Privacy Policy
Last updated
This policy explains what personal data is processed when you visit novakmarek.com or contact Marek Novak, why, on what legal basis, for how long, and what rights you have. We collect as little as possible: no advertising, no cross-site tracking, no data sales — and visitor statistics only if you allow them.
1. Who is responsible
The data controller under the EU/EEA General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act (personopplysningsloven) is:
MAREK NOVAK CONSULTANCY (sole proprietorship, owner Marek Novak)Org. no. 926 782 177 MVA
c/o Audun og Line Skaarer, Solliveien 10, 1825 Tomter, Norway
Email: consultancy@novakmarek.com
We are a small business that does not process personal data on a large scale, so we are not required to appoint a data protection officer. Questions about privacy go to the email address above.
2. At a glance
| What | Data | Why | Legal basis (GDPR) | How long |
|---|---|---|---|---|
| Visiting the site | IP address, date and time, requested page, referrer, browser and device type | Deliver the pages, keep the site secure, fix errors, count visits in aggregate | Art. 6(1)(f) legitimate interest | Short-lived technical logs at our hosting provider (see section 3) |
| Contact form or email | Name, email, phone (optional), your message, time sent | Answer your enquiry, prepare and carry out an engagement | Art. 6(1)(b) steps before a contract; otherwise Art. 6(1)(f) | Up to 12 months after the conversation ends, longer only if a contract or the law requires it |
| Spam protection | IP address, browser signals evaluated by Cloudflare Turnstile | Stop bots and abuse of the contact form | Art. 6(1)(f) legitimate interest (security) | Not stored by us |
| Visitor statistics (only if you allow them) | Page viewed, referrer, browser and device type, country, page-load timings — no cookies | Understand which pages are useful and how fast they load | Art. 6(1)(a) consent | Aggregated statistics only; your choice is kept 12 months |
| Your settings | Theme and motion choice, stored in your browser only after you use a switch | Remember choices you made | Strictly necessary for a feature you asked for; Art. 6(1)(f) | Until you clear them |
3. When you visit the website
The website is a static site delivered by Cloudflare. To send you the pages, Cloudflare necessarily processes your IP address and standard request information (date and time, requested address, referrer, browser and operating system). Cloudflare also uses this information to protect the site against attacks and abuse. Our own website code does not write personal data to any log or database. Cloudflare keeps technical logs only for a short period according to its own policies. From these requests Cloudflare shows us anonymous, aggregated numbers (for example visits per day and per country). No script runs in your browser for this and nothing is stored on your device.
All fonts, images, scripts and styles are served from our own domain. Visiting the site does not contact Google Fonts, social networks or advertising services.
4. When you contact us
If you use the contact form, we receive your name, email address, phone number (if you give it) and your message. The form sends this to our mailbox as an email via Cloudflare; it is not stored on the website. Our mailbox is hosted by Google Workspace. If you email us directly, the same applies.
We use the information only to reply and, if it leads to work together, to prepare and carry out that engagement. Name, email and message are needed to answer you; the phone number is optional. Please do not send sensitive information (such as health data) through the form. We delete enquiries no later than 12 months after the conversation has ended. If an engagement follows, we keep what is needed for the contract and for as long as the Norwegian Bookkeeping Act requires for accounting records.
5. Spam protection with Cloudflare Turnstile
To keep bots out of the contact form we use Cloudflare Turnstile. It loads only when you start using the form. Turnstile checks signals from your browser to tell people from automated software and gives our server a one-time token that we verify with Cloudflare. It is not used for advertising or to track you across websites. Cloudflare processes these signals for us as a processor, and as an independent controller when it uses them to improve its bot detection (see the Turnstile privacy addendum (opens in a new tab)). Legal basis: our legitimate interest in the security of the form (Art. 6(1)(f) GDPR); reading this information from your device is strictly necessary to provide the service you asked for, sending a message (Norwegian Electronic Communications Act § 3-15).
6. Visitor statistics — only with your consent
When you first visit, a small banner asks “May we count your visit?”. Only if you choose Allow statistics do we load Cloudflare Web Analytics. It sets no cookies, builds no profiles and does not follow you to other websites. It records the page viewed, the referring site, browser and device type, country and page-load timings, and shows us these as aggregated numbers. If you choose Reject or do nothing, the script is never loaded. You can change your mind at any time under Privacy choices; withdrawing does not affect statistics already counted.
We use no advertising scripts, tracking pixels, fingerprinting or social-media plug-ins, and no third party can track you through our site. Do Not Track / Global Privacy Control: if your browser sends a Global Privacy Control signal, we treat it as Reject — no banner, no statistics, nothing stored.
7. What is stored on your device
We do not set any cookies ourselves. The site stores a few small settings in your browser’s local storage — only after you make a choice:
| Name | Type | Purpose | Duration | Legal basis |
|---|---|---|---|---|
nm-theme | Local storage (first party) | Remembers the light or dark look — only after you use the theme switch. | Until you clear it or press “Forget my preferences” | Strictly necessary for a feature you asked for (ekomloven § 3-15 (2) b) |
nm-motion | Local storage (first party) | Remembers if you switched animations off or on — only after you use the motion switch. | Until you clear it or press “Forget my preferences” | Strictly necessary for a feature you asked for (ekomloven § 3-15 (2) b) |
nm-sound | Local storage (first party) | Remembers that you switched the bar sounds on — only after you use the sound switch. | Until you clear it or press “Forget my preferences” | Strictly necessary for a feature you asked for (ekomloven § 3-15 (2) b) |
nm-consent | Local storage (first party) | Records your privacy choice (statistics allowed or rejected), its version and date, so we do not ask again. | 365 days, then we ask again | Needed to respect and document your choice (GDPR Art. 7(1); ekomloven § 3-15) |
Full details are on the Cookies & storage page.
8. Links to social networks
Links to LinkedIn, Instagram and Facebook are ordinary links. Nothing is loaded from these networks until you click a link and leave our site. After that, the privacy policy of the network you visit applies.
9. Who processes data for us
- Cloudflare, Inc. (USA) and its affiliates — hosting, content delivery, security, Turnstile, delivery of contact-form emails, aggregated traffic statistics and (only with your consent) Web Analytics. Data processing agreement: Cloudflare Customer DPA (opens in a new tab); sub-processors (opens in a new tab).
- Google (Google Workspace) — our email mailbox. Data processing agreement: Google Cloud Data Processing Addendum.
We do not sell personal data, share it for advertising, or pass it to anyone else unless the law requires us to.
10. Transfers outside the EEA
Cloudflare and Google may process data in the United States. Both are certified under the EU–U.S. Data Privacy Framework, which the European Commission has found to provide an adequate level of protection and which also applies in Norway through the EEA Agreement. As an additional safeguard their agreements include the EU Standard Contractual Clauses. Marek Novak currently works in the United States, so messages you send may be read and answered from there.
11. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have data deleted or its use restricted;
- data portability for data you gave us under a contract or consent;
- object at any time to processing based on our legitimate interests;
- withdraw consent at any time, where we rely on consent.
To review, correct or delete what we hold about you, or to use any of these rights, email consultancy@novakmarek.com from the address you wrote to us from. It is free, and we answer within one month. You can also complain to the Norwegian Data Protection Authority, Datatilsynet (opens in a new tab) (Postboks 458 Sentrum, 0105 Oslo, Norway), or to the data protection authority where you live or work (in the UK, the Information Commissioner’s Office).
12. No profiling or automated decisions
We do not use your data for profiling or for decisions made solely by automated means.
13. Security
The site is served only over encrypted HTTPS connections with HSTS, uses a strict Content Security Policy, loads no third-party code except the spam check when you use the form and the statistics script if you allow it, and does not keep contact-form messages in any database.
14. Children
This website is about a profession in the hospitality and drinks industry and is intended for adults. We do not knowingly collect data from children.
15. Visitors from the United States
We do not sell personal information, share it for cross-context behavioural advertising, or use it for targeted advertising. The categories we collect, the parties we share them with and how you can review or correct them are described above (California Online Privacy Protection Act). How we respond to Do Not Track and Global Privacy Control signals is explained in section 6.
16. Changes
We update this policy when our processing changes and announce changes by updating it on this page; the “Last updated” date at the top is its effective date. If a change matters for people who have contacted us, we will also tell them by email.