At Nova we take data privacy very seriously. We always treat personal data in accordance with the General Data Protection Regulation (GDPR) as well as any national legislation, regulations, etc. applicable to its processing. Contact us if you have any doubts about how your data is being treated.
This Privacy Policy explains how, when, and why your personal data is processed by Nova in connection with the use of the Nova Recruiter platform and related services (the “Service”).
For the purpose of this Policy, any reference to “Nova” shall mean any applicable company within NGlobal Holding AB, company registration no. 559240-0864, with registered address at C/O Talent Venture Group AB, Postbox 3053, 10361 Stockholm, Sweden, including its subsidiaries:
This Policy applies to all processing of personal data carried out by Nova in relation to Nova Recruiter, including data collected directly from client users (recruiters, hiring managers, or companies) and data obtained from third-party or publicly available sources integrated into the Service (such as ContactOut).
Your privacy and data integrity are essential to us. Nova handles personal data responsibly and strives to limit processing to what is strictly necessary to deliver the Service, maintain quality, and comply with legal obligations.
Nova acts as both Data Controller and Data Processor, depending on context:
This Policy is established in accordance with the EU General Data Protection Regulation (2016/679) (“GDPR”), the UK GDPR, and, where applicable, Spain’s Organic Law 3/2018 (LOPDGDD) and other relevant privacy laws.
For certain processing operations, such as candidate profile visibility and recruiter search activity, Nova and its verified client users may act as independent or joint controllers within the meaning of Article 26 GDPR.
In such cases, Nova ensures that appropriate arrangements define the respective roles and responsibilities of each party, particularly regarding the handling of data-subject rights and transparency obligations.
NGlobal Holding AB (”Nova”). Reg. No. 559240-0864. C/O Talent Venture Group AB, Postbox 3053, 10361 Stockholm, Sweden
Nova has appointed a Data Protection Officer in accordance with Articles 37–39 GDPR. The DPO is responsible for monitoring compliance with data-protection laws, advising Nova on privacy obligations, and acting as the contact point for supervisory authorities and data subjects.
Email: dpo@novatalent.com
Postal: Attn: Data Protection Officer, NGlobal Holding AB, Postbox 3053, 10361 Stockholm, Sweden
You may contact the DPO for any questions or concerns about how Nova processes personal data or to exercise your data-protection rights.
Nova Recruiter contains professional information about individuals (“candidates”) gathered from:
ContactOut acts as an independent Data Controller and warrants lawful collection. Nova acts as a subsequent Controller when it integrates that data into Nova Recruiter to enable legitimate recruitment use by authorized clients.
Data typically includes:
No sensitive data (e.g. health, religion, political views) is collected.
Nova processes this data only to:
Nova never resells or redistributes ContactOut data as a standalone dataset. Access is restricted to authenticated Nova Recruiter users for professional recruiting purposes only.
Nova processes candidate data obtained from public and licensed sources on the basis of legitimate interest (Article 6(1)(f) GDPR).
The specific interest pursued is to operate and improve a professional-use recruitment and talent-matching platform that enables verified employer clients to identify and contact qualified professionals for genuine job opportunities.
This processing is subject to a written Legitimate Interest Assessment (LIA) confirming that it is necessary, proportionate, and limited to business-context data, with appropriate safeguards such as restricted access, opt-out rights, and exclusion of sensitive information.
Nova has performed a three-part Legitimate Interest Assessment (purpose, necessity and balancing tests) confirming that:
A summary of this Legitimate Interest Assessment can be made available upon request by contacting privacy@novatalent.com
Nova Recruiter incorporates algorithmic and AI-based functionalities — such as candidate scoring, ranking, matching and automated outreach suggestions or messages — to assist recruiter users in identifying and engaging with relevant professionals.
These operations may involve automated processing of professional data to generate recommendations or trigger limited communications on behalf of a verified client, but they do not produce legal or similarly significant effects on individuals within the meaning of Article 22 GDPR. Candidates are never automatically contacted or evaluated without a human-in-the-loop decision by a recruiter, and Nova maintains audit trails to evidence such human oversight.
All final hiring and selection decisions are taken by human recruiters or client representatives, who retain full control over whether to contact, shortlist or hire a candidate. Nova continuously reviews its AI systems to ensure appropriate human oversight, fairness, and transparency in line with GDPR principles and the forthcoming EU AI Act.
Nova does not monitor or track candidates’ online behavior or activity. Processing is limited to static professional data made publicly available or lawfully licensed from verified providers.
In accordance with Article 14 GDPR, you can read more about the categories of data, sources, lawful basis, and your rights in Nova’s dedicated Transparency Notice (HYPERLINK)
For registered recruiters and client users we process:
Lawful basis: performance of contract (Art. 6(1)(b)).
Nova Recruiter offers optional integrations with Google Workspace (Gmail) and Microsoft 365 (Outlook) to enable recruiters to manage communications with candidates directly within the platform.
When you connect your email account, Nova will request your explicit consent to access specific data strictly necessary to support these features.
Data accessed and processed
Nova does not use connected-email data for advertising, analytics unrelated to recruitment, or any form of AI model training. Processing is fully automated within the recruiter’s account environment and is not visible to other clients.
Storage and retention
Lawful basis and consent management
The lawful basis for this processing is explicit consent under Article 6(1)(a) GDPR, obtained when you authorize Nova Recruiter to connect with your Google or Microsoft account.
You may withdraw consent at any time by:
Withdrawal of consent immediately stops all access and triggers deletion of associated cached data.
Third-party API compliance
Nova complies with the Google API Services User Data Policy, including the “Limited Use” requirements, and with Microsoft’s API and Graph Data Protection terms.
Email data is used solely to deliver user-requested functionality within Nova Recruiter and is never transferred to any external system other than the recruiter’s own workspace.
Collected automatically for security and analytics: IP address, device and browser type, login events, cookies, and telemetry.
Lawful basis: legitimate interest (ensuring security and service reliability).
Purpose | Lawful Basis under GDPR | Example Processing Activities
Operate and maintain the Nova Recruiter platform | Performance of a contract (Art. 6(1)(b)) | Account creation, authentication, user management
Provide candidate search and matching capabilities | Legitimate interest (Art. 6(1)(f)) | Indexing and display of professional profiles
Integrate licensed data from ContactOut and public sources | Legitimate interest (Art. 6(1)(f)) | Importing and updating professional datasets
Manage email integrations (Google / Microsoft) |Consent (Art. 6(1)(a)) | User-authorized access to email metadata and replies
Provide billing, customer support and contract administration | Performance of a contract (Art. 6(1)(b)) | Invoicing, account support, user roles
Ensure security and fraud prevention | Legitimate interest (Art. 6(1)(f))| Monitoring logins, detecting abuse or misuse
Comply with legal and regulatory obligations| Legal obligation (Art. 6(1)(c)) | Record keeping, responding to lawful requests
Nova only shares personal data where necessary to deliver the Service, comply with legal obligations, or ensure the secure operation of our systems.
We never sell or disclose personal data for advertising or unrelated commercial purposes.
Candidate profiles are made visible only to verified Nova Recruiter clients who have entered into a contractual agreement with Nova. These clients act as independent Data Controllers for their own recruitment activities and must use the information solely for legitimate hiring purposes in accordance with the GDPR and their own privacy obligations.
Where a client exports candidate data into its own ATS or HRIS, the client becomes an independent controller for that processing and must provide its own privacy information to the candidate.
We use carefully selected third-party providers to host and operate our infrastructure, analytics, and communications. They process personal data only under Nova’s instructions and subject to strict data-processing agreements.
Current categories include:
Each provider is contractually bound to implement appropriate security measures and may not use the data for its own purposes.
Nova obtains professional data from ContactOut Limited (Hong Kong) and similar licensed providers that act as independent Controllers and warrant GDPR-compliant collection of information from public business sources. Nova acts as a subsequent Controller when integrating such datasets into Nova Recruiter. All controller-to-controller transfers occur under adequate safeguards and encryption, in line with Articles 44–46 GDPR.
Where Nova receives updated datasets from licensed providers, Nova applies its internal suppression lists (opt-outs and objections) to prevent re-appearance of data subjects who have exercised their rights with Nova.
Nova verifies each provider’s data-collection notices and removal mechanisms before onboarding and conducts annual due-diligence reviews.
Personal data is primarily stored within the European Economic Area (EEA). When data must be transferred outside the EEA—such as to the United States or Hong Kong—Nova ensures an equivalent level of protection through:
Copies of relevant transfer mechanisms can be requested at privacy@novatalent.com.
Nova may disclose limited information where required by law, court order, or governmental request, or in connection with a merger, acquisition, or reorganisation of Nova’s business, always under confidentiality and data-protection safeguards.
Nova does not sell personal data.
Personal data processed through Nova Recruiter is primarily stored and managed on secure servers located within the European Union / European Economic Area (EU/EEA).
Nova’s main hosting provider is Amazon Web Services (AWS), with data hosted in the EU (Ireland) region under ISO 27001 and SOC 2 certifications.
Some of Nova’s trusted technology and infrastructure partners may store or access personal data from outside the EEA, for example, from the United States or Hong Kong, in order to provide technical support, maintenance, or integration services.
Whenever such transfers occur, Nova ensures that an adequate level of protection is maintained in accordance with Chapter V of the GDPR.
Depending on the provider and destination, Nova relies on one or more of the following mechanisms:
Provider | Function | Data Storage | Location | Transfer Mechanism (if outside EU)
Amazon Web Services (AWS) | Cloud hosting and infrastructure | EU (Ireland)
Google (Workspace, Cloud, OAuth) | Authentication, productivity and analytics | Primarily EU (Ireland / Netherlands); limited U.S. access for support | EU–U.S. Data Privacy Framework and SCCs
Intercom | Customer support and in-app communications | EU (Ireland) | Limited U.S. access under EU–U.S. Data Privacy Framework and SCCs
Notion Labs | Inc.Internal collaboration and documentation |United States | EU–U.S. Data Privacy Framework and SCCs
Typeform S.L. | Form and survey management | Spain (EU)
Unipile SAS | Secure messaging integration (Gmail/Outlook connectors) | France (EU)
ContactOut Limited | Licensed professional data provider |Hong Kong | SCCs with supplemental safeguards and encryption
Each provider operates under a Data Processing Agreement (DPA) compliant with Article 28 GDPR, ensuring that:
Nova applies layered protection for international transfers, including:
These measures ensure that your personal data remains secure, even when processed outside the EEA.
You may request further details about Nova’s international data transfers or obtain a copy of the applicable Standard Contractual Clauses (SCCs) by contacting privacy@novatalent.com.
Nova retains personal data only for as long as it is necessary to fulfil the purposes described in this Privacy Policy or to comply with legal, contractual, or security obligations.
We regularly review the data we hold and apply minimisation, suppression, or anonymisation measures when information is no longer needed.
Category of Data | Typical Retention Period | Purpose of Retention
Client (Account) Data | While the client’s Nova Recruiter subscription is active + up to 3 years after termination | Contract administration, billing, legal defence, and audit trail
Recruiter Activity Logs | Up to 24 months | Service security, misuse detection, troubleshooting
Candidate Profiles (Professional Data) | As long as the data remains relevant and accurate for legitimate recruitment purposes, or until we receive an objection or deletion request | Operation of candidate search and matching features
Licensed Data from ContactOut and other providers | In line with the provider’s licensing agreement and Nova’s own data-review cycles (typically 12–24 months), or earlier if a candidate requests removal | Ensuring dataset accuracy, deduplication, and lawful use
Email-Integration Data (Gmail / Outlook) | Cached only while the integration is active; deleted or de-linked immediately upon disconnection or after 30 days of inactivity | Delivery and reply-tracking functionality
Support and Communication Records | Up to 3 years after closure of the ticket or interaction | Customer support history, dispute resolution
Aggregated / Anonymised Data | Indefinite (non-personal) | Product analytics and performance statistics
When retention periods expire, Nova will:
If you request deletion of your professional profile or object to our processing, we will suppress your record from search results and ensure that no recruiter can access it going forward.
Certain information may be retained for longer periods where required by law (for example, taxation or accounting regulations) or where necessary to establish, exercise, or defend legal claims.
Such data is stored securely and access is strictly limited.
Nova implements a combination of technical, organisational, and contractual safeguards to protect personal data against unauthorised access, alteration, disclosure, or destruction.
Security and privacy are integral parts of the Nova Recruiter design and operations framework.
We apply industry-standard measures, including:
These controls are reviewed periodically and updated in line with best practices and regulatory requirements.
If a personal-data breach occurs, Nova will:
We maintain documented incident-response procedures to ensure timely and effective action.
If you believe you have discovered a security vulnerability in any Nova Recruiter system, please contact us responsibly at privacy@novatalent.com with the subject line “Security Vulnerability.”
Testing must avoid accessing other users’ data, disrupting service, or breaching confidentiality obligations.
Personal data is primarily stored in Amazon Web Services (AWS) data centres located within the European Economic Area (EEA).
When data must be accessed or processed outside the EEA (e.g. by certain sub-processors), Nova ensures that EU Standard Contractual Clauses or other approved safeguards are in place, consistent with Section 5 (d) above.
Depending on your location and the nature of the data we process, you have several rights under the General Data Protection Regulation (GDPR) and related national laws. Nova is committed to enabling these rights in a clear, fair, and timely manner.
You may at any time exercise the following rights with respect to your personal data processed by Nova:
To exercise any of the rights above, please contact us at privacy@novatalent.com with the subject line “Data Rights Request – Nova Recruiter.” We may request limited information to verify your identity before processing your request. We will respond without undue delay and within one month, unless an extension is permitted under the GDPR due to complexity or volume.
If your data was obtained from a public or licensed source, you can also learn more about your rights and how to object specifically to that processing in our Transparency Notice. (HYPERLINK)
If we cannot identify you in our index with the information you provide, we may ask you for additional details — such as your LinkedIn URL, current employer, or public profile link — solely to locate your record. We will not retain this information after resolving your request.
If your professional data originated from a licensed provider (for example, ContactOut Limited), we will, where contractually possible, also inform that provider of your objection or deletion request so they can update their dataset accordingly.
Nova will never deny access to the Service, alter pricing, or offer different levels of service because you exercised your data-protection rights.
Nova’s Data Protection Officer conducts regular reviews of Nova Recruiter’s processing operations, including Legitimate Interest Assessments (LIA) and the Data Protection Impact Assessment (DPIA), and advises on updates to maintain ongoing GDPR compliance.
Nova maintains a Record of Processing Activities (“RoPA”) in accordance with Article 30 GDPR, covering all relevant data flows, categories, retention schedules, legal bases, and international transfers relating to Nova Recruiter.
This record is reviewed and updated periodically to reflect changes in the Service, and may be shared with competent supervisory authorities or enterprise customers upon legitimate request for compliance verification.
Nova processes professional data from public and licensed sources based on legitimate interest (Article 6(1)(f) GDPR), supported by a written Legitimate Interest Assessment (LIA) evaluating necessity, proportionality, and data-subject impact.
Given the potentially large scale of candidate data involved, Nova has also assessed the need for a Data Protection Impact Assessment (DPIA) under Article 35 GDPR and will update that assessment as the Service expands or incorporates new data sources or automated functionalities.
The assessment concluded that residual risks for data subjects are low and effectively mitigated through restricted access, transparency measures, and suppression mechanisms.
To enhance transparency, Nova Recruiter includes source-attribution labels within candidate profiles, indicating whether the information originates from:
Where technically feasible, users can also view the date of the last update or verification.
This ensures that data subjects, recruiters, and customers understand the provenance and update cycle of professional data displayed in the Service.
Enterprise clients and regulators may request additional documentation such as Nova’s Article 30 RoPA summary, LIA executive summary, or DPIA statement by contacting privacy@novatalent.com.
Nova continuously monitors regulatory developments and guidance from EU and national Data Protection Authorities regarding the use of publicly sourced professional data for recruitment.
We update our privacy framework, including this Privacy Policy, the LIA, and the DPIA, to maintain compliance with evolving interpretations and best practices.
We use cookies and similar technologies to ensure proper functioning of the Service and analyze usage patterns. You can control cookie preferences in your browser or via our Cookie Settings panel.
See our separate Cookie Policy (HYPERLINK) for details on categories, retention and third-party ad/analytics cookies.
Nova does not use third-party tracking cookies for advertising or behavioral profiling.
We may update this Policy to reflect legal, technical, or business changes. Material updates will be communicated through the Service or by email. The date at the top indicates the latest revision.
NGlobal Holding AB (Nova)
© 2025 NGlobal Holding AB. All rights reserved.
