What this site collects about you.

When conversation notifications are enabled, the questions you send and the replies actually shown to you are copied, with recognised sensitive details withheld by a filter, to our internal enquiries@novus-point.co.uk mailbox through our email delivery provider, Resend. This helps our team understand the question and prepare a response if you separately give us contact details and ask us to reply. The assistant does not verify identity, and an address included in a question is not permission to contact that address. A mailbox copy is separate from the database record and is handled as correspondence; ask us to erase both where applicable.

One company decides what happens to the personal data described here, and that company is answerable for it.

Novus Point Limited is registered in England and Wales, company no. 08146241. Our registered office is 124 City Road, London EC1V 2NX. For anything in this notice, write to enquiries@novus-point.co.uk.

What this notice covers

This website, the correspondence that reaches us through it, and the consultation calls we hold with you. If we are engaged to act for you, the personal data we handle in the course of that engagement is governed by the terms we agree with you at the time — including whether we act as controller or as your processor for it. This notice does not displace those terms.

We have no Data Protection Officer

We are not a public authority, we do not monitor people at scale and we do not process special category data as our core activity, so UK GDPR Article 37 does not require us to appoint one, and we have not appointed one for appearances. Data protection questions are answered at principal level, at the address above.

No cookies, no analytics, no tracking. What reaches us is what you choose to send: an enquiry, an email, or a question to the site assistant.

An advisory firm that writes about data governance should be able to state plainly what its own website does, and should not mind being checked. What your browser does can be confirmed from the page source and from the response headers this site sends; what the assistant keeps on our side is set out below.

Fonts and assets are served from this domain

The typefaces, the logo and the icons are self-hosted. Loading a page here makes no request to Google Fonts, to a content delivery network or to any other third party, so no other company learns that you visited, or from where.

Hosting, and the server logs that come with it

This site is hosted by Vercel. As an ordinary incident of serving a web page, Vercel's systems record technical request data: your IP address, the user agent string your browser sends, the page requested, the time of the request and the response status. Every web server on the internet does this — it is how a page is delivered and how a host defends itself against abuse.

Our lawful basis is legitimate interests, UK GDPR Article 6(1)(f): delivering this site reliably and keeping it secure. We do not use that log data for analytics, marketing or profiling, we do not combine it with anything else, and we make no attempt to identify you from it. It is generated by Vercel. On the Vercel plan this site uses, the request logs we can see are kept for one day and then expire; we take no copy and keep none ourselves. Vercel also records usage data about its own service as a separate controller, under its own privacy notice, not on our instructions. The small functions that deliver the enquiry form and run the site assistant also use your IP address to slow down automated abuse; they hold it in the function's own memory only, for as long as that instance of the function runs, and write the address itself nowhere. The assistant stores only a one-way, salted hash of it, as described below.

Nothing is sent to us until you press send.

The enquiry form at /contact asks for four things — first name, last name, email address and, optionally, a company name — and delivers them to enquiries@novus-point.co.uk as a single email over our own mail service. It exists so that reaching us does not depend on your machine having a working mail client. Every other contact link on this site is a mailto link to the same address, or our LinkedIn page.

What you have to give us. Nothing, until you decide to write. If you use the form, three of its four fields are required — your name and your email address — because what you are asking for is a conversation, and we need a way to answer. We do not ask for a telephone number: the diagnostic is arranged by email, and if a call turns out to be the better way to hold it, we agree that with you at the time. None of it is demanded by any law or contract: the only consequence of not providing it is the obvious one, that we cannot come back to you. And by email you decide entirely what we get — you can send us less than you think we want.

What we receive

From the form: the four fields above, and nothing else — the form has no message box, no identifier of any kind, and one hidden field: a decoy that only spam robots fill in. If it is filled, nothing is sent. A person never sees it, and it never carries your data. From email: whatever your message contains. In practice that is your name and email address, your job title and employer if you mention them, and what you tell us about your organisation, your systems or the problem you are trying to solve. We also receive the ordinary metadata that travels with any email: the sending address, the time, and the routing headers.

Please do not send special category data — health, biometric, trade union, religious or similar — or anyone else's personal data, in an opening email. An unsolicited message is not a controlled channel. If something sensitive has to move, say so first and we will agree a route for it.

Why we are entitled to hold it

Legitimate interests. UK GDPR Article 6(1)(f). Running an advisory firm means reading, answering and keeping a record of the enquiries sent to it. You would expect a reply; holding your message in order to write one is what you asked for, and it does not override your interests or rights.

Steps prior to a contract. UK GDPR Article 6(1)(b). Where your enquiry concerns a possible engagement, we process what you send in order to take steps at your request before entering into a contract — holding the diagnostic conversation, scoping the work, quoting it and agreeing terms.

What we use it for

To answer you. To hold the thirty-minute diagnostic if you want one, to prepare a written position or a proposal, and to keep a record of what was asked and what we said. That is the list. We do not sell personal data, we do not share it for anyone's marketing, and we do not add you to a mailing list you did not ask to join.

How long we keep it

Correspondence that does not lead to an engagement is deleted within 12 months of the last message. Where an engagement follows, the records are kept for the duration of that engagement and for six years afterwards — the period in which a claim could still be brought and in which we may need to evidence what was advised. We delete sooner if you ask and there is no reason left to hold it.

You are talking to an AI system, not to a person. It answers only from the pages of this site, and it is not legal advice.

Using it is optional. Nothing is sent until you send a question, and the chat sets no cookie and writes nothing to your browser's storage: the conversation identifier is held in the open page's memory only, and a reload starts a new conversation.

Please do not type personal or confidential information into the assistant — and in particular no special category data, such as information about health, religion, political opinions or trade union membership, about yourself or anyone else. It has no use for it, and it is free text that we would then hold.

What we store

For each question: the question as you typed it, the answer you were shown, which published passages were used, and technical details of how the answer was produced. For each conversation: the random identifier your browser generated for it, the page you were on when you asked your first question, counters and timestamps, and a one-way hash of your IP address, combined with a secret value before hashing — never the address itself. That hash is still personal data. We use it to apply the daily limit per address; because it stays with each conversation for as long as the conversation is kept, it would also show that two conversations came from the same address. We do not use it for that, and we do not try to reverse it.

While we test a language model. For a limited period we may send your question to a language model, Anthropic's Claude, purely to test how it would answer. During that test the model's draft answer is never shown to you — you get the same answer, or the same "no answer", as you would without it — but we store the draft so that we can review it. A draft can repeat what you typed. This testing brings no benefit to you as the person asking; it is how we check whether a model's answers are safe to show before we show them to anyone. Only your question, up to two earlier questions from the same conversation, and the site passages are sent to the model: never your IP address or any identifier.

What we use it for

To answer you; to keep the assistant secure, to limit abuse and to stay within a fixed monthly cost; to review the quality of its answers and fix what it got wrong; and, while the test above runs, to evaluate a language model's draft answers. Not for marketing, advertising or profiling. When notifications are enabled, an optional follow-up request is linked to this conversation only if you submit its separate form and request a reply; an address pasted into a question is not treated as contact permission.

Why we are entitled to hold it

Legitimate interests. UK GDPR Article 6(1)(f), and the same article of the EU GDPR: running a public assistant safely, within a cost limit, and improving it — including testing a language model on real questions before its answers are shown to anyone. We weighed that against your interests: contact details are optional and requested only if you ask for a follow-up, it tells you not to include confidential data in questions, the address is hashed, the records are kept for a short, fixed time, the model test is limited in time and receives no identifier, and you can object at any time.

How long we keep it

Questions that were sent to the language model during the test, with its unshown draft answers, are deleted 30 days after they are written. The assistant database record, optional contact request and notification queue are deleted 90 days after the last activity in the conversation. These database deletions are scheduled and checked. Internal mailbox copies are correspondence records held separately; ask us to erase them where applicable. Monthly totals of usage and cost, which contain no personal data, are kept.

Voice

If the assistant shows a microphone button, you can speak your question and have answers read aloud. Both are done by your browser, not by us. Turning speech into text is a service provided by your browser's maker under its own privacy terms; in some browsers (Chrome, Safari and Edge, for example) your speech is sent to that company's servers for this. We never receive the audio, only the text you then choose to send. Reading an answer aloud is also done by your browser; depending on the voice it uses, the browser may send the answer text to its maker's speech service. None of this is sent to us.

Finding your conversation

The assistant has no accounts. If you submitted the optional follow-up form, we can find that conversation from the supplied address; otherwise we can find it only from what you can tell us: the approximate time and the text of a question, or your IP address at the time, from which we can compute the hash to locate it. You can ask us to delete it, or object to its use, as described under "Your rights".

Nobody else touches it, and none of them may use it for their own purposes. The exceptions are the usage data that Vercel and Fireflies record about their own services, and the de-identified data that Fireflies may create under its addendum, all described below.

Email — Google Workspace

Our email is provided by Google Workspace. Google stores and transmits our messages, including yours, as our processor under a data processing agreement, and is not permitted to use their content for its own purposes. Where we hold a call with you on Google Meet, part of the same service, Google processes it under the same agreement. For Google, the transfer safeguard is Google LLC's certification to the EU–US Data Privacy Framework and its UK Extension (the UK–US data bridge); where that does not cover a transfer, Google's data processing addendum applies the European Commission's standard contractual clauses.

Hosting — Vercel

Vercel hosts this website and runs the small functions that handle the enquiry form and the site assistant, as our processor. It generates the server log data described above, and it also records usage data about its own service as a separate controller, under its own privacy notice, not on our instructions. For Vercel, the transfer safeguard is the European Commission's standard contractual clauses and the Information Commissioner's International Data Transfer Addendum to them, both incorporated in Vercel's data processing addendum; Vercel also states that it complies with the EU–US Data Privacy Framework and its UK Extension.

Form delivery — Resend

When you submit the enquiry form, the message carrying your details travels from that function to our mailbox through Resend, an email delivery service, as our processor under a data processing agreement. Resend handles the message only long enough to deliver it and keeps a delivery log; it is not permitted to use the content for its own purposes. For Resend, the transfer safeguard is the European Commission's standard contractual clauses with the Information Commissioner's UK Addendum, both in Resend's data processing agreement; Resend also states that it complies with the EU–US Data Privacy Framework and its UK Extension. Email you send us directly, rather than through the form, never touches Resend.

Assistant records — Supabase

The records the site assistant keeps, described above, are stored in a Supabase database in its Stockholm region (eu-north-1), in the European Economic Area, as our processor. Supabase holds them on our instructions only. For Supabase, the transfer safeguard is the European Commission's standard contractual clauses (modules two and three) and the Information Commissioner's UK Addendum to them, both incorporated in Supabase's data processing addendum.

Language model — Anthropic

When the assistant uses a language model, your question, up to two earlier questions from the same conversation, and the site passages it draws on are sent to Anthropic's Claude API, as our processor. Your IP address and the conversation identifier are never sent. Anthropic's commercial terms state that it may not train models on customer content from its services, which covers both what is sent to the model and what it returns, and that data submitted through those services is processed under its data processing addendum. That addendum allows Anthropic to retain customer data where it is necessary to combat harmful use of its services. For Anthropic, the transfer safeguard is the European Commission's standard contractual clauses (modules two and three) and, for data subject to the UK GDPR, the Information Commissioner's International Data Transfer Addendum to them, both incorporated in that addendum.

Call transcription — Fireflies

Where it is switched on for a call, Fireflies.ai Corp. records and transcribes our consultation calls with you and produces notes from them, as our processor under its data processing addendum. Everyone on the call is told before transcription starts, and if anyone objects, the call is not transcribed. Our lawful basis for recording and transcribing a call is legitimate interests, UK GDPR Article 6(1)(f): keeping an accurate record of what was asked and what we advised. The recording, transcript and notes are kept for the same period as the enquiry correspondence they belong to: if no engagement follows, they are deleted within 12 months of the last message; if one does, they are kept as engagement records, for the duration of that engagement and for six years afterwards. We delete sooner if you ask and there is no reason left to hold them.

Under that addendum Fireflies may also create de-identified data, meaning information that cannot reasonably be linked to a person, and use it to improve its products and services and for other business purposes. It must take reasonable measures to keep that data from being linked to anyone, process it only in de-identified form, and not try to re-identify it except as data protection law permits. Fireflies also records usage data about its own service as a separate controller, under its own privacy policy, not on our instructions. To tell speakers apart, Fireflies' service providers may derive data about the characteristics of participants' voices; Fireflies states in its privacy policy that this data is not used to identify or authenticate anyone, and that Fireflies itself does not receive it. For Fireflies, the transfer safeguard is Fireflies.ai Corp.'s certification to the EU–US Data Privacy Framework and its UK Extension (the UK–US data bridge); where that does not cover a transfer, the addendum applies the European Commission's standard contractual clauses (module two) together with the UK International Data Transfer Addendum.

Transfers outside the United Kingdom

All six providers are capable of storing or processing data outside the UK, and the safeguard for each is stated above. In every case it is one that UK law recognises: the adequacy regulations made under section 17A of the Data Protection Act 2018 (for the United States, the UK–US data bridge, which covers recipients certified to the UK Extension to the EU–US Data Privacy Framework), or the Information Commissioner's International Data Transfer Addendum to the European Commission's standard contractual clauses. If you want to know which safeguard covers a particular transfer, or to see a copy of it, write to us and we will show you.

Disclosure to anyone else

We would disclose personal data where we are required to by law, by a court or by a regulator, or where it is necessary to establish, exercise or defend a legal claim. Where an engagement needs specialist legal, security or data expertise, we bring that expertise in under our own direction and responsibility — and we tell you before your information reaches anyone outside the firm.

Security

This site is served over HTTPS with strict transport security, a content security policy that permits no third-party code, and no scripts beyond our own. Email is a less controlled medium: it crosses the public internet, and no one can guarantee a message in transit. Treat a first email accordingly.

Links to other people's sites

Some pages link outward — to LinkedIn, to Companies House, to EUR-Lex. Following a link takes you to someone else's site, where their privacy notice applies and ours does not. We have no control over what they do.

Exercising these rights costs you nothing, and we answer within one month.

You do not need to cite an article, fill in a form or explain yourself. Write and say what you want. If a request is genuinely complex we may take up to two further months, in which case we will tell you why inside the first month. We would charge a fee, or decline, only for a request that is manifestly unfounded or excessive — and we would say so, and why.

No automated decisions, no profiling

We make no decision about you by automated means, and we do not profile you. Article 22 does not arise. Where we use AI tools in our own work, a person decides, and that person is accountable for the decision.

How to exercise a right

Email enquiries@novus-point.co.uk and say what you want. We may ask you to confirm who you are before we release information about you, which is a protection for you rather than an obstacle.

If you are not satisfied

Tell us, and we will look at it again. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Raising it with us first is not a precondition, and complaining to the ICO does not stop you raising it with us as well.

If you write to us from the EU or EEA

Nothing above changes, but two things are worth saying plainly. Where we have offered our services to you in the EU, the EU GDPR may apply to what you send us alongside the UK version; the two are materially the same, and this notice is written to honour both. And you can complain to the data protection authority where you live or work, not only to the ICO — raising it with one does not shut the door on the other.

Our representative in the EU under Article 27 of the EU GDPR is Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria. You — or a data protection authority — can reach them through prighter.com/q/16315401859, quoting ID-16315401859. Writing to them is the same as writing to us: it changes nothing about who is responsible for your data, which remains Novus Point Limited.

Changes to this notice

If what we do changes, this notice changes with it and the date at the top of the page changes too. The current version is always the one published here. Where a change materially affects something you have already sent us, we will tell you rather than leave you to notice.

Copyright and reuse

The text and design of this site belong to Novus Point Limited. The typefaces — Source Serif 4, Lato and Montserrat — are used under the SIL Open Font License; their licence texts sit alongside the font files at /assets/fonts/. Where we set out the EU AI Act, we compile from Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744 as published in the Official Journal of the European Union — which alone is authentic. The legislation itself belongs to everyone; our reading of it belongs to us. Quote this site with attribution and we will not mind.

Ask us anything about this notice