Privacy Policy

This Privacy Policy governs the processing of personal data carried out by Nova Hiring S.L. (“Nova Hiring”) in relation to the website https://novahiring.com (the “Website”) and the NovaHiring platform.

Nova Hiring acts in two distinct capacities, and the distinction matters:

• As data controller, in respect of: Website visitors, people who request information or a demonstration, contact persons and users at client companies, suppliers, and its own staff and applicants for jobs at Nova Hiring itself.
• As data processor, in respect of the candidates taking part in recruitment processes run by each client company. In that case the client company is the controller: it defines the role, the assessment criteria, the questions and who is contacted. Nova Hiring merely provides the tool and processes the data on its documented instructions, under the processing agreement required by Article 28 GDPR. If you are a candidate and wish to exercise your rights or understand the processing in detail, you should contact the company running the process; Nova Hiring will assist and forward your request.

By accessing or using Nova Hiring's services, you acknowledge that you have read and understood this Policy.

Last updated: 9 September 2026

Version: 4.0-EN

• Company name: Nova Hiring S.L.
• Tax ID (NIF): B75773119
• Registered office: Calle Túria 53, Bajo, 46008 Valencia (Spain)
• Telephone: +34 620 57 76 47
• Email: info@novahiring.com
• Data protection email: privacy@novahiring.com

Data Protection Officer (DPO):

Nova Hiring has not appointed a Data Protection Officer at this time. It has designated a data protection contact point, reachable at privacy@novahiring.com, and is currently assessing whether the appointment of a DPO is required under Article 37(1)(b) GDPR.

For clarification purposes, the following definitions apply (Art. 4 GDPR):

• Personal data: Any information relating to an identified or identifiable natural person.
• Data subject: Natural person whose personal data is processed.
• Processing: Any operation performed on personal data (collection, storage, use, erasure, etc.).
• Data controller: Entity that determines the purposes and means of the processing (Nova Hiring).
• Data processor: Entity that processes personal data on behalf of the controller.
• Consent: Freely given, specific, informed and unambiguous indication of the data subject's wishes.

4.1. Candidates

The data processed includes:

• Identification and contact data (first name, surname, email, telephone).
• Academic and professional data (experience, skills, education, LinkedIn links).
• Audiovisual content (image and voice during video interviews).
• Technical metadata (IP address, device type, browser, logs).

4.2. Recruiters / Corporate clients

The data processed includes:

• Identification of the contact person.
• Professional data (position, corporate email, telephone).
• Billing data (tax ID, bank details, payment history).
• Platform activity (logins, evaluations, searches).

Special categories of data:

The platform contains no field designed to collect special categories of data (health, origin, beliefs, trade union membership, sexual orientation or biometric data), and performs no biometric processing of any kind: there is no facial recognition, no generation of identifying templates and no emotion analysis.

Such data may nevertheless reach the system on the data subject's own initiative, by freely writing a message, answering an open question or attaching a CV. Where that happens, it is for the company responsible for the process to assess its processing or deletion; Nova Hiring does not use it for any purpose of its own.

Nova Hiring processes personal data for the following purposes:

Management of recruitment processes

Registration, video interviews, communications, updates and contract formalization.

Legal basis: Performance of a contract or pre-contractual measures (Art. 6.1.b GDPR).

Creation and maintenance of recruiter accounts

User setup, licenses, reports and billing.

Legal basis: Performance of a contract (Art. 6.1.b GDPR).

Managing the commercial relationship with companies

Handling requests for information and demonstrations received through the Website, and following up on the relationship with clients and prospective clients in our sales management system. Nova Hiring does not send bulk commercial communications or newsletters; contact is maintained individually.

Legal basis: Pre-contractual measures at the data subject's request (Art. 6.1.b GDPR) and legitimate interest in promoting our own services among professionals (Art. 6.1.f GDPR).

Handling inquiries

Legal basis: Legitimate interest (Art. 6.1.f GDPR) or pre-contractual measures (Art. 6.1.b GDPR).

Compliance with legal obligations

(Labor, tax and accounting obligations).

Legal basis: Legal obligation (Art. 6.1.c GDPR).

Data processed by Nova Hiring as controller. Obtained directly from the data subject: Website forms, requests for information or a demonstration, registration and use of the platform, and email correspondence.

Candidate data, processed on behalf of the client company. It reaches the platform through the channels that company enables, which may be:

• Directly from the candidate: the public application form linked to the job posting, the company's careers portal, the CV they provide, and their answers in the interview or process conversation.
• Provided by the client company itself: CSV file uploads, bulk import of CVs in PDF, manual entry by the recruitment team, or exports from job boards.
• From other systems of the client company, where it activates the integration: its applicant tracking system (ATS) or other in-house systems connected via API.

Nova Hiring does not disclose personal data to third parties for their own purposes, does not sell it, does not cross-reference it between clients, and does not use it to train artificial intelligence models.

Providing the service requires the following providers, acting as processors or sub-processors under Article 28 GDPR:

• Amazon Web Services EMEA SARL (Luxembourg; processing in the Paris region, European Union): hosting, database, file storage, queues, search engine, backups and content delivery. Includes Amazon Textract and Amazon Transcribe.
• OpenAI: CV analysis and structuring, candidate assessment, answer classification, conversational assistant and semantic search.
• AssemblyAI: transcription of interview audio and voice notes.
• Microsoft (Azure AI Speech), West Europe region: pronunciation assessment in language tests.
• Mistral AI (France): optical character recognition of CVs, as an alternative route.
• Meta Platforms Ireland and, residually, Unipile: messaging with the candidate over WhatsApp.
• Google Ireland: corporate email and outbound mail server, calendar, geocoding of the stated location, and Website analytics.
• Calendly: interview scheduling and booking.
• Sentry (ingestion in Germany): error telemetry, with prior scrubbing of personal data.
• Teamtailor (Sweden) and Apideck: integration with the client company's applicant tracking system, where activated.
• HubSpot: management of the commercial relationship with client and prospective companies. It does not process candidate data.
• Stripe Payments Europe (Ireland): payment and billing. Card details are captured directly against Stripe and never reach Nova Hiring's systems.

Data may also be disclosed to public authorities and bodies where legally required, and to professional advisers bound by a duty of confidentiality.

The current, named list of sub-processors, with their function, location and safeguards, is available on request at privacy@novahiring.com. Nova Hiring will give prior notice of any addition or replacement of a sub-processor.

All of Nova Hiring's own infrastructure is located in the European Union. The database, file storage (CVs, video, audio and documentation), queues, search engine, logs and backups are hosted on Amazon Web Services, eu-west-3 region (Paris). There is no replica or copy of that information outside the European Union.

There are, however, transfers to third countries arising from the use of specialised providers. As at the date of this Policy, the following providers process data outside the European Economic Area, all of them in the United States unless stated otherwise: OpenAI, AssemblyAI, Calendly, HubSpot, Google (for certain services), Sentry (with ingestion in Germany), Stripe, and Meta Platforms Ireland (an Irish entity that nonetheless processes data in the United States). The content delivery network used to serve files is global in scope.

These transfers rely on Standard Contractual Clauses approved by the European Commission (Art. 46.2.c GDPR) and, where applicable, on the adequacy decision concerning the EU-US Data Privacy Framework (Art. 45 GDPR).

Where the client company is established outside the European Economic Area, access by its recruitment team from its own country is itself an international transfer, to be covered in the processing agreement entered into with that company.

• Candidates: 12 months from the last interaction or deletion request.
• Recruiters / Clients: For the duration of the contract and the applicable legal periods (6 years).
• Consent records: Until consent is withdrawn or the purpose ceases.

Nova Hiring applies appropriate technical and organizational measures, including:

• TLS 1.3 and AES-256 encryption.
• Multi-factor authentication (MFA) and role-based access control.
• Activity logging and monitoring.
• Periodic code reviews and penetration testing.
• Daily encrypted backups (redundant AWS region).

Users may exercise the following rights:

• Access
• Rectification
• Erasure
• Objection
• Restriction of processing
• Portability
• Any other rights recognized in Articles 15 to 22 of the GDPR

To exercise your rights, you may send an email to info@novahiring.com indicating:

• The right you wish to exercise
• A description of the request
• Proof of identity, if necessary

Response time: 1 month, extendable by up to 2 additional months in complex cases.

You may also file a complaint with the Spanish Data Protection Agency (AEPD)

https://www.aepd.es

or with the competent supervisory authority.

Fields marked with * are mandatory.

Failure to provide them prevents the provision of the service.

All other data is optional.

Consent is obtained through a clear affirmative action.

Withdrawal of consent does not affect the lawfulness of prior processing.

You may withdraw your consent through:

• Email to info@novahiring.com
• The unsubscribe link included in commercial communications

The Website uses first-party and third-party cookies for:

• Essential functionality
• Analytics
• Personalization

Preferences can be configured through the Cookie Preference Center.

See the full Cookie Policy in the footer of the Website.

Nova Hiring performs daily backups, but is not responsible for the accidental deletion of data by users.

Full restoration between backup intervals is not guaranteed.

Users are responsible for keeping copies of critical information they upload to the platform.

Nova Hiring does not send bulk commercial communications or newsletters by email. The relationship with clients and prospective clients is maintained individually, following a prior request for information or within an existing commercial relationship.

Should such mailings begin in the future, prior consent would be obtained where required under Article 21 of the Spanish LSSI-CE, and every communication would include a simple, free-of-charge objection mechanism.

In any event, you may object to receiving communications by writing to privacy@novahiring.com.

All intellectual, industrial and software rights relating to the Website and the platform belong to Nova Hiring.

Their reproduction, distribution, modification or public communication without written authorization is prohibited.

Users must respect third-party software licenses.

Use is limited to the provision of the service and its duration.

Nova Hiring's services are not aimed at persons under 18 years of age.

If the processing of a minor's data is detected, it will be deleted immediately.

Nova Hiring may update this Policy to adapt it to legal or regulatory changes.

Significant changes will be notified to users at least 30 days in advance.

This Policy is governed by:

• Regulation (EU) 2016/679 (GDPR)
• Spanish Organic Law 3/2018 (LOPDGDD)
• Applicable Spanish law

Disputes shall be submitted to the Courts and Tribunals of Valencia, unless otherwise provided by law.

For inquiries, suggestions or the exercise of rights:

• Data protection email: privacy@novahiring.com
• General email: info@novahiring.com
• Address: Calle Túria 53, Bajo, 46008 Valencia (Spain)
• Telephone: +34 620 57 76 47

Building the future of Talent Acquisition