Short version: this website sets no cookies, runs no analytics, embeds no third-party content and tracks nothing, and it is hosted in the EU. The only personal data we handle from this site is what you choose to put in an email to us. Because our work is cross-border by nature, that correspondence may be read by advisors working outside Europe. We explain below exactly when, why, and on what legal footing.
Who is responsible
Nomos Notabu
Email: info@notabugroup.com
Nomos Notabu is currently completing a corporate restructuring. The registered operating entity, address, EIN and filing numbers are being updated and will be published here shortly.
We are the controller for the personal data described below. We have not appointed a data protection officer, as we are not required to do so.
If you are in the European Union
Nomos Notabu is established in the United States, not in the European Union. Where our processing falls within the scope of the EU GDPR, for example because we offer services to individuals in the EU, that regulation applies alongside the law of our own jurisdiction, and you keep your rights under it.
Where Article 27 of the EU GDPR requires a representative established in the European Union to act as a point of contact for data subjects and supervisory authorities, we will appoint one and publish their name and contact details here.
In the meantime, and in every case, you can contact us directly at info@notabugroup.com about anything in this policy. We answer data protection questions ourselves rather than routing them through anyone else.
What this website does not do
- It sets no cookies of any kind, and stores nothing in your browser's local or session storage.
- It runs no analytics or measurement software.
- It contains no advertising, tracking pixels, or social media plug-ins.
- It loads no fonts, scripts, maps or videos from third-party servers. Typefaces are served from our own domain, so your browser does not contact any outside service while you read these pages.
- It has no contact form, and therefore no form processor receives your details.
Because nothing is stored on or read from your device, no consent banner is required and none is shown.
Server logs
Our hosting provider records standard technical information when a page is requested. This typically includes your IP address, the time of the request, the page requested, the referring page if any, and your browser and operating system.
This is processed to deliver the website securely and reliably. The legal basis is our legitimate interest in operating a functioning and secure site (Article 6(1)(f) GDPR). Our hosting provider states that it does not retain this data after serving the request, and it is never combined with other data or used to build a profile. We ourselves receive no logs, statistics or visitor reports of any kind.
This website is hosted by statichost.eu, operated by Variable Object Assignment, Svartmangatan 9, 111 29 Stockholm, Sweden, acting as our processor under a data processing agreement. All processing takes place within the EU/EEA. There are no transfers to third countries, and no US cloud infrastructure is involved at any layer of the hosting stack.
Our host states that it does not store personal data relating to website visits: your IP address is processed only to the extent needed to send you the pages you request, and is not retained. It sets no cookies on hosted sites and uses no third-party processors for website data.
To be clear about the limits of this: the only personal data reaching our host is the technical information needed to deliver a web page, which is unavoidable for any website. No client files, case details, correspondence, marketing data or tracking data are held there. The site is a set of static pages with no database and no user accounts.
If you email us
We ask you to contact us by email rather than through a form, deliberately: it means no third-party service sits between you and us.
When you write to us we receive whatever you choose to include, typically your name, email address, and the details of your situation. We use this solely to answer you and, if we go on to work together, to provide the services you engage us for. The legal basis is the taking of steps at your request prior to entering a contract, and performance of that contract (Article 6(1)(b) GDPR).
Where we instead contact a company or professional directly about our services as part of our own business development, the legal basis is our legitimate interests in offering services relevant to that business (Article 6(1)(f) GDPR). You can object at any time and we will stop.
What that means for your message depends on where you write from. If you also use Proton Mail, your email to us is end-to-end encrypted and nobody in between can read it. If you write from Gmail, Outlook or most other providers, your message is encrypted in transit but is not end-to-end encrypted, and your own email provider can read it. Subject lines and email addresses are never end-to-end encrypted, whichever provider you use.
So if you need to send us something particularly sensitive, such as financial statements, documents identifying family members, or anything commercially confidential, tell us first and we will set up a password-protected exchange or PGP, either of which is end-to-end encrypted regardless of your provider.
For calls we use Proton Meet, where the audio, video, screen sharing and chat are end-to-end encrypted by default, so the provider cannot access the content of the meeting. Proton's servers still see basic connection metadata, such as when a meeting took place and how long it lasted. If you would prefer a different platform, tell us and we will accommodate it.
We keep correspondence for as long as needed to deal with your enquiry and, where an engagement follows, for the periods required by professional and tax record-keeping rules in the relevant jurisdictions. Enquiries that do not lead to an engagement are deleted once they are no longer relevant.
Who else sees your data
Our email provider
Our email and associated services are provided by Proton AG, Geneva, Switzerland, acting as our processor. Switzerland is recognised by the European Commission as providing an adequate level of data protection, so no additional safeguards are required for the storage of your correspondence. Your messages are therefore held under Swiss law and Swiss privacy protections, separately from the hosting of this website.
Our advisors, and where they work
We are an international firm and we work with independent consultants and local specialist firms rather than a single office. Our people work from a number of countries, and some of them are outside the European Economic Area. In practice this means your correspondence and case details may be read, and your matter discussed, from a country outside Europe.
This is not incidental to the service. It is the service. If you ask us about leaving one country for another, the person best placed to answer is usually qualified in, and working from, one of those countries. We tell you who is involved in your matter, and we share only what that person needs in order to advise you.
The legal basis for that
Where personal data is made available outside the EEA in the course of your matter, we rely on the following, depending on the circumstances:
- Necessity for your contract. Where the transfer is necessary to perform the engagement you have entered into with us, or to take steps at your request before entering one, we rely on Article 49(1)(b) GDPR. This covers most of our work, because the cross-border element is the reason you came to us.
- Necessity for a contract in your interest. Where we instruct a local firm on your behalf, for example to make a filing or complete a registration in another country, we rely on Article 49(1)(c) GDPR.
- Appropriate safeguards. Where a consultant or firm processes personal data on our behalf rather than as an independent professional, we put a written agreement in place and, where the country has not been recognised as providing adequate protection, incorporate the European Commission's Standard Contractual Clauses.
- Your explicit consent. Where none of the above applies and a transfer would still be useful to you, we will ask you first and explain the risks, under Article 49(1)(a) GDPR.
You should understand what this means in practice: countries outside the EEA do not all provide the level of protection guaranteed within it, and in some the authorities have broader powers of access to data than in Europe. Where we rely on a derogation rather than on adequacy or Standard Contractual Clauses, you have fewer enforceable remedies in the destination country than you would within the EEA. If you would prefer your matter to be handled only within Europe, tell us at the outset and we will say whether that is possible for what you need.
Independent professionals
Where a local lawyer, tax advisor or accountant advises you in their own name, they act as an independent controller of your data and are bound by their own professional confidentiality rules and their own privacy notice, not ours. We will tell you when this is the case.
What we never do
We do not sell personal data, we do not share it for marketing purposes, we do not use it to build profiles, and we do not disclose it to anyone who is not working on your matter, except where we are legally required to do so.
Your rights
Under the GDPR you may request access to the personal data we hold about you, ask us to correct or erase it, ask us to restrict how we use it, object to processing based on legitimate interests, and request a copy in a portable format. To exercise any of these, write to info@notabugroup.com.
You also have the right to complain to a data protection supervisory authority in the country where you live or work. In Germany, that is the authority of the relevant federal state; a list is published by the Federal Commissioner for Data Protection and Freedom of Information.
Changes
If we change how this site works, for example by adding a booking tool or analytics, we will update this page before doing so, and if the change involves storing anything on your device we will ask for your consent first.