Short version: this website sets no cookies, runs no analytics, embeds no third-party content and tracks nothing, and it is hosted in the EU. The only personal data we handle from this site is what you choose to put in an email to us. Because our work is cross-border by nature, that correspondence may be read by advisors working outside Europe — we explain below exactly when, why, and on what legal footing.
Who is responsible
Notabu Group LLC, trading as Nomos Notabu
30 N Gould St Ste R
Sheridan, WY 82801, United States
Email: info@notabugroup.com
We are the controller for the personal data described below. We have not appointed a data protection officer, as we are not required to do so.
What this website does not do
- It sets no cookies of any kind, and stores nothing in your browser's local or session storage.
- It runs no analytics or measurement software.
- It contains no advertising, tracking pixels, or social media plug-ins.
- It loads no fonts, scripts, maps or videos from third-party servers. Typefaces are served from our own domain, so your browser does not contact any outside service while you read these pages.
- It has no contact form, and therefore no form processor receives your details.
Because nothing is stored on or read from your device, no consent banner is required and none is shown.
Server logs
Our hosting provider records standard technical information when a page is requested. This typically includes your IP address, the time of the request, the page requested, the referring page if any, and your browser and operating system.
This is processed to deliver the website securely and reliably. The legal basis is our legitimate interest in operating a functioning and secure site (Article 6(1)(f) GDPR). Our hosting provider states that it does not retain this data after serving the request, and it is never combined with other data or used to build a profile. We ourselves receive no logs, statistics or visitor reports of any kind.
This website is hosted by statichost.eu, operated by Variable Object Assignment, Svartmangatan 9, 111 29 Stockholm, Sweden, acting as our processor under a data processing agreement. All processing takes place within the EU/EEA. There are no transfers to third countries, and no US cloud infrastructure is involved at any layer of the hosting stack.
Our host states that it does not store personal data relating to website visits: your IP address is processed only to the extent needed to send you the pages you request, and is not retained. It sets no cookies on hosted sites and uses no third-party processors for website data.
To be clear about the limits of this: the only personal data reaching our host is the technical information needed to deliver a web page, which is unavoidable for any website. No client files, case details, correspondence, marketing data or tracking data are held there — the site is a set of static pages with no database and no user accounts.
If you email us
We ask you to contact us by email rather than through a form, deliberately: it means no third-party service sits between you and us.
When you write to us we receive whatever you choose to include — typically your name, email address, and the details of your situation. We use this solely to answer you and, if we go on to work together, to provide the services you engage us for. The legal basis is the taking of steps at your request prior to entering a contract, and performance of that contract (Article 6(1)(b) GDPR).
Please note that ordinary email is not end-to-end encrypted in transit. If you need to send something particularly sensitive, tell us and we will arrange a secure channel.
If a matter later calls for a call or video meeting, we will tell you in advance which service we propose to use and where that provider is established, so that you can decide whether you are comfortable with it.
We keep correspondence for as long as needed to deal with your enquiry and, where an engagement follows, for the periods required by professional and tax record-keeping rules in the relevant jurisdictions. Enquiries that do not lead to an engagement are deleted once they are no longer relevant.
Who else sees your data
Our email provider
Our email and associated services are provided by Proton AG, Geneva, Switzerland, acting as our processor. Switzerland is recognised by the European Commission as providing an adequate level of data protection, so no additional safeguards are required for the storage of your correspondence. Your messages are therefore held under Swiss law and Swiss privacy protections, separately from the hosting of this website.
Our advisors, and where they work
We are an international firm and we work with independent consultants and local specialist firms rather than a single office. Our people work from a number of countries, and some of them are outside the European Economic Area. In practice this means your correspondence and case details may be read, and your matter discussed, from a country outside Europe.
This is not incidental to the service — it is the service. If you ask us about leaving one country for another, the person best placed to answer is usually qualified in, and working from, one of those countries. We tell you who is involved in your matter, and we share only what that person needs in order to advise you.
The legal basis for that
Where personal data is made available outside the EEA in the course of your matter, we rely on the following, depending on the circumstances:
- Necessity for your contract. Where the transfer is necessary to perform the engagement you have entered into with us, or to take steps at your request before entering one, we rely on Article 49(1)(b) GDPR. This covers most of our work, because the cross-border element is the reason you came to us.
- Necessity for a contract in your interest. Where we instruct a local firm on your behalf — for example to make a filing or complete a registration in another country — we rely on Article 49(1)(c) GDPR.
- Appropriate safeguards. Where a consultant or firm processes personal data on our behalf rather than as an independent professional, we put a written agreement in place and, where the country has not been recognised as providing adequate protection, incorporate the European Commission's Standard Contractual Clauses.
- Your explicit consent. Where none of the above applies and a transfer would still be useful to you, we will ask you first and explain the risks, under Article 49(1)(a) GDPR.
You should understand what this means in practice: countries outside the EEA do not all provide the level of protection guaranteed within it, and in some the authorities have broader powers of access to data than in Europe. Where we rely on a derogation rather than on adequacy or Standard Contractual Clauses, you have fewer enforceable remedies in the destination country than you would within the EEA. If you would prefer your matter to be handled only within Europe, tell us at the outset and we will say whether that is possible for what you need.
Independent professionals
Where a local lawyer, tax advisor or accountant advises you in their own name, they act as an independent controller of your data and are bound by their own professional confidentiality rules and their own privacy notice, not ours. We will tell you when this is the case.
What we never do
We do not sell personal data, we do not share it for marketing purposes, we do not use it to build profiles, and we do not disclose it to anyone who is not working on your matter, except where we are legally required to do so.
Your rights
Under the GDPR you may request access to the personal data we hold about you, ask us to correct or erase it, ask us to restrict how we use it, object to processing based on legitimate interests, and request a copy in a portable format. To exercise any of these, write to info@notabugroup.com.
You also have the right to complain to a data protection supervisory authority in the country where you live or work. In Germany, that is the authority of the relevant federal state; a list is published by the Federal Commissioner for Data Protection and Freedom of Information.
Changes
If we change how this site works — for example by adding a booking tool or analytics — we will update this page before doing so, and if the change involves storing anything on your device we will ask for your consent first.