Privacy.
Last updated 12 October 2026.
Atelier Noven is being incorporated in the European Union. Until registration completes, the details below that depend on it (company name, number, registered address, VAT number) are published in our legal notice as soon as they exist.
1. Who this covers
This policy explains how Atelier Noven (“we”) handles personal data when you visit ateliernoven.com, contact us, hear from us, or work with us. It applies where we decide why and how your data is used, which makes us the controller under the EU General Data Protection Regulation (GDPR) and the UK GDPR.
When a client gives us access to their own systems (ad accounts, analytics, CRM) to deliver our work, we only use that data on the client’s instructions. There, we are the client’s processor, a data processing agreement governs our use, and the client’s own privacy policy applies to the people in that data.
2. How to reach us
Email hello@ateliernoven.com. Our full company details are in our legal notice.
3. What we collect, why, and on what basis
| When | What | Why | Legal basis |
|---|---|---|---|
| You fill in a form on this site | Name, company, work email, role, funding stage, growth spend, your message, your website | To reply, prepare for a call, or record your teardown | Steps at your request before a contract (Art. 6(1)(b)); our legitimate interest in answering enquiries (Art. 6(1)(f)) |
| We think we can help your company | Name, job title, work email, company, public professional profile | To send you a short, relevant business message | Legitimate interest in business-to-business marketing (Art. 6(1)(f)). Every message lets you opt out in one reply. |
| You book or join a call | Name, email, meeting time, notes; a recording only if you agree at the start | To run the call and write an accurate proposal | Pre-contract steps; consent for recordings, which you can withdraw |
| Your company becomes a client | Contact details of the people we work with; invoicing details | To deliver the work, invoice and keep records | Contract (Art. 6(1)(b)); legal obligation for accounting records (Art. 6(1)(c)) |
| You subscribe to our notes | Email address | To send what you asked for | Consent (Art. 6(1)(a)), withdrawable at any time |
We don’t collect special category data, we don’t make automated decisions with legal or similarly significant effects, and we don’t sell personal data.
4. Where the data comes from
Mostly from you. For outreach, also from public sources: company websites, professional networks, funding announcements and B2B data providers.
5. Who we share it with
Only service providers that help us run the business, under contracts that require them to protect it:
- Website hosting and form handling: Netlify
- Scheduling: Cal.com
- Email and documents: our business email provider
- Customer relationship management and outreach tools
- Payments and accounting software
- AI tools used for research and first drafts, configured so your data is not used to train their models
We will name each provider here as accounts are set up, and we keep an up-to-date list available on request. We also share data where the law requires it.
6. International transfers
Some providers process data outside the EU and UK, mainly in the United States. Where they do, we rely on an adequacy decision (including the EU–US Data Privacy Framework where the provider is certified) or on the European Commission’s standard contractual clauses, with the UK addendum where needed.
7. How long we keep it
- Enquiries and prospect records: up to 24 months after our last contact. If you opt out, we keep only your email address on a suppression list so we never contact you again.
- Call recordings: 90 days.
- Client contact data: for the engagement and 24 months after it ends.
- Client system data we process for you: returned or deleted within 30 days of the engagement ending.
- Invoices and accounting records: as long as tax law requires.
8. Your rights
You can ask us for a copy of your data, and ask us to correct it, delete it, restrict it, or move it to someone else. You can object at any time to processing based on our legitimate interests, including all direct marketing, and we will stop. Where we rely on consent, you can withdraw it whenever you like.
Email us and we’ll reply within one month. You also have the right to complain to a data protection authority, in particular where you live or work. In the UK that is the Information Commissioner’s Office (ico.org.uk).
9. Security
We use two-factor authentication on every account, give access only to the people who need it, and ask clients for read-only access to their systems wherever possible.
10. Cookies
See our cookie policy. In short, this site sets no cookies.
11. Changes
We’ll update this page when anything changes and change the date at the top.