Trust
Trust and data handling
Who operates this website, what happens to an enquiry, who handles data on our behalf, how long we keep it, and how to report a security problem.
Who we are
BlueNova IT is the IT-services brand of BlueNova OÜ, a private limited company (osaühing) registered in the Estonian commercial register under code 17193730, VAT number EE102849745, Narva mnt 5, 10117 Tallinn, Estonia.
These details are the same as in the legal notice. Business enquiries go through the contact form, which is the only business contact channel of this website.
What happens to your enquiry
- You open the contact page. A security check from Cloudflare (Turnstile) starts loading as the page opens; it receives your IP address and browser signals, not the text you type.
- You send the form. The website server checks it, including a check of the security token with Cloudflare (which receives your IP address for that purpose), and does not keep a copy of the enquiry itself.
- The enquiry passes to our enquiry intake and queue system, which stores it so that it can be delivered reliably, even if our CRM is temporarily unavailable.
- The queue system delivers it as a lead to our Odoo CRM, where we handle it.
We do not sell personal data. The form fields, the legal bases and your rights are described in the privacy notice.
Enquiries are not processed by AI tools.
What this website does not do
- It sets no cookies.
- Optional analytics and campaign tracking are switched off. Visit statistics are anonymous daily page counts computed from our own server log.
- Apart from the security check on the contact page, its pages load nothing from third-party servers.
- It stores in your browser only what the contact form and the security check need; the details are in the cookie and storage notice.
Who handles data on our behalf
These parties receive personal data from the contact form in order to provide a service to us.
| Role | Provider or system | What it receives | Location |
|---|---|---|---|
| Security check on the contact form | Cloudflare, Inc. (Turnstile) | Your IP address and browser signals when the contact page loads; your IP address and the check token when the form is sent; not the text of your message | United States |
| Enquiry intake and queue | NitrOdoo | The enquiry as sent through the form | Same server as this website |
| CRM | Odoo S.A. | The enquiry, delivered as a lead (Odoo SaaS service) | European Union region |
Our hosting provider (the server on which this website and our enquiry intake run) also processes enquiries for us, as the privacy notice states.
How long we keep data
| Data | Retention |
|---|---|
| Enquiries that do not become an engagement | Deleted or anonymised no later than about 12 months after we last handled the enquiry; reviewed quarterly |
| Enquiries that become an engagement | Kept as needed to handle the engagement and the related records |
| Record that you confirmed the privacy notice | Kept with your enquiry (date and time, notice version, language and reference) |
| Encrypted backups of the enquiry system | Kept on a rotation cycle of about 14 days; a small number of the most recent encrypted copies is also stored with a cloud storage provider |
| Web server access log | Not kept for a fixed number of days. It is written to size-limited files (about 30 MB in total) and older entries are overwritten as new ones arrive. It holds a shortened IP address, the time, the page requested and the response status. The TLS proxy in front of the web server keeps no access log of its own. |
| Application log of submission outcomes | Same size-based rotation. It never contains your message, your IP address or the security token |
| Anonymous daily page counts | Kept. They contain no address and no visitor identifier |
| Your IP address in the website application | Held in memory for a short time to limit repeated submissions; not written to a database |
| Turnstile data at Cloudflare | Handled by Cloudflare under its own terms |
Privacy contact
For privacy questions, to exercise your rights, or to report a problem with how your data is handled, use the contact form or the contact details in the privacy notice. Those details are for privacy matters, for legal or regulatory communications, and for accessibility barriers that stop you using the contact form.
You may also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or to the data protection authority of the country where you live or work.
Working with client systems
This page is about this website. For client work, the principles on our About page apply:
- The scope is agreed upfront, before work begins.
- Access and accounts stay with your organisation.
- Responsibilities are set out in writing, not assumed.
- We review the arrangement with you regularly, so the scope can change as your business does.
We do not assume response times, coverage or availability: any service commitments are agreed in writing for your organisation.
What we do not claim
- BlueNova IT does not certify or guarantee anyone’s compliance with a regulation or standard. The guides on this site are general information, not legal advice.
- We do not describe BlueNova IT as certified, accredited or award-winning on this website, and we publish no uptime or availability figures or service levels. There is no public status page.
- BlueNova IT does not hold ISO 27001 or similar certifications.
Reporting a security problem
If you think you have found a security problem in this website, please tell us.
How to report. Use the contact form and start the subject line or the first line of your message with “Security report”. Give a work email address we can reply to; the form asks for one. Reports can be written in English or Spanish.
Scope. This website, www.bluenovait.com. Other systems, including third-party services such as Cloudflare, are out of scope: please report problems in those to their operators.
What to include.
- the address of the page or endpoint concerned;
- what you observed and what you expected;
- the steps to reproduce it, with any tools or settings you used;
- the impact as you understand it;
- how we can contact you.
Please. If you test, keep it to this website. Do not access, change or delete data that is not yours; stop and tell us if you come across personal data; do not disrupt the service. Do not include credentials or personal data in your report. Give us reasonable time to look into the problem before you share details publicly.
What happens next. We read the report and may ask you for more detail. If we can confirm the problem, we may work on a fix. We do not publish response times and we do not offer rewards. This policy describes how we handle reports; it is not a legal authorisation or protection to test.
Our security.txt file lists the contact form for security reports.
Related pages
Last updated: 12 October 2026.