Legal

Privacy notice

Document version 2026-09-17.2. English text is authoritative.

1. Controller identity and contact

1.1 NovaMX B.V., Salland 1, 1948 RE Beverwijk, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 42107118, VAT identification number NL869765097B01, is the controller for the personal data described in this notice, unless clause 2 states that NovaMX acts as processor.

1.2 Contact: telephone +31 85 130 0982, e-mail contact@novamx.eu, or through My NovaMX.

2. Roles: controller and processor

2.1 For account, billing, and portal-login data of the customer's own organisation, and for NovaMX's own operational and security logs, NovaMX acts as an independent controller. This notice describes that processing.

2.2 For customer end-user and content data processed while delivering a Service, for example mailbox content, website files, or DNS/mail configuration tied to a customer's domains, NovaMX acts as processor on the customer's documented instructions. That processing is governed by the Data Processing Agreement, not by this notice. If you are an end user of a NovaMX customer (for example an employee whose mailbox is hosted by a NovaMX customer), your organisation is the controller for that data and is the appropriate contact for a data subject request; NovaMX will redirect such requests where required.

3. Categories of personal data

3.1 NovaMX processes, depending on the Service used: identification and contact data (name, e-mail address, phone number, postal address); account and authentication data (username, hashed password, multi-factor authentication status, session identifiers); billing and company data (billing address, company name, KvK/VAT numbers, invoice history); technical and log data (IP address, browser/user-agent, access timestamps, portal action logs); support data (ticket content, attachments, and, where relevant, screen-context summaries used by the optional AI assistant described in clause 13); and, where the customer registers a domain, the registrant, administrative, and technical contact details required by the applicable domain registry.

3.2 NovaMX does not knowingly collect special categories of personal data (Article 9 GDPR) through account registration or billing. If a customer places such data into a Service NovaMX operates on the customer's behalf (for example within hosted mail content), NovaMX processes it as processor under the Data Processing Agreement and the customer remains responsible for a lawful basis.

4. Purposes and legal bases

4.1 Contract performance (Article 6(1)(b) GDPR): creating and securing your account and portal access; delivering ordered Services; issuing invoices and processing payments; providing customer support; administering domain registrations and renewals.

4.2 Legitimate interest (Article 6(1)(f) GDPR): securing the platform against abuse and unauthorised access; maintaining service and security logs; preventing fraud and payment default; improving Services based on aggregated, non-identifying usage patterns; and, after a completed paid order, inviting a service review through an EU/EEA review-invitation platform. Where NovaMX relies on legitimate interest, it has weighed that interest against your rights and freedoms. You may object to review invitations under clause 11.

4.3 Legal obligation (Article 6(1)(c) GDPR): retaining financial administration records for the statutory period; responding to lawful requests from competent authorities; complying with registry and anti-fraud obligations applicable to domain registration.

4.4 Consent (Article 6(1)(a) GDPR): optional communications such as maintenance or product news e-mails (clause 14); the optional AI assistant in My NovaMX (clause 13); and any other processing this notice identifies as opt-in.

5. Cookies and similar technologies

5.1 NovaMX uses only strictly necessary cookies. No cookie consent banner is shown because no cookie requiring consent is set; see clause 5.4.

5.2 Session cookie. After you log in, My NovaMX and the admin portal set a session cookie named novamx_portal_session (HttpOnly, Secure, SameSite=Strict) containing only a session token; account data is not stored in the cookie and stays on NovaMX servers. Staff sign-in through the internal identity provider on admin.novamx.eu may set a comparable short-lived authentication session cookie for the same purpose.

5.3 Marketing cart handoff cookie. When you start checkout from the public marketing site, NovaMX may set a short-lived cookie named novamx_marketing_cart_handoff (approximately one hour, Secure, SameSite=Lax) so that My NovaMX can receive your cart selection when you log in or register. This cookie contains a handoff reference only, not payment details.

5.4 NovaMX does not use advertising, analytics, or social-media tracking cookies on the public website or in the portal. Theme and language preferences are not stored in cookies; see clause 6.

5.5 First-party product counters (no cookies). When you use public tools on novamx.eu (for example domain search or adding a catalog item to the cart) or start checkout in My NovaMX, NovaMX increments daily server-side totals: requested page paths from existing access logs, the TLD and available/taken outcome of a domain check (not the domain name you typed), and catalog product codes added to the cart or taken through checkout. These counters do not store IP addresses, unique visitor identifiers, cookies, or fully-qualified domain names. They are used to improve NovaMX pages and offers under legitimate interest (clause 4.2) and are kept for about 90 days. Optional Website traffic in My NovaMX is described in clause 5.7.

5.6 Portal load timings (no cookies). After you sign in, My NovaMX and the admin portal may send anonymous page-load durations (time until the loading overlay is hidden, time to first byte, and largest contentful paint) so NovaMX can operate and improve portal performance. These samples do not include IP addresses, account identifiers, cookies, or page content. They are kept for about 90 days and are shown only in the admin Site insights view.

5.7 Optional Website traffic (no cookies). When you opt in to Website traffic for a domain in My NovaMX (or when NovaMX measures its own public sites for Site insights), NovaMX summarises that domain's Apache access logs into daily aggregates: visitor page counts, status-code groups, byte totals, top paths, referrer hosts, and country codes derived from the request IP at ingest time. For an approximate unique-visitor figure, the request IP is hashed with a daily rotating secret and folded into a HyperLogLog sketch; the raw IP and the hash are not stored. Aggregates are kept for about 90 days and are deleted when you turn measurement off for that domain. This feature uses no analytics cookies or browser tracking scripts.

6. Browser storage

6.1 The public website and My NovaMX may store interface preferences in localStorage and temporary values in sessionStorage. On the public site this includes theme and language preferences and a VAT-display preference. In My NovaMX this includes theme, language, and sidebar preferences.

6.2 These values are used only to remember the interface you requested on that device and browser; they are not linked to advertising profiles, are not shared with third parties for tracking purposes, and are not stored in your NovaMX account record.

6.3 Temporary sessionStorage values may also include in-progress multi-factor authentication state, shopping-cart contents, or, where you use the optional public-site or portal AI assistant, a chat transcript for that browser tab. Optional AI-assistant consent in My NovaMX is recorded in localStorage until you revoke it.

7. Recipients and categories of processors

7.1 NovaMX shares personal data only where necessary to deliver the Services or meet a legal obligation, and does not sell personal data. Depending on the Service, NovaMX engages processors in the following categories, each bound by a data processing agreement: payment service providers, to process card and other electronic payments; accounting and invoicing service providers, to issue invoices and maintain financial records; domain registry and registrar-infrastructure providers, to register and manage domain names; hosting, data-centre, and network-connectivity providers, to operate servers, storage, and network paths; content-delivery and web-font providers, to serve static assets efficiently; customer-support and communication tooling providers, to operate ticketing and notification systems; and, where NovaMX invites a service review after a completed paid order, an EU/EEA customer review-invitation platform that receives only the account contact name, e-mail address, order reference and preferred language so it can send the invitation. NovaMX does not place review-platform cookies or scripts on novamx.eu or My NovaMX for that purpose.

7.2 NovaMX may also disclose personal data to a competent authority where required by law, to enforce these Terms or the Acceptable Use Policy, or to protect the rights, property, or safety of NovaMX, its customers, or others.

8. International transfers

8.1 NovaMX processes personal data primarily within the European Economic Area (EEA). Where a processor listed in clause 7 is located outside the EEA, or transfers data outside the EEA, NovaMX ensures an appropriate transfer mechanism is in place (an adequacy decision, Standard Contractual Clauses, or another lawful safeguard recognised under GDPR) before the transfer occurs.

9. Retention

9.1 NovaMX retains personal data for as long as necessary for the purpose for which it was collected: account and service data for the duration of the account plus a reasonable period to handle post-termination queries; financial records for the statutory retention period under Dutch tax law (currently seven years); and security/access logs for a limited operational retention period, after which they are deleted or anonymised, unless a longer period is required by law or necessary to establish, exercise, or defend a legal claim.

10. Security

10.1 NovaMX applies technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS/TLS), access control based on need-to-know, monitoring for unauthorised access, and regular backups for applicable Services, consistent with the measures described in NovaMX's information security practices.

10.2 No method of transmission or storage is completely secure. If NovaMX becomes aware of a personal data breach affecting your data as controller, NovaMX will assess and, where legally required, notify the Autoriteit Persoonsgegevens and affected individuals without undue delay.

11. Your rights

11.1 Subject to conditions under applicable law, you may request access to, correction of, or erasure of your personal data, restriction of or objection to processing, and data portability. Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

11.2 To exercise a right, contact NovaMX at contact@novamx.eu or through My NovaMX. NovaMX will respond within the period required by applicable law and may request information to verify your identity before acting on a request.

11.3 If NovaMX processes data as processor on behalf of another organisation (clause 2.2), NovaMX will direct your request to that organisation where it is the appropriate controller, unless the law requires NovaMX to act directly.

12. Complaints

12.1 If you believe NovaMX has not handled your personal data correctly, you may contact NovaMX first at contact@novamx.eu. You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the supervisory authority in your EU member state of residence.

13. Optional AI assistant in My NovaMX

13.1 My NovaMX may offer an optional AI assistant. It remains inactive until you explicitly opt in under Preferences, and that consent is recorded with a timestamp.

13.2 When enabled, NovaMX processes your question, a structured summary of the screen you are viewing, and customer-safe account context already available in My NovaMX, such as domains, packages, renewal dates, and aggregate status or report summaries. Passwords, forensic mail content, API tokens, and alert delivery targets are never included in that context.

13.3 The assistant runs on NovaMX infrastructure and is used only to answer your question or draft a support message that you must review and confirm before it is sent. Chat content is not used for advertising and is not shared with third parties beyond what is needed to operate the feature. The current conversation may remain in your browser's sessionStorage for that tab until you close it or revoke consent; you can revoke consent at any time under Preferences.

14. Email communications

14.1 NovaMX sends service-related e-mails necessary to operate your account, such as domain expiry warnings, security notices, and messages that confirm a domain holder contact address before registration or transfer. Holder-confirmation links expire after seven days; NovaMX stores a hashed token, not the raw link. These messages are not optional and are not marketing. After a completed paid order, an EU/EEA review-invitation platform may send a separate service-review invitation on NovaMX's behalf (see clause 7.1). That invitation is not marketing news under clause 14.2; you may object under clause 11.

14.2 Optional e-mails about planned maintenance or product news are sent only if you opt in under Account, Alerts. Your opt-in choice is recorded in an audit log with a timestamp, and you can withdraw it at any time in the same settings screen.

15. Changes to this notice

15.1 NovaMX may update this notice to reflect legal, technical, or product changes, including changes to cookies, browser storage, or processors described above. Material changes are published under a new version identifier and, where practical, notified through the portal or by e-mail.

16. Related documents

16.1 This notice forms part of the agreement between you and NovaMX B.V., together with the Terms, the Acceptable Use Policy, the Portal Access Policy, the Service Levels document, and, where applicable, the Data Processing Agreement.