Privacy Policy

At NOVALYTE LABS, we are committed to protecting your personal data and respecting your privacy in accordance with the European Union General Data Protection Regulation (GDPR) and applicable national data protection legislation. This Privacy Policy explains how we collect, use, store, and protect your information when you visit our website or place an order.

Last updated: August 2026

1. Information We Collect

We collect information that you provide directly to us, as well as data generated automatically when you interact with our website. The categories of personal data we process include:

• Identity data: full name, company or institution name, job title or role.
• Contact data: email address, telephone number, billing address, and shipping address.
• Account data: username, password (stored in hashed form), account preferences, and communication settings.
• Transaction data: order history, payment method details (processed securely by our payment provider — we do not store full card numbers), invoices, and refund records.
• Technical data: IP address, browser type and version, operating system, device identifiers, time zone, and general geographic location derived from your IP address.
• Usage data: pages visited, links clicked, products viewed, session duration, referral source, and search queries entered on our site.
• Communication data: records of correspondence when you contact our support team, including emails, chat transcripts, and any attachments you provide.

2. How We Use Your Information

We process your personal data only when we have a lawful basis to do so under the GDPR. The purposes for which we use your data, and the corresponding legal bases, are as follows:

• Fulfilling orders and providing services (contractual necessity): processing and shipping your orders, managing your account, sending order confirmations and shipping updates, and handling returns or refunds.
• Customer support (contractual necessity and legitimate interest): responding to your inquiries, resolving disputes, and providing technical assistance.
• Improving our website and services (legitimate interest): analysing usage patterns to enhance site functionality, optimise product offerings, and improve the overall user experience.
• Marketing communications (consent): sending newsletters, product updates, and promotional offers. You may withdraw your consent at any time by clicking the unsubscribe link in any marketing email or by contacting us directly.
• Legal compliance (legal obligation): meeting our obligations under tax, accounting, anti-fraud, and other applicable laws.
• Security and fraud prevention (legitimate interest): protecting our website, systems, and users from fraudulent activity, unauthorised access, and other security threats.

3. Data Storage & Security

Your personal data is stored on secure servers located within the European Economic Area (EEA). We implement appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL protocols.
• Encryption of sensitive data at rest using industry-standard encryption algorithms.
• Regular security assessments and penetration testing of our systems.
• Strict access controls ensuring that only authorised personnel can access personal data, on a need-to-know basis.
• Regular backups and disaster recovery procedures to ensure data integrity and availability.

In the event that personal data is transferred outside the EEA, we ensure that adequate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission or an adequacy decision, to guarantee an equivalent level of protection.

4. Cookies

Our website uses cookies and similar tracking technologies to enhance your browsing experience and to collect analytical data. Cookies are small text files placed on your device when you visit our site. We use the following types of cookies:

• Strictly necessary cookies: essential for the website to function properly, including session management, shopping cart functionality, and security features. These cannot be disabled.
• Analytical cookies: help us understand how visitors interact with our site by collecting anonymous usage statistics. We use this data to improve our website performance and content.
• Functional cookies: remember your preferences such as language, region, and display settings to provide a more personalised experience.
• Marketing cookies: used to track visitors across websites and display relevant advertisements. These are only set with your explicit consent.

You can manage your cookie preferences at any time through our cookie consent banner or by adjusting your browser settings. Please note that disabling certain cookies may affect the functionality of our website.

5. Third-Party Services

We work with carefully selected third-party service providers who process personal data on our behalf. These providers are bound by data processing agreements that comply with GDPR requirements. Our third-party partners include:

• Payment processors: to securely handle payment transactions. Your payment data is processed directly by these providers and is not stored on our servers.
• Shipping and logistics providers: to fulfil and deliver your orders. We share only the information necessary for delivery (name, address, and contact number).
• Analytics providers: to collect and analyse anonymised usage data for website improvement purposes.
• Email service providers: to send transactional emails (order confirmations, shipping notifications) and, where you have consented, marketing communications.
• Cloud hosting providers: to host our website and store data securely within the EEA.

We do not sell, rent, or trade your personal data with third parties for their own marketing purposes.

6. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the following rights regarding your personal data:

• Right of access: you may request a copy of the personal data we hold about you.
• Right to rectification: you may request that we correct any inaccurate or incomplete personal data.
• Right to erasure: you may request that we delete your personal data, subject to certain legal exceptions (such as data required for tax compliance).
• Right to restriction of processing: you may request that we limit the processing of your data in certain circumstances.
• Right to data portability: you may request to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller.
• Right to object: you may object to the processing of your personal data based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: you have the right to lodge a complaint with your local data protection supervisory authority if you believe your rights have been violated.

To exercise any of these rights, please contact us at privacy@novalyte-labs.com. We will respond to your request within 30 days, as required by the GDPR.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our general retention periods are as follows:

• Account data: retained for the duration of your account and for up to 12 months after account closure, unless a longer retention period is required by law.
• Transaction and order data: retained for a minimum of 7 years to comply with tax and accounting obligations.
• Communication records: retained for up to 3 years after the last interaction, unless required for ongoing legal proceedings.
• Analytics data: anonymised and aggregated data may be retained indefinitely. Identifiable analytics data is deleted after 26 months.
• Marketing consent records: retained for the duration of your consent and for up to 3 years thereafter as proof of consent.

When personal data is no longer required, it is securely deleted or anonymised so that it can no longer be associated with you.

8. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:

• Company: NOVALYTE LABS
• Email: privacy@novalyte-labs.com

We take your privacy seriously and are committed to resolving any concerns promptly. If you are not satisfied with our response, you have the right to lodge a complaint with your national data protection supervisory authority.