Infrastructure, jurisdiction and governmental access

Last updated: 19 October 2026. This page is referenced in Section 5.4.12 of the Terms of Service and forms part of the Agreement. It is published under Article 28(1) of Regulation (EU) 2023/2854 and is kept up to date. The contractual description of processing locations is Annex I, Part D of the Data Processing Agreement; where this page and the DPA differ, the DPA prevails.

1. Jurisdiction of the ICT infrastructure

All ICT infrastructure used to provide the Services is located in the European Union and is subject to the law of the European Union and of the Member State in which it is located. No part of the Services is provided from, and no customer data or hosted content is stored or backed up in, a country outside the EU or the EEA.

Primary production location

LuxConnect DC1.1, Luxembourg (Grand Duchy of Luxembourg). NovaNode-owned hardware and network equipment, colocated. Jurisdiction: Luxembourg.

Secondary location

Premises controlled by NovaNode in another European Union Member State, NovaNode-owned hardware. Used for encrypted backup storage and internal operational systems used in the administration and support of the Services. Jurisdiction: that Member State and the European Union. Details of the specific facility are available to Customers on request under Section 13.5 of the DPA.

Operator of the infrastructure

MikeNetworks S.à r.l.-S. trading as NovaNode, 2 Rue Jean Engling, L-1466 Luxembourg, RCS Luxembourg B294237. NovaNode owns and operates all servers, storage, hypervisors, mail systems, backup systems and the customer portal and ticketing systems itself.

Sub-processors

None. NovaNode engages no sub-processor for customer data (DPA Annex III, novanode.eu/legal/subprocessors.pdf).

Colocation and connectivity suppliers

LuxConnect S.A. provides premises, power, cooling and physical security at the primary location and has no logical access to customer data. IP transit and connectivity suppliers carry traffic and have no access to stored data. They are not sub-processors (DPA Section 8.6 and Annex III).

Governing law

Luxembourg law (Terms of Service Section 12, DPA Section 16.4). Competent supervisory authority: Commission nationale pour la protection des données (CNPD), 15 Boulevard du Jazz, L-4370 Belvaux.

2. Location per Service

Technical description of the primary datacenter (certification, power, connectivity) is on the Infrastructure page. That page is informational; this page and the DPA are the contractual statements.

3. Data that leaves the EEA, and why it is not covered by this page

This page describes the infrastructure on which customer data and hosted content are processed. Three limited categories of account and order data, for which NovaNode is controller and not processor, are handled by third parties that process outside the EEA: payment data and identity verification data (Stripe Payments Europe, Limited, with onward transfer to Stripe, Inc.), and order data submitted for fraud screening (MaxMind, Inc.). None of these categories includes content hosted on the Services, and the transfers take place under the EU-US Data Privacy Framework and the standard contractual clauses as set out in Section 6 of the Privacy Policy. Website visitor data is addressed in Section 6.2 of the Privacy Policy.

4. Measures against unlawful international governmental access or transfer

Article 32 of Regulation (EU) 2023/2854 requires NovaNode to take all adequate technical, organisational and legal measures to prevent international and third-country governmental access to, and transfer of, non-personal data held in the Union where that access or transfer would conflict with Union law or the law of a Member State. The following measures apply. Personal data is protected by the corresponding obligations in Section 14.5 of the DPA and Section 10 of the Privacy Policy.

Legal measures

• No infrastructure, operator, sub-processor or backup location is subject to the jurisdiction of a third country. All data at rest is within the EU and under the control of a Luxembourg company.
• NovaNode acts on a disclosure request only where it is required to do so, or lawfully permitted to do so, under applicable law, a binding order, a lawful request from a competent authority, a court order or a valid request under European Union or Luxembourg law (Terms of Service Section 9.9.1). This includes European Production Orders and European Preservation Orders under Regulation (EU) 2023/1543 (Section 9.9.2).
• A decision or judgment of a court or an administrative authority of a third country requiring access to or transfer of data is recognised or enforced only where it is based on an international agreement in force between that third country and the European Union or a Member State, such as a mutual legal assistance treaty, in accordance with Article 32(2) of Regulation (EU) 2023/2854. In the absence of such an agreement, NovaNode discloses only the minimum permitted under Article 32(3) and after the conditions of that provision are met.
• Each request is reviewed for validity, scope and the authority of the requester. NovaNode discloses only the minimum information the request lawfully requires and challenges a request it considers unlawful, overbroad or disproportionate (DPA Section 14.5, Privacy Policy Section 10).
• To the extent legally permitted, NovaNode notifies the Customer of a legally binding request for disclosure of its data before complying. Where NovaNode is prohibited from notifying the Customer, it uses reasonable efforts to obtain a waiver of that prohibition and notifies the Customer as soon as permitted (DPA Section 14.5). Notice may be withheld where it is prohibited by law, restricted by an order, would prejudice an investigation or create a risk of destruction or alteration of evidence (Terms of Service Section 9.9.3).
• Customer data is not processed for NovaNode's own purposes and is not disclosed to any third party except as described above (DPA Section 5.5).

Technical measures (DPA Annex II)

• Backup archives are encrypted at rest at both locations. Encryption at rest is applied to production storage where the platform and storage configuration support it; the position for a specific Service is available on request.
• All customer-facing and administrative connections are encrypted in transit (TLS 1.2 or higher, HSTS enabled). Administrative access uses key-based authentication over encrypted channels; password-based administrative access to servers is disabled.
• Network segmentation between management, production and customer-facing networks, with stateful firewalling and default-deny ingress. Hypervisor-level isolation between customer instances.
• No routine transport of customer data on removable media. Secure erasure of storage media before reuse and secure destruction before disposal.
• Platform backups are held on storage separate from production data, with a retention window of seven to thirty days.

Organisational measures

• Access to customer data is granted on a need-to-know basis under role-based access controls and is logged (DPA Section 6.2).
• Physical access at the primary location is controlled, logged and monitored by the facility operator. At the secondary location, equipment is in a locked rack in premises controlled by NovaNode; physical access is restricted to a single named individual and no third party holds access (DPA Annex II, paragraph 2).
• Personnel are bound by confidentiality undertakings without limit of time (DPA Sections 6.1 and 6.3).
• Lawful access and authority requests are handled through a single channel, contact​[at]​novanode​.​eu, and are recorded (Privacy Policy, contact section and Section 10).

5. Transparency about requests received

NovaNode publishes a yearly transparency report at novanode.eu/transparency: the number of requests for customer data received from authorities, by origin, how many led to disclosure, and the abuse notices handled. A Customer may ask whether NovaNode has received a legally binding request concerning its data, and NovaNode answers to the extent it is legally permitted to do so (DPA Section 14.5).

6. Changes to this page

NovaNode keeps this page up to date. A change of processing location, the engagement of a sub-processor or a change of operator is notified under Section 8.2 of the DPA and Section 8.1.7 of the Terms of Service before it takes effect, with the objection and termination rights set out there. The date at the top of this page is the date of the last change.

7. Contact

contact​[at]​novanode​.​eu. Postal address: MikeNetworks S.à r.l.-S., 2 Rue Jean Engling, L-1466 Luxembourg.