This Privacy Policy explains how ESS ENN Associates, trading under the brand NUVZ (“NUVZ”, “we”, “us”), collects and uses personal data when you visit nuvz.xyz (the “Site”), contact us or book a call. We respect your privacy and process personal data in line with the EU General Data Protection Regulation (GDPR), the UK GDPR and the Data Protection Act 2018, and other applicable data-protection laws.
1. Who is responsible for your data
The data controller is ESS ENN Associates. To exercise your rights or ask a question about privacy, please use the contact form (choose “Something else” and start your message with “Privacy request”) or call us:
- USA: +1 661 727 3766
- UK: +44 208 144 0337
- India: +91 97817 16363
2. What data we collect
- Enquiry data you submit through our forms: name, work email, optional phone and company, the topic you select, your message, the page you sent it from, and a record of your consent (tick-box value and timestamp).
- Booking data if you schedule a call through our scheduling provider (Cal.com): name, email, chosen time and any notes you add.
- Analytics data — only if you opt in — collected by Google Analytics 4: pages viewed, approximate location (country/city), device and browser type, referral source and interactions, using pseudonymous identifiers and IP anonymisation.
- Technical data processed by our web host to deliver the Site securely (e.g. IP address and request logs), kept for a short period for security purposes.
We do not intentionally collect special-category data. Please do not include sensitive personal data in your messages.
3. Why we use your data and our legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Responding to your enquiry and arranging consultations | Consent (Art. 6(1)(a)), given via the form tick-box; and steps prior to entering a contract (Art. 6(1)(b)) |
| Website analytics to improve content | Consent (Art. 6(1)(a)) via our cookie banner — off by default |
| Keeping the Site secure and preventing spam or abuse | Legitimate interests (Art. 6(1)(f)) |
| Meeting legal, tax and accounting obligations if we enter into a contract | Legal obligation (Art. 6(1)(c)) |
We do not sell personal data, and we do not use it for automated decision-making or profiling that produces legal effects.
4. Who we share data with
- Formspree, Inc. (USA) — receives and forwards form submissions to us.
- Google Ireland Ltd / Google LLC — Google Analytics 4, only if you consent.
- Cal.com, Inc. — scheduling, only if you book a call.
- Our hosting provider — to serve the Site.
- Our own staff and group teams in the USA, UK and India who need the data to respond to you, bound by confidentiality.
Some of these recipients are located outside the UK/EEA. Where data is transferred internationally we rely on adequacy decisions (including the EU–US Data Privacy Framework where the recipient is certified) or Standard Contractual Clauses, together with supplementary measures where needed.
5. How long we keep data
- Enquiries that do not lead to a contract: up to 24 months after our last contact, then deleted or anonymised.
- Client records: for the duration of the relationship and as required by law afterwards (typically 6–8 years for financial records).
- Analytics data: Google Analytics retention is set to 14 months.
- Your cookie choice: stored in your browser until you clear it or change it.
6. Your rights
Subject to applicable law you have the right to: access your data; rectify inaccurate data; erase your data; restrict or object to processing; data portability; and withdraw consent at any time (without affecting processing carried out before withdrawal). You can withdraw analytics consent instantly via “Cookie settings” in the footer. To exercise other rights, contact us as described in section 1. We will respond within one month.
You also have the right to lodge a complaint with a supervisory authority — for example the authority in your EU member state of residence, or the Information Commissioner’s Office (ICO) in the UK.
7. Security
We use HTTPS throughout the Site, restrict access to enquiry data to people who need it, and apply the same security discipline we use for client tokenization platforms. As a principle we never write personal data to public blockchains.
8. Children
The Site is intended for business users and is not directed at children under 16. We do not knowingly collect their data.
9. Changes to this policy
We may update this policy from time to time. The “last updated” date at the top shows when it was last changed. Material changes will be highlighted on the Site.