Novalyth Systems
Last Updated: 19 August 2026
Novalyth Systems (“Novalyth”, “we”, “us”, or “our”) provides enterprise workflow and managed application services from London, United Kingdom.
This Privacy & Cookie Policy explains how we collect, use, disclose, retain and protect personal data when you:
Visit novalythsystems.com
Contact or contract with us
Use services we provide directly
Interact with systems we operate for clients
A client-, partner- or product-specific notice may provide additional information. If that notice conflicts with this policy for a particular service, the more specific notice applies to that processing.
Company: Novalyth Systems
Headquarters: London, United Kingdom
Privacy Email: privacy@novalythsystems.com
When we provide hosted workflow platforms, integrations or managed application support for a client, we normally act as the client’s data processor.
We act as data controller for our website, sales, supplier, security and account-administration records.
If we process personal data for a client, requests concerning that data should normally be directed to the client. We will assist the client as required by contract and applicable law.
Depending on your relationship with us, the people concerned may include client personnel, authorised platform users, suppliers and business contacts.
We may collect:
Business and relationship data: names, organisation, role, work contact details, correspondence, meeting information, contracts and billing records.
Workflow user names, work email addresses, roles and permissions.
Workflow records, approval history, form submissions and content entered into client environments.
API and integration identifiers, system events, access logs, support tickets, audit trails and backup records.
Website and technical data: IP address, browser and device details, pages viewed, referral source, approximate location derived from IP, cookie choices, timestamps and security logs.
Information you choose to provide in enquiries, support requests, applications, surveys or other communications.
Please do not provide sensitive or unnecessary personal data.
Where sensitive information is genuinely required, we limit its use to the stated purpose and apply any additional legal safeguards, including explicit consent where required.
We may collect personal data:
Directly from you, your employer, a client, group organiser, authorised user or account administrator.
Automatically from the website, applications, devices, integrations and security systems you use.
From service providers and business partners involved in an authorised transaction or service.
From public or licensed sources where lawful and relevant to due diligence, research, professional services or business development.
We may process personal data to:
Configure, host, integrate and support enterprise workflows.
Authenticate users, administer permissions and preserve auditability.
Monitor availability, investigate incidents and improve platform reliability.
Respond to enquiries, prepare proposals, contract with clients and manage suppliers.
Protect people, information, systems and services.
Prevent fraud, misuse and security incidents.
Comply with applicable laws and regulations.
Resolve disputes and establish or defend legal claims.
Maintain required business, accounting and operational records.
Novalyth Systems does not sell personal data for money.
We also do not use client-controlled data for our own unrelated advertising purposes.
Where the UK GDPR and Data Protection Act 2018 require a legal basis, we rely, as appropriate, on:
Performance of a contract or steps requested before entering into a contract.
Legitimate interests, such as delivering and improving services, securing systems, administering our business and communicating with business contacts, balanced against individual rights.
Compliance with legal obligations.
Consent, including for non-essential cookies or sensitive data when the law requires consent.
Protection of vital interests in a genuine emergency, where applicable.
Where we rely on consent, you may withdraw it at any time without affecting processing already carried out.
Where we rely on legitimate interests, you may request information about the relevant balancing assessment.
We disclose personal data only where reasonably necessary.
Recipients may include:
Hosting, cloud, connectivity, security, analytics, communications, customer-support and professional-service providers.
Payment, identity, logistics, travel, marketplace, platform, research or other operational partners relevant to the requested service.
Our clients or their authorised administrators when we process data on their behalf.
Professional advisers, insurers, auditors, potential transaction counterparties and successors, subject to appropriate confidentiality requirements.
Courts, regulators, law-enforcement bodies or other recipients where disclosure is legally required or necessary to protect rights and safety.
Service providers are selected with regard to confidentiality, security and data-protection obligations.
Third parties acting for their own purposes are responsible for their own privacy practices and privacy notices.
Because our clients, users, suppliers and infrastructure may be located in different countries, personal data may be transferred outside the United Kingdom.
Where transfer restrictions apply, we use recognised safeguards such as:
Adequacy decisions
Approved contractual clauses
Binding contractual commitments
Other lawful transfer mechanisms
Supplementary safeguards where appropriate
We retain personal data only for as long as necessary for the purpose for which it was collected.
We take into account contract duration, client instructions, account activity, security and backup cycles, dispute periods and applicable legal, tax, audit or regulatory requirements.
Website enquiries and unsuccessful proposals: generally up to 24 months after the last substantive contact.
Client, supplier, transaction and accounting records: for the duration of the engagement and any applicable statutory limitation or record-keeping period that follows.
Client-controlled service data: for the period specified in the relevant contract, after which it is deleted or returned in accordance with agreed instructions, subject to secure backup rotation and legal holds.
Security logs: for a proportionate period based on risk, unless they are required for an incident investigation, dispute or legal claim.
We use proportionate technical and organisational measures designed to protect personal data.
These measures may include:
Role-based access controls
Authentication controls
Encryption where appropriate
Logging and monitoring
Secure development and change-management processes
Vulnerability management
Incident-management procedures
Backup and recovery controls
Confidentiality obligations
Supplier security reviews
No information system can be guaranteed to be completely secure. We therefore review and adapt our controls in light of identified risks, legal requirements and service needs.
Subject to applicable law, you may have the right to:
Request access to your personal data.
Request a copy of your personal data.
Correct inaccurate or incomplete personal data.
Request deletion of personal data.
Request restriction of processing.
Object to processing based on legitimate interests.
Object to direct marketing.
Request portability of personal data you provided in a structured, commonly used format.
Withdraw consent.
Change your cookie preferences.
Appeal the refusal of a privacy request where applicable law provides that right.
Exercise your privacy rights without unlawful discrimination.
To submit a request, contact:
We may need to verify your identity and authority before responding to a request.
An authorised agent may act on your behalf where permitted by law and properly verified.
You may also complain to the UK Information Commissioner’s Office (ICO).
If the relevant personal data is controlled by one of our clients, please contact that client first.
Cookies are small files or similar technologies placed on or read from your device.
Our website may use the following categories of cookies:
These cookies support essential website functionality, including:
Security
Network management
Website navigation
Forms
Remembering privacy and cookie choices
These cookies may operate without consent where permitted by law because they are necessary for the website to function properly.
Preference cookies remember settings or choices you make to improve your experience on the website.
Analytics cookies help us understand how visitors interact with our website and allow us to improve website content and performance.
Where consent is required by law, analytics cookies operate only after you have provided consent.
Marketing cookies are used only where clearly disclosed through our cookie banner or preference centre and where any consent required by law has been obtained.
We do not state that marketing cookies are active unless they are identified in the website’s cookie-management interface.
Our cookie banner or preference centre provides current information about:
Cookies in use
Their purposes
Cookie providers
Cookie durations
Your available choices
You can reject non-essential cookies or withdraw previously provided consent through the cookie preference centre.
You can also block or delete cookies through your browser settings.
Please note that disabling strictly necessary cookies may affect the operation or availability of some website functions.
We may send relevant business communications where permitted by applicable law.
You can opt out of marketing communications at any time by:
Using the unsubscribe option provided in the communication; or
Contacting us directly.
Service, security, administrative and transaction-related communications are not marketing communications and may still be sent where necessary.
Our website and business services are not directed to children.
We do not knowingly collect personal data from children except where information is lawfully provided by a parent, guardian or authorised organisation and is necessary to provide a requested service.
We may update this Privacy & Cookie Policy from time to time to reflect changes in:
Our services
Technology
Applicable laws or regulations
Our data-processing practices
The latest version will be published on our website with an updated revision date.
Where required, material changes may also be communicated using an appropriate additional method.
For questions about this Privacy & Cookie Policy or to exercise your privacy rights, please contact:
Novalyth Systems
London, United Kingdom
Email: privacy@novalythsystems.com