NOVACODE / INFORMATION
Privacy and cookies
This notice explains how novaCode handles information when you visit our website, contact us or use the client portal.
Who to contact
novaCode is responsible for the processing described here. Contact kontakt@novacode.no with privacy questions or requests. novaCode is operated by WALDE ONLINE TJENESTER, organisation no. 931 630 334.
Enquiries
We receive your name, email and message, and your phone number, company, service choices and attachments if you provide them. Required fields are marked. We use this information to respond, understand your needs and follow up a possible project. Without the required contact information we cannot process the form.
Where you request steps towards a contract with you, the basis is GDPR Article 6(1)(b). For business representatives and other enquiries, it is our legitimate interest in responding to relevant contact and managing client relationships, Article 6(1)(f).
Client portal
We store account and contact details, access permissions, project content, messages, files, tasks and approvals. Approvals record the content version, user and time. Access is restricted by role and project; clients see only content shared with them. Processing supports service delivery and collaboration, based on contract where the individual is the contracting party, otherwise legitimate interests in managing project contacts. Legally required records are retained on the basis of a legal obligation. We do not make automated decisions or use profiling with legal effects.
Security
The server receives technical information such as IP addresses with requests. Security controls limit abuse of forms, login and statistics. Security and access logs support our legitimate interest in protecting the service. IP addresses do not appear in visitor reports.
Optional statistics
Only after you choose “Allow statistics” do we send page views, viewed sections, language, screen category and search topics to our own statistics service. We do not store raw search text, names, visitor identifiers or individual visitor profiles in these statistics. Searches are counted as a topic or “No results”. Search works without consent.
You can withdraw consent through “Statistics preferences” in the footer. New collection then stops. Global Privacy Control is respected. Existing aggregated daily counts cannot be linked back to you or separated out as your data. Statistics older than 90 days are removed on the next collection or report access. A daily changing, hashed abuse-prevention key is separate from the statistics; its rate-limit records are cleaned after 24 hours during further collection.
Cookies and local storage
| Name | Purpose | Duration |
|---|---|---|
| nc_statistics | Remembers allow/deny. Contains no visitor ID. | 180 days |
| novacode_form | Necessary session protecting form submission. | Browser session |
| novacode_workspace | Necessary login and security session. | Browser session; access also ends on logout |
| nc-timer-[user ID] | Local storage for a work timer the signed-in user starts: title, project and start time. | Until recorded or local storage is cleared |
| nc-intro | Session storage remembering that the hero introduction has played. No visitor identifier. | Current tab session |
| nc-accent | Session storage remembering the colour you select by clicking the glass. | Current tab session |
Necessary storage supports requested functions, not advertising. Session restoration may retain session cookies longer. Clearing browser storage may sign you out or remove an active timer. Images, fonts and animation files are hosted on the website. We do not use third-party advertising pixels.
Recipients and hosting
Enquiries and attachments are stored in novaCode’s private workspace. The form also attempts to send an email notification to kontakt@novacode.no. Authorised staff and necessary hosting and email providers handle data for the purposes above. Processors: Vercel (website and server functions, in Ireland), Supabase (database and attachment storage, in Ireland) and Resend (sending the email notification). The companies are headquartered in the USA. Any transfer outside the EEA follows the providers’ data processing agreements using the EU Standard Contractual Clauses or the EU–US Data Privacy Framework. Private attachments are not published on the website and information is not sold.
Retention
Enquiries are kept as needed for follow-up. Project and agreement records are kept as needed for delivery, subsequent support, legal duties or documented claims. Information should be deleted or anonymised when no longer needed. Accounts are disabled when access is no longer required; disabling is not deletion. Hosting log and backup retention must be agreed before launch. This website does not automatically delete all client and project records.
Your rights
You can request access and correction, and, where applicable, deletion, restriction or a portable copy. You can object to processing based on legitimate interests and withdraw consent without affecting earlier lawful processing. Contact kontakt@novacode.no; we may need information to verify your identity. You can complain to the Norwegian Data Protection Authority.
Draft updated 27.09.2026