Legal

Privacy Policy

Last updated: September 7, 2026

This policy explains what information Nova Exhibits ("Nova", "we", "us") collects when you use novaexhibits.com and novaexhibits.co.uk, and how we use it. That includes asking for a quote, placing an order, and creating an account if you choose to. Two companies trade under that name, one for each site — see who we are for which one holds your data.

Contents

Who we are
Information we collect
How we use it
Payments
Sharing & processors
Cookies, storage & analytics
Data retention
Your rights
California
Do Not Track & GPC
International transfers
Children
Changes
Contact

1. Who we are

Nova Exhibits designs and builds a modular exhibition stand system. It is a trading name used by two companies, one for each of our sites, and the one that operates the site you are on is the data controller for the information it collects about you.

novaexhibits.co.uk: Northern Makers Ltd, trading as Nova Exhibits. Registered in England and Wales. Registered office: Unit 5, Overtown Farm, Warburton WA13 9TG, United Kingdom.
novaexhibits.com: Black Peak North LLC, trading as Nova Exhibits.

Both companies use the same systems and the same suppliers, listed in section 5, and the records they hold live in the same place: a Firebase project in London (see section 11). For any privacy question, contact us at support@novaexhibits.co.uk.

2. Information we collect

We collect only what we need to respond to you, fulfill orders, and run an account if you create one:

Information you give us: when you submit a "Request a quote" form or contact us: your name, email, phone, company, and details about your stand (footprint, show date, needs).
Your email address, if you ask to be told when we open: the sign-up form on our home page stores your email address, the date you asked, and which of our two shops you asked from. Nothing else — no name, and nothing about how you came to the page.
Account information: if you create a Nova account, we store the email address you sign in with, a sign-in identifier, and how you signed in. You can sign in with Google, or by asking us to email you a one-time link. We do not set or store a password. If you use Google, we also receive the name and profile picture Google sends with that sign-in, if any. An account is optional: you can ask for a quote and place an order without one.
Saved stands and artwork: if you ask us to save a design, we keep that configuration in your account, together with any artwork you upload to it. A stand left only in your browser (see §6) stays on your device until you save it, submit a quote, or place an order.
Order information: when you purchase through the configurator: your configuration, the priced quote, and order status. We also keep the billing name and address you give at checkout, and a VAT or tax number if you enter one, because an invoice cannot be issued without them and we are required to keep a copy of every invoice we issue. Payment card and bank details are entered directly with our payment processor and are not stored on our servers (see §4).
Technical information: basic, standard server logs (such as IP address and request data) used to operate and secure the site (see §6).

3. How we use your information

To respond to quote requests and provide customer support.
To create and operate your account, if you have one, including keeping you signed in and showing you the orders placed with that email address.
To save a stand you asked us to keep, and to store artwork you uploaded to it.
To process, fulfill, and support your orders.
To operate, secure, and improve the site.
To send service communications related to your request, order, or account — a sign-in link, an order confirmation, a fulfilment update, or a reply to a data request. None of those is marketing.
To tell you that we have opened, if you asked us to on the home page. That is the only thing that list is used for, and asking to be told is the only way onto it — we never add an address because you enquired, bought something, or created an account.
We do not send marketing emails unless you opt in, and you can unsubscribe at any time.

We process this information because it is necessary to perform a contract with you, to respond to your requests, and for our legitimate interest in running our business, or with your consent where required by law.

The home-page email list is the one thing here we rely on your consent for, because it is the one thing that is neither a reply to you nor part of an order. You give that consent by typing your address and pressing the button, and you can withdraw it at any time — every email we send you will carry an unsubscribe link, and one box on our data request page takes you off the list on the spot without needing one, with nothing to confirm and no wait. Withdrawing it costs you nothing else: the list is separate from your orders and your account, and coming off it does not affect either.

4. Payments

Payments are processed by Stripe. When you check out, your card or bank details are submitted directly to Stripe's hosted checkout; Nova does not receive or store full payment details. Stripe's handling of your data is governed by Stripe's Privacy Policy.

Stripe also issues your invoice and emails it to you after payment. It carries the billing details you entered at checkout and the VAT number of the company you bought from, which is named in section 1.

We do not sell your personal information. We share it only with service providers who help us run the business:

Stripe, Inc.: payment processing (card & ACH checkout).
Google Firebase (Google LLC): website hosting, serverless functions, authentication, and secure storage of orders, quote requests, saved stands, and uploaded artwork. If you sign in with Google, Google authenticates you and we receive the identity it sends. If you ask for an email sign-in link, Firebase Authentication sends that email.
Resend (Resend, Inc.): transactional email we send about a quote, an order, or a data request, and the copy we send our team when one of those arrives. Resend does not send the sign-in link; that is Firebase, above.
Plausible Analytics (Plausible Insights OÜ, Estonia): privacy-focused website analytics. Visitor data is processed and stored in the EU and does not leave the EU. See section 6.

We may also disclose information if required by law or to protect our rights.

6. Cookies, storage & analytics

We set no cookies at all — not for advertising, not for analytics, and not for running the site. We do store a small number of items in your browser, all of them strictly necessary for something you asked us to do, and every one of them is listed here:

nova_signin_email, nova_signin_intent — set only if you ask to sign in by email link, so the link returns you to where you left off. Cleared once you are signed in.
Sign-in token — stored by Google Firebase Authentication in your browser's IndexedDB if you sign in. It is what keeps you signed in. Removed when you sign out.
nova_draft_v1 — the stand you are building, saved on your own device so a refresh does not lose your work. It stays in your browser until you submit a quote or place an order.
nova_reorder — carries a past stand into the configurator when you choose to re-order. Cleared once used.
nova_region — remembers whether you are shopping in pounds or dollars.
nova_catalog_v1 — a copy of our product list, so a page can show the right products straight away. Our catalogue, not anything about you.
nova_consent, plausible_ignore — your answer to the privacy banner, stored so we can honour it and stop asking.

We use no advertising cookies, no social media pixels, no session recording, and nothing that tracks you across other websites. Our fonts are served from our own domain rather than from Google Fonts, so that simply reading a page here does not disclose your IP address to anyone else. Our Cookie Policy covers all of this in more detail.

To understand how the site is used we use Plausible Analytics, which is designed not to collect personal data. It sets no cookies, stores no persistent identifier, and writes nothing to your device. It records only aggregate measures: the page visited, the referring site, approximate location (country, region, city), and browser, operating system, and device type, together with a small set of milestones — a design started or saved, a quote submitted, a checkout started, a purchase completed, a page not found — none of which carries your name or contact details.

Plausible is loaded through our own domain rather than from plausible.io, so your browser never contacts an analytics server directly. Our server passes each measurement on, and in doing so it forwards your IP address and browser user-agent to Plausible. Plausible uses them to generate a daily identifier, by hashing them together with our domain and a rotating salt. Neither your IP address nor your user-agent is stored, and the salt is deleted every 24 hours, so the same visitor cannot be recognised from one day to the next. Analytics data is processed and stored in the EU.

Your choice. Analytics is on by default, and you can switch it off at any time and switch it back on again just as easily: We rely on our legitimate interest in understanding how the site is used, rather than on your consent, because nothing here is stored on or read from your device — and the right that accompanies a legitimate interest is the right to object, which that button exercises immediately. Turning it off never limits any part of the site.

7. Data retention

We keep quote requests and order records for as long as needed to provide our services and to meet legal, tax, and accounting obligations, then delete or anonymize them. In general, we keep quote requests for up to 24 months and order records for up to 7 years to meet legal, tax, and accounting obligations.

An email address left on the home page is deleted — not anonymised, deleted — 36 months after the last time you asked to be on the list, or straight away if you unsubscribe or ask us to remove it. Consent goes stale, and an address we have had for years without ever writing to it is not something you agreed to recently.

Your account, the stands you saved, and any artwork on them are kept until you delete the account or we close it. There is no automatic sweep: a saved stand does not expire because you have not opened it. Deleting the account removes those records outright. Orders already placed are anonymised and kept for the seven years above; deleting an account does not cancel a sale or erase the fact of one.

A record that we sent you a message is kept for up to 24 months, then deleted. It is a log of the send, not a copy of your inbox.

8. Your rights

Under UK and EU GDPR, you may have the right to access, correct, delete, or port your data, and to object to or restrict certain processing. The quickest way to exercise any of them is our data request form, which also lets you delete your account outright if you have one. You can equally just email support@novaexhibits.co.uk. We answer within 30 days, it is free, and we will never treat you differently for asking. You may also contact your local data protection authority — in the UK, the Information Commissioner's Office.

9. California residents

If you live in California, the CCPA (as amended by the CPRA) gives you the right to know what personal information we collect and why, to have it deleted, to have it corrected, to receive a copy of it, and not to be discriminated against for exercising any of those rights. Use the data request form and we will answer within 45 days.

The categories we collect are set out in section 2: identifiers (name, email, phone, and, if you have an account, the sign-in address and identifier), commercial information (what you ordered and what you paid), internet activity (the aggregate analytics in section 6), and, if you save a design, the stand itself and any artwork you uploaded to it. We collect them for the purposes in section 3, we keep them for the periods in section 7, and we disclose them only to the service providers named in section 5.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising — not for money and not for anything else of value. We have never done so, including in the preceding twelve months, and we do not knowingly sell or share the personal information of anyone under 16. Because there is no sale or sharing, there is nothing for you to opt out of on that front; you can still switch off the only measurement we do, at any time, from

10. Do Not Track and Global Privacy Control

Some browsers can send a Do Not Track (DNT) or Global Privacy Control (GPC) signal on your behalf. California law requires us to tell you how we respond to them, so: we honour both. If we see either signal we switch analytics off before anything is measured, and we will not show you a banner asking a question your browser has already answered. You can still turn measurement back on for this site from the privacy choices panel if you want to.

11. International transfers

We build in the United Kingdom, and the records behind both sites are held there: the database, the file storage and the code that serves this site all run in Google's London region. An order placed on novaexhibits.com is stored in the United Kingdom for that reason, and where US law gives you rights over it, section 9 applies wherever it happens to sit.

Some of the providers in section 5 process data outside the UK. Where they do, we rely on the safeguards required for those transfers.

12. Children's privacy

Our site is not directed to children, and we do not knowingly collect information from anyone under 16.

13. Changes to this policy

We may update this policy from time to time. We'll post the new version here and update the "Last updated" date.

14. Contact us

Questions about this policy or your data? Email support@novaexhibits.co.uk, or use the data request form to delete your account or ask for a copy of what we hold.