This policy explains how KOSAL NOVIREN INC handles personal information at its gateway outpost and across the services described on this website.
Last updated 27 October 2026
This Privacy Policy is published by KOSAL NOVIREN INC, a company that operates a staffed gateway outpost in the field of computer systems design and related professional, scientific, and technical services. The company address is KOSAL NOVIREN INC, 6750 W Parkway Blvd, West Valley City - 84128-1159, United States (US). The outpost is operated under the care of the developer KosalNoviren, who is responsible for the technical design of this website and for the engineering practices described across these pages.
KOSAL NOVIREN INC acts as the controller of the personal information that it collects directly from clients, prospective clients, visitors to this website, and other individuals who choose to make contact with the outpost. Where the company processes information on behalf of a client as part of a managed gateway service, the client remains the controller of that information and KOSAL NOVIREN INC acts as a processor, handling the information only on documented instructions and only for the purposes set out in the relevant service agreement.
We take the protection of personal information seriously because the outpost exists on the boundary between organisations and the systems they depend on. That position requires discretion, and discretion requires clear rules. This policy sets out those rules in plain language so that any reader can understand what we collect, why we collect it, how long we keep it, and how a person can assert control over it.
This policy applies to personal information collected through this website, through email and telephone contact with the outpost, through the contact form that opens a mail draft in a visitors own mail application, and through the ordinary operation of managed gateway services provided to clients. It also applies to information collected in the course of a survey, a bridge configuration night, an uptime watch round, a certificate rotation day, a failover drill week, or a log triage session.
This policy does not apply to information that a client organisation holds in its own systems, even where that information passes through a gateway that we manage. It also does not apply to websites operated by other organisations, including services that we link to for convenience. Where a link leads to another website, the privacy policy of that website governs the information it collects, and we encourage readers to review it before sharing personal information.
Some services may be governed by a separate agreement, a statement of work, or a data processing addendum. Where those documents conflict with this policy, the more specific document governs the part of the relationship that it covers. This policy remains in force for everything else.
We limit collection to information that is genuinely needed to answer a question, prepare a proposal, deliver a service, or satisfy a legal obligation. The categories below describe what that means in practice.
When a person writes to the outpost, we receive the name they choose to give, their email address, a telephone number if they provide one, the name of their organisation, and any information they put in the body of the message. This is the minimum needed to reply and to keep a record of the conversation.
For clients and prospective clients we may hold business contact details, job titles, billing addresses, purchase order references, and correspondence about scope. We do not ask for payment card numbers through this website, and we do not want anyone to send card details by email.
When a visitor loads a page on this website, the web server that delivers the page may record standard technical information such as the request path, the time of the request, the response code, and a truncated network address. This information is used to keep the site available and to understand unusual traffic. It is not used to build a profile of individual visitors.
In the course of managed gateway services we may handle configuration data, peer identifiers, certificate metadata, watch entries, and log excerpts. Where these contain personal information, we treat them with the same care as contact information and limit access to the engineers who need them for the work.
Most of the information we hold is provided directly by the person concerned. This happens when a person completes the contact form, sends an email to the gateway address, telephones the outpost, attends a meeting, or responds to a request for information during a survey.
A smaller amount is collected automatically by the web server in the ordinary course of delivering pages. This automatic collection is limited to the standard request records described above and does not involve behavioural tracking, advertising pixels, or fingerprinting technology.
We may also receive information from a colleague of the person concerned, for example when a client project lead introduces an engineer who will participate in a bridge configuration night. In that case we ask the introducer to confirm that the person knows their details are being shared with us.
Where data protection law requires a lawful basis, we rely on one or more of the following.
We do not use automated decision making that produces legal effects for individuals, and we do not make decisions about individuals through profiling that would have a significant impact on them.
We use personal information for the following purposes, and for no others without a lawful basis.
We will not use personal information for a new purpose that is incompatible with the purpose for which it was collected unless we have a lawful basis for doing so and, where required, we have informed the person concerned.
The watch ledger is the record that the outpost keeps of what happened on a gateway. It contains entries about connectivity, certificate status, configuration changes, verification results, and the observations of the duty engineer. Most ledger entries concern equipment and services rather than individuals, but some entries name the engineer who performed a task or the client contact who approved a change.
We treat the ledger as an operational record and a continuity tool. Access is limited to engineers on the relevant watch and to the client contacts named in the service agreement. Where a ledger entry names an individual, that name is retained only for as long as the entry is needed for operational, contractual, or audit purposes.
Clients may request a copy of the ledger entries that concern their own gateway. We provide those entries in a readable form and explain any abbreviation or internal reference that appears in them. We do not disclose ledger entries that concern another client, even in summary form, because the ledger is confidential to each relationship.
Service providers act on our instructions and are not permitted to use personal information for their own purposes. Before engaging a provider we review its security practices, and we put a written agreement in place that covers confidentiality, security, sub-processing, and the return or deletion of information at the end of the engagement.
Where a provider is located outside the United States, we take steps to ensure that the transfer is lawful and that the information remains protected. Those steps are described in the section on international transfers.
We review our provider list at least once a year. A provider that no longer meets our requirements is replaced, and information that is no longer needed is returned or deleted in accordance with the agreement.
The outpost is based in the United States, and the primary systems used to deliver the service are located in the United States. Where a client or a service provider is located in another country, information may be transferred across borders so that the service can be delivered.
When we transfer personal information from a jurisdiction that restricts international transfers, we rely on an approved transfer mechanism. Depending on the circumstances, that mechanism may be a set of standard contractual clauses, an adequacy decision, or another lawful route. We assess the destination and the receiving organisation before the transfer takes place.
Any person who wishes to know more about the safeguards that apply to a particular transfer may contact us using the details at the end of this policy.
We keep personal information only for as long as it is needed for the purpose for which it was collected, or for as long as a legal obligation requires. The periods below describe our ordinary practice.
When a retention period ends, we delete the information or render it anonymous so that it can no longer be associated with an individual. Where deletion is technically difficult, we isolate the information and restrict access until deletion is possible.
We protect personal information with technical and organisational measures that are appropriate to the sensitivity of the information and the risks of the work that we do. Those measures include access control, encryption in transit for email and web traffic, separation of client environments, and a written procedure for responding to a security incident.
Access to client information is limited to engineers and staff who need it for the task at hand. Access is reviewed when a person joins the outpost, when a person changes role, and when a person leaves. Administrative accounts are protected with strong authentication, and changes to production systems require a recorded approval.
No system is perfectly secure, and we do not claim otherwise. If we become aware of a security incident that affects personal information, we will investigate promptly, take steps to contain the incident, and notify affected parties and the relevant authorities where the law requires it.
Depending on where a person lives, they may have some or all of the following rights in relation to their personal information.
California residents may also have the right to know the categories of personal information collected, the right to know the categories of sources and recipients, the right to request deletion, and the right to opt out of the sale or sharing of personal information. We do not sell personal information, and we do not share it for cross context behavioural advertising.
These rights are not absolute. Where a request would affect the rights of another person, interfere with a legal obligation, or prevent us from completing a contractual duty, we will explain the limitation in our response.
A request may be made by writing to gateway@kosalnoviren.mom or by calling +13096172815. The request should describe the right being exercised and the information concerned, so that we can locate the relevant records without unnecessary delay.
We will acknowledge a request promptly and will respond within the period required by applicable law. To protect personal information, we may ask for information that allows us to verify the identity of the person making the request. We will not ask for more than is reasonably necessary for that purpose.
An authorised representative may make a request on behalf of another person where the representative provides evidence of their authority. If we cannot verify a request, we will explain why and set out what is needed to proceed.
If a person is not satisfied with our response, they may contact us again to ask for a review or may lodge a complaint with the data protection authority in their jurisdiction.
This website and the managed gateway services are intended for organisations and their professional staff. They are not directed at children, and we do not knowingly collect personal information from anyone under the age of sixteen.
If we learn that we have collected personal information from a child without appropriate consent, we will delete it promptly. A parent or guardian who believes that a child has provided information to us may contact gateway@kosalnoviren.mom and we will investigate.
Where a client engages us for work that involves systems used by minors, the client is responsible for obtaining any consent required by law and for ensuring that the engagement itself is appropriate.
We do not add client contacts to a marketing list without their agreement. Where a person has opted in to receive notes about the outpost, each message includes a way to withdraw, and a withdrawal is processed promptly.
Service messages are different from marketing messages. A notice about a booked bridge configuration night, a completed certificate rotation, or a failover drill report forms part of the service relationship and is sent regardless of marketing preferences.
We do not purchase contact lists and we do not share our contact list with other organisations for their marketing purposes.
This website may link to resources operated by other organisations, such as standards bodies or technical documentation. Those resources are outside our control. We do not endorse their privacy practices and we are not responsible for the information they collect.
When a visitor follows a link to another website, the privacy policy of that website applies from the moment the link is followed. We encourage visitors to read that policy before providing personal information.
We review this policy from time to time to reflect changes in the service, in the law, or in our internal practice. When we make a material change, we update the date at the top of the page, and where the change is significant for clients we provide a direct notice.
Continued use of this website after a change takes effect indicates acceptance of the revised policy. A person who does not agree with a change should stop using the website and may contact us to discuss the records we hold about them.
Earlier versions of this policy are kept for reference and are available on request.
Questions about this policy, requests to exercise a privacy right, and complaints may be directed to the outpost using the details below.
KOSAL NOVIREN INC
6750 W Parkway Blvd
West Valley City - 84128-1159
United States (US)
Email: gateway@kosalnoviren.mom
Telephone: +13096172815
The outpost aims to answer privacy correspondence within five business days. Written requests and complaints receive a reference so that they can be followed up without repeating the background.