Privacy policy and DPA

Our full privacy policy and data-processing-agreement (DPA) information live on their own page, linked from the login screen.

Data protection questions — including requesting a signed DPA — go to the data protection contact point listed in the privacy policy. Novro has not appointed a Data Protection Officer under GDPR Article 37; this is a contact point, not a registered DPO.

The same page holds the subprocessor list and the retention policy. In short: data is stored in Google Cloud (database and server logic in the EU), email is sent through Brevo, AI features use Google Gemini (a global service, only when AI is switched on), and Google reCAPTCHA protects against automated abuse. Each AI area can be switched off for the organization. The list is updated whenever a provider is added or removed.

The first time you arrive on a Novro page, a notice about cookies and storage is shown, and you accept it before continuing. Novro has no cookies for analytics, tracking or marketing, so there is only one button. The notice is shown again if the cookie policy changes. On the whistleblowing pages and the survey page nothing that can identify you is stored, only that the notice was answered, and only until the tab closes. On a survey kiosk the notice is answered once for the device. The full list is under Cookie Policy on the privacy page.