Legal
Privacy Policy
Last updated: July 2026
1. Controller identity
This Privacy Policy applies to the processing of personal data by:
Business name: NovaPiek
Legal form: Eenmanszaak (sole proprietorship)
KvK number: 99676028
Establishment number: 000064731057
Address: de Linde 24, 3224TH Hellevoetsluis, The Netherlands
Email: info@novapiek.com
2. What data we collect
We process personal data in two distinct contexts:
a) Platform clients (businesses)
When a business signs up to use the NovaPiek platform, we process: business name, contact person name, business email address, phone number, business address, and billing information. We also process account activity and configuration data.
b) End-customers of our clients
When a business client uses our platform to communicate with their own customers (for example via WhatsApp or email), NovaPiek processes messages and contact data on behalf of that business client. This includes: names, phone numbers, email addresses, and the content of messages. NovaPiek acts as a data processor in this context; the business client is the data controller.
3. Purpose and legal basis
Providing and operating the NovaPiek platform
Contract (Art. 6(1)(b) GDPR)
Processing messages on behalf of platform clients
Contract / Data Processing Agreement
Sending service-related communications
Contract (Art. 6(1)(b) GDPR)
Compliance with legal obligations
Legal obligation (Art. 6(1)(c) GDPR)
Website analytics and improvement
Legitimate interest (Art. 6(1)(f) GDPR)
4. Third-party processors
NovaPiek uses the following third-party services to operate the platform. These parties are sub-processors under GDPR:
Meta / WhatsApp Business Platform
WhatsApp Business API — message delivery and WhatsApp Business Account management. Clients connect their own WhatsApp Business Account (WABA) via Meta Embedded Signup. Meta processes messages on behalf of clients under Meta's own terms and WhatsApp Business Policy.
Data location: USA (Standard Contractual Clauses)
Twilio Inc.
WhatsApp and SMS message routing and delivery. NovaPiek uses Twilio as a WhatsApp Business Solution Provider to route WhatsApp messages between clients' WABAs and their customers.
Data location: USA (Standard Contractual Clauses)
Supabase Inc.
Database hosting and real-time data infrastructure. Contact data, message history, and platform configuration are stored in Supabase.
Data location: EU region
Resend Inc.
Transactional email delivery for platform communications.
Data location: USA (Standard Contractual Clauses)
Vercel Inc.
Hosting and deployment of the NovaPiek web application.
Data location: USA / EU edge network
5. WhatsApp Business data — specific notice
NovaPiek operates as a WhatsApp Business Solution Provider partner via the Twilio platform. When a business client connects their WhatsApp Business Account (WABA) through NovaPiek, the following applies:
- The WABA and WhatsApp phone number remain the sole property of the business client.
- Inbound and outbound WhatsApp messages are processed by NovaPiek on behalf of the business client for the purpose of automated message handling and workflow automation.
- Message content is stored in NovaPiek's secure database (Supabase) and is accessible only to the business client and NovaPiek for support and operational purposes.
- NovaPiek does not sell, share, or use WhatsApp message data for advertising or marketing purposes.
- Message data is retained for the duration of the client relationship, plus a maximum of 12 months after contract termination, unless a shorter period is agreed or required by law.
- End-customers who send messages to a business's WhatsApp number should refer to that business's own privacy policy regarding how their data is handled by the business.
6. Data retention
Client account data
Duration of contract + 7 years (statutory Dutch record-keeping obligation)
WhatsApp and email messages
Duration of contract + 12 months
Contact / lead data
Duration of contract + 12 months
Website analytics data
Maximum 14 months
7. Your rights (GDPR)
Under the General Data Protection Regulation (GDPR) and the Dutch UAVG, you have the following rights:
- Right of access — you may request an overview of the personal data we hold about you.
- Right to rectification — you may request correction of inaccurate or incomplete data.
- Right to erasure — you may request deletion of your personal data, subject to legal retention obligations.
- Right to data portability — you may request your data in a structured, machine-readable format.
- Right to object — you may object to processing based on legitimate interest.
- Right to restriction — you may request that we restrict processing of your data in certain circumstances.
To exercise any of these rights, contact us at info@novapiek.com. We will respond within 30 days.
You also have the right to lodge a complaint with the Dutch Data Protection Authority: Autoriteit Persoonsgegevens, Bezuidenhoutseweg 30, 2594 AV Den Haag, autoriteitpersoonsgegevens.nl.
8. Security
NovaPiek implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or destruction. This includes encrypted data storage, access controls, and secure communication protocols. All third-party processors are bound by data processing agreements and are required to maintain appropriate security standards.
9. Cookies
The NovaPiek website uses functional cookies required for the website to operate correctly. We do not place advertising or tracking cookies. Analytics data, if collected, is anonymised and used solely for website improvement.
10. Changes to this policy
We may update this Privacy Policy from time to time. The date of the most recent update is shown at the top of this page. For material changes, we will notify active platform clients by email.
11. Contact
For questions about this Privacy Policy or about the processing of your personal data, contact us at: