Privacy Policy

Last updated: October 2026

This is a translation for your convenience. In case of any discrepancy, the German version is legally binding.

This policy explains which personal data we process when you visit this website, use your customer account, take out a subscription and when the SmartCut 2026 software checks its licence.

1. Controller

NOVA GmbH
Danziger Str. 23
47665 Sonsbeck
Germany
Email: datenschutz@vecap.eu

We have not appointed a data protection officer, as there is no legal obligation to do so.

2. Visiting the website and server logs

Each time the website is accessed, our web server automatically stores the date and time, IP address, requested address, referrer (the page visited before), browser and operating system (user agent), HTTP status code and response time. To prevent abuse, the number of requests to the licence interface is also counted briefly per IP address in memory. Technical errors additionally create error logs.

This serves the secure and stable operation of the website as well as the analysis of errors and abuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in these purposes. Server logs are deleted after 14 days unless an entry is needed longer to investigate a specific security incident.

The website does not embed any external fonts, scripts or third-party content. We do not use any analytics or advertising services.

3. Cookies

We only use technically necessary cookies:

  • Sign-in cookie: keeps you signed in to your customer account. It is deleted when you close your browser; if you choose to stay signed in when logging in, it remains valid for up to 14 days.
  • Security cookie: protects forms against forged requests (CSRF) and is deleted when you close your browser.
  • Notice cookie: carries short status messages in the customer account over to the next page and is deleted once displayed, at the latest when you close your browser.
  • Language cookie: remembers the language you have chosen for the website (German, English, French, Italian or Spanish) and is deleted after one year.

Storing and reading these cookies is strictly necessary for the service you have requested (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG); consent is therefore not required. The subsequent data processing is based on Art. 6(1)(b) and (f) GDPR.

4. Customer account

To register, we need your first and last name, email address, billing address and a password. You may optionally provide a title, company and telephone number. We store passwords only as a cryptographic hash. Failed sign-in attempts are counted to protect the account against password guessing.

The legal basis is Art. 6(1)(b) GDPR (contract and pre-contractual measures); for the optional details, Art. 6(1)(f) GDPR, our legitimate interest being to address you correctly and to contact you easily if we have questions.

5. Subscription and billing data

When you take out a subscription, we additionally process your billing details, your VAT ID if applicable, the type of subscription, term, price and payment status. We store a copy of the billing details with the subscription at the time it is taken out, so that the details on your invoices remain correct even if you change them in your account later. Your product key is stored in encrypted form so that you can retrieve it in your customer account at any time.

The legal bases are Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR (obligations under commercial and tax law).

6. Payment processing via PayPal

Payments are processed via PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. When you take out a subscription, you are redirected to PayPal and enter your payment details there directly; we do not receive any bank or card details. We transmit the amount, currency or subscription plan and an internal reference number to PayPal, but not your name or address from the customer account.

From PayPal we receive transaction or subscription identifiers and payment events. We store these events as proof of payment; depending on the event, they may also contain details transmitted by PayPal such as your name and email address. The legal basis is Art. 6(1)(b) GDPR.

PayPal processes your data under its own responsibility and may also transfer it to countries outside the EU, for example to the USA. According to PayPal, it relies among other things on binding corporate rules (Art. 47 GDPR). For more information, please see the PayPal privacy statement and the PayPal Binding Corporate Rules.

7. Emails

We send you emails that are necessary for the contractual relationship, such as the welcome email with your trial key after registration, a one-off reminder shortly before your trial ends and the link for resetting your password (Art. 6(1)(b) GDPR). We do not send advertising emails or a newsletter. Our mail server runs on our own server and logs technical sending data such as sender, recipient and time; these logs are deleted after 14 days (Art. 6(1)(f) GDPR, our legitimate interest being operational security and error analysis).

If you write to us, we process your details to handle your request (Art. 6(1)(b) or (f) GDPR).

8. Licence check of the SmartCut 2026 software

The software is activated with a key – the free 14-day trial key you receive when you register, or the key of your subscription. The software contacts our licence server on activation, regularly to check and renew the licence and when it is deactivated. The following data is processed:

  • product key or licence ID and product code,
  • a randomly generated installation ID,
  • a device fingerprint: on your device, the software creates a hash value from the Windows installation ID, the serial number of the system drive, the processor name and the installation ID. Only this hash value is transmitted to us, not the original values,
  • the times of activation, last check and deactivation,
  • an event log of activation processes in which the IP address is stored only as a hash value (pseudonymised).

The data is used to provide the licence, to comply with the agreed number of devices and to detect abuse. This includes ensuring that the free trial can only be used once per device: when a trial key is activated, we compare the hash value of the device fingerprint with previous trial activations. This includes ensuring that the free trial can only be used once per device: when a trial key is activated, we compare the hash value of the device fingerprint with previous trial activations. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for detecting abuse. Reading the device characteristics is strictly necessary for the licence service you have requested (Section 25(2) no. 2 TDDDG).

9. Recipients and processors

Our website, our database and our mail server run on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in Germany. Backups are also stored at Hetzner. Hetzner acts as a processor on the basis of a contract pursuant to Art. 28 GDPR.

In addition, data is received by PayPal (see section 6) and, where required by law, tax advisers and authorities. Beyond that, we do not pass on or sell your data. Except in the case described in section 6, we do not transfer data to countries outside the EU or the EEA.

10. Storage period

  • Customer account: until the account is deleted. You can request deletion at any time by email to the address given above.
  • Contract and licence data: for the term of the subscription and thereafter until the statutory limitation period expires (generally three years from the end of the year, Sections 195, 199 of the German Civil Code, BGB).
  • Invoices and accounting records: for the statutory retention periods of generally six to ten years (Section 147 of the German Fiscal Code, AO; Section 257 of the German Commercial Code, HGB; Section 14b of the German VAT Act, UStG).
  • Server and mail logs: 14 days.
  • Backups: are overwritten after 14 days; deleted data may still be contained in backups until then.

11. Your rights

You have the right to:

  • access (Art. 15 GDPR),
  • rectification (Art. 16 GDPR),
  • erasure (Art. 17 GDPR),
  • restriction of processing (Art. 18 GDPR),
  • data portability (Art. 20 GDPR).

Right to object (Art. 21 GDPR): Where we process data on the basis of Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation.

An email to datenschutz@vecap.eu is sufficient for your request. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the country where you live or where our company is based. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen).

12. Obligation to provide data and automated decision-making

The details marked as required are necessary to conclude the contract and to issue invoices; without them we cannot set up an account or a subscription. We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

13. Data security

The connection to this website and to the licence server is encrypted using TLS. We protect your data through technical and organisational measures, including restricted access rights.

14. Changes

We will update this policy if our processing or the legal situation changes. The version published on this page applies.