Privacy notice

Last updated: 30 October 2026

Who we are and what this notice covers

Quest2S BV, trading as NUVAI (or its legal successor for the NUVAI business), Frankrijklei 5 bus 4.01, 2000 Antwerpen, Belgium, company number BE 0544.737.251, is the controller of the personal data described in this notice ("NUVAI", "we", "us"). For any privacy question or request, contact us at hello@nuvai.eu or +32 474 96 42 84.

This notice covers visitors to nuvai.eu, people who contact us or download a resource, users of the client space, prospects we approach, and contact persons at our clients and suppliers.

What this notice does not cover. When we work on a project, we often process personal data on behalf of a client, for example in the client's documents, mailboxes or systems. That data is handled under the agreement and data processing agreement with the client concerned, not under this notice. Please contact that client with any question about it.

What we process, why, on what basis and for how long

Website operation and security

To deliver the website, keep it stable and protect it against bots and misuse. Cloudflare filters automated traffic. A server-side check turns your IP address into a country code to suggest a language or region; we use the result only for that purpose. A rate limiter stops repeated form submissions.

• —Data: IP address, browser and device information, pages requested, date and time; for the rate limiter, IP address and e-mail address per submission.
• —Legal basis: our legitimate interest in a secure and working website (art. 6(1)(f) GDPR).
• —Retention: server and security logs are kept for as long as necessary for this purpose and in line with our hosting and security providers' standard retention, after which they are deleted. We delete rate-limit records after 7 days.

Website analytics (only with your consent)

To count page views and events and to measure page speed, using the analytics built into our website platform (Lovable). Session replay and automatic capture are not enabled.

• —Data: pages visited, events, an analytics session identifier (the session-id cookie), and technical and performance data about your browser and device.
• —Legal basis: your consent (art. 6(1)(a) GDPR and the Belgian cookie rules; see the Cookie statement). You can withdraw it at any time through "Cookie settings" at the bottom of every page.
• —Retention: analytics data is kept for as long as necessary for this purpose and in line with Lovable's standard retention, after which it is deleted. Your cookie choice is stored on your device for 182 days. We keep records of cookie choices for as long as needed to prove consent, at most the cookie lifetime (182 days) plus 12 months, and then delete them.

Contact form enquiries

To answer your question and follow up on it. You receive a confirmation e-mail and we receive a notification.

• —Data: name, company, e-mail address, role, your message, and the browser user agent and referring page.
• —Legal basis: steps you ask us to take before a possible contract (art. 6(1)(b) GDPR) and our legitimate interest in answering business enquiries (art. 6(1)(f) GDPR).
• —Retention: we delete enquiries 24 months after our last contact if no assignment follows.

Resource downloads

To send you a resource you request on our insights pages, and to understand which channels bring download requests. We do not add you to a newsletter or an e-mail sequence.

• —Data: e-mail address, company, role, your checkbox choice, your browser and device details (user agent), the referring page and campaign (UTM) parameters in the link you used.
• —Legal basis: steps you ask us to take by requesting the resource (art. 6(1)(b) GDPR) and, for the browser, referrer and campaign details, our legitimate interest in understanding which channels bring requests (art. 6(1)(f) GDPR).
• —Retention: we delete download requests at the latest 24 months after the download.

Build-decision map

To generate the build-decision map you request with the form on our site and send it to you by e-mail. Signed-in client users can also save maps in the client space.

• —Data: name, e-mail address, company and your answers on the form; for saved maps, the map and your client-space account.
• —Legal basis: steps you ask us to take (art. 6(1)(b) GDPR) and our legitimate interest in following up business enquiries (art. 6(1)(f) GDPR).
• —Retention: we delete map requests 24 months after our last contact if no assignment follows. Maps saved in the client space are kept as client-space data (see below).

Client space and statements of work

To give client users access to their space, share tasks, documents, questionnaires and saved maps, and sign statements of work electronically. The signing platform keeps an audit trail, adds a trusted timestamp to each signed document and stores signed PDFs in our Google Drive (Google Workspace).

• —Data: name, e-mail address, login data (magic link), uploads, questionnaire answers, saved maps, which statements of work you opened and read to the end, signature and signing audit trail, messages sent from the space, and copies of signed statements of work.
• —Legal basis: performance of the contract with your employer (art. 6(1)(b) GDPR) or, where you sign or act for your employer, our legitimate interest in running and proving the contract (art. 6(1)(f) GDPR).
• —Retention: we delete client-space accounts and content 12 months after the last activity in the client space. Uploaded files are deleted on request or when we close the space. Signed statements of work, their signing records and stored contract files are kept for as long as claims under the contract are possible.

Prospects and outreach

To approach businesses that may benefit from our services, for example through LinkedIn or by e-mail, and to keep track of those contacts. We keep this data in our own mailbox and contact records, not on the website.

• —Data: name, company, role, professional contact details, information from your public professional profile (for example LinkedIn) and our messages with you.
• —Legal basis: our legitimate interest in business-to-business prospecting (art. 6(1)(f) GDPR). You can object at any time, with no reason needed: reply "stop" or write to hello@nuvai.eu, and we stop contacting you.
• —Retention: we delete prospect data 12 months after the last contact without a reply. After an objection we keep only your name and e-mail address on a do-not-contact list, so that we do not contact you again.

Client and supplier contacts

To prepare, perform and administer contracts with our clients and suppliers, including invoicing and payment.

• —Data: name, company, role, business contact details, correspondence, contract and invoice data.
• —Legal basis: performance of the contract (art. 6(1)(b) GDPR), our legitimate interest where the contract is with your employer (art. 6(1)(f) GDPR), and legal obligations for accounting and tax (art. 6(1)(c) GDPR).
• —Retention: for the duration of the relationship; invoices and accounting records for the period required by Belgian accounting and tax law.

References and case studies

Under our General Terms, we may name a client company and show its logo from go-live, and publish a case study once the client has approved it in writing. Names, quotes and images of identifiable people are only used with that person's consent.

• —Data: for a person featured in a case study or testimonial: name, role, company, quote and, where agreed, a photo.
• —Legal basis: your consent (art. 6(1)(a) GDPR) for anything that identifies you; our legitimate interest (art. 6(1)(f) GDPR) for naming the client company itself.
• —Retention: until you withdraw your consent or the client withdraws its permission for future use. Material already printed or shared cannot always be recalled.

Legal obligations and claims

To comply with the law, answer requests from authorities and establish, exercise or defend legal claims.

• —Data: the data from the purposes above that is needed for that.
• —Legal basis: legal obligation (art. 6(1)(c) GDPR) and our legitimate interest (art. 6(1)(f) GDPR).
• —Retention: as long as the obligation or the claim requires.

The AI assistant in the client space

The AI assistant in the client space is currently disabled. When it is enabled, documents and questions you share with it are processed in the European Union via Google Cloud (Vertex AI).

When it is enabled:

• —What you type and the documents you share are sent to the model to produce an answer. Google may cache them temporarily to answer faster, and may log prompts to detect abuse under its terms, unless we switch this off.
• —We delete conversations 1 year after the last message.
• —We do not use your data to train AI models, and under Google Cloud's terms Google does not use it to train or fine-tune its models without our permission.
• —Answers can be wrong or incomplete. Check them before you rely on them or pass them on.

The assistant does not make decisions with legal or similarly significant effects.

Documents in the client space are handled under the agreement and data processing agreement with the client concerned.

Who receives your data

Our service providers process data only to provide their services to us and only as far as they need it. We do not sell personal data.

We may also share data with our professional advisers (such as our accountant and lawyers), with authorities where the law requires it, and with a buyer or successor of the NUVAI business, which is planned to become a separate company from 2027.

Transfers outside the EEA

Some providers, or their own sub-processors, may process data outside the European Economic Area. We only allow this under an adequacy decision (such as the EU-US Data Privacy Framework for certified US companies) or under standard contractual clauses approved by the European Commission, as shown per provider above. Ask us at hello@nuvai.eu for details.

Security

We take technical and organisational measures that fit the risk, such as named accounts with multi-factor authentication, least-privilege access and encryption in transit. No system is fully secure; if a breach affects you, we will act as the GDPR requires.

Your rights

Within the limits of articles 15 to 22 GDPR, you have the right to access your data, have it corrected or erased, restrict its processing, receive it in a portable format, and object to processing based on our legitimate interest, including prospecting at any time. Where we rely on consent, you can withdraw it at any time; this does not affect processing before the withdrawal.

Write to hello@nuvai.eu and say which right you want to use. We may ask you to confirm your identity. We answer within one month; for complex requests this can be extended by two more months, in which case we tell you why within the first month.

No automated decisions. We do not take decisions about you based only on automated processing that have legal or similarly significant effects (art. 22 GDPR).

Complaints

You can lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, Belgium, www.gegevensbeschermingsautoriteit.be, +32 2 274 48 00, contact@apd-gba.be, or with the authority in the country where you live or work. We would appreciate the chance to resolve your concern first.

Contact

Quest2S BV, trading as NUVAI, Frankrijklei 5 bus 4.01, 2000 Antwerpen, Belgium · BE 0544.737.251 · hello@nuvai.eu · +32 474 96 42 84

Changes

We may update this notice. The date at the top shows the current version; for significant changes we will also inform the people concerned where we can.