NOVA privacy notice

3.1 When you visit our website or contact us (we are controller)

• Name, email address, telephone number, company, role and country
• The content of enquiries, demo requests and support messages
• Marketing preferences and engagement, such as emails opened and pages viewed
• Technical data: IP address, browser and device type, operating system, referring page, pages viewed and time spent, and approximate location derived from IP address

3.2 When you hold or administer a Nova account (we are controller for the account itself)

• Name, email address, role and permissions
• Sign-in and session records. Authentication is by email, so your email address serves as your sign-in identifier; where a password is used it is stored only in hashed form
• Organisation name, billing contact and address, and tax registration details
• Subscription and billing records, including plan, usage against allowances, invoices and payment status
• Support requests and correspondence
• Records of acceptance of our terms, including version and timestamp

We do not receive or store full payment card numbers. Card payments are handled by our payment providers.

3.3 Information inside a Nova account (we are processor)

Our customers determine this. It typically includes:

• Asset registers, locations, checkpoints and checklists
• Completed inspection records, including who performed the inspection, when, and the result of each checkpoint
• Photographic evidence attached to inspections, which may incidentally capture people, vehicles or premises
• Location data associated with inspections and site rounds
• Names and contact details of the customer's own staff, contractors and clients
  

4. Why we use information, and our legal bases

Where we are a processor (section 3.3), the legal basis is our customer's responsibility, not ours. The table below covers our controller activities.

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and you can object as described in section 10.

You can withdraw marketing consent at any time using the unsubscribe link in any marketing email or by contacting us. That does not affect service communications such as billing notices, security alerts or changes to our terms, which we send because they are necessary to the contract.

5. Where your information is held

Nova operates two independent production regions:

• ca1 — Canada
• eu1 — Ireland

Your account's region is set by the country you select at signup, according to our published country-to-region mapping. Everything associated with your account is stored and processed only in that region. Nothing is copied to, stored in, or processed in the other region. This applies to inspection records, asset registers, photographs, databases, backups and derived data, and to your account and user records.

Your account is created in your region, and signing in resolves there. We do not hold a central directory of accounts or users outside your region. Infrastructure deployment is managed centrally from Canada, but that function maintains the regional environments rather than holding anything in them.

Regional separation is built into how the platform is deployed. The regions are independent environments maintained from a common infrastructure definition, so they behave identically while remaining separate.

Access by our people. Your data does not leave its region, but authorised AssetPool personnel and sub-processors located in Canada and South Africa may access it remotely to operate, support and secure the platform. That access is controlled, limited to what is necessary, and logged. Section 7 explains the basis for the resulting transfers.

Website and marketing information (section 3.1) is held by our website and marketing platform providers, which are listed at assetpool.com/sub-processors.

6. Who we share information with

Sub-processors and service providers. Listed at assetpool.com/sub-processors, with the category of information each handles and where it operates. They act on our instructions under written terms and may not use the information for their own purposes.

Between our two companies. For customers registered in South Africa, AssetPool (Pty) Ltd provides the service and holds the customer relationship, and instructs AssetPool Inc. as its operator to run, host and support the platform. For every other customer, AssetPool Inc. holds the relationship and AssetPool (Pty) Ltd has no role. Information passes between the two companies only as far as necessary for whichever of them is providing your service, under written terms.

App store distribution. The Nova mobile applications are published in the Apple App Store and Google Play under the developer account of AssetPool (Pty) Ltd, which is the entity shown as seller. The software is owned, and the service provided, by AssetPool Inc., which is named in the copyright line and is the party you contract with. The stores hold their own account and download information about you under their own privacy policies, which we do not control.

Professional advisers. Lawyers, accountants and auditors, under duties of confidentiality.

Legal and regulatory. Where required by law, court order or a valid request from a public authority, or to establish or defend legal claims. Where we are permitted to do so, we will tell our customer before disclosing information from their account.

Corporate transactions. If we are acquired or merge, information may transfer to the acquiring entity, subject to this notice continuing to apply.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

7. International transfers

Because we are a Canadian company with people in Canada and South Africa, information may be accessed from those countries even where it is stored elsewhere.

For customers in eu1. Your information is stored in Ireland. Access from Canada relies on the European Commission's adequacy decision for Canada. Access from South Africa is under the European Commission's standard contractual clauses.

For customers in ca1. Your information is stored in Canada. Access from South Africa is under written terms requiring equivalent protection.

For customers in South Africa. Your information is stored in Ireland, where it is protected by European data protection law. See Annex C.

You can ask us for details of the safeguards that apply to you using the contact details in section 16.

8. How long we keep information

Where we are the processor, deletion of account content is our customer's decision, subject to the retention period for their tier.

9. Security

We maintain technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls and least-privilege administration, logging of administrative access, separation of production environments by region, and regular backups.

No system is completely secure. If a breach affects your personal information, we will notify you and the relevant regulator where the law requires it, and will notify affected customers without undue delay so they can meet their own obligations.

10. Your rights

Depending on where you are, you may have the right to access your information, correct it, delete it, restrict or object to its use, receive a portable copy, withdraw consent, and complain to a regulator. Region-specific rights are in the Annexes.

Where to send a request. If it concerns your relationship with us — marketing, an enquiry, your account login — contact us at the details in section 16. If it concerns records held inside an organisation's Nova account, contact that organisation. If you are unsure, contact us and we will tell you which applies and, where we can, pass the request on.

Deleting your user account

If you set up your own Nova account, you are its Owner. You can delete your user account from within the mobile app and the web application. Doing so removes your login, your profile and your access to the service.

If your user account was created for you by an Owner — for example by your employer or the organisation whose assets you inspect — that Owner controls it, and you cannot delete it yourself. Ask your Owner to remove you. You can also contact us at support@assetpool.com and we will pass your request to your Owner. We cannot remove you from an organisation's account without their instruction, because the account and its records are theirs.

In either case, deleting a user account does not delete inspection records you completed. Where you use Nova through an organisation, those records belong to that organisation, form part of its compliance history, and may be subject to retention obligations it owes to a regulator. Deleting your account removes you; it does not remove the organisation's evidence that an inspection happened. If you want those records changed or removed, ask the organisation.

Where you set up Nova yourself, deleting your account deletes your content with it, subject to anything we must keep by law.

Where the person deleting is the only Owner of an account, we ask for administrative ownership to be transferred to someone else first, so that an account holding other people's compliance records is not left without an owner.

We respond within the period the applicable law requires and will not charge unless a request is manifestly unfounded or excessive. We may need to verify your identity first.

11. Inspection records and workforce information

Nova records who completed an inspection, when, where, and what they found. Those records are meaningful safety and compliance evidence, and they are also a record of individual working activity.

Where you are an employee, contractor or field technician using Nova, the organisation that operates the account decides what is recorded and how it is used, including any use in performance or disciplinary contexts. We do not use that information for any purpose of our own. Questions about how your employer uses it should go to your employer.

Where you are a customer of ours, you are responsible for having a lawful basis for that processing, for telling your workforce about it, and for meeting any consultation or works council obligations in your jurisdiction.

12. AI-assisted features

Nova includes AI-assisted features such as checklist generation. These are provided using Amazon Bedrock, operated by Amazon Web Services, which is already one of our sub-processors. Content you provide to those features is not transmitted to any third-party model provider and is not used to train any model.

AI-assisted output is a suggestion for you to review, not a decision. We do not use it to make automated decisions producing legal or similarly significant effects about individuals.

13. Cookies and similar technologies

Our use of cookies on assetpool.com is described in the Cookie Notice at assetpool.com/cookies, where you can also manage your preferences.

assetpool.io is a separate domain. Cookie preferences set on one do not carry to the other. The Cookie Notice describes what each site uses.

14. Children

Nova is a product for managing assets and inspections. It is not directed at children, we do not offer it to anyone under 18, and we do not knowingly collect information from anyone under 18. If you believe we have, contact us and we will delete it.

15. Changes to this notice

We will publish any updated version here with a new version number and effective date, and record it in the version history at assetpool.com/legal. We keep superseded versions and will provide them on request.

Where a change materially affects how we use your information, we will give notice by email to account administrators and in-product before it takes effect.

16. Contact and complaints