This policy explains how the Nova8 group of companies collects and uses personal data. The Nova8 group comprises the companies listed in the Group Entity Register (Document J1), available on request. In this policy “Nova8”, “we”, “us” and “our” mean the relevant group company that determines how your personal data is used. The group company coordinating data protection across the group is Nova8 Pte. Ltd. (company registration no. 201543872K; EA Licence No. 17S8782), 105 Cecil Street, #22-88 The Octagon, Singapore 069534. Some of our services are offered under service brands within the group, including “Source by Nova8” (our UK-focused legal-recruitment service). Whichever brand or website you deal with, the group company responsible for your personal data is as described in this policy and in the Group Entity Register.
1. Scope
This policy applies to personal data we process about consultants, candidates, clients and their personnel, suppliers, website visitors and other contacts, wherever located. Depending on which group company you deal with and where you are located, different laws may apply — including the UK GDPR and Data Protection Act 2018, Singapore’s Personal Data Protection Act 2012 (PDPA), and Malaysia’s Personal Data Protection Act 2010 (as amended).
2. The personal data we collect
Depending on our relationship with you, we may collect: identity and contact details; professional and employment history, qualifications and CV data; right-to-work and identity-verification information; engagement, assignment and payment details; correspondence and records of our dealings with you; and technical data when you use our websites.
3. How we collect it
We collect personal data directly from you, and also from third parties and public sources — for example professional networking sites, referrals, recruitment platforms and publicly available professional directories. Where we obtain your data from a source other than you, we will provide information about our processing within a reasonable period, as required by applicable law.
4. Why we use your data and our legal bases
We use personal data to operate our business, manage recruitment, provide services, and comply with legal obligations.
5. Automated processing and AI
We use technology, including AI-assisted tools, to help identify and rank potential matches between people and engagements. These tools support our team; a suitably trained member of staff reviews and is responsible for any decision that materially affects you. The matching is designed so that special category data is not used to assess or rank you. We do not take decisions producing legal or similarly significant effects about you based solely on automated processing without a lawful basis and appropriate safeguards. When we deploy a new AI-enabled product or feature, we update this policy and, where required, provide a specific notice. We do not use your personal data to train artificial-intelligence models. Our AI providers act as our processors under contract and are not permitted to use your personal data to train their models; nor do we train models on your data ourselves.
6. Special category data and criminal-records data
We do not carry out background checks for every engagement. Where an engagement requires screening, a screening provider acting for us carries out the check and we receive the results, which may include criminal-records information. We use the results to assess suitability for the engagement, we disclose them to the client only where the client requests them, and we retain them so they can be produced if the client or a regulator audits the engagement. We process this information on the basis of your consent and, where it concerns criminal convictions or offences or is otherwise sensitive, under an additional condition permitted by the applicable law, with restricted access and heightened security. We do not ask you to provide special category data (such as health, racial or ethnic origin, religious or philosophical beliefs, trade-union membership, or sexual orientation), and where such data appears incidentally and is not needed we remove or disregard it. Occasionally such information may appear in a CV or other material you send us. Where it does, we do not use it to source, assess or rank you, our AI-assisted matching does not use it, and we remove or disregard it where it is not needed. If we ever need to process special category data for a specific purpose (for example, a health-related reasonable adjustment), we will tell you and rely on an appropriate lawful condition at that time.
7. Who we share your data with
We share personal data with: other companies in the Nova8 group (listed in the Group Entity Register); clients and prospective clients, where relevant to an engagement; our service providers who process data on our behalf under written contracts (categories include cloud hosting, CRM and recruitment-technology providers, and professional advisers); and authorities or advisers where required by law. We do not sell your personal data. Within the group, we may consolidate and migrate candidate and consultant records between group companies — including from our UK company to Nova8 Pte. Ltd. in Singapore — for group administration and to maintain a single candidate database. Such transfers are made under the safeguards described in section 8.
8. International transfers
As a group operating across Singapore, the United Kingdom and Malaysia (and other locations from time to time), we transfer personal data between group companies and to service providers in other countries. Where we do so, we put in place the safeguards required by the law applicable to the originating company — for example the UK International Data Transfer Agreement for transfers out of the UK, and comparable contractual protections for transfers from Singapore and Malaysia — within our intra-group data transfer arrangements. Some of these providers are located outside your country, including in the United States; where personal data is transferred to them it is protected by appropriate safeguards such as standard contractual clauses and, for UK data, the UK Addendum, under our data processing agreements with those providers. You can ask us for more information about these safeguards using the contact details below.
9. How long we keep your data
We keep personal data only for as long as necessary for the purposes described and to meet legal and regulatory requirements; our periods are set out in our Retention Schedule (Document J4). For example: panel members — throughout membership plus 5 years after final placement; unsuccessful candidates — 6 months after the decision; engagement and financial records — 7 years after the end of the engagement; marketing contacts — until you object or withdraw consent; and right-to-work and identity records for the duration of the engagement and a short period afterwards. background-screening reports are deleted six months after the suitability decision, and a minimal record of the outcome is kept for the duration of the engagement and up to six years afterwards to meet client-audit and legal-retention requirements; special category data that appears incidentally and is not needed is removed or disregarded rather than retained.
10. Your rights
Depending on your location and the law that applies, you may have some or all of the following rights: to access your personal data; to have inaccurate data corrected; to have data erased; to restrict or object to processing; to data portability; and to withdraw consent where processing is based on consent. To exercise any right available to you, contact us using the details below; we will respond within the time required by the applicable law.
11. Cookies
Our websites use only strictly necessary cookies — small files required for the site to work and to be secure, for example to protect against misuse, to manage the connection and balance traffic so pages load reliably, and to remember information you enter as you move between pages during a single visit. These are first-party cookies, and are either deleted when you close your browser or kept only for the short period needed for that purpose. We do not use analytics, advertising or other tracking cookies; we do not use cookies to profile you or to track you across other websites; and we do not set third-party advertising or analytics cookies. Because cookies that are strictly necessary to provide a service you have requested do not require consent under the UK Privacy and Electronic Communications Regulations and the ePrivacy rules — and we handle any limited personal data involved in line with the applicable law in Singapore and Malaysia — we do not use a cookie banner, and there is no separate cookie policy. You can block or delete cookies through your browser settings at any time, though parts of the site may not work properly if you do. If we introduce any non-essential cookies in future — for example analytics or marketing cookies — we will update this policy and, before those cookies are set, ask for your consent through a cookie banner.
12. Security, children and changes
We maintain appropriate technical and organisational measures to protect personal data. Our services are not directed at children. We may update this policy from time to time; the current version is always available on our websites, and we will notify you of material changes where required.
13. How to contact us and complain
For any privacy question or to exercise your rights, contact our Data Protection Officer at privacy@nova8.co. If you are in the UK and wish to complain, you may contact the Information Commissioner’s Office (ico.org.uk); in Singapore, the Personal Data Protection Commission (pdpc.gov.sg); in Malaysia, the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi). The group’s UK establishment is Source Professional Support Limited (1 Cornhill, London EC3V 3ND); individuals in the UK may contact us there or via privacy@nova8.co. Because our UK processing is carried on in the context of Source’s activities in the UK, we are not required to appoint a separate UK representative under Article 27 of the UK GDPR.
Nova8 Pte. Ltd. · 105 Cecil Street, #22-88 The Octagon, Singapore 069534 · © 2026 Nova8. All rights reserved. · EA Licence No. 17S8782
