Privacy Policy

NOCTIVALE GROUP LTD (brand: NOCTIVALE) is a private company limited by shares, incorporated in Scotland on 8 November 2026 under the Companies Act 2006. Company number: 908352.

Registered office: 57 Shaw Crescent, Aberdeen AB25 3BT, Scotland, United Kingdom.

Contact: contact@noctivale.com.

We are the controller of personal information used for our website and our own correspondence. Please use the email above for privacy questions or rights requests; a named data protection officer is not designated in this policy.

This policy covers Noctivale’s informational website hosted through Lovable, together with enquiries sent to us by email. The site has no visitor accounts, sign-up process, checkout or working contact form. An email link opens your own email service; the site itself does not receive the message.

If we provide services under a separate agreement or introduce a product that processes personal information, additional privacy information may apply. Third-party websites and your email provider have their own privacy notices.

Technical connection and security data. When your browser requests a page or resource, hosting and resource providers may receive your IP address, browser or user-agent details, request time, requested URL, referrer where supplied, and diagnostic or security information. Access and error logs may record some of this information; the exact logging and retention settings require confirmation with the providers.

Email and voluntary correspondence. If you contact us, we receive the sender’s email address, name if supplied, message contents, attachments and other information you choose to include, together with relevant correspondence metadata. Please avoid sending sensitive personal information or information about other people unless it is necessary and you are entitled to share it.

The website does not ask you to complete a personal-information form. This does not mean that browsing is anonymous to hosting or external resource providers.

Under the UK GDPR and applicable UK data protection law, we use the following lawful bases according to the purpose:

• Reliable operation and security: legitimate interests in making the website available, diagnosing faults and preventing abuse, balanced against visitors’ rights and reasonable expectations.
• General enquiries and correspondence: legitimate interests in responding to requests, maintaining relevant business communications and keeping an appropriate record of them.
• Potential engagements: taking steps at your request before entering a contract, where the enquiry concerns a contract with you. For correspondence with someone acting for an organisation, legitimate interests may instead apply.
• Legal duties: compliance with a legal obligation where a specific duty requires us to retain, disclose or otherwise process information.

A general enquiry is not consent to marketing. If optional tracking or another activity requiring consent is introduced, we must provide the relevant information and obtain consent before it starts. These bases do not give us permission to use information for unrelated purposes.

Relevant categories of recipients are hosting and infrastructure providers, email delivery and mailbox providers, and IT or professional advisers where their involvement is necessary. Access should be limited to what each recipient needs for the relevant purpose. Information may also be disclosed to authorities where legally required or to establish, exercise or defend legal rights.

Lovable website hosting: the website is provided through Lovable. Hosting infrastructure may process connection, diagnostic and security data. The application includes optional Lovable error-reporting hooks; whether these hooks transmit errors, and what information is included, depends on the hosting or preview environment. Actual log retention, infrastructure recipients and reporting behaviour have not all been confirmed.

Microsoft 365 email: our working mailbox, contact@noctivale.com, is hosted using Microsoft 365. Microsoft processes email addresses, message contents, attachments and associated delivery, account and security information as part of providing the email service. The owner has confirmed the mailbox works. Processing roles and purposes depend on the relevant service and contractual terms; we do not assert exclusive UK storage.

Cormorant Garamond and Manrope are open-licensed fonts served with the website’s own resources; the site does not request fonts from Google Fonts. Following an external link takes you to a third party whose own privacy notice applies. The full hosting and email subprocessor arrangements, applicable contractual terms and processing locations still require confirmation; contact us for the information we can verify.

Lovable hosting and Microsoft 365 email infrastructure may involve processing outside the UK. We have not verified all processing locations or the transfer mechanisms applicable to these services.

Where a provider processes information on our behalf and a restricted transfer arises, the operator is responsible for ensuring that an appropriate UK mechanism applies, such as an applicable adequacy regulation or suitable contractual safeguards (which may include the UK International Data Transfer Agreement or UK Addendum), with any required transfer assessment. This policy does not claim that particular safeguards or transfer assessments have already been verified for our providers.

You can contact us to request information about the locations and safeguards relevant to your information; we will explain the arrangements we can verify, subject to legitimate confidentiality restrictions.

We retain information only for as long as needed for the purpose for which it was collected, taking account of ongoing correspondence, contractual needs, legal duties and the reasonable need to resolve disputes. Different records can have different retention requirements.

Routine enquiries: our approved policy is to review and delete routine enquiry correspondence 12 months after the last meaningful contact, unless an ongoing business matter, legal obligation or other justified lawful reason requires longer retention. Any exception should be documented and reviewed. The review/deletion procedure still needs implementing in Microsoft 365, including attachments, deleted items, recoverable copies and any applicable holds or backups. We do not claim automatic deletion is already configured or that all copies disappear immediately.

Hosting and security logs: retention depends on the provider’s actual settings and requirements. These periods, and any backup or diagnostic retention, have not all been confirmed; no fixed log-deletion period has been verified.

HTTPS protects the website connection but does not eliminate every risk, and ordinary email should not be assumed to be end-to-end encrypted. We do not claim a security certification or guarantee that any online service is completely secure.

The operator is responsible for maintaining appropriate access controls, protecting mailbox and hosting credentials, keeping services updated and managing incidents. Provider controls and the operator’s working practices are subject to ongoing review. Please use the contact address to report a suspected privacy or security issue without including unnecessary sensitive information.

Depending on the circumstances, you can request access to your personal information, correction of inaccurate information, erasure, restriction of processing, or portability of information where the statutory conditions apply. You can object to processing based on legitimate interests; we must consider your circumstances and stop unless a lawful reason permits us to continue. You can always object to direct marketing.

Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing. Rights are not absolute; legal obligations and other lawful exceptions may apply.

Email contact@noctivale.com with your request. We may ask for proportionate information to confirm identity and locate the relevant records. We will respond without undue delay and normally within one month, subject to legally permitted extensions and exceptions; we will explain any extension or refusal.

You may complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint. You do not have to contact us first, although we welcome the opportunity to address your concern.

No optional analytics or marketing pixels or cookies are installed by the website’s active page code reviewed for this version. This is not a statement that the hosting platform, preview environment, external resources or your browser set no cookies or process no data.

Browser checks of the review environment are not a guarantee of behaviour on a different public domain. Hosting services, injected resources and similar storage must also be assessed on that domain. A resource request can disclose connection information even when no cookie is set. Strictly necessary technologies can have different consent requirements from optional technologies; a provider label alone does not determine the exemption.

If non-essential cookies or similar technologies are introduced or found in the deployment, they must not operate before any consent required by UK law has been obtained. Visitors must receive clear information and an effective way to refuse or withdraw consent. Browser cookie controls can also be used, but do not replace our consent obligations.

We will update this policy when the website, providers or processing practices change, and provide additional notice where appropriate for significant changes. The date shown identifies this version.

For privacy questions, contact contact@noctivale.com. For the conditions of using the website, see our Terms of Use.