Privacy Policy

1. Who We Are

NOVTRIQ is the trading name of Novus Projects Ltd, a company registered in England and Wales (company registration number 13629950). We are an engineering consultancy providing services across energy, infrastructure, digital innovation, and sustainability sectors.

We are committed to protecting your privacy and ensuring transparent data practices in accordance with the UK Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR).

2. Information We Collect

We collect information in several ways:

Direct Interactions

• Contact forms, enquiry submissions, and website requests
• Email correspondence and phone calls
• Project consultations and service agreements
• Newsletter subscriptions and marketing preferences

Automated Collection

• Usage data including pages visited, time spent, and navigation patterns
• Device information (browser type, operating system, device type)
• IP address and approximate location data
• Cookies and similar tracking technologies

Data Categories

• Identity data: name, job title, company
• Contact data: email, phone number, business address
• Professional data: industry sector, role, interests in services
• Technical data: IP address, browser data, device identifiers
• Usage data: how you interact with our website and services

3. How We Use Your Information

We process your personal data on the following legal bases under UK GDPR:

Contractual Necessity

To provide engineering consultancy services, fulfill project requirements, send invoices, and manage client relationships.

Legitimate Business Interests

• Improving our website, services, and user experience
• Analysing website traffic and performance
• Preventing fraud and enhancing security
• Understanding client needs and service delivery

Consent

• Marketing communications (newsletter, case studies, industry updates)
• Non-essential cookies for analytics and personalisation

Legal Obligation

Complying with UK tax, employment, and professional engineering regulations.

4. Data Sharing and Third Parties

We do not sell your personal data. We may share information with:

Service Providers

• Website hosting and infrastructure providers
• Email delivery and CRM platforms
• Analytics and monitoring tools
• Cloud storage providers

Legal Requirements

We may disclose data if required by law, court order, or to protect our legal rights and safety.

Business Transfers

If NOVTRIQ is sold, merged, or restructured, your data may be transferred as part of that transaction. We will provide notice of any such change.

5. International Data Transfers

Your data is primarily processed within the United Kingdom. If we transfer data internationally (e.g., to cloud providers), we implement appropriate safeguards including:

• Standard Contractual Clauses (SCCs) with EU/EEA entities
• Adequacy decisions recognised by the UK government
• Your explicit consent where required

6. Data Retention

We retain personal data for as long as necessary to fulfil the purposes stated in this policy:

• Client data: Duration of engagement plus 6 years (UK tax requirements)
• Enquiry data: 2 years or until opted out of communications
• Website analytics: 26 months (standard retention period)
• Marketing preferences: Until withdrawn

After the retention period, we securely delete or anonymise your data, unless legal obligations require longer retention.

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right of Access

Request a copy of the personal data we hold about you (Subject Access Request).

Right to Rectification

Correct inaccurate or incomplete personal data.

Right to Erasure

Request deletion of your data in certain circumstances (the "right to be forgotten").

Right to Restrict Processing

Restrict how we use your data while we assess a complaint or verify information.

Right to Data Portability

Receive your data in a structured, machine-readable format and transfer it to another controller.

Right to Object

Object to processing based on legitimate interests or direct marketing. We will cease processing for direct marketing immediately.

Rights Related to Automated Decision-Making

You have the right not to be subject to solely automated decision-making. Our processes include human review where applicable.

8. Cookies and Tracking Technologies

We use cookies to improve your experience on our website. For comprehensive information about cookies we use and your preferences, please visit our Cookie Policy.

Cookie types include:

• Essential: Required for website functionality (automatically placed)
• Analytical: Help us understand user behaviour (requires consent)
• Marketing: Enable targeted content recommendations (requires consent)

9. Security and Data Protection

We implement comprehensive technical and organisational measures to protect your personal data:

• HTTPS encryption for all data transmission
• Secure data storage with access controls
• Regular security assessments and audits
• Staff data protection training
• Incident response procedures

While we strive to protect your data, no system is entirely secure. Please safeguard your login credentials and notify us immediately of any suspected security breaches.

10. Children's Privacy

Our services are not directed to individuals under 13 years of age. We do not knowingly collect personal data from children. If we become aware that a child has provided us with personal data, we will delete it promptly.

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by updating the "Last updated" date and posting the revised policy on our website. Your continued use of our services constitutes acceptance of the updated policy.

12. Contact Us and Data Controller Information

If you have questions about this Privacy Policy, wish to exercise your rights, or want to report a data protection concern, please contact us:

Data Protection Authority

If you believe we have breached your rights under UK GDPR, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent authority for data protection.