Nova Hiring Privacy Policy

Personal data protection according to the GDPR

NOVA HIRING S.L.

Last updated: June 13, 2025

Version: 3.0‑EN (entirely replaces previous versions)

INTRODUCTION AND SCOPE OF APPLICATION

This Privacy Policy governs the processing of personal data carried out by Nova Hiring S.L. (hereinafter, “Nova Hiring” or the “Controller”) in relation to users who interact with the website https://novahiring.com (hereinafter, the “Website”) and with the recruitment services offered through the platform – including, but not limited to, the video interview portal, recruiter dashboards, and the receipt of commercial communications

By accessing and using Nova Hiring’s services, you acknowledge that you have read and understood this Policy and agree to be bound by it. If you do not agree with its content, please refrain from using the Website or providing personal data.

CONTROLLER IDENTITY AND CONTACT DETAILS

Legal name: Nova Hiring S.L.

Tax ID (NIF): B75773119

Registered address: Avenida Doctor Waksman 28, 2‑2, 46006 Valencia (Spain)

Phone: +34 620 57 76 47

Email (general and privacy inquiries): info@novahiring.com

Data Protection Officer (DPO): Nova Hiring is not required to appoint a DPO, as its core activity does not involve large-scale systematic monitoring or processing of special categories of data (Articles 37 and 38 GDPR).

KEY DEFINITIONS

For a better understanding of this Policy, the following definitions are included (Art. 4 GDPR):

Personal data: Information about an identified or identifiable natural person.

Data subject: The natural person whose data is processed.

Processing: Any operation performed on personal data (collection, recording, storage, use, disclosure, erasure, etc.).

Controller: The entity that determines the purposes and means of the processing (Nova Hiring).

Processor: The entity processing data on behalf of the Controller.

Consent: Freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which they agree to data processing.

CATEGORIES OF DATA SUBJECTS AND DATA COLLECTED

4.1. Candidates

• Identification and contact details: name, surname, email, phone number.

• Academic and professional data: education, work experience, skills, certifications, links to professional profiles (e.g., LinkedIn).

• Audiovisual content: image and voice during video interviews; potential notes made by third parties (recruiters).

• Technical metadata: IP address, browser type, device type, and access logs.

4.2. Recruiters / Corporate clients

• Identification details: name and surname of the contact person.

• Professional data: job title, company, corporate email, work phone.

• Billing information: tax ID, bank details, payment history.

• Platform activity: login sessions, searches, evaluations, and comments.

Nova Hiring does not intentionally request special categories of data (health, beliefs, sexual orientation, etc.). If a candidate includes such information voluntarily, it will be anonymized or deleted as soon as technically possible.

PURPOSES OF PROCESSING AND LEGAL BASES

Nova Hiring processes personal data for the following purposes, in accordance with the legal bases provided (Art. 6 GDPR):

• Managing recruitment processes: candidate registration, conducting video interviews, communicating updates, and, where applicable, formalizing employment contracts.

  • Legal basis: performance of a contract or pre-contractual measures requested by the candidate (Art. 6(1)(b) GDPR).

• Creating and maintaining recruiter accounts: user setup, license assignment, report generation, and service billing.

  • Legal basis: performance of the contract with the client (Art. 6(1)(b) GDPR).

• Sending newsletters and marketing communications about Nova Hiring’s own products or services related to recruitment.

  • Legal basis: explicit consent from the data subject (Art. 6(1)(a) GDPR). Consent can be withdrawn at any time.

• Responding to inquiries and requests submitted via the contact form or email addresses provided.

  • Legal basis: legitimate interest in responding to requests and maintaining user relationships (Art. 6(1)(f) GDPR), or pre-contractual measures (Art. 6(1)(b) GDPR), as applicable.

• Compliance with legal obligations under labor, tax, and accounting regulations.

  • Legal basis: legal obligation applicable to the Controller (Art. 6(1)(c) GDPR).

DATA SOURCES

Data is obtained:

• Directly from the data subject through registration forms, CV uploads, interview responses, or email communication.

• Indirectly, via authentication providers (e.g., social login) or external talent sourcing services, subject to prior verification of the legality of data transfer.

RECIPIENTS AND DATA PROCESSORS

Nova Hiring does not share personal data with third parties unrelated to the recruitment process unless legally required to do so. However, in order to provide services properly, certain data processors may process data on behalf of Nova Hiring under Article 28 GDPR. These include:

• Amazon Web Services EMEA SARL – hosting, databases, and backups (within the EEA).

• Email marketing tool (TBD) – newsletter distribution.

• Web analytics and CMP provider (TBD) – cookie preference management and usage metrics.

An updated list of processors can be requested by emailing info@novahiring.com.

INTERNATIONAL DATA TRANSFERS

Currently, all primary servers are located within the EEA. If it becomes necessary to use services outside the EEA, Nova Hiring will ensure an adequate level of protection by means of:

• European Commission adequacy decision (Art. 45 GDPR); or

• Standard Contractual Clauses or other instruments under Art. 46 GDPR; or

• Adherence to the EU–US Data Privacy Framework, where applicable.

DATA RETENTION PERIODS

• Candidates: 12 months from last interaction or until deletion request; data is then blocked and retained solely for legal obligations.

• Recruiters / Clients: for the duration of the contractual relationship and subsequently for the legally required retention periods (6 years).

• Consent records: while the purpose remains valid or until consent is withdrawn.

SECURITY MEASURES

Nova Hiring implements appropriate technical and organizational measures to ensure data confidentiality, integrity, and availability, including:

• In-transit (TLS 1.3) and at-rest (AES‑256) encryption.

• Multi-factor authentication (MFA) and role-based access control.

• Event logging and real-time monitoring alerts.

• Periodic code reviews and penetration testing.

• End-to-end encrypted daily backups in a separate AWS region, with quarterly restore tests.

DATA SUBJECT RIGHTS

Data subjects may exercise, at any time and free of charge, their rights of access, rectification, erasure, objection, restriction, and data portability (Art. 15–22 GDPR), as well as any other rights recognized by current legislation.

PROCEDURE FOR EXERCISING RIGHTS

To exercise your rights, email info@novahiring.com from the same address you registered with, stating:

• The right you wish to exercise.

• A description of your request.

• Proof of identity (e.g., copy of ID), if necessary.

Nova Hiring will respond within a maximum period of 1 month, extendable by an additional 2 months in complex cases (Art. 12(3) GDPR). If you believe your rights have not been adequately addressed, you may file a complaint with the Spanish Data Protection Agency (AEPD) (https://www.aepd.es) or the competent authority in your place of residence.

MANDATORY OR OPTIONAL NATURE OF INFORMATION

Fields marked with an asterisk (*) in the forms are strictly necessary to provide the service. Refusing to provide such data will prevent Nova Hiring from processing the application or creating a recruiter account. All other data is optional.

CONSENT AND WITHDRAWAL

Where processing is based on consent, it will be obtained through a clear affirmative action (e.g., an unchecked checkbox). The data subject may withdraw consent at any time without affecting the lawfulness of prior processing. Withdrawal can be made by emailing info@novahiring.com or using the “Unsubscribe” link in all marketing communications.

COOKIES AND SIMILAR TECHNOLOGIES

Nova Hiring uses first- and third-party cookies for website functionality, analytics, and personalized experiences. Full details are available in the Cookie Policy at the website footer. Users can accept, reject, or configure cookies via the Preference Center (CMP).

BACKUPS AND HOSTED DATA PROTECTION

Nova Hiring performs daily backups of content hosted on its servers. However, it is not responsible for accidental data loss or deletion by users, nor does it guarantee full restoration of deleted data between backup intervals. Users are responsible for keeping updated backups of any critical information they submit to the platform.

COMMERCIAL COMMUNICATIONS (LSSI-CE)

Nova Hiring will not send unsolicited marketing or promotional emails or other electronic communications without prior request or express consent.

For users with a pre-existing contractual relationship, Nova Hiring may send information about its own products or services similar to those initially contracted. Users can opt out of such communications at any time by emailing info@novahiring.com.

INTELLECTUAL PROPERTY

Nova Hiring holds all intellectual, industrial, and exploitation rights related to the content of the Website, platform, and software necessary for its operation. Reproduction, distribution, public communication, transformation, or any non-private use of such content is prohibited without Nova Hiring’s prior written consent.

Users must also respect third-party software made available, even if it is free and/or public domain. Users do not acquire any rights or licenses over the software beyond what is necessary for the proper provision of services and solely for their duration.

MINORS

Nova Hiring’s services are not intended for individuals under 18 years of age. If the inadvertent processing of a minor’s data without parental authorization is detected, it will be…