Novacoast Global Privacy Policy

1. Who we are and what this statement covers

This statement explains how Novacoast, Inc. and its subsidiaries, including Novacoast Holding, Innovate Cybersecurity, ZuPam, Novacoast Ltd, and Novacoast EU Ltd ("Novacoast," "we," "us"), collect, use, and share personal data through novacoast.com and our business dealings with customers, prospects, partners, and website visitors.

It does not cover personal data we process on behalf of customers when delivering services. Our customer contracts govern that data, and the customer is the controller.

Job applicants and employees receive separate privacy notices.

Who is responsible for your data

Novacoast EU Ltd's lead supervisory authority is the Irish Data Protection Commission.

Where a contract or a product-specific notice says something different, that document controls for that product or service.

2. Personal data we collect

We collect business contact and relationship data, plus limited website data.

We do not intentionally collect sensitive personal data through the website. Please do not send it to us through web forms.

If you give us someone else's details (for example, a colleague to contact), you confirm you are allowed to do so.

3. How we use personal data

We use personal data only for the purposes below. The legal basis column applies to people in the UK and EEA.

Where we rely on legitimate interests, we have balanced our interests against yours. You can ask for details of that assessment.

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

4. Cookies and similar technologies

novacoast.com uses essential cookies to run the site and, only if you accept, Google Analytics cookies to measure visits and site usage. We do not use advertising or cross-site tracking cookies. Providers of embedded content you choose to load may set their own cookies, as described below.

Your choice. When you first visit, our banner lets you accept or reject analytics with equal ease. Analytics stays off unless you accept. We store your choice in your browser for six months, then ask again. You can change your choice at any time through Cookie settings, linked at the bottom of every page.

Global Privacy Control. Analytics stays off unless you accept it, and we do not sell or share personal data or use it for targeted advertising. For that reason, our site does not act on Global Privacy Control (GPC) signals.

Cookies we use

Cookies set by embedded content providers, such as YouTube, are set only after you allow that content and are described in the provider's own policy.

Google Analytics. Google processes analytics data for us as our service provider and data processor, under Google's data processing terms. Google may process this data in the United States (see section 7). We do not use Google Signals or advertising features. You can also install Google's opt-out browser add-on at tools.google.com/dlpage/gaoptout.

Embedded content. Our Video Library page shows YouTube videos. They do not load until you choose to allow them, so YouTube receives no data from you and cannot set cookies before then. Once you allow a video, YouTube receives your IP address and may set its own cookies. Google acts as an independent controller for YouTube content, and Google's privacy policy (policies.google.com/privacy) applies to it. Our contact, incident response, and careers forms are provided by HubSpot, our service provider and processor. They load with the page, and HubSpot receives your IP address and the details you submit, which it processes only on our behalf.

Do Not Track. Browsers' Do Not Track signals have no agreed standard, so we do not respond to them.

5. Who we share personal data with

We do not sell personal data, and we do not share it for cross-context behavioral (targeted) advertising. We disclose it only to the recipients below.

When you buy third-party software through us, the software vendor's own terms and privacy policy govern its use of your data.

Text messages. Our employees may text with you one to one, for example during an incident response. We text you only if you give us your mobile number and agree to receive texts, or if you text us first. How many messages you get depends on your conversation. We do not charge for texts, but your carrier's message and data rates may apply. To stop texts from a number, reply STOP, QUIT, END, REVOKE, OPT OUT, CANCEL, or UNSUBSCRIBE to any message from it; we may send one text confirming you have opted out. Reply HELP for help, or email privacy@novacoast.com.

We only use information you provide through this service to transmit your mobile messages and respond to you. This includes sharing it with platform providers, phone companies, and other vendors who assist us in the delivery of mobile messages. Mobile information will not be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. Our Text Messaging Terms also apply to our text messages.

6. Security and threat intelligence

As a cybersecurity provider, we process limited network data to detect, block, and respond to cyber threats against our systems and our customers' systems.

This data can include email addresses, file names, URLs, and IP addresses linked to spam, malware, phishing, or attacks. Some of it may relate to an identifiable person, such as the sender or target of a malicious email.

We process only what is strictly necessary and proportionate for network and information security, which is a recognized legitimate interest under UK and EU GDPR (Recital 49). We do not try to identify individuals unless that is needed to address a threat or required by law.

Our systems may assign reputation scores to IP addresses and URLs based on threat indicators, which can cause traffic to or from them to be blocked. If you believe this affects you, contact us and we will review it.

You may object to this processing. We will stop unless we have compelling legitimate grounds to continue, such as an active threat, and we will explain our decision.

7. International transfers

We store and process personal data mainly in the United States and the United Kingdom, and our providers may process it elsewhere.

When we transfer personal data out of the UK or EEA to a country without an adequacy decision, we use one of these safeguards:

• The EU Standard Contractual Clauses, with the UK International Data Transfer Addendum for UK data, or the UK International Data Transfer Agreement
• The EU-U.S. Data Privacy Framework and its UK Extension, where the recipient is certified (for example, Google for Google Analytics data)

The UK and EU have adequacy arrangements with each other, so transfers between Novacoast Ltd and EEA recipients need no extra safeguard.

Transfers from Novacoast Ltd and Novacoast EU Ltd to group companies outside the UK and EEA are covered by an intra-group agreement using the EU Standard Contractual Clauses and, for UK data, the UK Addendum. You can request a copy of the relevant safeguards at privacy@novacoast.com.

8. How long we keep personal data

We keep personal data no longer than we need it for the purpose we collected it, then delete or de-identify it.

We may keep data longer if the law requires it or to resolve a dispute, and only for as long as that need lasts.

9. Your choices and rights

Wherever you are, you can:

• Change your cookie choice at any time through Cookie settings
• Unsubscribe from marketing emails using the link in any email, or by emailing privacy@novacoast.com
• Ask us to access, correct, or delete your personal data

To make a request, email privacy@novacoast.com or call +1 800 949 9933. We will verify your identity before acting, using information we already hold, and we will not use that information for anything else. We will not treat you differently for exercising your rights.

Sections 10 and 11 describe additional rights in the UK, EEA, and US states.

10. UK and EEA rights

If you are in the UK or EEA, you have the right to:

• Access your personal data and receive a copy
• Correct inaccurate or incomplete data
• Erase your data in certain circumstances
• Restrict how we use your data in certain circumstances
• Object to processing based on legitimate interests, including at any time to direct marketing
• Receive data you gave us in a portable format, where processing is based on consent or contract
• Withdraw consent at any time, without affecting earlier processing

We respond within one month. We may extend this by up to two more months for complex requests and will tell you if we do.

You can complain to the UK Information Commissioner's Office (ico.org.uk) or, in the EEA, to the Irish Data Protection Commission (dataprotection.ie) or the data protection authority where you live or work. We would appreciate the chance to address your concern first.

11. California and other US state rights

This section applies to residents of California and other US states with comprehensive privacy laws. It supplements the rest of this statement.

What we collected in the last 12 months

Section 2 lists our sources, section 3 our purposes, and section 8 how long we keep data.

Sale, sharing, and sensitive data. We do not sell or share personal information, as those terms are defined in the CCPA, and have not done so in the last 12 months. Disclosures you direct us to make, such as to event sponsors you agree to share with or to software vendors for products you ask us about, are not sales or sharing. We do not knowingly sell or share data of consumers under 16. We do not use or disclose sensitive personal information for purposes that would give you a right to limit it.

Your rights. Depending on your state, you may have the right to:

• Know what personal information we collected, used, and disclosed about you, and get a copy
• Get a copy of your personal information in a portable format
• Correct inaccurate personal information
• Delete personal information
• Get a list of the specific third parties we have disclosed your personal information to (Oregon and Minnesota residents)
• Opt out of sale, targeted advertising, and certain profiling (we do none of these)
• Not be discriminated against for exercising these rights

Residents of some states may also have the right to confirm whether we process their personal information and to question the result of profiling. We do not use personal information for profiling that produces legal or similarly significant effects.

How to exercise them. Email privacy@novacoast.com or call +1 800 949 9933. We will confirm receipt within 10 business days and respond within 45 days, which we may extend once by 45 days with notice.

Authorized agents. An agent may request on your behalf with your signed permission. We may ask you to verify your identity directly.

Appeals. If we deny your request, you can appeal by emailing privacy@novacoast.com with "Appeal" in the subject line. We will respond within the time your state's law requires. If you disagree with the outcome, you can contact your state attorney general.

12. Children

Our website and services are for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe we have, contact us and we will delete it.

13. How we protect personal data

We use administrative, technical, and physical safeguards suited to the risk, including access controls, encryption, endpoint protection, monitoring, and staff training. No system is completely secure. If a breach affects your personal data, we will notify you and regulators as the law requires.

14. Links to other sites

Our website links to sites we do not control. Their own privacy policies apply.

15. Changes to this statement

We review this statement at least once a year and update the effective date when we change it. If we make a material change, we will post a notice on the website before it takes effect.

16. Contact us

Questions about Novacoast's processing in the EEA can go to Novacoast EU Ltd or the Irish Data Protection Commission.

Last reviewed: October 15, 2026