Nova Network Privacy Policy

1. Basic understanding

a. About this policy

This Privacy Policy explains how, when and why your personal data is processed by Nova. For the purpose of this policy, any reference to “Nova” shall mean any applicable company within NGlobal Holding AB, company registration no. 559240-0864, with address at C/O Talent Venture Group AB, Postbox 3053, 10361, Stockholm, Sweden, including its subsidiaries:

• Nova Talent AB, company registration no. 559152-1603, with address at C/O Talent Venture Group AB, Postbox 3053, 10361, Stockholm, Sweden
• Nova Global Italy SRL with Registration number MI - 2609948, with address at Bastioni di Porta Nuova 21, Milano (MI) 20121, Italy, and
• Nova Global Spain, S.L.U., with Spanish CIF: B-87600391, with registered address at Avenida Pablo Iglesias 15, Esc D 3A, 28003 Madrid, Spain.

b. Your rights

Your rights to privacy and integrity are important to us and we are therefore cautious with handling your personal data and thrive to limit the processing only to information that is required in order to perform our services to you.

c. Scope of this policy

This Privacy Policy applies to personal data that Nova collects directly from you when you apply to become a Nova member, use our network services (such as the Nova app, Gravity or Nova 111), or interact with our events, programs or newsletters. Nova also operates Nova Recruiter, a separate talent intelligence / sourcing service that may process professional information obtained from third-party sources (e.g. public profiles or licensed datasets). That processing is described in the Nova Recruiter Data Privacy Policy.

2. Personal data

a. What is personal data

Personal data is any kind of information that directly or indirectly refers to an identified or identifiable person.

b. What personal data is Nova processing?

For the purposes stated in this privacy policy, Nova will process your name, contact information (including email address), age, gender, study background, career preferences, career type, university, main field of study or any other information you may provide when using the Sites.

If you choose to submit your account from Facebook, Instagram and/or LinkedIn to Nova Sites, Personal Data will also include your profile picture.

3. Children’s personal data

Our intentions with carrying out our services is to help professionals and students currently studying at university. For this reason, we have no reason to collect personal data from people who do not fall within said demographics. We therefore do not collect, or otherwise process, personal data from any individual under the age of 18.

4. Cookies

A cookie is a small data file that our website plants on your hard drive to store certain information that we may recover later to be used for different purposes. We use cookies to complete and handle our surveys and to track user traffic patterns in order to evaluate our user’s patterns and to see how effective our navigational structure is in helping users to complete surveys as effectively as possible. We gather your consent ahead of using cookies (except for the use of technical cookies or cookies that are necessary to fulfil your specific requests). You may find more information on how we use cookies in our Cookies Policy

5. Processing purposes and lawful basis

a. Overview

Nova processes personal data only for specific, explicit and legitimate purposes. Depending on how you interact with Nova (for example, applying to become a member, participating in community programs, or receiving newsletters), we rely on different lawful bases under Article 6 GDPR. This section explains, purpose by purpose, which lawful basis applies.

b. Membership application and account creation

Purpose: to receive and review your application to Nova, assess whether you meet the eligibility criteria, create your member account, and manage your membership.

Data used: identification data, contact details, education and career information, application answers, test results, video interview (if applicable).

Lawful basis: performance of a contract / steps prior to entering into a contract (Art. 6(1)(b) GDPR). Without this processing, we cannot evaluate your candidacy or give you access to the Nova community.

How we assess applications (automated processing and human review). Nova’s selection process combines automated processing with human review. An algorithmic assessment scores your application against pre-defined parameters (such as academic and professional background, achievements and languages) and, where your process includes a video interview, an AI tool suggests a grade for each answer based exclusively on the transcript of that answer: it does not analyse your image, voice, tone or any other visual or behavioural signal. These scores are inputs to the decision, not the decision itself. Whether you are admitted to Nova is decided by a member of Nova’s talent team, who reviews the scores together with your application and may depart from them. Nova does not take decisions about applicants based solely on automated processing within the meaning of Article 22 GDPR. You may at any time ask us to explain how your application was assessed, to have the outcome reviewed by a person, and to express your point of view or contest the outcome, by writing to privacy@novatalent.com. Nova periodically reviews these tools for accuracy and bias, and does not use your application data to train the underlying AI models (see Section 5.i).

c. Provision of Nova community services (Nova Connect, Gravity, events, Nova 111, mentoring, introductions, etc.)

Purpose: to let you build and update your profile, be visible to other Nova members (when you choose so), receive introductions, be matched with other members, and participate in initiatives and events.

Data used: profile data, career and interest data, participation data, internal Nova score (if applicable).

Lawful basis: performance of a contract (Art. 6(1)(b) GDPR), because these features are part of the service you sign up for as a Nova member. Certain optional features (for example, publishing you publicly as Nova 111) will rely on consent (Art. 6(1)(a)) as explained in Section 7.

d. Communications about your membership and service messages

Purpose: to send you information that is necessary for your use of Nova (membership status, selection updates, event confirmations, platform changes, security notices).

Lawful basis: legitimate interest in operating and securing our services and keeping members informed (Art. 6(1)(f) GDPR) and/or performance of a contract (Art. 6(1)(b) GDPR), since these messages are part of the service.

e. Career and development content, newsletters and third-party employer opportunities

Purpose: to send you career-related content, Nova news, job or project opportunities, and invitations from partner companies that may be relevant to your profile.

Lawful basis: where we have your opt-in to receive this content: consent (Art. 6(1)(a) GDPR); where the law allows B2B or soft-opt-in communications: legitimate interest in promoting our services to our members (Art. 6(1)(f) GDPR). You can object or withdraw consent at any time via the links in the message or by writing to privacy@novatalent.com

f. Referrals, nominations and applications run with partners

Purpose: to process your application to a job, talent pool, program or event that Nova runs with a company, university or other partner, and to share the strictly necessary data with that partner.

Lawful basis: performance of a contract / steps prior to a contract (Art. 6(1)(b) GDPR) because you are asking Nova to put you forward; and Nova’s legitimate interest in operating these collaborations (Art. 6(1)(f) GDPR).

g. Optional visibility to recruiters via Nova Recruiter

Purpose: to make selected professional information from your Nova profile (name, role/title, industry, experience summary, LinkedIn URL and the email address in your profile) visible to verified recruiter users of Nova Recruiter only if you have set your status to “open to new opportunities” or “actively looking.”

Lawful basis: consent (Art. 6(1)(a) GDPR), given when you enable that status, which you can withdraw at any time in your account settings.

h. Analytics, service improvement and aggregated reporting

Purpose: to measure usage of our platforms, improve member experience, maintain security, and produce aggregated, de-identified reports about community activity.

Lawful basis: legitimate interest in operating, securing and improving our services (Art. 6(1)(f) GDPR). When we fully anonymize data, GDPR no longer applies.

i. AI features and no use of member data for AI model training

Nova uses AI-based tools (for example, to support matching, content recommendations or community moderation). Nova does not use members’ personal data, profile content, messages or interactions to train, fine-tune or otherwise improve the underlying foundation models or generative-AI systems we rely on, whether developed by Nova or by third-party AI providers.

Nova’s contracts with its AI sub-processors expressly exclude training on Nova’s data and require zero-retention or short, security-only retention windows.

Nova may use aggregated, anonymised or de-identified information that cannot reasonably be associated with an individual to improve the Service. Such information is not considered personal data under the GDPR.

Lawful basis: legitimate interest in operating, securing and improving our services (Art. 6(1)(f) GDPR).

j. Legal, security and compliance

Purpose: to comply with legal obligations, respond to authorities, prevent fraud or abuse, and defend Nova’s rights.

Lawful basis: compliance with a legal obligation (Art. 6(1)(c) GDPR) and legitimate interest in establishing, exercising or defending legal claims (Art. 6(1)(f) GDPR).

6. Protection and storage of personal data

a. Data security

Nova protects your personal data using technical and organisational measures designed to prevent accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures include firewalls, encryption in transit and at rest, multi-factor authentication, least-privilege access control, continuous monitoring, and regular security audits.

All Nova employees and contractors are bound by confidentiality obligations and receive privacy and security training.

If Nova becomes aware of a personal data breach that may result in a risk to your rights or freedoms, we will promptly notify the competent supervisory authority and, where required, you as the affected individual.

b. Storage locations

Your personal data is primarily stored and processed on secure servers located within the European Union / European Economic Area (EU/EEA).

Nova’s main cloud-hosting provider is Amazon Web Services (AWS), with data stored in the EU (Ireland) region.

c. Transfers outside the EU/EEA

Some of Nova’s trusted technology and infrastructure partners may store or access data from outside the EU/EEA for support or maintenance purposes. When such transfers occur, Nova ensures that an adequate level of protection is applied in accordance with Chapter V of the GDPR.

Depending on the provider and destination, Nova relies on one or more of the following legal mechanisms:

• Adequacy decisions issued by the European Commission (e.g., the EU–U.S. Data Privacy Framework for certified U.S. entities).
• Standard Contractual Clauses (SCCs) adopted by the European Commission, together with technical and organisational safeguards such as encryption and strict access controls.
• Intra-group data transfer agreements between Nova entities incorporating SCCs.

d. Key service providers and transfer mechanisms

Each provider acts under a Data Processing Agreement (DPA) consistent with Article 28 GDPR, ensuring that they process data solely on Nova’s instructions, maintain appropriate security, and assist with data-subject rights and breach notifications.

e. Copies and further information

You may contact privacy@novatalent.com to request further details about Nova’s international data transfers or to obtain a copy of the relevant safeguards (e.g., applicable Standard Contractual Clauses).

7. Recipients of personal data

Nova shares personal data only when necessary to deliver our services, operate our community, or comply with legal obligations. We never sell personal data.

We group our data-sharing activities into the following categories:

a. Internal community visibility

If you are accepted as a Nova member, you may create a profile on Nova Connect. Other members of the Nova community can view the information you choose to share there – such as your name, current role, education, skills, photo, and interests – for the purpose of professional networking. You can edit or remove this information at any time. Profiles are never visible to people outside Nova.

b. Nova programs and initiatives

When you take part in a Nova program or initiative, Nova may share relevant information with verified partners or jury members strictly for that purpose:

All partners receiving such data have agreed in writing to comply with the GDPR and to delete the information after the evaluation or event ends.

c. Referrals and nominations

If you nominate or refer another person to Nova (a “nominee” or “referral”), you must first ensure that you have that person’s consent to share their basic information (typically name, email address, and LinkedIn profile). Nova will use this information solely to invite the referred person to start their own membership or application process. Once the nominee engages with Nova (for example, by opening the invitation or beginning an application), their data is treated in the same way as any other applicant’s and processed under this Privacy Policy. If the nominee chooses not to proceed, Nova may retain minimal information (e.g. email address, date of referral) for a limited period to record that an invitation was sent and to avoid duplicate nominations. This processing is based on Nova’s legitimate interest in operating its referral system efficiently and maintaining the integrity of its recruitment and selection processes.

d. Visibility to recruiters via Nova Recruiter (opt-in)

If you indicate in your Nova profile that you are “open to new opportunities” or “actively looking for roles”, selected professional details from your Nova profile – your name, current role or title, industry, experience summary, LinkedIn URL and the email address in your Nova profile – may become visible to verified recruiters and company users of Nova Recruiter.

• Nova does not share your phone number or any other private contact details.
• Recruiters may contact you by email, via LinkedIn or through Nova’s secure messaging tools.
• If you have not enabled that status, your Nova profile is not made available to Nova Recruiter clients, even where similar professional information about you is available from public sources or licensed data providers. Recruiters may hold professional data about you obtained through other tools or sources outside Nova; that processing is not carried out through Nova Recruiter and is the recruiter’s own responsibility.
• Recruiters and companies that view or contact you act as independent data controllers for their own recruitment activity, under their own privacy notices and under the Nova Recruiter contractual terms, which restrict use of the information to legitimate recruitment purposes.
• This visibility exists only while your status remains open/active and can be changed or withdrawn at any time in your account settings.
• The lawful basis for this processing is your explicit consent, provided when enabling that status.

e. Service providers (data processors)

To operate efficiently, Nova uses trusted service providers that process data on our behalf for functions such as hosting, analytics, communications, customer support, and productivity tools. These include Amazon Web Services (AWS), Google, Notion, HubSpot, Typeform, TestGorilla, Unipile and, where AI features are involved, large-language-model providers operating under zero-retention, no-training contractual terms, among others. All such providers act under Data Processing Agreements consistent with Article 28 GDPR and are listed in Section 6 (Protection and International Transfers).

f. Legal, corporate and compliance disclosures

Nova may disclose personal data:

• when required by law or lawful requests from public authorities;
• to establish or defend legal claims;
• to investigate fraud or protect the rights, property or safety of Nova, our users, or the public; or
• in connection with a corporate transaction such as a merger, acquisition, or sale of assets, always subject to appropriate confidentiality and data-protection safeguards.

8. Term of processing

a. Applicants. If your application is not successful, Nova keeps your application data (your answers, assessment results and, where applicable, the transcript of your video interview) for 24 months from the date of the decision, so that you can re-apply or be considered for later editions and programmes. The video recording of your interview is deleted 6 months after the decision. Before the 24-month period ends, we will ask you whether you would like Nova to keep your profile for a further 24 months; if you do not confirm, your data is deleted or irreversibly anonymised. You may ask us to delete your data earlier at any time (Section 9), and we will do so, keeping only the minimal record needed to comply with a legal obligation or to establish, exercise or defend legal claims. If you re-apply, these periods run from the new decision. Applications that remain without a final decision are closed after 12 months and treated as unsuccessful for retention purposes.

b. Members. Nova processes your personal data for as long as you are a member of the Nova network. Membership ends when you ask to leave the network. At that point Nova deletes your personal data and, before fully erasing it, keeps it duly blocked for the statute of limitations of potential claims that may arise as a consequence of the processing.

c. Nominees and referrals who do not proceed. Minimal information (e.g. email address and date of referral) is kept for a limited period, as described in Section 7.c.

d. Newsletters and other communications. Until you unsubscribe or withdraw your consent.

e. Legal and regulatory retention. Certain information may be kept for longer where required by law (for example, accounting rules) or where necessary to establish, exercise or defend legal claims. Such data is stored securely and access is strictly limited.

9. Your rights to obtain extract, correction, erasure etc.

a. You have the right to access the information Nova holds about you. If you want to obtain such access, or if you wish to correct information or data, object to, or restrict a certain processing of your data, you are welcome to contact Nova on privacy@novatalent.com. Nova will also assist you, if requested to the aforementioned e-mail address, with the transmitting of your data to another controller (so called “data portability”), delete information regarding you and/or your use of the Site and/or if you wish to withdraw your consent to a specific processing. However, please be aware that if you ask us to delete all information from your user account you will no longer be able to use the parts of the Sites where a user account is mandatory for access.

b. We hope that questions regarding our processing of your personal data can be resolved effectively through communication between us. However, please be informed that you always have the right to lodge a complaint with the the Data Protection Authority competent in the country in which you are located.

10. Updates

a. This privacy policy may be updated without prior notice. Where appropriate, Nova will duly inform you about that.

11. Data Protection Officer

Nova has appointed a Data Protection Officer in accordance with Articles 37–39 GDPR. The DPO is responsible for monitoring compliance with data-protection laws, advising Nova on privacy obligations, and acting as the contact point for supervisory authorities and data subjects.

Email: dpo@novatalent.com

Postal: Attn: Data Protection Officer, NGlobal Holding AB, Postbox 3053, 10361 Stockholm, Sweden

You may contact the DPO for any questions or concerns about how Nova processes personal data or to exercise your data-protection rights.

For general privacy inquiries or to exercise your rights, you may also contact privacy@novatalent.com

© NGlobal Holding AB, 2026, All rights reserved.