Privacy Policy

1. Who we are

WebNovaBZ ("we", "us", "our") is a web design and development studio. We operate the website at webnovabz.com and provide website design, development, and related services to businesses worldwide.

This Privacy Policy applies to all visitors of our website and anyone who contacts us through our contact form or phone. It is designed to comply with the General Data Protection Regulation (GDPR) for visitors in the European Union and the United Kingdom, and the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) for visitors in California, as well as other applicable privacy laws.

2. Data we collect

We collect only the information you choose to provide and the technical information needed to operate and secure our website.

Information you provide to us

When you submit our contact form, we collect the following information so we can respond to your request:

• Full name — so we know who we're speaking with.
• Email address — so we can reply to your request.
• Business name (optional) — so we understand your context.
• Package of interest (optional) — so we can tailor our response.
• Project message (optional) — the details you share about your project.

Technical data collected automatically

When you submit the contact form, we also record the following technical data to prevent abuse and secure our systems:

• IP address — used for rate limiting and anti-spam protection.
• User agent (browser/device type) — used for security and diagnostics.
• Timestamp — the date and time of your submission.

We do not collect payment card details, government IDs, or any sensitive personal data (such as health, race, religion, or political opinions) through this website.

3. Why we collect it

We process your personal data for the following legitimate business purposes:

• To respond to your inquiry — we use your name, email, and message to reply to your quote request and discuss your project.
• To provide our services — if you become a client, we use your contact details to deliver the website project and communicate with you.
• To prevent abuse and spam — we use your IP address and user agent to enforce rate limits and block malicious submissions.
• To improve our website — aggregated, non-identifying data helps us understand how visitors use our site.

Our legal basis for processing under the GDPR is legitimate interest (to respond to inquiries and secure our systems) and, where you have provided it, consent (via the consent checkbox on our contact form).

4. How we store & protect it

Your contact request is sent to our business inbox through our email delivery provider so we can respond.

We take reasonable technical and organizational measures to protect your data, including:

• HTTPS encryption for all data transmitted to and from our website.
• Rate limiting on the contact form to prevent abuse.
• Input validation and sanitization to prevent injection attacks.
• Security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy) on all responses.
• Access to stored submissions is restricted to authorized personnel via a token-protected admin endpoint.
• Server-side logging is kept to the minimum necessary for security and operations.

While no method of transmission or storage is 100% secure, we work to protect your data using industry-standard practices.

5. How long we keep it

We retain contact form submissions for as long as needed to respond to your inquiry and, if you become a client, for the duration of our business relationship plus a reasonable period afterward for record-keeping and legal purposes (typically up to 24 months after your last contact).

Technical data (IP address, user agent) is retained only as long as necessary for security and abuse prevention, and is not used for any profiling or marketing purposes.

You may request deletion of your data at any time — see Section 13 below.

6. Who we share it with

We do not sell, rent, or trade your personal data to third parties. We share data only in the following limited circumstances:

• Email delivery — when you submit the contact form, we send a notification email (containing your name, email, business, package, and message) to our studio inbox via our SMTP email provider. This is necessary to respond to your request.
• Service providers — we may use third-party hosting and infrastructure providers to operate our website and server. These providers process data only on our behalf and under our instructions.
• Legal obligations — we may disclose data if required by law, regulation, or legal process, or to protect our rights, safety, or property.

We do not transfer your personal data outside of the jurisdictions where our service providers operate without appropriate safeguards (such as Standard Contractual Clauses) where required by applicable law.

7. Cookies & analytics

Our website does not use advertising cookies, cross-site trackers, or third-party analytics tools. We use a small first-party analytics system to count anonymous actions such as CTA clicks and quote-form submissions so we can improve the website. These events contain the page, a short event label, and timestamp — they do not contain your name, email address, IP address, advertising identifiers, or other direct identifiers.

Our server may also log standard technical information for operational and security purposes. Contact-form submissions separately include the technical data described in Section 2. Analytics events are kept separate from that information.

If we add cookies or analytics in the future, we will update this policy and, where required, obtain your consent before doing so.

8. Your rights (GDPR — EU/UK)

If you are located in the European Union, the European Economic Area, or the United Kingdom, you have the following rights under the GDPR:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — request deletion of your personal data.
• Right to restriction of processing — request that we limit how we use your data.
• Right to data portability — request your data in a machine-readable format.
• Right to object — object to processing based on legitimate interest.
• Right to withdraw consent — withdraw any consent you have given at any time.
• Right to lodge a complaint — complain to your local data protection authority (e.g., the ICO in the UK or your national supervisory authority).

To exercise any of these rights, contact us using the details in Section 13. We will respond within 30 days as required by the GDPR.

9. Your rights (CCPA/CPRA — California)

If you are a resident of California, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with the following rights:

• Right to know — request disclosure of the categories and specific pieces of personal information we have collected about you, the purposes for collection, and the categories of third parties with whom we share it.
• Right to delete — request deletion of the personal information we have collected about you, subject to certain exceptions.
• Right to correct — request correction of inaccurate personal information.
• Right to opt-out of sale/sharing — we do not sell or share your personal information, so there is nothing to opt out of. If this changes, we will update this policy.
• Right to non-discrimination — we will not discriminate against you for exercising any of your privacy rights.
• Right to limit use of sensitive personal information — we do not collect sensitive personal information as defined by the CPRA.

To exercise any of these rights, contact us using the details in Section 13. We will verify your identity and respond within 45 days as required by the CCPA. You may also designate an authorized agent to make a request on your behalf.

10. Children's privacy

Our website and services are intended for businesses and individuals aged 18 and older. We do not knowingly collect personal data from children under 13 (or under 16 in the EU/UK, where applicable). If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

11. Security

We take the security of your personal data seriously. Our website and server implement the measures described in Section 4. However, please be aware that no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

If we become aware of a data breach that affects your personal data, we will notify you and the relevant supervisory authority as required by applicable law.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email if we have your contact details.

We encourage you to review this page periodically to stay informed about how we protect your data.

13. Contact us

If you have any questions about this Privacy Policy, or if you would like to exercise any of your privacy rights (access, correction, deletion, restriction, portability, or objection), please contact us:

• Phone: +501 635-7886
• Service area: Belize and international clients; local service includes Belize City, Belmopan, and San Pedro.

Please include "Privacy Request" in the subject line so we can prioritize your request. We will respond within the timeframes required by applicable law (30 days under GDPR, 45 days under CCPA).

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority (GDPR) or the California Attorney General (CCPA).