Legal
Privacy Policy
We collect very little. This page says exactly what we collect, why, who helps us process it, and for how long we keep it.
1.Who we are
Novum Labs is an independent research laboratory operated by Salfati Group GmbH, Zählerweg 12, 6300 Zug, Switzerland, UID CHE-292.423.728, registered in the Commercial Register of the Canton of Zug. Salfati Group GmbH is the controller of your personal data under the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR) and the UK GDPR.
Privacy contact: privacy@novumlabs.com.
2.What this policy covers
This website at novumlabs.com, the form to join Novum Labs or request an invitation, the emails we send you as a member, and the records our team keeps about members.
3.What we collect
- When you join or request an invitation: your email address.
- Your membership: when you confirm, the cohort you joined in. The first 500 people to confirm are Cornerstone members and get a number, from 1 to 500, in the order they confirmed. Later members are founding members, and people we invite are members. A number is given once and never given to anyone else.
- If you choose to tell us more: after you confirm, you can tell us who you are (investor, researcher, industry, engineer or other) and where you are based (Zurich, London or elsewhere). You can also give a separate consent to be considered for a private briefing or an invitation. All of these are optional.
- Our relationship records: a person on our team may note how we work with you (as a candidate, an investor, a partner or an advisor), write private notes about our contact with you, and record marks such as a gathering you attended or hosted, or early access you were given. Notes record who wrote them and when, and are never edited afterwards. These records are for our team only: we do not show them on the site and never send them to analytics. You receive all of them when you ask for a copy of your data.
- Proof of your consent: the time of your request, the exact wording you agreed to and its version, the time we sent the confirmation email, and the time and IP address of your confirmation. We do not record your IP address when you submit the form, only when you confirm.
- Where your visit came from: if the link you followed carried campaign tags (such as
utm_source), we store those tags with your request, together with the domain of the referring website and the page you arrived on. We do not store full referring addresses. - When you visit: aggregate statistics such as pages viewed, referring website, country, browser and device type. See section 6.
- How fast pages load: measurements of how quickly a page loads and responds, with the page, browser, device type, operating system, network speed and country. See section 6.
- When a page fails: if a script on our site fails, or your browser blocks something under our security policy, your browser sends our own server a short report. It says what failed, on which of our pages, and where in our code. It carries no cookie and no identifier, and we do not add your IP address or browser details to it. Our hosting provider still logs the request, like any other (see technical logs below).
- Technical logs: our hosting provider processes your IP address, browser type and the requested page to deliver the site and keep it secure.
- When you write to us: your message and your contact details.
We do not ask for sensitive data, such as health, political or financial information. Please do not send it.
4.Why we use it, and on what basis
| Purpose | Data | Legal basis |
|---|---|---|
| Running your membership, sending invitations and occasional updates on our research | Email address, cohort and number | Your consent (GDPR Art. 6(1)(a); FADP Art. 6 and 31) |
| Knowing who is asking, and inviting you to gatherings near you | Your role and where you are based, if you give them | Your consent (GDPR Art. 6(1)(a)) |
| Managing our relationship with members who work with us | Relationship marker, private notes, marks | Our legitimate interest in running the community and our relationships with candidates, investors, partners and advisors (GDPR Art. 6(1)(f)) |
| Considering you for a private briefing or an invitation | Email address, role, date of your request | Your separate consent (GDPR Art. 6(1)(a)) |
| Proving your consent and honouring your opt-out | Consent record, suppression entry | Our legitimate interest in meeting our legal duties (GDPR Art. 6(1)(f) and 7(1)) |
| Understanding where interest comes from | Campaign tags, referring domain, landing page | Our legitimate interest in understanding our audience (GDPR Art. 6(1)(f)) |
| Understanding how the site is used, in aggregate | Anonymous statistics | Our legitimate interest in improving the site (GDPR Art. 6(1)(f)) |
| Measuring how fast the site loads, in aggregate | Performance measurements | Our legitimate interest in a fast, working site (GDPR Art. 6(1)(f)) |
| Finding and fixing faults and blocked content | Error and security reports | Our legitimate interest in keeping the site working and secure (GDPR Art. 6(1)(f)) |
| Delivering and securing the site, preventing abuse | Technical logs | Our legitimate interest in security (GDPR Art. 6(1)(f)) |
| Keeping our team’s sign-in to the members admin secure | A sign-in cookie, for our team only | Our legitimate interest in security (GDPR Art. 6(1)(f)) |
| Answering your messages | Your message and contact details | Your request and our legitimate interest (GDPR Art. 6(1)(b) and (f)) |
A person at Novum Labs reviews requests for briefings and invitations. Your cohort and number follow only from the order in which people confirmed. We make no other decision about you by automated means.
5.How joining works
You enter your email address and select Be among the first. The short line next to the field, “One email to confirm”, stands for this: by joining you agree that Novum Labs (Salfati Group GmbH) may email you about your membership, gatherings, early access and occasional updates on its research, and you can unsubscribe from any email in one click. When the public list is closed, we send invitations ourselves, and the invitation email says the same.
We send one email to confirm. Your membership becomes active only after you confirm it. If you do not confirm within 7 days, we delete it. When you confirm, we tell you your cohort and, if you are a Cornerstone member, your number. Our welcome email asks one optional question, where you are based, which you answer with one click.
The confirmation email contains no marketing. Every email after it includes a one-click unsubscribe link. Membership does not entitle you to an invitation to a briefing, a gathering or early access. Our Terms of Use explain this.
6.Cookies and device storage
The public website sets no cookies, and we store nothing on your device to identify you.
The one cookie on our domain belongs to our team’s members admin. It keeps a team member signed in, is strictly necessary for that, and is set only on the admin pages, never for visitors to the site.
Our statistics come from Vercel Web Analytics, which counts visits without cookies. It recognises a visit using a hash computed from the request, which is discarded after 24 hours. It cannot follow you across days or across websites.
Our performance measurements come from Vercel Speed Insights. They are taken without cookies and are not linked to you, to your IP address or to your other visits.
If your browser sends a Global Privacy Control or Do Not Track signal, we do not count your visit and take no performance measurements. You can also object to statistics at any time by writing to privacy@novumlabs.com.
Error and security reports go to our own server, not to an analytics provider, and are kept with our technical logs. A page that works sends none. To stop abuse, we count reports per network using a one-way hash of the network part of your IP address. That count is deleted within two days.
If you switch motion off with the Motion control, your browser remembers that choice on your device. It is never sent to us.
7.Who we share it with
We do not sell your data and we do not share it for advertising. A small number of providers process it for us, only on our instructions and under a data processing agreement.
| Provider | What they do | Where | Safeguard |
|---|---|---|---|
| Vercel Inc. | Hosting, content delivery and the functions that handle your request | Functions in Frankfurt, Germany. Pages are delivered from the location nearest to you. Company in the United States | EU-US and Swiss-US Data Privacy Framework, and Standard Contractual Clauses |
| Neon | The database that holds your membership and our records | Frankfurt, Germany | Data processing agreement. Standard Contractual Clauses for any access from the United States |
| Resend | Delivering our emails | Emails sent from Ireland. Account and delivery data in the United States | EU-US and Swiss-US Data Privacy Framework, and Standard Contractual Clauses |
| Twenty | A copy of confirmed members’ email address, role and cohort, used only once we enable it. Relationship markers and notes are not sent | Frankfurt, Germany | Data processing agreement |
We may disclose data where the law requires it, for example to a court or a public authority.
Novum Labs may become a separate company. If it does, we will transfer your request and the record of your consent to that company, so that it can continue to write to you on the same terms. We will tell you before the transfer, and you can leave at any time.
8.International transfers
We keep your request in a database in Frankfurt, Germany. Switzerland and the EU recognise each other as providing adequate protection.
Some providers are based in the United States and can access data from there, which counts as a transfer under Swiss and EU law. The countries involved are Germany, Ireland and the United States. Where a country does not have an adequate level of protection, we rely on the EU-US and Swiss-US Data Privacy Framework for certified recipients, and on the European Commission’s Standard Contractual Clauses, adapted for Swiss law, as a further safeguard. You can ask us for a copy of these safeguards.
9.How long we keep it
- Unconfirmed requests: 7 days, then deleted.
- Your membership, role, region and our relationship records: until you unsubscribe, ask us to delete them, or we close the list.
- After you unsubscribe: we delete your profile, including your role, region, relationship marker, notes and marks. We keep a one-way hash of your email address, so that we never write to you again, and the record of your consent for 3 years, to show it was valid. Then we delete that record. A Cornerstone number stays retired with that hash, so it is never given to anyone else. If you ask us to erase your data, we remove the number too.
- Technical logs, including error and security reports: up to 14 days.
- Statistics and performance measurements: kept in aggregate. They cannot identify you.
- Your emails to us: as long as we need to answer, then up to 12 months.
10.Your rights
You can ask for access to your data, a correction, its deletion, restriction of its use, or a copy in a portable format. A copy includes everything we hold about you, our relationship records and notes among it. You can object to any use based on our legitimate interest. You can withdraw consent at any time, with the unsubscribe link in any email or by writing to us. Withdrawal does not affect what we did before it.
Write to privacy@novumlabs.com. We answer within 30 days. We may ask you to confirm your identity first.
You can also complain to a supervisory authority. In Switzerland, that is the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch). In the EU, it is the authority where you live or work. In the UK, it is the Information Commissioner’s Office (ICO, ico.org.uk).
11.Security
We encrypt data in transit, limit access to the people who need it, store tokens and suppression entries only as hashes, and choose providers with recognised security practices. No system is perfectly secure. If a breach puts you at risk, we will tell you.
To report a security issue, write to security@novumlabs.com.
12.Age
This site and membership are for people aged 18 and over.
13.Changes
We publish every change here with a new version and effective date. If a change is material, we email confirmed members before it takes effect. Earlier versions are available on request.
14.Contact
Salfati Group GmbH, Zählerweg 12, 6300 Zug, Switzerland. privacy@novumlabs.com.
Legal notice
- Operator
- Salfati Group GmbH
- Address
- Zählerweg 12, 6300 Zug, Switzerland
- UID
- CHE-292.423.728
- Registered seat
- Zug
- Contact
- hello@novumlabs.com