Privacy policy

What personal data NOSOTA collects, why, who we share it with and how you can exercise your rights.

Last updated: 7 November 2026

1. Who we are

This website is operated by NOSOTA LDA (NIPC 514160217), Rua do Campo Grande, n.º 28, 7 C, 1700-093 Lisboa, Portugal, which is the controller of the personal data processed through it.

The NOSOTA brand also includes NOSOTA YAZILIM TİCARET LİMİTED ŞİRKETİ (NOSOTA Yazılım Tic. Ltd. Şti.; Vergi Kimlik No 6321305603), Etiler Mah. Evliya Çelebi Cad. No: 23 İç Kapı No: 106, 07010 Muratpaşa, Antalya, Türkiye, +90 534 044 09 03. If you sign a contract with the Turkish company, it is the controller of the data processed under that contract, and the Turkish Personal Data Protection Law No. 6698 (KVKK) also applies.

For any question about this policy or your data, write to request@nosota.com.

2. What data we process and why

  • Inquiries by e-mail. Your name, e-mail address, company and the content of your message, to answer you and prepare a proposal. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) or our legitimate interest in answering business inquiries (Art. 6(1)(f)).
  • Call bookings. When you book a call, Calendly collects your name, e-mail address, the chosen time and your answers to the booking form, so that we can hold the call. Legal basis: Art. 6(1)(b).
  • Adobe license orders. Company name, address, VAT number, the name and e-mail address of your administrator, and the number and type of licenses. We pass these to Adobe and to an authorized Adobe distributor to place your order under Adobe VIP Marketplace. Legal basis: performance of the contract (Art. 6(1)(b)) and our legal accounting obligations (Art. 6(1)(c)).
  • Clients of our development services. Contact details of your representatives, to perform the contract. Legal basis: Art. 6(1)(b).
  • Website analytics. Google Analytics records pseudonymous identifiers, the pages you visit, your device and browser, and your approximate location, so that we can understand how the site is used. Legal basis: your consent (Art. 6(1)(a) GDPR). Google Analytics loads only after you allow it in the cookie banner.
  • Server logs. The web server records IP address, time, requested page and browser, to keep the site secure and working. Legal basis: our legitimate interest (Art. 6(1)(f)).

We do not sell personal data and do not use it for automated decision-making.

3. Cookies and local storage

If you allow analytics, Google Analytics sets the cookies _ga and _ga_*, which last up to two years. The site also stores your light or dark theme and your cookie choice in your browser’s local storage; they contain no personal data. You can change your choice at any time via “Cookie settings” at the bottom of every page; if you withdraw consent, the analytics cookies are deleted. You can also delete or block cookies in your browser settings.

4. Who we share data with

  • Adobe and an authorized Adobe distributor, for Adobe license orders.
  • Google Ireland Limited (Google Analytics), for website statistics.
  • Calendly LLC, for call bookings.
  • Our hosting and e-mail providers, which process data on our behalf.
  • Accountants, tax and other public authorities, where the law requires it.

5. Transfers outside the EEA

Some of these providers (Google, Calendly, Adobe) may process data in the United States. Such transfers rely on the EU–US Data Privacy Framework or on the European Commission’s standard contractual clauses.

6. How long we keep data

We keep correspondence for as long as we are discussing your request and for a reasonable time afterwards. Contract and accounting records are kept for the period required by Portuguese law (generally 10 years). Analytics data is kept for the retention period set in Google Analytics. Server logs are kept only as long as needed for security and diagnostics.

7. Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw consent at any time. To exercise them, write to request@nosota.com; we reply within one month.

You may also lodge a complaint with the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt.

8. Security

The site is served over HTTPS only, and access to personal data is limited to the people who need it for their work.

9. Changes to this policy

We may update this policy. The current version is always on this page, with the date of the last update at the top.