Privacy policy.

1. Data Controller

The Data Controller is NOVAPOWER SPA, VAT no. 03109150809, registered office at Via Leone Tolstoi 1, 20146 Milan (MI), Italy. Data protection enquiries may be sent to info@novapowerspa.com.

2. Categories of data processed

Browsing data

The systems and technical procedures that make the website available may collect information such as IP address, browser and device type, requested pages, date and time, response codes and similar technical data. Such information is normally processed in aggregate form or for the time necessary to ensure service operation, integrity and security.

Data provided by the user

Sending an email or initiating a telephone conversation involves processing the contact details used and the information included in the communication. Users are invited not to send unnecessary data, particularly special-category data, unless strictly necessary and agreed in advance.

Client, supplier and partner data

Where a contact develops into a pre-contractual or contractual relationship, identification, professional, administrative, accounting and technical data may be processed as required to assess and manage that relationship.

3. Purposes and legal bases

Providing data through email or telephone is voluntary. Failure to provide information that is necessary to process a request may make it impossible to respond.

4. Processing methods

Data is processed through digital and, where necessary, paper-based tools in accordance with the principles of lawfulness, fairness, transparency, minimisation, accuracy, storage limitation and integrity. NOVAPOWER adopts organisational and technical measures proportionate to the nature of the data and the risks involved.

No decisions are made solely through automated processing that produce legal or similarly significant effects on the data subject.

5. Recipients and authorised persons

Data may be processed by authorised staff and collaborators and by service providers supporting IT, hosting, communication, consulting, administration and professional activities. Where required, such providers act as processors under Article 28 GDPR.

Data may also be disclosed to public authorities or other parties where required by law or necessary to protect a right. Personal data is not disseminated.

6. Transfers outside the EEA

Some digital service providers may process technical information outside the European Economic Area. Where this occurs, the Controller relies on a GDPR-compliant transfer mechanism, such as an adequacy decision, Standard Contractual Clauses or other applicable safeguards. Further information may be requested from the Controller.

7. Retention periods

• Technical browsing data is retained only for the time required for security, diagnostics and operation, unless needed to investigate unlawful conduct.
• Information requests are retained for the time required to respond and manage potential developments, normally no longer than 24 months where no subsequent relationship is established.
• Pre-contractual and contractual data is retained for the relationship and thereafter for the periods required by civil, tax and accounting law or to protect legal rights.

8. Data subject rights

Where applicable, data subjects may request access, rectification, erasure, restriction, portability and objection to processing based on legitimate interests, and may withdraw consent where processing is based on consent. Withdrawal does not affect the lawfulness of previous processing.

Requests may be sent to info@novapowerspa.com. The Controller may request information reasonably necessary to verify the identity of the applicant.

Data subjects may also lodge a complaint with the Italian Data Protection Authority or another competent supervisory authority.

9. Security and external links

The website may contain links to third-party services, including maps, mail clients and institutional websites. When a user follows an external link, the relevant provider processes data under its own privacy notice. NOVAPOWER does not control third-party processing practices.

10. Children

This is a corporate website and is not specifically directed at children. Parents and guardians are encouraged to supervise children’s use of digital services.

11. Notice updates

This notice may be updated to reflect regulatory, technical or organisational changes. The current version is published on this page together with the date of the latest update.