Minimal data, stated purposes
Privacy Policy
Effective and last updated: August 16, 2026
1. Controller and contact
NOVARIA SASU, 60 rue François Ier, 75008 Paris, France, SIREN 993 976 323, is the controller for personal data described here. Contact us at info@novaria-france.fr or by mail at the registered-office address.
2. Data we handle
| Context | Data | Purpose and legal basis |
|---|---|---|
| Website and security | Request time, IP address, user agent, requested URL, security and error signals | Operate, secure and troubleshoot the service; legitimate interests |
| Checkout | Order and checkout references, amount, currency, payment status and limited payer/payment metadata returned by Stancer | Take and reconcile payment; perform the contract and comply with accounting obligations |
| Project intake and invoicing | Name, business email, legal business name, billing address and country, optional business tax ID, brand, event, audience, offer, proof point, CTA, dimensions, colors, asset links, notes and rights confirmations | Invoice, assess, produce and deliver the purchased service; perform the contract and comply with accounting obligations |
| Support | Your messages, contact details and relevant order history | Answer requests, resolve disputes and protect legal rights; contract and legitimate interests |
| Optional measurement | Consent state and, only after consent, Google advertising/measurement identifiers and interaction events | Measure and improve campaigns; consent |
Do not submit payment-card details, personal government identifiers such as an SSN, passwords, special-category data or personal data unrelated to the project. A business VAT or tax identifier may be supplied only when needed for invoicing. Asset intake uses HTTPS links; this site does not ask you to upload files directly.
3. Payment data
Stancer hosts the payment page and handles card data under its own security and legal obligations. NOVARIA receives checkout and transaction identifiers, amount, currency and status needed to confirm the order, but this website does not receive or store your full card number or card security code.
4. Cookies and optional Google measurement
Strictly necessary browser and network functions may operate without consent to deliver and secure the website. Optional Google Ads measurement is blocked until you choose “Accept analytics & ads.” “Reject optional cookies” is presented at the same level, and rejection does not prevent access to the site or checkout.
Your choice is stored in your browser for up to six months. You can withdraw or change it at any time; withdrawal does not affect prior lawful processing.
We do not intentionally use advertising identifiers for sensitive profiling, and enhanced conversions are disabled in the site configuration.
5. Service providers and transfers
We use providers only for defined operational purposes:
- Cloudflare for website delivery, security and serverless functions;
- Hostinger for domain-registration or DNS services;
- Stancer for hosted payment processing, payer confirmation and transaction records;
- Resend for transactional intake and confirmation emails; and
- Google Ads for optional campaign measurement, only after consent.
Some providers may process data outside the European Economic Area. Where required, transfers rely on an adequacy decision, standard contractual clauses or another lawful safeguard. Providers also process certain data under their own legal duties, especially for payments, fraud prevention and network security.
6. Retention
- Operational intake, working links and project copies: for active delivery and normally up to 90 days after final delivery, unless longer retention is needed for support, a dispute or your documented request.
- Contracts, invoices, transaction references and accounting evidence: for the periods required by French law, which can reach 10 years.
- Support messages: normally up to three years after the last substantive contact, longer only for a live dispute or legal requirement.
- Server and security logs: for the provider’s short operational/security window, subject to a longer period for an investigated incident.
- Consent choice: up to six months in your browser.
- Google measurement data: according to the configured Google account retention settings and applicable consent.
7. Who receives the data
Access is limited to NOVARIA personnel and processors who need the data to perform the service, operate the website, process payment, send transactional email, provide support or comply with law. We may disclose information to authorities, advisers or counterparties when legally required or necessary to establish, exercise or defend legal claims.
8. Your choices and rights
Subject to applicable law, you may ask for access, correction, deletion, restriction, portability or objection, and may withdraw consent at any time. Send your request to info@novaria-france.fr. We may request proportionate information to verify identity and authority.
You may also lodge a complaint with the French data-protection authority, the CNIL, or the competent supervisory authority where you live or work.
9. Security and responsibility for links
We use access controls, HTTPS, hosted card entry, data minimization and limited retention. No system is risk-free. You are responsible for configuring shared asset links so they expose only files needed for the order and for removing access when no longer required.
10. Marketing
Transactional messages about your order do not require marketing consent. We will not add the business contact to promotional email merely because they bought the pack. Any separate marketing choice is optional and can be withdrawn.
11. Changes
We may update this policy when providers, purposes or legal requirements change. The current version and effective date remain available on this page. Material changes affecting active customers will be communicated where required.