Privacy Policy

1. Who we are

Nova CRM ("we", "us", "our") recruits and manages care staff, and this policy explains how we collect, use, store, and protect personal data submitted through our website and candidate portal.

2. What we collect

To process a job application and, where successful, manage your employment, we collect:

  • Contact and identity details (name, date of birth, address, phone, email).
  • Right-to-work documents (passport/ID, share code, visa details).
  • Education and employment history, and references.
  • National Insurance number and bank details, for payroll.
  • Enhanced DBS (criminal record) check details and results, where applicable to the role.
  • Training certificates and compliance documents.
  • Account and usage data (login activity, uploaded documents, portal activity).

DBS/criminal record information is "special category" data under UK GDPR. We only collect and process it where necessary for a role that requires it, and we restrict access to authorised staff.

3. Why we collect it, and our legal basis
  • Recruitment and employment — to assess your application, verify eligibility to work, run compliance/DBS checks, and manage ongoing employment (contract, legal obligation, and legitimate interests).
  • Payroll — to pay you correctly and meet tax/NI obligations (legal obligation).
  • Training and compliance — to arrange and track mandatory training (legitimate interests, legal obligation).
  • Communication — to contact you about your application, interview, training, or employment.
4. Who we share it with

We share data only where needed to deliver the services above, including with:

  • DBS / criminal record check providers.
  • Training and compliance providers (course bookings, certificate tracking).
  • Payroll and workforce scheduling providers.
  • Email and IT service providers who host our systems.
  • Regulatory or government bodies, where we're legally required to.

We do not sell personal data.

5. How long we keep it

We retain application and employment records for as long as needed to fulfil the purposes above and to meet our legal, tax, and regulatory obligations (including sector-specific retention rules for DBS and compliance records), after which it's securely deleted or anonymised.

6. Your rights

Under UK GDPR you have the right to access, correct, delete, or restrict the personal data we hold about you, to object to certain processing, and to request a copy of it in a portable format. To exercise any of these rights, contact us using the details below.

7. Cookies and analytics

We may use cookies and analytics tools (such as Google Analytics) to understand how our site is used. These tools may set cookies in your browser; you can control or disable cookies through your browser settings.

8. Security

We use appropriate technical and organisational measures to protect your personal data, including access controls, encryption of sensitive fields, and restricted staff access.

9. Contact us

If you have any questions about this policy or how we handle your data, please contact us.