Privacy policy

Last updated: October 27, 2026

Processing of your data

What data?

• Contact: full name, email address, organization and job title (optional), topic and message of your request, page from which it was sent, date.
• Audience: pages viewed and their sequence, referring page or website and campaign, date and duration of the visit, device type, browser, languages, country, city and network name derived from the IP address at the time of the visit (the IP address is not kept), interactions with links and with the contact form (fields filled in, without their content).
• Bot protection on the form: technical signals analyzed by Google's reCAPTCHA service (IP address, browser, interactions with the page) and the resulting trust score.
• Technical server logs: IP address, date, page requested, browser.

For what purpose?

• To respond to your contact requests when you use the contact form.
• To handle your requests to exercise your rights.
• To measure our website's audience and improve its content (overall statistics).
• To protect the contact form against bots and abuse, and keep the website secure.

On what legal basis?

• Your consent, given when you fill in the contact form.
• Our legitimate interest in measuring our website's audience and keeping it secure.
• Compliance with our legal obligations, for requests to exercise your rights.

Recipients

Access to the data is strictly limited to the persons authorized by Novelis to carry out the purposes described above. This data may also be disclosed to the legally competent authorities, to meet our legal, regulatory and contractual obligations.

The data is also processed by our technical service providers, bound by contract: website hosting, Microsoft 365 (notification of requests to our team) and Google (bot protection). Google and, for occasional technical access, Microsoft may process data in the United States. These transfers are governed by the European Commission's adequacy decision of July 10, 2023 (EU-US Data Privacy Framework) for certified companies, and otherwise by the European Commission's standard contractual clauses.

Security of your data

To ensure the security, integrity and confidentiality of your data, protective measures have been put in place and are checked regularly. Access to your data is limited to the persons who need to know this information.

However, there may be a risk of loss or destruction of your data.

Retention period

Contact data

Contact requests: 3 years from our last exchange; irrelevant requests (spam): 90 days.

Audience data

Audience measurement: 13 months, then daily totals only.

Server logs

Website security: 6 months.

Your rights

You can exercise your rights by writing to info@novelis.io or by mail to: Novelis, DPO, 40 avenue des Terroirs de France, 75012 Paris.

Your request must clearly state the right or rights you wish to exercise, and include in particular:

• your last name and first name;
• the address at which you wish to be contacted;
• a photocopy of a signed identity document, so that we can verify your identity.

If the information provided is not sufficient to process your request, we may ask you for additional information.

Under Article 12(3) of the General Data Protection Regulation (GDPR), we undertake to respond within one month. If the complexity of your request requires it, this period may be extended by two months; we will then inform you within one month.

Access and rectification

You can ask Novelis whether your data is being processed. You have a right of access to your data and a right to obtain a copy of it, under the conditions set out in Article 15 of the GDPR. You can ask for your data to be rectified or completed.

Information

This policy informs you of how your data is processed. If our processing changes, we will inform you.

Objection

When processing is based on our legitimate interest, you can object to it.

Restriction

You can ask for the processing of your data to be restricted.

Portability

You can ask for a copy of the data concerning you, under the conditions set out in Article 20 of the GDPR.

Withdrawal of consent

When processing is based on your consent, you can withdraw it at any time. This withdrawal does not affect processing carried out earlier with your consent.

Erasure

You can ask us to delete your data. We will grant your request when:

• the data is no longer necessary for the purposes;
• we no longer have a legal basis justifying the processing.

However, we cannot act on your request if the retention of your data is required by law or regulation.

Right to lodge a complaint

If you believe that the processing of your data does not respect your rights, you can file a complaint with the competent authority. In France, this is the Commission nationale de l'informatique et des libertés (CNIL, the French data protection authority):

• by mail: 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07;
• online: cnil.fr/fr/plaintes.

Cookies

The www.novelis.io website uses an audience measurement cookie set by our servers. This cookie, exempt from consent, is only used to produce overall traffic statistics and cannot track your browsing on other websites. No advertising cookies are set. The bot protection on the contact form may also lead Google to set cookies or local storage data, which are necessary for this protection.

lb_m · 13 months, not extended

Audience measurement: tells first visits from later ones, in overall statistics.

_GRECAPTCHA (and rc::* local storage data) · up to 6 months, according to Google

Protects the contact form against bots (Google reCAPTCHA).

You can object to audience measurement at any time from this page; it is also turned off when your browser sends the Global Privacy Control or Do Not Track signal.