Controller and contact
Maarten Strootman operates NovaSEAN as a trade name of the Dutch sole proprietorship Straeder (KVK 42050491), at Karekietstraat 18, 1431 WP Aalsmeer, the Netherlands. He is the controller responsible for personal data used to deliver this website, manage Novasean's own client accounts and handle its own portfolio enquiries. Contact privacy@novasean.com or use the contact and rights routes below. Data processed on a hosting customer's behalf are covered by that customer's applicable agreement and fall outside this notice.
Information, purposes and legal bases
Our website receives your connection address, the page address you request and the technical request information needed to display the page. Operational, error and security logs may record the connection address, host, page address, time and details of a fault when an event occurs. We use this information to deliver, protect and diagnose the site. Our legal basis is our legitimate interest in providing a secure, reliable public website.
The portfolio form asks for four answers: the number of websites, the type of work they do, whether your agency has an application owner, and whether medical personal data are involved. It saves an eligible selection in this browser tab. When you choose Continue, our server checks whether the enquiry service is available, without sending your four answers in that check. If it is available, your answers are included in the web address of the separate client-portal review page. They may therefore appear in browser history and the portal's technical logs. An enquiry is created only when you submit it from that page while signed in. It is linked to your signed-in user and selected client account. The record contains your four answers, the version of the enquiry criteria, an identifier used to recognise repeat submissions, the time, reference, status, and any later replies or attachments. We use these records to respond to your request, show its status, prevent duplicate submissions and manage account permissions. Our legal basis is our legitimate interest in responding to business representatives. If you would personally enter into a contract with us, the legal basis may instead be taking steps towards that contract at your request. Submitting an enquiry does not order or reserve hosting.
Registering for the client portal separately collects the account and contact details shown in its form. When you actively accept the account and enquiry terms, the portal records the document version, a digital fingerprint of its exact text, the acceptance time, the linked user and client account, and whether that acceptance has been linked to the account. If registration is interrupted, a pending record with restricted access may remain while we check and reconcile it; that record does not mean the account is complete. We use these records to administer the account and establish which terms were accepted. Our legal basis is contractual necessity where you are the contracting individual, or our legitimate interest in reliable business-account administration. Legal obligations apply to records or responses where the law requires them. Accepting terms is not consent to marketing or to personal-data processing.
Automated category check
Fixed rules check whether your four answers meet the criteria for this enquiry form. They do not assess suitability or availability, set a price, order a service or make a legal or similarly significant decision. You do not have to submit an enquiry. You can contact us to discuss your requirements with a person, without sending medical personal data or secrets. The four-answer check does not forward your enquiry to an AI model.
Recipients and locations
The public website runs on Novasean-managed infrastructure at Worldstream in Naaldwijk, the Netherlands. The separate client portal runs on Novasean infrastructure at the same location and holds account and submitted enquiry records. Authorised Novasean operators can access the records needed for their duties. Cloudflare provides the DNS service that directs visitors to the website; requests for this public website go directly to Novasean's server, without passing through Cloudflare's web proxy. This description does not cover any separate Cloudflare role for the client portal or other services. WHMCS provides the installed account software. Using that software does not, by itself, mean its vendor receives enquiry contents.
The client-portal server is included in scheduled backups using HostDZire's service, identified as Montreal/Leaseweb in Canada. These copies may contain account records and, once included in a completed backup, enquiry records. This describes the backup service and country. It does not guarantee that every record has a usable backup or that all access takes place within the EU. This information also does not establish the identity of any separate recipient in a third country or the legal mechanism for transferring data to that recipient. See the recipient information and data-location statement.
Retention
Your eligible, unsubmitted answers stay in this tab's session storage until you choose Reset, clear browser data or end the tab session. Clearing them does not delete a submitted enquiry. New portfolio enquiries are scheduled for a deletion review 90 days after an authorised operator closes them. After checking a ticket, an authorised operator can remove the ticket, its replies and the four answers if there are no attachments or active retention holds. Tickets or replies with attachments need a separate deletion process, with checks on what is removed, before disposal can be completed. If the closure date is unreliable, or there is a justified legal or dispute hold, deletion waits for review. Deletion is not automatic on day 90. We also review whether an enquiry still open after 90 days remains needed. These rules do not apply to existing client accounts or unrelated support records.
We keep the record of your acceptance of the account terms for the relevant account relationship. If the account is explicitly closed or the linked account is lost, we review whether we still need that record, including for a legal claim. Inactivity alone does not mean an account is closed. Pending acceptance records have restricted access and are removed after reconciliation when no valid need remains. We keep legal and privacy requests for as long as needed to answer them and, where justified, to demonstrate how they were handled or address a related legal claim.
The website server's persistent system journal, a technical log, is configured for a maximum retention of 30 days and a size cap of 256 MiB. Its local system and authentication log files are configured for daily rotation, up to 30 rotations, a maximum age of 30 days checked at each rotation, and compression. These settings do not guarantee that every log entry or other copy is deleted exactly after 30 days. We review exceptional security or legal holds separately. Client-portal records and technical logs have their own applicable retention arrangements. Older backups may retain data after the active record has been deleted. Restricted records of completed deletions help us repeat those deletions after a restoration.
Your rights
You may request access to your personal data, correction, erasure, restriction of processing, or portability where applicable. You may also object to processing. We may ask for proportionate information to confirm your identity. Email privacy@novasean.com, use the legal-request form, or write to our registered address. You may complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens. If your request concerns a website hosted for another organisation, contact that organisation as controller; we assist our customer under its applicable processing arrangement.
Version
First issued 30 September 2026 · Wording updated 4 October 2026 · Version website-enquiry-2026-10-04-v6. Existing service agreements and mandatory rights remain unchanged.
Information you provide and exercising your rights
Creating an account is optional. The mandatory registration details identified in the portal form are required to establish and administer the account relationship. If you do not provide them, registration cannot be completed. This is an account-service requirement, not a general statutory obligation to open an account. Optional information should be limited to what your request needs.
Giving us an enquiry is optional. The four answers and the account details required by the portal are needed to use that enquiry route; if you do not provide them, you can use the general contact route instead. Optional replies and attachments should contain only what is needed for your request. We do not require medical personal data or passwords in an enquiry.
If someone else supplies your contact details in an account or legal report, the source may be their organisation, the reporting person or a public source they identify. We must provide the applicable information under Article 14 GDPR within the required period, normally no later than one month and, where earlier, at the first communication or disclosure, unless a lawful exception applies.
Legal notices, complaints and rights requests may contain contact details, service references, allegations and evidence supplied by the sender or affected parties. We use the necessary information to assess and answer the matter, comply with applicable legal duties, or pursue our legitimate interests in resolving service disputes and protecting rights. We must assess the appropriate basis for the particular use; sensitive data require an additional applicable condition. Necessary information may be shared with the affected party, advisers or competent authorities where lawful. We retain these records only for the handling and justified legal-claim or statutory-retention purposes described above.
You may object at any time to processing based on legitimate interests, on grounds relating to your situation. We must stop that processing unless a lawful overriding ground or legal-claim exception applies. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. Acceptance of account terms is not consent to marketing.
We must respond to a GDPR rights request without undue delay and normally within one month. If complexity or the number of requests makes an extension necessary, we must tell you within that first month, explain why, and may extend by up to two further months. If we do not act, we must explain the reasons and complaint or court options within the applicable period. Requests are generally free; any statutory exception must be justified. You may complain to a competent supervisory authority, including where you habitually live or work or where an alleged infringement occurred.
The Canadian backup disclosure does not yet identify a verified transfer mechanism for the actual recipient. We cannot represent that transfer information as complete. You can request recipient and safeguard information, including how to obtain a copy where Article 13 or 14 requires it, at privacy@novasean.com.
Optional website analytics
Our legal basis for optional Google Analytics measurement is your consent. After acceptance of the extended website and checkout choice, we use public page visits, navigation and contact clicks, portal and cart handoff clicks, enquiry handoff attempts, search-use events, reading depth, checkout starts, native orders submitted and first order invoices paid to understand our website and sales journey. Analytics covers visitors who accept; it is not a count of every visitor. You can withdraw in one click using Withdraw analytics consent, without affecting earlier lawful processing or website access.
Google receives reviewed public page addresses and titles, fixed interaction classifications, cookie-based browser and session identifiers and technical browser information. Its network connection receives your connection address; Google states that GA4 does not log or store IP addresses. We remove query values and fragments before loading the tag, suppress the referring-page address and pass only reviewed campaign labels. We do not send search terms, form answers, names, email addresses, client-portal account/order/invoice/service references or a customer User-ID. Advertising personalisation, Google signals, automatic cross-domain linker decoration and automatic form measurement are disabled.
Google Analytics is provided through Google Ireland Limited and Google LLC, and may involve processing outside the EEA, including the United States. Google publishes its subprocessors, processing terms and international-transfer arrangements and contractual safeguards. You can request applicable safeguard information at privacy@novasean.com. We have disabled the account options for Google product and service improvement, contributions to modelling and business insights, technical support access and business recommendations.
User and event data retention is set to two months, without resetting on new activity. Standard aggregated reports are not governed by that setting and can remain longer. Your consent preference and analytics cookies have a configured maximum of 180 days. Withdrawal stops future collection and does not delete previously collected data. Use the rights and contact routes in this statement for applicable access or erasure requests. See the cookie notice for storage details.
Optional analytics section issued 13 October 2026 · Version website-checkout-analytics-2026-10-13-v3.
For consented new orders, WHMCS keeps a private consent record and sends fixed order-submission and paid-purchase events to Google from the server. Google receives the consented browser identifier and, when applicable, the checkout session identifier, an opaque transaction reference, currency, the initial invoice value excluding VAT, tax and a generic order item. It does not receive the native order, invoice or client reference, customer details, domains, free-text order fields or payment credentials. A unique native event record prevents duplicate local queuing. A stable keyed transaction reference is used by GA4 to deduplicate repeated purchase transmissions. Historical orders, recurring renewal invoices and identified synthetic clients are excluded. A new cart checkout order may include renewals.
Our server records a hash of the random withdrawal capability, consent expiry and the order link needed for this measurement. Revocation cancels unsent events and removes the stored GA identifiers and order attribution links. Expired identifiers are purged by the sender. Minimal deduplication and withdrawal tombstones are retained for the fixed consent period and a further seven days to prevent replay. A disconnected browser cannot confirm server withdrawal until its cancellation reaches us; browser collection stops immediately and cancellation is retried. Previously transmitted events remain subject to the rights routes below.