Privacy policy

Cookies and analytics

This website uses no analytics or marketing cookies. We do not use Google Analytics, we do not profile visitors and we run no remarketing — which is why you will not see a cookie consent banner.

We use Google Search Console, which works solely through a verification meta tag and stores nothing on your device. It provides us only with aggregated, anonymous statistics about how the site performs in search results.

Contacting us by e-mail

The public part of the website contains no contact form for business enquiries. Contact takes place directly via the e-mail addresses and phone numbers listed in the “Contact” section. The places where the site does collect data from a form are described separately below: job applications on the “Careers” page.

If you send us a message, we process the data it contains (name, e-mail address, company name, content of your enquiry) solely in order to reply and to carry on the resulting business correspondence.

Job applications

The “Careers” page carries a form you can use to send us a job application. In it you provide your name, e-mail address, optionally a phone number, the area you are interested in and a short message about yourself. A CV is required; a cover letter is optional.

Your application goes to our company mailbox and nowhere else — we do not save it in any database or in the site’s data store. We also send an automatic acknowledgement to the address you provided.

Legal basis: Art. 6(1)(a) GDPR (the consent you tick when submitting the form) and Art. 22¹ of the Polish Labour Code for the data we may request from a candidate. If you tick the additional, optional consent, we also keep your application for future recruitment.

Applications are deleted within 6 months of the recruitment ending, or 12 months after receipt if you consented to future recruitment. You can withdraw your consent at any time by writing to nova@novaseafood.pl; we then delete the application together with its attachments.

Apart from the application itself we store only irreversible hashes of the sender’s IP address and e-mail address. They serve solely to count submissions against our limits and allow us to reconstruct neither the addresses nor the application. A counter stops applying once its window (an hour or a day) has passed, and the entry itself is deleted on the next submission from the same address.

The Nova Partner app

Nova Partner is an app intended solely for our established business customers. There is no public sign-up — access is granted only to a company whose account we create, and signing in uses the phone number assigned to that company in our sales system together with a PIN handed over by the account manager.

In the app we process the customer company’s details and the contact details of the person using the account: company name, tax ID, phone number (which is also the login), e-mail address, the assigned account manager and the commercial terms. The app also shows that customer’s price list, product availability, reservations and purchase history. The data comes from our sales system and flows one way only — the app never writes anything back to it.

We never store the PIN itself — only an irreversible hash of it, so it cannot be read or recovered; a lost PIN is replaced with a new one. An account is bound to a single device: we store an irreversible hash of the device identifier (never the identifier itself), so that knowing the phone number and PIN is not enough to sign in from someone else’s phone. A change of device is unlocked by our staff on request.

For security reasons we record sign-in events (date, phone number, outcome of the attempt, IP address); they serve to detect unauthorised access attempts and to lock an account after a series of incorrect PINs. We also record which products were opened in the app and any product enquiries sent; the account manager uses this when preparing an offer.

Legal basis: Art. 6(1)(b) GDPR (performance of the commercial contract and servicing the business relationship) and Art. 6(1)(f) GDPR (our legitimate interest in securing access to the customer’s commercial data and in running sales support).

App data is kept for the duration of the business relationship. Access is withdrawn at the customer’s request or once cooperation ends — revoking the PIN blocks sign-in immediately. Sign-in events and the history of viewed products are deleted within 12 months.

App data is stored with our provider Supabase, on servers located in the European Union. The iPhone version is distributed through TestFlight (Apple Inc.) — installation requires an Apple account, and Apple then processes that account’s data on its own terms. The Android version is not published on Google Play: we share the installation file directly by link, so installing it requires no account with any intermediary. The same applies to the browser version.

Newsletter and commercial information

If you have consented to receiving commercial information from us, we process your e-mail address and your company contact details in order to send you a newsletter containing our offer and information about product availability.

Legal basis: Art. 6(1)(a) GDPR (consent) and Art. 6(1)(f) GDPR (our legitimate interest in the direct marketing of our own products). Sending commercial information by electronic means takes place on the basis of the recipient’s separate consent.

We use the Smaily platform (Smaily OÜ, Estonia) to handle the mailings; Smaily processes the data solely on our instructions, under a data processing agreement.

You can withdraw your consent at any time — by using the “unsubscribe” link included in every message or by writing to nova@novaseafood.pl. Withdrawing consent does not affect the lawfulness of mailings sent before its withdrawal.

We process the data until consent is withdrawn or an objection is raised.

Legal basis and retention

We process correspondence data under Art. 6(1)(f) GDPR — our legitimate interest in answering enquiries and maintaining business relationships. Where a contract is concluded, the basis is Art. 6(1)(b) GDPR, and accounting records are retained for the period required by tax law.

Business correspondence is kept for as long as needed to handle the matter and for the limitation period of any related claims.

Recipients of data

Data may be shared only with providers supporting our operations, in particular: Netlify, Inc. (website hosting together with the data store used by the recruitment submission counters), Supabase, Inc. (the Nova Partner app database, servers in the European Union), Apple Inc. (distribution of the iPhone version through TestFlight), Smaily OÜ (newsletter delivery) and our e-mail provider, which hosts the novaseafood.pl mailboxes and delivers job applications sent through the careers form. We do not sell personal data or share it with third parties for marketing purposes.

Transfers of data outside the European Economic Area

Our website is hosted on the Netlify platform (Netlify, Inc., United States), which delivers content through a global network of servers. This means that technical data contained in server logs (IP address, date and time of the request, browser type) may be processed outside the European Economic Area.

Transfers take place on the basis of Netlify, Inc.’s participation in the EU-U.S. Data Privacy Framework, covered by a European Commission adequacy decision. In addition, standard contractual clauses approved by the European Commission apply as part of the data processing agreement concluded with the provider.

E-mail services in the novaseafood.pl domain — including delivery of job applications together with their attachments — remain with a domestic provider, with servers located in Poland. Those messages are not transferred outside the European Economic Area.

Nova Partner app data is stored on servers located in the European Union. Its provider, Supabase, Inc., is based in the United States, so administrative access to the data may take place from outside the European Economic Area — on the basis of standard contractual clauses approved by the European Commission, forming part of the data processing agreement. As regards distribution of the iPhone version, tester account data is processed by Apple Inc. on its own terms.

Your rights

In connection with the processing of your data, you have the right to:

• access your data and obtain a copy of it,
• rectify (correct) your data,
• erase your data,
• restrict processing,
• data portability,
• object to processing based on legitimate interest,
• lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).

Server logs

Like any website, this site records technical access logs (IP address, date and time of the request, browser type). They serve solely to keep the site secure and working correctly; they are not used to identify visitors and are not combined with other data.

Changes to this policy

If you have any questions about data protection, write to nova@novaseafood.pl. Should the scope of the data we process change (for example if we add a contact form or analytics tools), we will update this document.