Privacy Policy

1. Who we are

Novaxis Tech Limited ("Novaxis Tech", "we", "us", "our") is a company registered in England and Wales. We are the data controller responsible for the personal data we process about you through this website and our business interactions.

2. What data we collect

We collect the following categories of personal data:

2.1 Information you provide directly

• Contact enquiries. When you email us or use a contact form, we collect your name, email address, company (if provided), and the contents of your message.
• Business correspondence. Information exchanged during commercial discussions, proposals, contracts, and ongoing engagements.

2.2 Information collected automatically

• Server logs. Our hosting provider records standard technical information when you visit the site — IP address, browser type, pages accessed, timestamps, and referring URL. This is used for security and diagnostic purposes.
• Cookies. This website uses only strictly necessary cookies required for basic functionality. We do not use advertising, tracking, or analytics cookies without your consent. If we introduce analytics in future, we will update this policy and request consent where required.

3. Why we process your data (legal basis)

Under UK GDPR, we must have a lawful basis for processing personal data. Ours are:

• Legitimate interests — to respond to your enquiries, manage our business relationship, protect the security of our website, and communicate with prospective and existing clients.
• Contract — to enter into and perform contracts with clients, suppliers, and service providers.
• Legal obligation — to comply with tax, accounting, and other statutory obligations under UK law.
• Consent — where you have specifically opted in (for example, to receive optional communications). You may withdraw consent at any time.

4. How long we keep your data

We keep personal data only for as long as necessary for the purpose it was collected:

• Contact enquiries that don't lead to a business relationship: up to 24 months, then deleted.
• Client records: for the duration of the engagement plus 7 years to meet UK statutory retention requirements (tax, accounting, contractual).
• Server logs: typically 30–90 days, depending on hosting provider defaults.

5. Who we share it with

We do not sell personal data. We share it only with:

• Service providers acting on our behalf — such as our web hosting provider, email provider, and accounting software vendor — under contractual data processing terms.
• Professional advisers — accountants, auditors, or legal advisers where reasonably required.
• Regulators or authorities where we are required to do so by law.

Some of our providers may process data outside the UK. Where this happens, we ensure appropriate safeguards are in place — such as UK adequacy regulations, the UK International Data Transfer Agreement, or Standard Contractual Clauses.

6. Your rights

Under UK GDPR you have the following rights in relation to your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion in certain circumstances ("right to be forgotten").
• Restriction — ask us to limit how we use your data.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, at any time.

To exercise any of these rights, please start a conversation. We will respond within one month.

7. Complaints

If you believe we have not handled your personal data properly, please start a conversation and we will work to address your concerns.

8. Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These include TLS encryption on our website, access controls on internal systems, and vendor selection based on their security posture. No system is completely secure, and we cannot guarantee absolute security of data transmitted over the internet.

9. Children

This website is not intended for children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent version. Material changes will be highlighted on the website.

11. Contact

For any privacy-related questions, please start a conversation.