‣ INTRODUCTION
‣ DEFINITIONS
‣ APPLICABLE LEGISLATIONS
‣ PRIVACY POLICY SUMMARY WHERE WE ACT AS AN EMPLOYMENT
AGENCY OR RECRUITMENT AGENCY
‣ DATA PROCESSING UNDER THE DATA PROTECTION LAWS
‣ THE DATA PROTECTION PRINCIPLES
‣ LEGAL BASES FOR PROCESSING
‣ CONSENTS AND DATA COLLECTION
‣ PURPOSE OF PROCESSING AND LEGAL BASIS
‣ SUBJECT ACCESS REQUESTS
‣ RECTIFICATION
‣ ERASURE
‣ RESTRICTION OF PROCESSING
‣ OBJECT TO PROCESSING
‣ ENFORCEMENT OF RIGHTS
‣ AUTOMATED DECISION MAKING
‣ MONITORING AND RECORDING COMMUNICATION
‣ CHILDREN’S PRIVACY

‣ PERSONAL DATA BREACHES
1. PERSONAL DATA BREACHES WHERE NOVALIFE IS THE DATA
CONTROLLER
2. PERSONAL DATA BREACHES WHERE NOVALIFE IS THE DATA
PROCESSOR
3. COMMUNICATING PERSONAL DATA BREACHES TO INDIVIDUALS
‣ DISCLAIMER
‣ COMPLAINTS
‣ NOTIFICATION OF CHANGES
‣ ANNEX – LEGAL BASES FOR PROCESSING PERSONAL DATA

‣ INTRODUCTION

All organisations that process personal data are required to comply with data protection
legislation.  

The Data Protection Laws give individuals (known as ‘data subjects’) certain rights over
their personal data whilst imposing certain obligations on the organisations that process
their data.

As a Recruitment Business and an Employment Agency, Novalife collects and processes
both personal data and sensitive personal data.  Such processing is necessary for the
effective provision of Novalife’s services and for the fulfilment of its statutory and
regulatory obligations.  It is also required to keep this data for different periods depending
on the nature of the data.

This policy sets out how Novalife implements the Data Protection Laws.

‣ DEFINITIONS

In this policy the following terms have the following meanings:

‘Novalife’ means and includes the brand Novalife, Novalife Global Recruiters, and all
entities, subsidiaries, affiliates, branches, and companies incorporated, operated, or branded
under the name “Novalife” and/or “Novalife Global Recruiters” in the EU/EEA, the
UAE/Dubai, and South Africa;

‘Consent’ means any freely given, specific, informed and unambiguous indication of an
individual’s wishes by which he or she, by a statement or by a clear affirmative action,
signifies agreement to the processing of personal data relating to him or her;
‘Data controller’ means an individual or organisation which, alone or jointly with others,
determines the purposes and means of the processing of personal data;

‘Data processor’ means an individual or organisation which processes personal data on
behalf of the data controller;

‘Personal data’ means any information relating to an individual who can be identified, such
as by a name, an identification number, location data, an online identifier or to one or more
factors specific to the physical, physiological, mental, economic, cultural or social identity of
that natural person. 

‘Sensitive personal data’ means personal data revealing racial or ethnic origin, political
opinions, religious or philosophical beliefs, or trade union membership, and
the processing of biometric data, data concerning health, and an individual’s criminal
convictions.

* For the purposes of this policy we use the term ‘personal data’ to include ‘sensitive
personal data’ except where we specifically need to refer to sensitive personal data. 

‘Personal data breach’ means a breach of security leading to the accidental or unlawful
destruction, loss, alteration, unauthorised disclosure of, or access to, personal data;

‘Processing’ means any operation or set of operations performed on personal data, such as
collection, recording, organisation, structuring, storage (including archiving), adaptation or
alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise
making available, alignment or combination, restriction, erasure or destruction. 

‘Supervisory authority’ means an independent public authority which is responsible for
monitoring the application of data protection.

‘Cookies’ is a small file placed on your computer by this Website when you either visit, or
use certain features of the Website. A cookie generally allows the website to “remember”
your actions or preference for a certain period of time.

‘Website’ shall mean the website currently owned and operated by Novalife, being
https://novalifeglobalrecruiters.com/ and shall include any and all sub-domains thereof,
unless expressly excluded by their own terms of use.

‣ APPLICABLE LEGISLATIONS

This Privacy Policy is governed by and drafted in accordance with applicable data protection
and privacy laws, including but not limited to the following, as may be amended, replaced,
or supplemented from time to time:

• European Union / European Economic Area (EEA):
– Regulation (EU) 2016/679 – General Data Protection Regulation (GDPR);

• South Africa:
– Protection of Personal Information Act, 2013 (POPIA) and related regulations.

• United Arab Emirates (Dubai and UAE):
– Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL);

‣ PRIVACY POLICY SUMMARY

1. Our Role as Data Controller
Novalife is a recruitment and employment agency providing commercial recruitment and
staffing services to its client companies, and assisting candidates in identifying and
securing appropriate employment opportunities.
In the course of providing these services, Novalife processes personal data (including,
where applicable, special category / sensitive personal data) relating to:
● Candidates, and
● Client companies
In doing so, Novalife acts as a Data Controller in accordance with applicable data
protection laws.

2. How We Collect Personal Data
We may collect personal data in the following ways:
● Directly from you, including through application or enquiry forms, service agreements,
interviews, meetings, email correspondence, telephone or other electronic
communications, whether received from candidates or from client companies and their
authorised representatives;
● From third-party sources such as professional platforms, referrals, Novalife websites, or
publicly available sources;
● From client companies in connection with recruitment and placement activities;
● Where legally required, from government or regulatory authorities.

3. Purpose of Processing and Legal Basis
Novalife collects and processes personal data for the purposes of providing recruitment
and employment services, including but not limited to:
● Candidate sourcing, assessment, and placement;
● Presenting candidate profiles to client companies;
● Managing client relationships and service delivery;
● Entering into and performing contracts;
● Compliance with legal, regulatory, and immigration requirements;
● Business administration and record-keeping.
The legal bases relied upon include one or more of the following:
● Consent

● Legitimate Interests
● Legal Obligations
● Contractual Necessity

4. Legitimate Interests
Where Novalife relies on legitimate interests as a lawful basis, such interests include:
● Identifying and assessing suitable candidates for client companies;
● Confirming identity, qualifications, experience, and suitability of candidates;
● Managing and maintaining relationships with client companies;
● Ensuring health and safety compliance;
● Compliance with employment, immigration, and labour regulations;
● Preventing fraud and maintaining business integrity;
● Ensuring efficient and high-quality service delivery.
These interests are balanced against your rights and freedoms.

5. Collection and Use of Personal Data

5.1 Categories of Personal Data Collected
The personal data we may collect and process includes, where relevant:
For candidates and individuals:
● Identification and contact details (such as name, address, email address, telephone
number);
● Date of birth, age, gender, nationality, country of origin and country of birth;
● Employment history, qualifications, skills, training, and professional experience;
● Curriculum vitae (CV) and application-related information;
● Right-to-work, immigration, and passport details;
● Background screening and compliance verification information (where lawful);
● Payroll, tax, pension, holiday, and statutory information (only where Novalife acts as
employer).
For client companies and authorised representatives:
● Business name, registered address, and company registration number;
● Job title and business contact details of authorised representatives;
● Authorised contact numbers and email addresses;
● Enquiry, contractual, and communication information.

5.2 Special Category (Sensitive) Personal Data
Where Novalife collects special category personal data, Novalife will:
● Clearly inform you of the necessity and purpose of collecting such data;

● Identify and rely on an appropriate lawful basis for processing; and
● Obtain your explicit consent, where required.

5.3 Website and Technical Data
When you visit Novalife’s website, we may collect technical information such as:
● IP address;
● Device and browser information;
● Location data (where applicable).
Such data is processed for purposes including website functionality, security, analytics,
and user experience improvement.

5.4 Personal Information About Other Individuals
Where you provide personal data relating to another individual, you confirm that:
● You are authorised to act on their behalf;
● The individual has been informed of this Privacy Policy;
● The individual has provided valid consent or another lawful basis exists for the
processing of their personal data.
This includes consent, where applicable, for:
● Processing for the purposes outlined in this Policy;
● Transfer of personal data outside the state, subject to appropriate safeguards;
● Processing of financial or contractual information where necessary.
You further confirm that the individual has been made aware of their data protection
rights.

6. Recipients of Personal Data
Personal data may be shared strictly on a need-to-know basis with:
● Client companies for recruitment, placement, and workforce engagement purposes;
● Candidates where relevant to service delivery;
● Government and regulatory authorities where legally required;
● Payroll, pension, and benefits providers (where we act as employer);
● Background check, compliance, and verification service providers;
● Professional advisers (legal, tax, compliance, accounting);
● Other third parties where required to facilitate lawful recruitment or placement.
Novalife does not sell personal data.

7. Statutory and Contractual Requirements

Certain personal data is required:
● By law (e.g. immigration, employment, tax, and social security requirements); and/or
● To enter into or perform a contract with a candidate, or client company.
Failure to provide required personal data may result in:
● Inability to progress with recruitment or placement;
● Inability to enter into or continue a service relationship.

8. Where We Act as an Employer
In limited circumstances where Novalife acts as an employer (e.g. employer-of-record or
PAYE employment):
● We are legally required to retain payroll, tax, pension, holiday, and sick pay records;
● Such data is retained for statutory periods as required by law;
● Data may be shared with statutory bodies.

9. Data Retention
Novalife retains personal data only for as long as necessary to fulfil its operational,
contractual, and legal obligations.
Retention periods vary depending on:
● Recruitment or employment activity;
● Legal and regulatory requirements;
● Contractual obligations; and
● Whether consent has been provided.
Where processing is based on consent, and such consent is withdrawn or expires,
Novalife will cease processing unless another lawful basis applies.

10. Your Data Protection Rights
You have the right to:
– Be informed about how your personal data is processed;
– Access your personal data;
– Request rectification of inaccurate or incomplete data;
– Request erasure of personal data (subject to legal limitations);
– Restrict processing in certain circumstances;
– Data portability, where applicable;
– Object to processing based on legitimate interests;
– Not be subject to automated decision-making or profiling;

– Withdraw consent at any time (where consent is the lawful basis). However,
Withdrawal will not affect the lawfulness of processing carried out prior to
withdrawal.

‣ DATA PROCESSING UNDER THE DATA PROTECTION LAWS

Novalife processes personal data in relation to its own staff, work-seekers and client
contacts and is a data controller for the purposes of the Data Protection Laws.

Novalife may hold personal data on individuals for the following purposes:
– Staff administration;
– Accounts and records;
– Administration and processing of work seekers’ personal data for the purposes of
providing recruitment/employment services, including processing using software
solution providers and back-office support;
– Administration and processing of clients’ personal data for the purposes of
supplying/introducing work-seekers;

‣ THE DATA PROTECTION PRINCIPLES

The Data Protection Laws require Novalife acting as either data controller or data
processor to process data in accordance with the principles of data protection. These
require that personal data is: 

– Processed lawfully, fairly and in a transparent manner;

– Collected for specified and legitimate purposes and not further processed in a
manner that is incompatible with those purposes;

– Adequate, relevant and limited to what is necessary in relation to the purposes for
which they are processed;

– Accurate and kept up to date; every reasonable step must be taken to ensure
that personal data that are inaccurate, having regard to the purposes for which
they are processed, are erased or rectified without delay;

– Kept for no longer than is necessary for the purposes for which the personal
data are processed;

– Processed in a manner that ensures appropriate security of the personal data,
including protection against unauthorised or unlawful processing and against
accidental loss, destruction or damage, using appropriate technical or
organisational measures; and that the data controller shall be responsible for, and
be able to demonstrate, compliance with the principles.

‣ LEGAL BASES FOR PROCESSING

Novalife will only process personal data where it has a legal basis for doing so (see
Annex A).

Novalife will review the personal data it holds on a regular basis to ensure it is being
lawfully processed and it is accurate, relevant and up to date.

Before transferring personal data to any third party (such as past, current or prospective
employers, and clients, intermediaries such as umbrella companies, persons making an
enquiry or complaint and any other third party (such as software solutions providers and
back-office support)), Novalife will establish that it has a legal reason for making the
transfer.

‣ CONSENTS AND DATA COLLECTION

When you register with Novalife, whether as a candidate/job-seeker or a client
company/employer, or when you apply for a job or engage our services, you consent to
Novalife processing your personal data for the purposes described below.
Novalife will not use your personal data for purposes other than those specified, and the
types of personal data we collect include:

• For Candidates / Job-Seekers:

Personal Data

When you register with Novalife, whether as a candidate/job-seeker or a client company/employer, or when you apply for a job or engage our services, you consent to Novalife processing your personal data for the purposes described below.

Novalife will not use your personal data for purposes other than those specified, and the types of personal data we collect include:

• Name

• Date of birth

• Contact details (telephone, email, postal address)

• Experience, training, qualifications, and CV

• National Insurance number

Sensitive Personal Data

• Disability or health conditions relevant to the role
• Criminal convictions (if relevant for the role)

• For Client Companies / Employers:

• Company name and contact information
• Representative names, job titles, and professional contact details
• Communication and contractual information
• Company requirements and preferences for recruitment

 

 

‣ MONITORING AND RECORDING COMMUNICATION

Reporting and Response:
1. When Novalife is the data controller:
– Steps are taken to contain and recover from breaches.
– Likely risks to individual rights and freedoms are reported to the relevant supervisory authority.
2. When Novalife is the data processor:
– The relevant data controller is notified immediately upon awareness of a breach.
3. Notification to Individuals:
– Individuals affected by high-risk breaches will be notified without undue delay.
Exceptions apply where:
– Data is encrypted or otherwise unintelligible;
– Risk has been mitigated; or
– Notification would require disproportionate effort; in which case a public notice will be made.

‣ DISCLAIMER 

Novalife shall not be held liable for any acts, omissions, misconduct, fraud, or disputes arising between users of the platform. All users are solely responsible for verifying the authenticity, accuracy, and legality of any information received from other users prior to entering into any engagement, transaction, or interaction.

To protect your privacy and personal data, please refrain from sharing sensitive information with third parties or posting it on public forums.

 

‣ COMPLAINTS OR QUERIES 

Novalife tries to meet the highest standards when collecting and using personal information. We take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures.

‣ NOTIFICATION OF CHANGES

 

This policy was last updated on 13th February 2026