Privacy Policy

1. Scope and service identity

This Policy applies to the NOVA PMS website, cloud application, support, and subscription services. The service is owned and operated by KHALID SAAD Q ALANAZI from Al Khobar, Saudi Arabia.

Privacy questions and requests may be sent to info@nova-pms.com.

2. Data processing roles

NOVA acts as a controller for account creation, subscriptions, support, and security logs where it determines the processing purposes.

For guest and reservation data entered by a property, the property is the controller and NOVA acts as its processor to provide the service under its instructions. Guests should first direct reservation data requests to the relevant property.

3. Data we collect

• Account and contact data: name, email, mobile number, username, and property name.
• Subscription and billing data: plan, subscription status, amounts, currency, and payment transaction identifiers. NOVA does not store complete card numbers or security codes.
• Usage and security data: IP address, login times, device and browser, activity and error logs, and password recovery attempts.
• Operational data entered by the property: units, reservations, guest information, identification numbers where legally required, payments, notes, and reports.
• Integration data: reservation identifiers and calendar information received from services connected by the Customer.
• Support correspondence and feedback sent to NOVA.

4. Data sources

We receive data directly from account holders and property users, from use of the system, and from payment, email, hosting, and integration providers activated by the Customer. Properties may receive guest data directly from guests or a connected booking platform.

5. Processing purposes

• Create and verify accounts and provide trials and subscriptions.
• Operate property, reservation, guest, unit, payment, and reporting functions.
• Send service communications such as welcome, password recovery, and essential alerts.
• Process billing, reconcile payments, and manage renewal and cancellation.
• Protect accounts, prevent fraud, investigate faults, and improve performance.
• Provide support, respond to requests, and comply with legal and judicial obligations.

6. Legal basis and consent

We process data as necessary to perform the service contract, meet legal obligations, protect legitimate interests related to security and service development, or based on consent where required by law. Consent may be withdrawn for consent-based processing without affecting earlier processing or legal requirements.

7. Sharing and service providers

NOVA does not sell personal data. We may share the minimum necessary data with hosting, email, payment, backup, and technical support providers, or with authorities where legally required.

Service providers are subject to appropriate contractual and security obligations and may only process data to provide the requested services. The provider list may change as the operational infrastructure develops.

8. Hosting location and international transfers

Service data is hosted in a European data center located in the United Kingdom. Personal data may therefore be transferred from Saudi Arabia to the United Kingdom for hosting, operations, and backup.

NOVA seeks to limit transfers to necessary data and apply appropriate safeguards and legal requirements to protect data transferred outside Saudi Arabia.

Email, payment, or support services may involve providers processing limited data in other countries depending on services enabled by the Customer.

9. Retention and deletion

• Account and operational data is retained while the account is active and as needed to provide the service.
• After cancellation, Customers have thirty days to request export, after which operational data may be deleted from active systems.
• Backups may remain for up to ninety days before secure rotation or deletion.
• Billing, security, and dispute records may be kept longer where legally required or necessary to establish rights.
• De-identified data that does not identify a person may be retained for statistics and service improvement.

10. Security

We apply reasonable organizational and technical safeguards, including access controls, password hashing, encrypted connections where available, activity logs, backups, and need-based access restrictions.

No electronic method is entirely risk-free. Customers must protect login details, manage employee permissions, and immediately report suspected account compromise.

11. Cookies and sessions

NOVA uses essential session cookies and storage technologies for login, security, and user preferences such as language. Limited analytics may be used to measure website performance, and consent will be requested where legally required.

12. Data subject rights

• Be informed about data collection and processing purposes.
• Access personal data and request a copy, subject to legal requirements.
• Request correction, completion, or updating of inaccurate data.
• Request deletion or restriction where the right applies by law.
• Withdraw consent where consent is the legal basis for processing.
• Complain to NOVA or the competent data protection authority in Saudi Arabia.

To protect data, we may request sufficient information to verify the requester’s identity and relationship to the account or reservation.

13. Children’s data

The service is intended for businesses, not children. If a property enters a minor’s data as part of a reservation, the property is responsible for the appropriate legal basis, required consent, and data minimization.

14. Incidents and changes

If a data incident occurs, NOVA will take containment, assessment, and notification steps required by applicable law. We may update this Policy when services, processors, or laws change. The revision date will be published and material changes will be communicated where reasonably possible.

15. Contact and rights requests

Send requests to info@nova-pms.com with the subject “Privacy Request.” Owner: KHALID SAAD Q ALANAZI. Location: Al Khobar, Saudi Arabia.