Privacy policy

1. Data controller

The data controller within the meaning of the EU General Data Protection Regulation (GDPR) and its UK counterpart (UK GDPR) is the brand INNOVA Consulting Group (“INNOVA”, “we”, “us”). Services are delivered through a network of affiliated legal entities in different jurisdictions. The specific legal entity acting as controller for your enquiry, its registration details and legal address are stated in the contract and provided on request — write to us at the address below and we will identify the controller relevant to your jurisdiction.

For all questions about personal data processing and the exercise of your rights, contact privacy@innovacg.com.

2. What data we collect

We collect the minimum data needed to respond to your enquiry and keep the site secure:

• Enquiry form data — name, email address and message text that you voluntarily provide when submitting the “Discuss a project” form or a consultation request.
• Technical data — IP address and browser User-Agent string. These are processed by our enquiries API for rate-limiting, spam protection and abuse prevention.
• Analytics data — anonymised visit statistics via Google Analytics 4. Analytics cookies are set only after your explicit consent in the cookie banner; until consent is given, analytics is not loaded.

We do not collect special-category data and do not use data for ad targeting or selling to third parties.

3. Legal bases for processing

• Consent (Art. 6(1)(a) GDPR) — for analytics cookies (Google Analytics). You may withdraw consent at any time.
• Pre-contractual steps (Art. 6(1)(b) GDPR) — for processing enquiry form data in order to respond to your request and prepare possible cooperation.
• Legitimate interest (Art. 6(1)(f) GDPR) — for processing IP address and User-Agent for security, protection and abuse prevention.

4. Processors and data transfers

We use a limited set of processors acting on our instructions and under appropriate data processing agreements:

• Resend — email delivery of notifications about your enquiries.
• Postgres / Payload CMS — storage of enquiry content in our database.
• Google Analytics — anonymised web analytics (only with consent).

Some processors may be located outside the EEA / UK. In such cases, transfers are made on the basis of appropriate safeguards (for example, Standard Contractual Clauses).

5. Retention periods

Enquiry data is retained for as long as necessary to process the request and related business correspondence, after which it is deleted or anonymised. Technical logs for security and rate-limiting are retained for a limited time and then deleted. Analytics data is retained according to the Google Analytics retention settings. Specific periods can be confirmed on request at privacy@innovacg.com.

6. Your rights

As a data subject under GDPR / UK GDPR you have the right to:

• access your personal data;
• rectification of inaccurate data;
• erasure of data (the “right to be forgotten”);
• restriction of processing;
• data portability;
• objection to processing based on legitimate interest;
• withdraw consent at any time (for processing based on consent).

To exercise any of these rights, write to privacy@innovacg.com. You also have the right to lodge a complaint with the data protection supervisory authority in your jurisdiction.

7. Cookies

Strictly necessary cookies enable basic site operation. Analytics cookies (Google Analytics) are set only after your consent in the cookie banner. You can withdraw consent by clearing the site’s cookies in your browser settings; the banner will reappear on your next visit.

8. Changes to this policy

We may update this policy from time to time to reflect changes in our data practices or in the law. The current version is always available on this page.