Privacy
Privacy notice
This notice explains what the website genuinely does, checked against the site code, rather than what a template says websites typically do.
Draft. Legal review required before final publication.
Each technical statement below was verified against the site code rather than copied from a template.
Items a reviewer still needs to provide or confirm are flagged inline: retention periods, the identity and location of the form processor, and whether the company must appoint a representative in any market it serves.
What we verified, and how
- searched the code for
document.cookie,setCookieandjs-cookie— no cookies are written. - searched for analytics libraries (Plausible, Fathom, GA4, PostHog, Vercel Analytics) — none found.
- searched the code for
<script src=,<iframe,navigator.sendBeaconandnew Image()— no third-party scripts, frames or tracking beacons. - localStorage — a single key,
ng-motion, which stores the reduced-motion setting. - The only request sent by a visitor action is the contact form submission to
api.web3forms.com.
Who issues this notice
Novelo Limited (81115165), 99 Hennessy Road, Wan Chai, Hong Kong.
What this website collects
This website collects personal data in one place only: the contact form.
When you submit it, we receive the name, email address, company and message you enter. Nothing else is collected, and nothing at all is collected unless you choose to submit the form.
We do not use analytics, advertising pixels, session recording, heatmaps or any other tracking. There are no third-party scripts on this website.
Cookies
This website sets no cookies — not for analytics, not for advertising and not for functionality. That is why you were never asked to accept any.
The site keeps one value in your browser’s local storage, under the key ng-motion. It remembers whether you chose to reduce on-screen motion, so the site keeps that setting on your next visit. It does not identify you, it is never sent anywhere, and clearing your browser data deletes it. The whole site works without it.
What happens when you submit the contact form
Your enquiry is sent by email to our inbox at [email protected]. This site is a static website with no database — we do not keep your enquiry in any system of our own other than our email.
Open item — legal review required
[REVIEW: confirm how contact form submissions are delivered, where any processor stores data, and whether an international transfer mechanism is needed for enquirers in the UK/EU. Update this paragraph accordingly before launch.]
We use your enquiry to respond to you and to discuss working together. We never sell it, never share it with anyone else, and never add you to a marketing list without your permission.
Open item — legal review required
[REVIEW: set a retention period. A typical approach is to keep enquiries that do not become clients for 12–24 months and then delete them, but the company must decide and then follow it.]
Your rights
Depending on where you live, you may be entitled to request a copy of the personal data we hold about you, to have it corrected or deleted, or to object to how we use it.
Under Hong Kong’s Personal Data (Privacy) Ordinance you can request access to and correction of your personal data. If you are in the UK or the European Economic Area, the UK GDPR or EU GDPR may also give you rights including access, erasure, restriction, objection and portability, and the right to complain to your national supervisory authority.
To exercise any of these rights, email [email protected].
Open item — legal review required
[REVIEW: confirm which regimes apply based on where enquiries originate, and whether a UK/EU representative is required under Article 27. This depends on the scale and nature of UK/EU-facing activity and should be confirmed by a lawyer.]
Changes
If this notice is updated, we will revise this page and the date below.
Last updated: [DATE ON PUBLICATION]
Internal note — not part of the policy
A note for the reviewer
Two points worth understanding about this site’s current position.
1. Running without cookies is an intentional choice, not an oversight. Analytics were omitted precisely so no consent pop-up is required. If the company later adds GA4 for ad attribution, a consent banner becomes mandatory under UK GDPR/PECR, and this page has to be revised before that goes live — not afterwards.
2. The contact form is the only route by which personal data is collected. If anything new is added — a newsletter sign-up, a booking tool, live chat, or a tracking pixel on a campaign page — this notice becomes inaccurate the moment it launches.