No cookies
This site sets no cookies. It writes nothing to local storage or session storage and issues no device identifier. There is no cookie banner because there is nothing to consent to, and no legitimate interest to weigh.
Privacy notice
What this site collects about you.
Almost nothing. No cookies, no analytics, no forms. The only personal data we receive through this site is what you choose to put in an email.
This notice sets out what then happens to it: who holds it, why we are allowed to, how long we keep it, who else sees it, and what you can require of us. It is written to be read.
Last updated 26 August 2026. It applies to novus-point.co.uk and to the correspondence that reaches us through it.
Verifiable in this page's source
Who holds it
Novus Point Limited is the controller.
One company decides what happens to the personal data described here, and that company is answerable for it.
Novus Point Limited is registered in England and Wales, company no. 08146241. Our registered office is 124 City Road, London EC1V 2NX. We work from London and Dubai. For anything in this notice, write to jakub@novus-point.co.uk.
What this notice covers
This website, and the correspondence that reaches us through it. If we are engaged to act for you, the personal data we handle in the course of that engagement is governed by the terms we agree with you at the time — including whether we act as controller or as your processor for it. This notice does not displace those terms.
We have no Data Protection Officer
We are not a public authority, we do not monitor people at scale and we do not process special category data as our core activity, so UK GDPR Article 37 does not require us to appoint one, and we have not appointed one for appearances. Data protection questions are answered at principal level, at the address above.
The site itself
It serves pages. That is the whole of it.
This is a static site. There is nothing on it that watches you.
An advisory firm that writes about data governance should be able to state plainly what its own website does, and should not mind being checked. Everything below can be confirmed from the page source and from the response headers this site sends.
No analytics
There is no analytics package, no tag manager, no advertising or social pixel, no session recorder and no third-party script of any kind. We do not count your visit, and we do not build a profile of you.
No forms
There is no form anywhere on this site, and its content security policy sets form-action to none, so a page here could not submit your data even if a form were added to it. Every call to action is a mailto link that opens your own email client.
Fonts and assets are served from this domain
The typefaces, the logo and the icons are self-hosted. Loading a page here makes no request to Google Fonts, to a content delivery network or to any other third party, so no other company learns that you visited, or from where.
Hosting, and the server logs that come with it
This site is hosted by Vercel. As an ordinary incident of serving a web page, Vercel's systems record technical request data: your IP address, the user agent string your browser sends, the page requested, the time of the request and the response status. Every web server on the internet does this — it is how a page is delivered and how a host defends itself against abuse.
Our lawful basis is legitimate interests, UK GDPR Article 6(1)(f): delivering this site reliably and keeping it secure. We do not use that log data for analytics, marketing or profiling, we do not combine it with anything else, and we make no attempt to identify you from it. It is generated and retained by Vercel as our hosting processor, under its own retention practices.
If you write to us
Email is the only way data reaches us.
Nothing is sent to us until you write and press send.
Every contact route on this site — the buttons, the navigation, the footer — is a mailto link to jakub@novus-point.co.uk. You decide what goes into the message, and you can send us less than you think we want.
What we receive
Whatever your message contains. In practice that is your name and email address, your job title and employer if you mention them, and what you tell us about your organisation, your systems or the problem you are trying to solve. We also receive the ordinary metadata that travels with any email: the sending address, the time, and the routing headers.
Please do not send special category data — health, biometric, trade union, religious or similar — or anyone else's personal data, in an opening email. An unsolicited message is not a controlled channel. If something sensitive has to move, say so first and we will agree a route for it.
Why we are entitled to hold it
Legitimate interests. UK GDPR Article 6(1)(f). Running an advisory firm means reading, answering and keeping a record of the enquiries sent to it. You would expect a reply; holding your message in order to write one is what you asked for, and it does not override your interests or rights.
Steps prior to a contract. UK GDPR Article 6(1)(b). Where your enquiry concerns a possible engagement, we process what you send in order to take steps at your request before entering into a contract — holding the diagnostic conversation, scoping the work, quoting it and agreeing terms.
What we use it for
To answer you. To hold the thirty-minute diagnostic if you want one, to prepare a written position or a proposal, and to keep a record of what was asked and what we said. That is the list. We do not sell personal data, we do not share it for anyone's marketing, and we do not add you to a mailing list you did not ask to join.
How long we keep it
Correspondence that does not lead to an engagement is deleted within 24 months of the last message. Where an engagement follows, the records are kept for the duration of that engagement and for six years afterwards — the period in which a claim could still be brought and in which we may need to evidence what was advised. We delete sooner if you ask and there is no reason left to hold it.
Who else is involved
Two providers, both on our instructions.
Nobody else touches it, and neither of them may use it for their own purposes.
Email — Google Workspace
Our email is provided by Google Workspace. Google stores and transmits our messages, including yours, as our processor under a data processing agreement, and is not permitted to use their content for its own purposes.
Hosting — Vercel
Vercel hosts this website and generates the server log data described above, as our processor.
Transfers outside the United Kingdom
Both providers are capable of storing or processing data outside the UK. Where that happens, the transfer is made under the safeguards UK law requires: the adequacy regulations made under section 17A of the Data Protection Act 2018 where the destination is covered by them, or the Information Commissioner's International Data Transfer Addendum to the European Commission's standard contractual clauses where it is not. We work from London and Dubai, so a message you send us may be read by us in either place.
Disclosure to anyone else
We would disclose personal data where we are required to by law, by a court or by a regulator, or where it is necessary to establish, exercise or defend a legal claim. Where an engagement needs specialist legal, security or data expertise, we bring that expertise in under our own direction and responsibility — and we tell you before your information reaches anyone outside the firm.
Security
This site is served over HTTPS with strict transport security, a content security policy that permits no third-party code, and no scripts beyond our own. Email is a less controlled medium: it crosses the public internet, and no one can guarantee a message in transit. Treat a first email accordingly.
Links to other people's sites
Some pages link outward — to LinkedIn, to Companies House, to EUR-Lex. Following a link takes you to someone else's site, where their privacy notice applies and ours does not. We have no control over what they do.
Your rights
What you can require of us.
Exercising these rights costs you nothing, and we answer within one month.
You do not need to cite an article, fill in a form or explain yourself. Write and say what you want. If a request is genuinely complex we may take up to two further months, in which case we will tell you why inside the first month. We would charge a fee, or decline, only for a request that is manifestly unfounded or excessive — and we would say so, and why.
Rights under the UK GDPR
- Access
- Rectification
- Erasure
- Restriction
- Objection
- Portability
No automated decisions, no profiling
We make no decision about you by automated means, and we do not profile you. Article 22 does not arise. Where we use AI tools in our own work, a person decides, and that person is accountable for the decision.
How to exercise a right
Email jakub@novus-point.co.uk and say what you want. We may ask you to confirm who you are before we release information about you, which is a protection for you rather than an obstacle.
If you are not satisfied
Tell us, and we will look at it again. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Raising it with us first is not a precondition, and complaining to the ICO does not stop you raising it with us as well.
Changes to this notice
If what we do changes, this notice changes with it and the date at the top of the page changes too. The current version is always the one published here. Where a change materially affects something you have already sent us, we will tell you rather than leave you to notice.