Group Privacy Policy
Version 1.0 · 1 August 2026
This policy explains how the Nova8 group of companies collects and uses personal data. The Nova8 group comprises a number of group companies; we can tell you which company is responsible for your personal data on request. In this policy “Nova8”, “we”, “us” and “our” mean the relevant group company that determines how your personal data is used. The group company coordinating data protection across the group is Nova8 Pte. Ltd. (company registration no. 201543872K; EA Licence No. 17S8782), 105 Cecil Street, #22-88 The Octagon, Singapore 069534.
Some of our services are offered under service brands within the group, including “Source by Nova8” (our UK-focused legal-recruitment service). Whichever brand or website you deal with, the group company responsible for your personal data is as described in this policy, and we can tell you which company that is on request.
1. Scope
This policy applies to personal data we process about consultants, candidates, clients and their personnel, suppliers, website visitors and other contacts, wherever located. Depending on which group company you deal with and where you are located, different laws may apply — including the UK GDPR and Data Protection Act 2018, Singapore’s Personal Data Protection Act 2012 (PDPA), and Malaysia’s Personal Data Protection Act 2010 (as amended).
2. The personal data we collect
Depending on our relationship with you, we may collect: identity and contact details; professional and employment history, qualifications and CV data; right-to-work and identity-verification information; engagement, assignment and payment details; correspondence and records of our dealings with you; and technical data when you use our websites.
3. How we collect it
We collect personal data directly from you, and also from third parties and public sources — for example professional networking sites, referrals, recruitment platforms and publicly available professional directories. Where we obtain your data from a source other than you, we will provide information about our processing within a reasonable period, as required by applicable law.
4. Why we use your data and our legal bases
| Purpose | Data used | Legal basis (where applicable) |
|---|---|---|
| Providing legal-resourcing and managed services; matching consultants and candidates to engagements | Professional, contact and engagement data | Performance of a contract; legitimate interests |
| Sourcing and assessing candidates, including profiling to identify suitable matches | Professional history, CV and assessment data | Legitimate interests (balancing test carried out; details on request) |
| Verifying identity and right to work | Identity and right-to-work data | Legal obligation |
| Administering payments and managing the relationship | Contact, engagement and payment data | Performance of a contract; legal obligation |
| Marketing our services | Contact data | Consent or legitimate interests, depending on location |
5. Automated processing and AI
We use technology, including AI-assisted tools, to help identify and rank potential matches between people and engagements. These tools support our team; a suitably trained member of staff reviews and is responsible for any decision that materially affects you. The matching is designed so that special category data is not used to assess or rank you. We do not take decisions producing legal or similarly significant effects about you based solely on automated processing without a lawful basis and appropriate safeguards. When we deploy a new AI-enabled product or feature, we update this policy and, where required, provide a specific notice.
We do not use your personal data to train artificial-intelligence models. Our AI providers act as our processors under contract and are not permitted to use your personal data to train their models; nor do we train models on your data ourselves.
6. Special category data and criminal-records data
We do not carry out background checks for every engagement. Where an engagement requires screening, a screening provider acting for us carries out the check and we receive the results, which may include criminal-records information. We use the results to assess suitability for the engagement, we disclose them to the client only where the client requests them, and we retain them so they can be produced if the client or a regulator audits the engagement. We process this information on the basis of your consent and, where it concerns criminal convictions or offences or is otherwise sensitive, under an additional condition permitted by the applicable law, with restricted access and heightened security. We do not ask you to provide special category data (such as health, racial or ethnic origin, religious or philosophical beliefs, trade-union membership, or sexual orientation), and where such data appears incidentally and is not needed we remove or disregard it.
Occasionally such information may appear in a CV or other material you send us. Where it does, we do not use it to source, assess or rank you, our AI-assisted matching does not use it, and we remove or disregard it where it is not needed. If we ever need to process special category data for a specific purpose (for example, a health-related reasonable adjustment), we will tell you and rely on an appropriate lawful condition at that time.
7. Who we share your data with
We share personal data with: other companies in the Nova8 group; clients and prospective clients, where relevant to an engagement; our service providers who process data on our behalf under written contracts (categories include cloud hosting, CRM and recruitment-technology providers, and professional advisers); and authorities or advisers where required by law. We do not sell your personal data.
Within the group, we may consolidate and migrate candidate and consultant records between group companies — including from our UK company to Nova8 Pte. Ltd. in Singapore — for group administration and to maintain a single candidate database. Such transfers are made under the safeguards described in section 8.
8. International transfers
As a group operating across Singapore, the United Kingdom and Malaysia (and other locations from time to time), we transfer personal data between group companies and to service providers in other countries. Where we do so, we put in place the safeguards required by the law applicable to the originating company — for example the UK International Data Transfer Agreement for transfers out of the UK, and comparable contractual protections for transfers from Singapore and Malaysia — within our intra-group data transfer arrangements. Some of these providers are located outside your country, including in the United States; where personal data is transferred to them it is protected by appropriate safeguards such as standard contractual clauses and, for UK data, the UK Addendum, under our data processing agreements with those providers. You can ask us for more information about these safeguards using the contact details below.
9. How long we keep your data
We keep personal data only for as long as necessary for the purposes described and to meet legal and regulatory requirements; our periods depend on the type of record. For example: panel members — throughout membership plus 5 years after final placement; unsuccessful candidates — 6 months after the decision; engagement and financial records — 7 years after the end of the engagement; marketing contacts — until you object or withdraw consent; and right-to-work and identity records for the duration of the engagement and a short period afterwards. Background-screening reports are deleted six months after the suitability decision, and a minimal record of the outcome is kept for the duration of the engagement and up to six years afterwards to meet client-audit and legal-retention requirements; special category data that appears incidentally and is not needed is removed or disregarded rather than retained.
10. Your rights
Depending on your location and the law that applies, you may have some or all of the following rights: to access your personal data; to have inaccurate data corrected; to have data erased; to restrict or object to processing; to data portability; and to withdraw consent where processing is based on consent. To exercise any right available to you, contact us using the details below; we will respond within the time required by the applicable law.
11. Cookies
Our websites use cookies and similar technologies. Our Cookie Policy explains these and is published, with a cookie-consent banner, at nova8.co/cookie-policy.html.
12. Security, children and changes
We maintain appropriate technical and organisational measures to protect personal data. Our services are not directed at children. We may update this policy from time to time; the current version is always available on our websites, and we will notify you of material changes where required.
13. How to contact us and complain
For any privacy question or to exercise your rights, contact our Data Protection Officer at privacy@nova8.co. If you are in the UK and wish to complain, you may contact the Information Commissioner’s Office (ico.org.uk); in Singapore, the Personal Data Protection Commission (pdpc.gov.sg); in Malaysia, the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi). The group’s UK establishment is Source Professional Support Limited (1 Cornhill, London EC3V 3ND); individuals in the UK may contact us there or via privacy@nova8.co. Because our UK processing is carried on in the context of Source’s activities in the UK, we are not required to appoint a separate UK representative under Article 27 of the UK GDPR.