Last update: June 1st, 2026
This Privacy Policy explains how, when, and why your personal data is processed by Nova in connection with the use of the Nova Recruiter platform and related services (the “Service”).
For the purpose of this Policy, any reference to “Nova” shall mean any applicable company within NGlobal Holding AB, company registration no. 559240-0864, with registered address at C/O Talent Venture Group AB, Postbox 3053, 10361 Stockholm, Sweden, including its subsidiaries:
This Policy applies to all processing of personal data carried out by Nova in relation to Nova Recruiter, including data collected directly from client users (recruiters, hiring managers, or companies) and data obtained from third-party or publicly available sources integrated into the Service (such as providers of public data).
Your privacy and data integrity are essential to us. Nova handles personal data responsibly and strives to limit processing to what is strictly necessary to deliver the Service, maintain quality, and comply with legal obligations.
This Policy is established in accordance with the EU General Data Protection Regulation (2016/679) (“GDPR”), the UK GDPR, and, where applicable, Spain’s Organic Law 3/2018 (LOPDGDD) and other relevant privacy laws.
The role that Nova plays under the GDPR depends on the specific data flow within Nova Recruiter. To avoid any ambiguity, Nova distinguishes three scenarios:
This differentiation allows Nova and its clients to allocate responsibilities clearly, without relying on a joint-controllership arrangement under Article 26 GDPR.
NGlobal Holding AB (”Nova”). Reg. No. 559240-0864. C/O Talent Venture Group AB, Postbox 3053, 10361 Stockholm, Sweden
Nova has appointed a Data Protection Officer in accordance with Articles 37–39 GDPR. The DPO is responsible for monitoring compliance with data-protection laws, advising Nova on privacy obligations, and acting as the contact point for supervisory authorities and data subjects.
Email: dpo@novatalent.com
Postal: Attn: Data Protection Officer, NGlobal Holding AB, Postbox 3053, 10361 Stockholm, Sweden
You may contact the DPO for any questions or concerns about how Nova processes personal data or to exercise your data-protection rights.
Nova Recruiter contains professional information about individuals (“candidates”) gathered from:
Each such provider acts as an independent Data Controller for its own collection activity and warrants the lawful sourcing of the data. Nova acts as a separate, subsequent Controller when it integrates that data into Nova Recruiter to enable legitimate recruitment use by authorized clients. No client or candidate of Nova has any direct contractual or processing relationship with these providers as a result of using Nova Recruiter.
Data typically includes:
No sensitive data (e.g. health, religion, political views) is collected.
Nova processes this data only to:
Nova never resells or redistributes third-party data as a standalone dataset. Access is restricted to authenticated Nova Recruiter users for professional recruiting purposes only.
Nova processes candidate data obtained from public sources (directly or via providers of public data) on the basis of legitimate interest (Article 6(1)(f) GDPR).
The specific interest pursued is to operate and improve a professional-use recruitment and talent-matching platform that enables verified employer clients to identify and contact qualified professionals for genuine job opportunities.
This processing is subject to a written Legitimate Interest Assessment (LIA) confirming that it is necessary, proportionate, and limited to business-context data, with appropriate safeguards such as restricted access, opt-out rights, and exclusion of sensitive information.
Nova has performed a three-part Legitimate Interest Assessment (purpose, necessity and balancing tests) confirming that:
A summary of this Legitimate Interest Assessment can be made available upon request by contacting privacy@novatalent.com
Nova Recruiter incorporates algorithmic and AI-based functionalities — such as candidate scoring, ranking, matching and automated outreach suggestions or messages — to assist recruiter users in identifying and engaging with relevant professionals.
These operations may involve automated processing of professional data to generate recommendations or trigger limited communications on behalf of a verified client, but they do not produce legal or similarly significant effects on individuals within the meaning of Article 22 GDPR. Candidates are never automatically contacted or evaluated without a human-in-the-loop decision by a recruiter, and Nova maintains audit trails to evidence such human oversight.
All final hiring and selection decisions are taken by human recruiters or client representatives, who retain full control over whether to contact, shortlist or hire a candidate. Nova continuously reviews its AI systems to ensure appropriate human oversight, fairness, and transparency in line with GDPR principles and the EU AI Act.
Nova does not use Customer Data, candidate data uploaded or synced by a client, candidate personal data displayed in Nova Recruiter, or content of recruiter–candidate communications to train, fine-tune or otherwise improve the underlying foundation models or generative-AI systems used to power Nova Recruiter, whether developed by Nova or by third-party AI providers.
Nova’s contracts with its AI sub-processors expressly exclude model training on Nova’s data, prohibit any logging beyond what is strictly necessary to deliver the requested output, and require zero-retention or short, security-only retention windows.
Nova may use aggregated, anonymised or de-identified information that cannot reasonably be associated with an individual to monitor service quality, debug, generate statistics and improve the Service. Such information is not considered personal data under the GDPR.
Nova does not monitor or track candidates’ online behavior or activity. Processing is limited to static professional data made publicly available or lawfully sourced from verified providers of public data.
In accordance with Article 14 GDPR, you can read more about the categories of data, sources, lawful basis, and your rights in Nova’s dedicated Transparency Notice
For registered recruiters and client users we process:
Lawful basis: performance of contract (Art. 6(1)(b)).
Nova Recruiter offers optional integrations with Google Workspace (Gmail) and Microsoft 365 (Outlook) to enable recruiters to manage communications with candidates directly within the platform.
When you connect your email account, Nova will request your explicit consent to access specific data strictly necessary to support these features.
Data accessed and processed
Nova does not use connected-email data for advertising, analytics unrelated to recruitment, or any form of AI model training. Processing is fully automated within the recruiter’s account environment and is not visible to other clients.
Storage and retention
Lawful basis and consent management
The lawful basis for this processing is explicit consent under Article 6(1)(a) GDPR, obtained when you authorize Nova Recruiter to connect with your Google or Microsoft account.
You may withdraw consent at any time by:
Withdrawal of consent immediately stops all access and triggers deletion of associated cached data.
Third-party API compliance
Nova complies with the Google API Services User Data Policy, including the “Limited Use” requirements, and with Microsoft’s API and Graph Data Protection terms.
Email data is used solely to deliver user-requested functionality within Nova Recruiter and is never transferred to any external system other than the recruiter’s own workspace.
Collected automatically for security and analytics: IP address, device and browser type, login events, cookies, and telemetry.
Lawful basis: legitimate interest (ensuring security and service reliability).
Nova only shares personal data where necessary to deliver the Service, comply with legal obligations, or ensure the secure operation of our systems.
We never sell or disclose personal data for advertising or unrelated commercial purposes.
Candidate profiles are made visible only to verified Nova Recruiter clients who have entered into a contractual agreement with Nova. These clients act as independent Data Controllers for their own recruitment activities and must use the information solely for legitimate hiring purposes in accordance with the GDPR and their own privacy obligations.
Where a client exports candidate data into its own ATS or HRIS, the client becomes an independent controller for that processing and must provide its own privacy information to the candidate.
We use carefully selected third-party providers to host and operate our infrastructure, analytics, and communications. They process personal data only under Nova’s instructions and subject to strict data-processing agreements.
Current categories include:
Each provider is contractually bound to implement appropriate security measures, to process data only on Nova’s documented instructions, and not to use the data for its own purposes (including for AI model training).
Nova obtains professional data from providers of public data that act as independent Data Controllers and warrant GDPR-compliant collection of information from public business sources. Nova does not name individual providers in this Policy because they may change over time; the current list is available on request at privacy@novatalent.com.
In all cases, the relationship between Nova and each such provider is a controller-to-controller relationship. The provider is not a sub-processor of Nova and does not process Nova clients’ own data. Clients of Nova Recruiter therefore have no direct contractual exposure to those providers or their jurisdictions, and the international-transfer assessment for the provider→Nova flow is performed exclusively by Nova as the importing controller.
All controller-to-controller transfers occur under adequate safeguards in line with Articles 44–46 GDPR, including EU Standard Contractual Clauses (Module 1), encryption in transit and (where applicable) at rest, and supplementary technical and organisational measures.
Where Nova receives updated datasets from these providers, Nova applies its internal suppression lists (opt-outs and objections) to prevent re-appearance of data subjects who have exercised their rights with Nova.
Nova verifies each provider’s data-collection notices, lawful basis and removal mechanisms before onboarding, and conducts annual due-diligence reviews.
Personal data is primarily stored within the European Economic Area (EEA). When data must be transferred outside the EEA (for example, to the United States in the case of certain cloud sub-processors, or to other non-EEA jurisdictions in the case of controller-to-controller exchanges with providers of public data), Nova ensures an equivalent level of protection through:
Copies of relevant transfer mechanisms can be requested at privacy@novatalent.com.
Nova may disclose limited information where required by law, court order, or governmental request, or in connection with a merger, acquisition, or reorganisation of Nova’s business, always under confidentiality and data-protection safeguards.
Nova does not sell personal data.
Personal data processed through Nova Recruiter is primarily stored and managed on secure servers located within the European Union / European Economic Area (EU/EEA).
Nova’s main hosting provider is Amazon Web Services (AWS), with data hosted in the EU (Ireland) region under ISO 27001 and SOC 2 certifications.
Some of Nova’s trusted technology and infrastructure partners may store or access personal data from outside the EEA in order to provide technical support, maintenance, or integration services.
Whenever such transfers occur, Nova ensures that an adequate level of protection is maintained in accordance with Chapter V of the GDPR.
Depending on the provider and destination, Nova relies on one or more of the following mechanisms:
Each provider operates under a Data Processing Agreement (DPA) compliant with Article 28 GDPR, ensuring that:
Nova applies layered protection for international transfers, including:
These measures ensure that your personal data remains secure, even when processed outside the EEA.
You may request further details about Nova’s international data transfers or obtain a copy of the applicable Standard Contractual Clauses (SCCs) by contacting privacy@novatalent.com.
Nova retains personal data only for as long as it is necessary to fulfil the purposes described in this Privacy Policy or to comply with legal, contractual, or security obligations.
We regularly review the data we hold and apply minimisation, suppression, or anonymisation measures when information is no longer needed.
When retention periods expire, Nova will:
If you request deletion of your professional profile or object to our processing, we will suppress your record from search results and ensure that no recruiter can access it going forward.
Certain information may be retained for longer periods where required by law (for example, taxation or accounting regulations) or where necessary to establish, exercise, or defend legal claims.
Such data is stored securely and access is strictly limited.
Nova implements a combination of technical, organisational, and contractual safeguards to protect personal data against unauthorised access, alteration, disclosure, or destruction.
Security and privacy are integral parts of the Nova Recruiter design and operations framework.
We apply industry-standard measures, including:
These controls are reviewed periodically and updated in line with best practices and regulatory requirements.
If a personal-data breach occurs, Nova will:
We maintain documented incident-response procedures to ensure timely and effective action.
If you believe you have discovered a security vulnerability in any Nova Recruiter system, please contact us responsibly at privacy@novatalent.com with the subject line “Security Vulnerability.”
Testing must avoid accessing other users’ data, disrupting service, or breaching confidentiality obligations.
Personal data is primarily stored in Amazon Web Services (AWS) data centres located within the European Economic Area (EEA).
When data must be accessed or processed outside the EEA (e.g. by certain sub-processors), Nova ensures that EU Standard Contractual Clauses or other approved safeguards are in place, consistent with Section 5 (d) above.
Depending on your location and the nature of the data we process, you have several rights under the General Data Protection Regulation (GDPR) and related national laws. Nova is committed to enabling these rights in a clear, fair, and timely manner.
You may at any time exercise the following rights with respect to your personal data processed by Nova:
To exercise any of the rights above, please contact us at privacy@novatalent.com with the subject line “Data Rights Request – Nova Recruiter.” We may request limited information to verify your identity before processing your request. We will respond without undue delay and within one month, unless an extension is permitted under the GDPR due to complexity or volume.
If your data was obtained from a public source (directly or via a provider of public data), you can also learn more about your rights and how to object specifically to that processing in our Transparency Notice.
If we cannot identify you in our index with the information you provide, we may ask you for additional details — such as your LinkedIn URL, current employer, or public profile link — solely to locate your record. We will not retain this information after resolving your request.
If your professional data originated from a provider of public data, we will, where contractually possible, also inform that provider of your objection or deletion request so they can update their dataset accordingly.
Nova will never deny access to the Service, alter pricing, or offer different levels of service because you exercised your data-protection rights.
Nova’s Data Protection Officer conducts regular reviews of Nova Recruiter’s processing operations, including Legitimate Interest Assessments (LIA) and the Data Protection Impact Assessment (DPIA), and advises on updates to maintain ongoing GDPR compliance.
Nova maintains a Record of Processing Activities (“RoPA”) in accordance with Article 30 GDPR, covering all relevant data flows, categories, retention schedules, legal bases, and international transfers relating to Nova Recruiter.
This record is reviewed and updated periodically to reflect changes in the Service, and may be shared with competent supervisory authorities or enterprise customers upon legitimate request for compliance verification.
Nova processes professional data from public sources (directly or via providers of public data) based on legitimate interest (Article 6(1)(f) GDPR), supported by a written Legitimate Interest Assessment (LIA) evaluating necessity, proportionality, and data-subject impact.
Given the potentially large scale of candidate data involved, Nova has also assessed the need for a Data Protection Impact Assessment (DPIA) under Article 35 GDPR and will update that assessment as the Service expands or incorporates new data sources or automated functionalities.
The assessment concluded that residual risks for data subjects are low and effectively mitigated through restricted access, transparency measures, and suppression mechanisms.
To enhance transparency, Nova Recruiter includes source-attribution labels within candidate profiles, indicating whether the information originates from:
Where technically feasible, users can also view the date of the last update or verification.
This ensures that data subjects, recruiters, and customers understand the provenance and update cycle of professional data displayed in the Service.
Enterprise clients and regulators may request additional documentation such as Nova’s Article 30 RoPA summary, LIA executive summary, or DPIA statement by contacting privacy@novatalent.com.
Nova continuously monitors regulatory developments and guidance from EU and national Data Protection Authorities regarding the use of publicly sourced professional data for recruitment.
We update our privacy framework, including this Privacy Policy, the LIA, and the DPIA, to maintain compliance with evolving interpretations and best practices.
We use cookies and similar technologies to ensure proper functioning of the Service and analyze usage patterns. You can control cookie preferences in your browser or via our Cookie Settings panel.
See our separate Cookie Policy for details on categories, retention and third-party ad/analytics cookies.
Nova does not use third-party tracking cookies for advertising or behavioral profiling.
Nova Recruiter is a B2B service intended exclusively for adult professionals (recruiters, hiring managers, and corporate clients) and the professional information of working-age individuals. Nova does not knowingly collect or process personal data of individuals under the age of 18 through Nova Recruiter. If we become aware that data relating to a minor has been processed, we will delete it without undue delay.
We may update this Policy to reflect legal, technical, or business changes. Material updates will be communicated through the Service or by email. The date at the top indicates the latest revision.
NGlobal Holding AB (Nova)
© 2026 NGlobal Holding AB. All rights reserved.
‍
