of the Spanish LOPDGDD). For any question about your data, write to info@novantrek.com.

2. When you browse the website

The pages of novantrek.com are served by Cloudflare, the hosting provider. As with any website, its servers log technical data for each connection (IP address, date and time, page requested, browser and operating system) in order to provide the service, keep it available and protect it from attacks. Novantrek does not use those logs to identify anyone or to build profiles.

The legal basis is the legitimate interest in the website working and being protected (Article 6(1)(f) GDPR).

Everything the website loads comes from novantrek.com: there is no Google Analytics or other third-party analytics, no advertising network pixels, and no fonts or scripts from external servers. The details are in the cookie policy.

3. Visit analytics

The service pages count their visits with two in-house tools: Matomo, installed on a Novantrek server in the European Union, and an in-house meter that runs in Novantrek's Cloudflare account. It is not Google Analytics or a third-party service, and the data is not shared with anyone. The legal pages and the games room at novantrek.com/secret are not measured.

Matomo: what it measures and how

Matomo is an open-source (GPL) analytics program that runs on a Novantrek server, hosted in a data centre in the European Union. Your browser does not talk to it: it sends the data to novantrek.com, which forwards it. It has two levels, and you choose:

• By default (no choice made, or "Reject"): anonymous and cookie-free. Nothing is stored in your browser. Matomo recognises the visit with a code calculated from your IP, your browser and a secret key that changes every day: you cannot be followed from one day to the next. Legal basis: Novantrek's legitimate interest in knowing whether its website works (Article 6(1)(f) GDPR), using the least intrusive version possible.
• If you press "Accept": analytics with first-party cookies. Two novantrek.com cookies are created (nvk_v, 13 months, and nvk_s, 30 minutes) with a random identifier, to recognise repeat visits and see the path between visits. Legal basis: your consent (Article 6(1)(a) GDPR and Article 22.2 of the LSSI), which you can withdraw whenever you like without the website ceasing to work.

At both levels the following is stored: the pages you open (with their title and the campaign tags, if any), the referring page, the time on each page, outbound links and downloads, the buttons you press (their text, never what you type), what you search for in the model catalogue, the screen size, the browser, the operating system, the device type, the language and the country. Your name, your email and what you type into a form are not stored.

• Your IP address is not stored in full: it is truncated (its last two bytes are zeroed) before being stored and before the country is worked out. The country is deduced with the DB-IP database (db-ip.com, Creative Commons Attribution 4.0 licence), which sits on our server: no external service is queried.
• Your browser's Do Not Track and Global Privacy Control signals are respected: with either of them, nothing is measured.
• The records of each visit are deleted after 13 months; after that only aggregate figures remain, which identify no one.
• We make daily backups of the database on the server itself and rotate them. The data is not sold, not passed on and not combined with other sources; only the Novantrek team consults it, with a username, a password and two-step verification.
• Client websites hosted here are measured only at the anonymous, cookie-free level.

Novantrek's in-house meter

Besides Matomo, the in-house meter keeps working. Everything else in this section describes it: it uses no cookies and keeps its data for 30 days.

What is stored for each visit

• The pages you open, the approximate length of the visit, how far you scroll on each page (as a percentage) and the last page you view.
• Where you came from: the address of the referring page, if your browser sends it (for example, a Google search or Instagram), and the campaign, if the link carries one.
• Which links and buttons you click: the link text, where it leads and the position of the click in the window, as a percentage. If it is a contact button, the fact that you clicked it is noted. Never what you type into a field.
• Device data: screen and window size, whether it is a touch screen, browser and operating system (without version), main language, time zone, light or dark theme, the connection type your browser reports (4G, Wi-Fi…) and how long the page took to load.
• If an error occurs on the page: only that it happened and where, never the message, which could contain form data.
• The approximate location Cloudflare infers from the connection: country, region, city, postcode and approximate coordinates of that city. It is not your address: it is the area your connection exits from, which is often your provider's exchange.
• The network type, in four groups: "Spanish provider", "other provider", "server network" or "unknown". The name of your provider is not stored.
• Whether you moved the mouse, touched the screen or pressed a key: a yes or a no, without where, when or how many times; and whether the browser reports that it is being driven by a program. This helps tell a person from a program, and it only ever adds: someone browsing with a keyboard or a screen reader, or who only reads, still counts as a person.

Automated programs and copies of the website

When the visitor is a program (a search engine bot, an artificial intelligence crawler or a tool that copies websites), the full text it identifies itself with, the network it comes from and a sample of the pages it visits are also stored. This is stored only for programs, in a separate table.

If someone publishes a copy of this website on another domain and that copy calls the analytics tool, the name of that domain, the date and how many times are noted. Nothing is stored about the people visiting the copy.

What is never stored

• The in-house meter uses no cookie at all, neither first-party nor third-party. The only analytics cookies are Matomo's two, and only if you accept them.
• Your IP address. It is used for an instant to calculate a code and then discarded. The counters that curb abuse do not store it either: one uses a code derived from it that expires after ten minutes; the other counts per day and per group of addresses (each group covers 1 in 256), identifies no one and expires at the end of the day. Once expired, they are deleted automatically with the following requests.
• Nothing you type into a form, nor your name, email or phone number.

How a visit is counted without cookies

With a code calculated from your IP, your browser, a secret key and the date. That way, the five pages you open count as one visit rather than five. Because the date is part of the calculation, the next day the code is different: it is impossible to know that you have come back or to follow you from one day to the next.

None of this includes your name, your email or your IP. It is pseudonymised data: during that same day it could be linked to a specific device, which is why it is deleted after 30 days and you can turn analytics off whenever you like.

Legal basis and how to turn it off

Novantrek's legitimate interest in knowing whether its website works and which pages are useful (Article 6(1)(f) GDPR), using the least intrusive approach that allows it: no cookies, no stored IP, no profiles and no tracking across days.

You can object at any time with the "Turn off analytics" button in the cookie policy, or by opening any page with ?no-medir at the end of the address (?si-medir to switch it back on). If your browser sends the Do Not Track signal, nothing about your visit is measured.

How long it is kept and who sees it

Everything is deleted automatically after 30 days, including the records of programs and copies. Only the Novantrek team consults it, with a username and password, in a private dashboard. This data is not sold, not passed on and not combined with other sources.

So that months can be compared, before deletion only the daily totals are recorded: how many visits there were, where they came from and which pages and contact buttons were used. They are aggregate figures, with nothing about any individual visit, and they are kept for two years.

4. The contact form

The contact forms on this website have no server behind them. When you press the button, your own browser arranges what you have written into a message and opens your email program with it, addressed to info@novantrek.com.

• What you type is not stored in any database of this website: it stays in your browser until you send the email.
• It does not go through any intermediate form service: the message leaves from your own email program, with your account.
• If you close the draft without sending it, it goes nowhere.

The forms in the example websites of the gallery are demonstrations and send nothing.

5. When you email Novantrek

From the moment you send an email to info@novantrek.com, personal data is processed, and the controller is the one named in section 1.

What data

Your email address, the name set in your email program and whatever you tell us in the message: usually your name, your business name, the sector and what you need. It is best not to include sensitive data (health, beliefs, third parties' data) that is not needed to prepare a quote.

What for

To answer your enquiry, prepare a quote for you and, if you become a client, manage the business relationship.

On what legal basis

Taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR). If a project is signed, the performance of the contract and, for invoices, compliance with legal obligations (Article 6(1)(c)).

Which route the message takes

The message leaves from your email provider. When it reaches info@novantrek.com, it is received by Cloudflare's email forwarding service, which delivers it to the controller's mailbox. Email travels encrypted between servers when both support it, which is the norm, but not end to end: to send sensitive documents, say so in your first message and a suitable channel will be agreed with you.

6. The questions chat

The questions chat button on the Spanish-language service pages opens an automated assistant that uses artificial intelligence. Its answers are written by a language model from Anthropic, based on the information published on this website. It is an AI, not a person, and it can make mistakes: final prices and timelines are always given in writing. If the assistant is unavailable, or the daily usage limit has been reached, the box answers with texts written in advance.

What data and where it goes

When you send a question, your browser sends the latest messages of the conversation and the page you are on to a program on novantrek.com, hosted on Cloudflare. That program passes them to Anthropic, the AI provider, which acts as a processor on Novantrek's behalf, writes the answer and returns it. Novantrek does not store the question or the answer. When you close the tab, the conversation disappears from your browser. According to Anthropic, what it receives through its API is deleted from its systems within 30 days at most and, under its commercial terms, is not used to train its models.

To limit abuse and spending, the program counts how many questions are asked each hour from the same connection, using a keyed fingerprint of the IP address (the IP address itself is not stored) that deletes itself within a few hours, and how much is spent each day and month. These are only counters: they contain no text.

To discuss your case, the channel is info@novantrek.com: it is best not to type personal, medical or banking data in the chat.

International transfer to the United States

Anthropic's parent company is in the United States, so sending it your question may involve an international data transfer. It is covered by the European Commission's standard contractual clauses (Chapter V of the GDPR), which form part of Anthropic's data processing agreement.

On what legal basis

Your consent, when you write and send the question (Article 6(1)(a) GDPR). If you write nothing, nothing is sent.

The games room assistant

The games room at novantrek.com/secret, which is not linked from the rest of the website, has an assistant prepared to use Google's Gemini model, with images and PDFs. It is currently switched off and sends nothing to Google. This section will be updated before it is switched on. The games run inside your browser and only store your high scores there.

The domain check (cybersecurity)

At novantrek.com/en/ciberseguridad/verificar, when you press “Check”, your browser sends the domain and email you type to a novantrek.com program. It uses them to calculate the verification code and checks whether that code is published on the domain (DNS record, file or tag). It does not store the domain or the email and sends nothing to third parties, except the DNS query, which only carries the domain name. Legal basis: your consent when you press the button (Art. 6.1.a GDPR) and, if you hire us, preparing the contract (6.1.b).

7. Summary of processing

8. Who else processes the data

Data is not sold or passed on to third parties for advertising purposes. Three providers are involved:

• Cloudflare, which hosts the website, the analytics database and the programs behind the analytics tool and the chat, and forwards the email that reaches info@novantrek.com. Its parent company is in the United States, so there may be international data transfers; according to the provider itself, these are covered by the safeguards in Chapter V of the GDPR (standard contractual clauses and its participation in the EU-US Data Privacy Framework).
• Anthropic, the provider of the AI behind the questions chat, acting as a processor: it receives your question and the latest messages of the conversation to write the answer. Its parent company is in the United States, so there may be international data transfers, covered by the European Commission's standard contractual clauses included in its data processing agreement.
• Contabo GmbH, a German company that provides the hosting of Novantrek's server where Matomo runs, in the European Union.

Google currently receives no data from this website: it would only receive data from the games room assistant if it is ever switched on, and this policy would be updated first.

In addition, data may be disclosed to the tax authorities, courts or law enforcement when required by law and, if you are a client, to the accounting firm that keeps the books, as a data processor and only for what is relevant.

9. Retention periods

• Visit analytics with Matomo: the records of each visit, 13 months; after that they are deleted automatically and only aggregate figures remain. The analytics cookies last 13 months (nvk_v) and 30 minutes (nvk_s).
• In-house meter: 30 days, after which it is deleted automatically. Daily totals, which identify no one, are kept for two years.
• Enquiries that do not lead to a project: one year from the last message, in case you pick up the conversation again; after that they are deleted.
• Clients: for as long as the relationship lasts and, afterwards, for the tax and commercial limitation periods, which reach six years for accounting records.
• Hosting technical logs: those applied by Cloudflare in its service.

10. Your rights

You may exercise the rights the GDPR grants you at any time:

• Access: find out what data about you is processed.
• Rectification: correct any that is wrong.
• Erasure: ask for it to be deleted when it is no longer needed.
• Objection: object to processing based on legitimate interest, such as visit analytics.
• Restriction: ask for it to be kept but not used while a complaint is resolved.
• Portability: receive your data in a commonly used format.

To exercise them, write to info@novantrek.com stating which right you wish to exercise. If your identity needs to be verified, only what is strictly necessary will be requested. You will receive a reply within the one-month period set by the GDPR.

If you believe your data has not been handled properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, calle Jorge Juan 6, 28001 Madrid; www.aepd.es).

11. Minors

Novantrek's services are aimed at companies, professionals and adult individuals, and the website is not intended for children under fourteen. If you notice that data from a minor has been collected, write to info@novantrek.com and it will be deleted.

12. Security

The website is always served over HTTPS, so traffic between your browser and the server is encrypted. The pages are static files. Visit analytics data is kept for 30 days (daily totals, two years) in a Cloudflare database that only the Novantrek team consults, with a username and password. Service keys are stored as hosting secrets and never reach the browser.

Emails and working documents are kept on devices with protected access, with reasonable measures against unauthorised access, loss or alteration.

Websites and applications that Novantrek develops for its clients are hosted on the same infrastructure. That data is processed on behalf of each client and is explained in the privacy policy of each website.

13. Changes to this policy

This policy is updated when the services, the providers or the regulations change, and always before switching on any tool that processes data in a different way. The version in force is the one published on this page, with its date at the top.

About this translation

This English text is a translation provided for guidance only. In case of doubt, the Spanish text prevails.