Privacy policy

Last update:
October 3, 2026

1. Introduction

This Privacy Policy explains how Novair Studio (“Novair”, “we”, “us”, or “our”) collects, uses, stores, and protects personal data when you visit novairstudio.com (the “Website”), contact us, or use our services.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR – Regulation (EU) 2016/679), applicable Italian privacy law (including Legislative Decree 196/2003 as amended), and other applicable data protection rules.

By using the Website or submitting information to us, you acknowledge this Privacy Policy. If you do not agree with it, please do not use the Website or submit personal data to us.

2. Data controller

The data controller is:

For any privacy-related request, please contact us at hello@novairstudio.com.

3. Scope of this policy

This Privacy Policy applies to personal data processed through:

  • Browsing and using the Website
  • Contact or inquiry forms
  • Email, phone, or other communications you initiate with us
  • Newsletter or updates sign-ups, if offered
  • Business discussions related to our services (websites, software, automation, integrations, and related digital systems)

It does not cover third-party websites or services that may be linked from our Website. Those services are governed by their own privacy policies.

4. Personal data we collect

Depending on how you interact with us, we may collect the following categories of data:

4.1 Identity and contact data

  • Name
  • Business or company name
  • Email address
  • Phone number
  • Preferred contact method

4.2 Business and inquiry data

  • Website URL
  • Business type or industry
  • Description of your business needs, problems, or goals
  • Current tools or software you use
  • Any other information you choose to include in your message

4.3 Technical and usage data

  • IP address
  • Browser type and device information
  • Approximate location derived from IP address
  • Pages visited, referring URL, and basic interaction data
  • Date and time of access

4.4 Communication data

  • Content of emails, calls, or messages exchanged with us
  • Records needed to manage a request, proposal, or client relationship

We do not intentionally collect special categories of personal data (such as health, biometric, or political data) through the Website. Please do not submit sensitive personal data unless we expressly request it for a specific engagement and tell you why.

5. How we collect personal data

We collect personal data:

  • Directly from you, when you fill in a form, email us, call us, or otherwise communicate with us
  • Automatically, through cookies, server logs, and similar technologies when you browse the Website
  • From service providers that support hosting, analytics, communications, or security, where applicable

6. Purposes and legal bases for processing

We process personal data only where we have a lawful basis under the GDPR. The main purposes and bases are:

  • Responding to inquiries and providing information about our services — legal basis: steps prior to entering a contract (Art. 6(1)(b) GDPR) and/or our legitimate interest in handling business requests (Art. 6(1)(f) GDPR)
  • Preparing proposals, quotes, or project discussions — legal basis: Art. 6(1)(b) and/or Art. 6(1)(f) GDPR
  • Performing a contract and delivering services — legal basis: Art. 6(1)(b) GDPR
  • Managing client relationships and communications — legal basis: Art. 6(1)(b) and/or Art. 6(1)(f) GDPR
  • Operating, securing, and improving the Website — legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, functional website)
  • Sending newsletters or marketing communications (only if you opt in or where otherwise permitted by law) — legal basis: consent (Art. 6(1)(a) GDPR) or soft opt-in where applicable; you may withdraw consent or object at any time
  • Complying with legal, accounting, and tax obligations — legal basis: legal obligation (Art. 6(1)(c) GDPR)
  • Establishing, exercising, or defending legal claims — legal basis: Art. 6(1)(f) GDPR

Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

7. Who we share personal data with

We do not sell your personal data. We may share personal data only with:

  • Service providers acting as processors on our behalf (for example hosting, email delivery, form handling, analytics, CRM, or IT support), under appropriate data-processing terms
  • Professional advisors such as accountants, consultants, or lawyers, where needed
  • Authorities or courts, where required by law or to protect our rights
  • Business successors, in the event of a merger, acquisition, or restructuring, subject to applicable safeguards

These recipients process data only for the purposes described in this Privacy Policy or as required by law.

8. International data transfers

Some providers we use may process data outside the European Economic Area (EEA). Where that happens, we take steps to ensure an adequate level of protection, such as:

  • Transfers to countries covered by an adequacy decision of the European Commission; or
  • Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms under the GDPR

You can contact us for more information about transfers and the safeguards applied.

9. Data retention

We keep personal data only for as long as necessary for the purposes for which it was collected, including legal, accounting, or reporting requirements. Typical retention periods include:

  • Contact and inquiry data: generally up to 24 months after the last meaningful interaction, unless a longer period is needed for an ongoing discussion or legal reasons
  • Client and contract-related data: for the duration of the relationship and thereafter for the period required by Italian tax and commercial law (typically up to 10 years for accounting/tax records)
  • Marketing subscription data: until you unsubscribe or withdraw consent, and for a short period afterward to record your preference
  • Technical logs and security data: for a limited period needed for security, troubleshooting, and abuse prevention

When data is no longer needed, we delete or anonymize it, unless further retention is required by law.

10. Security

We use appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or disclosure. These measures may include access controls, encrypted connections (HTTPS), least-privilege access, and careful selection of service providers.

No method of transmission or storage is completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will handle it in accordance with applicable law, including notification obligations where required.

11. Cookies and similar technologies

The Website may use cookies and similar technologies that are:

  • Strictly necessary for the Website to function (for example security or load balancing)
  • Analytics or performance cookies, if enabled, to understand how the Website is used
  • Preference cookies, if used to remember settings

Where cookies are not strictly necessary, we will request your consent where required by law. You can also control cookies through your browser settings. Blocking some cookies may affect Website functionality.

12. Your rights

If you are in the EEA/UK or otherwise protected by the GDPR, you may have the right to:

  • Access your personal data
  • Rectify inaccurate or incomplete data
  • Erase your data (“right to be forgotten”), where applicable
  • Restrict processing in certain circumstances
  • Data portability, where processing is based on consent or contract and carried out by automated means
  • Object to processing based on legitimate interests, and to direct marketing
  • Withdraw consent at any time, where processing is based on consent
  • Lodge a complaint with a supervisory authority

In Italy, the supervisory authority is the Garante per la protezione dei dati personali (www.garanteprivacy.it).

To exercise your rights, contact us at hello@novairstudio.com. We may need to verify your identity before responding. We will respond within the time limits required by law.

13. Children’s privacy

Our Website and services are directed to businesses and adults. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.

14. Automated decision-making

We do not use personal data collected through the Website for automated decision-making, including profiling, that produces legal or similarly significant effects on you.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. The “Last update” date at the top of this page will be revised when changes are published. Where appropriate, we may also provide additional notice. Continued use of the Website after an update constitutes acknowledgment of the revised Privacy Policy.

16. Contact

For questions about this Privacy Policy or how we handle personal data, contact: