Sign in Get in touch
Legal

Privacy policy.

How we handle personal data from website visits, business discussions and client work, including the different responsibilities we have in each.

Last updated: October 16, 2026

The short version

  • We keep business contact details, correspondence and project records to discuss and deliver our work. This includes discussions that do not lead to a contract.
  • Personal data we handle on a client's instructions has a separate role and requires appropriate data processing terms. This can include access to systems hosted in the client's own cloud account.
  • Our business tools include email, Microsoft OneDrive, Slack, Odoo and Notion. We explain their uses below.
  • We use Plausible Analytics for cookieless website statistics.
  • We don't sell your data, don't share it with advertisers, and don't run third-party trackers on this site.
  • We're based in Antwerp, Belgium, and operate under the EU's GDPR.

Who we are

This privacy policy applies to the website at cloudnovi.com, our business discussions, and the services we provide under the Cloudnovi name. For website enquiries and our own business relationship records, the data controller is:

Cloudnovi BV
Kernenergiestraat 19
2610 Antwerpen, Belgium (visits by appointment only)
VAT BE0727 732 404
info@cloudnovi.com

A controller decides why and how personal data is processed. For personal data we process on a client's instructions, our role may instead be processor or sub-processor. See personal data in client systems.

Scope and sister brands

This policy covers cloudnovi.com and the services we sell under the Cloudnovi brand only. Cloudnovi BV also operates KGB Hosting (kgb-hosting.com), which serves a broader audience, including consumers, and may collect different data for different reasons.

KGB Hosting publishes its own privacy policy on its own website. If you signed up there, that policy is the one that applies to you, not this one. Statements like "we sell B2B services only" or "we don't process consumer data" in this document apply to Cloudnovi specifically, not to the wider group.

What we collect

The information depends on how you interact with us:

  1. Website visits. Pages viewed, referral source, approximate location and device information for usage statistics. Our website security provider also handles technical request information, including IP addresses, to deliver and protect the site.
  2. Enquiries and assessments. The information you submit, such as your name, work email, company, role and message. An assessment may also include information about your infrastructure, devices, budget or project requirements.
  3. Business discussions and engagements. Contact details, agreements, billing records and correspondence, together with project information relevant to the work. The next sections distinguish business records, project material and personal data handled on a client's instructions.

Please limit what you share to what we need for the discussion or task. Before sharing special-category data, such as health or biometric information, we must agree the purpose, legal requirements and safeguards with you.

Why we collect it

For personal data where Cloudnovi acts as controller, the legal basis depends on the purpose under GDPR Article 6:

  • Business enquiries, contact details and project coordination: our legitimate interests in answering enquiries, assessing possible work, communicating with the people involved and managing business relationships (Article 6(1)(f)). This includes contact details of a company's staff and contractors. We must limit this processing to what is necessary and balance those interests against the individual's rights.
  • A contract with you as an individual: performance of that contract, or steps you request before entering into it, where the processing is necessary for that purpose (Article 6(1)(b)).
  • Invoices and statutory records: compliance with applicable Belgian tax and accounting obligations (Article 6(1)(c)).
  • Website operation and security: our legitimate interests in delivering, protecting and improving the site (Article 6(1)(f)).

For personal data processed on a client's instructions, the controller is responsible for identifying the legal basis. Our processing must follow the agreed instructions and data processing terms.

Website analytics

We use Plausible Analytics to understand website usage. Plausible:

  • Does not use cookies and does not store anything in your browser.
  • Uses request information, including IP address and browser information, to derive statistics and a daily visitor identifier. Its documented approach does not store raw IP addresses or raw user-agent strings.
  • Does not track you across other websites.
  • Shows aggregate statistics such as page views, referral sources and device types. Cookieless analytics can still involve event and session records.

We serve the script through our own subpath (/p/js/...) and forward analytics events to our statistics service. The analytics request includes your IP address for processing. See our cookie policy for information about browser storage and website security cookies.

Contact form

Our contact and assessment forms use Cloudflare Turnstile to check for automated submissions. The website forwards the submitted enquiry to an internal Slack channel so we can respond. Business records and correspondence relating to the enquiry may also be kept in the tools described under tools and other recipients.

Cloudflare may briefly process your IP address and a Turnstile challenge token to determine whether the request looks human. Cloudflare acts as a processor and does not use this data for advertising. Their privacy notice: cloudflare.com/privacypolicy.

Business contacts and records

Cloudnovi acts as controller for its own business relationship records. This includes enquiries, introductions, project discussions and proposals, even if we never sign a service contract.

The people involved may be prospective or existing clients, suppliers, partners, or their employees and contractors. Depending on the relationship, the records may include:

  • Names, job titles, work email addresses, business telephone numbers and company details.
  • Email correspondence, meeting participants, written meeting notes, decisions and agreed actions.
  • Proposals, signed agreements, signatures, billing contacts, invoices and payment records.

We receive this information from you or from the organisation or colleague who involves you in the discussion. We use it to evaluate work, coordinate the people involved, administer the engagement and meet our legal obligations.

Project information and confidentiality

A discussion or engagement may involve requirements, use-case descriptions, project plans, architecture diagrams, system inventories, technical documentation, screenshots and support tickets. These materials can include personal data, such as a named system owner, an account identifier or an email address visible in a screenshot.

We use the information relevant to the agreed discussion or work. For example, we may record a project contact in Odoo, keep a shared document in OneDrive, discuss an action in Slack, or keep project notes in Notion. Which material we keep depends on the engagement and its confidentiality requirements.

Receiving a copy of a document or access to a system does not transfer ownership to Cloudnovi or give us permission to use it for unrelated purposes. Confidentiality agreements and engagement terms govern permitted use, disclosure, and return or deletion of project material, including information that is not personal data.

For personal data we handle on the client's behalf, the separate responsibilities below apply. The location of a document alone does not determine our role.

Personal data in client systems

Cloudnovi acts as processor when it handles personal data on a client's documented instructions. We may act as sub-processor if the client is itself a processor for another organisation.

This can arise during infrastructure administration, troubleshooting, security work or support. Depending on the agreed scope, we may access staff or customer account details, usernames, IP addresses, device identifiers, logs, support records, backups or data exports.

The data may remain in the client's environment, including a cloud account the client controls. Viewing, querying or managing that data can still count as processing, even if we do not host it or keep a copy in our own business tools.

Before that processing begins, the engagement must have appropriate binding data processing terms under GDPR Article 28. These must cover the purpose and duration, categories of data and people, instructions, access and security, authorised sub-processors, breach reporting, assistance with individuals' rights and other controller obligations, compliance information and audits, and return or deletion. A privacy notice or confidentiality agreement alone does not replace those terms.

Any use of our business tools for this client data must follow the client's instructions and the agreed sub-processing arrangements. Requests about data in a client's systems should go to the relevant controller; we assist under the agreed processing terms.

Tools and other recipients

We do not sell personal data or share it with advertisers. We use the following tools for business communications, records and project work, according to the purpose and the engagement:

  • Email: enquiries, introductions, correspondence and exchanged documents.
  • Microsoft OneDrive: document storage and file sharing.
  • Slack: internal coordination and website enquiry notifications.
  • Odoo: business relationship, customer and billing records.
  • Notion: project notes, documentation and coordination.

Our website also uses Cloudflare for request handling and bot protection, and Plausible for usage statistics. Providers processing personal data on our behalf must be covered by appropriate data processing terms. Using a tool for our own business records does not authorise its use for every client's operational data.

We may also disclose relevant records to our accountant, bank, professional advisers or public authorities where necessary for accounting, payments, legal advice or a legal obligation. Their role depends on the service; some act as independent controllers.

Providers may process data outside the EU/EEA, depending on the service and account configuration. Where this happens, the transfer must have a valid GDPR mechanism, such as an applicable adequacy decision or Standard Contractual Clauses with any additional safeguards required. Contact us for information about the recipients and transfer safeguards relevant to your data, including a copy of the applicable safeguards.

How long we keep it

  • Enquiries, business contacts and correspondence: for as long as needed to respond, assess the proposed work and manage the business relationship. After discussions or an engagement end, further retention must be necessary for a legal obligation or the establishment, exercise or defence of legal claims.
  • Project documents and working copies: for the agreed purpose and subject to the engagement's confidentiality, return and deletion requirements.
  • Invoices and statutory records: for the retention periods required by the applicable Belgian tax and accounting rules.
  • Personal data processed on a client's instructions: according to the agreed processing terms and the client's instructions, including arrangements for backups and return or deletion.
  • Website statistics: aggregate reports may be kept to compare usage over time. Technical data and any underlying event records must be limited to what is necessary for analytics or security.

We must delete or anonymise personal data once its purpose and any applicable retention requirement have ended. Archiving a record is still storage and remains subject to these requirements.

Your rights

Depending on the processing and legal basis, GDPR gives you the right to:

  • Access the personal data we hold about you.
  • Have it corrected if it's wrong.
  • Have it deleted, where we don't have a legal obligation to keep it.
  • Restrict or object to certain processing.
  • Receive your data in a portable format.
  • Withdraw any consent you previously gave.
  • Lodge a complaint with the Belgian Data Protection Authority (dataprotectionauthority.be).

Email info@cloudnovi.com. We respond without undue delay and within one month. If GDPR permits an extension for a complex request, we explain the reason and additional time within that first month. We do not charge for routine requests.

For data we process on a client's instructions, we pass relevant requests to the controller and assist with its response.

Security

Security measures must reflect the sensitivity of the information and the risks of the work. This includes limiting access to the people who need it and protecting information during transmission and storage. For work in client systems, permissions and security responsibilities must follow the agreed scope and processing terms.

For a personal data breach affecting data where we act as controller, we notify the competent supervisory authority where required, without undue delay and, where feasible, within 72 hours of becoming aware of it. We inform affected people when required. Where we act as processor, we notify the controller without undue delay and assist with its response.

Children

Cloudnovi provides business infrastructure and DevOps services. Our website and business enquiries are not aimed at children. Any personal data concerning children in a client's systems requires appropriate instructions and safeguards under that engagement. Our sister brands have their own policies.

Changes

If we update this policy materially, we'll change the "last updated" date at the top and, if it affects existing customers, notify them by email. Past versions are available on request.

How to reach us

For anything privacy-related, including questions, requests, or complaints, write to info@cloudnovi.com with "Privacy" in the subject line. A real engineer reads it.