Privacy Policy & Data Protection Statement

Effective Date: January 1, 2025 | Last Updated: July 2026 Registered Data Controller: NovaLink Global Solutions Limited (Kenya ODPC Registered)

1. Statutory Compliance & Legal Scope

NovaLink Global Solutions Limited ("NovaLink", "we", "us", "our") is a licensed international recruitment agency accredited by the National Employment Authority (NEA) of Kenya and registered as a Data Controller with the Office of the Data Protection Commissioner (ODPC) under the Kenya Data Protection Act 2019.

This Privacy Policy governs all personal data processing activities across our digital platform (https://novalinkglobal.com), mobile interfaces, candidate portals, employer KYB verification systems, and in-person consultation centers at our Nairobi Headquarters.

We comply with: - Kenya Data Protection Act 2019 (DPA) and Data Protection Regulations 2021. - European Union General Data Protection Regulation (EU GDPR 2016/679) for European Au Pair and talent corridors. - GCC Personal Data Protection Directives (UAE Federal Decree Law No. 45/2021, Qatar Law No. 13/2016, Kuwait Privacy Directives). - International Labour Organization (ILO) Conventions regarding candidate confidentiality and fair recruitment.

2. Categories of Information We Collect

A. Candidate Data (Job Seekers & Applicants) To provide international recruitment, trade testing, visa processing, and pre-departure preparation, we collect: - Identity & Contact Details: Full legal name, date of birth, gender, nationality, national ID number, passport number, passport photo, email address, phone number, and physical address. - Professional Credentials: CV/resume, work experience, educational diplomas, professional licenses (e.g. Nursing Council certificates, driving licenses, trade test certificates), language proficiency certifications (e.g. German A1/B1 certificates). - Background & Compliance Documentation: Certificate of Good Conduct (Kenyan Directorate of Criminal Investigations), medical fitness certificates (GAMCA/GCC approved health reports), reference checks, and next-of-kin contact details. - Consultation & Interview Records: Physical/virtual appointment logs at Nairobi HQ, interview notes, and skill evaluation scores.

B. Employer & Corporate Partner Data (Employers & Agencies) To verify corporate legitimacy and ensure safe working environments for candidates: - Corporate KYB Information: Company legal name, trade license / registration certificate, tax identification PIN, registered business address, company website, and industry sector. - Authorized Officer Details: Full name, designation, official corporate email, phone number, and government-issued ID/passport of designated recruitment officers. - Job Offer & Demand Letters: Attested demand letters, salary structures, contract terms, housing provisions, and embassy attestation codes.

C. Technical & Automated Site Data - Device & Connection Data: IP address, browser type, operating system, geolocation (country level), referral URLs, and session duration. - Security & Log Data: Authentication timestamps, failed login attempts, CSRF security tokens, and user audit logs.

3. Lawful Bases & Purposes of Data Processing

We process personal data strictly under the following legal bases:

1. Performance of a Contract: Matching candidates with verified employment vacancies, processing visa applications, and executing employment contracts.
2. Legal Obligation: Statutory reporting to the Kenya National Employment Authority (NEA), immigration authorities, and Ministry of Labour.
3. Consent: Sending job alerts, optional career newsletters, or candidate promotional profiles with explicit opt-in consent.
4. Legitimate Interests: Platform fraud prevention, KYB employer vetting, network security, and service optimization.

4. Zero Placement Fee & Candidate Confidentiality Guarantee

In strict accordance with Kenyan law and ILO Convention No. 181: - NovaLink does NOT charge placement fees to job candidates. - Candidate financial data is never collected or requested for recruitment placement. - Candidate profiles are shared with verified employer partners only after explicit candidate consent and job application submission.

5. Cross-Border Data Transfers & Third-Party Sharing

As an international recruitment agency, candidate data may be transferred outside Kenya to destination countries (e.g. UAE, Qatar, Saudi Arabia, Kuwait, Germany, Sweden, Netherlands, Spain, United Kingdom).

Safeguards for Cross-Border Transfers: - Verified Employers Only: Data is shared exclusively with corporate employers who have completed full KYB verification and submitted government-attestation documents. - Standard Contractual Clauses (SCCs): International transfers to non-adequate jurisdictions are protected by binding data protection agreements enforcing security and confidentiality. - Government & Visa Authorities: Data shared with foreign embassies, VFS Global, GAMCA medical centers, and destination ministry portals for visa issuance. - No Commercial Data Sale: NovaLink never sells, rents, or monetizes personal data to third-party marketing networks.

6. Data Security & Technical Standards

NovaLink implements robust technical and organizational security measures: - Encryption in Transit: TLS 1.3 encryption across all website and API communications. - Encryption at Rest: AES-256 encryption for candidate identity documents, CVs, and database backups. - Access Controls: Strict Role-Based Access Control (RBAC) limiting candidate document access to authorized NovaLink officers. - Security Monitoring: Automated intrusion detection, vulnerability scanning, and httpOnly secure cookies.

7. Data Retention Schedule

8. Data Subject Rights

Under the Kenya Data Protection Act 2019 and EU GDPR, candidates and employers possess the following enforceable rights:

• Right to Access: Request a full copy of all personal data held by NovaLink.
• Right to Rectification: Correct any inaccurate or incomplete personal information.
• Right to Erasure ("Right to be Forgotten"): Request deletion of personal profile data, subject to statutory retention limits for active placements.
• Right to Restrict Processing: Request temporary suspension of data processing during dispute reviews.
• Right to Data Portability: Receive candidate profile data in a structured, machine-readable JSON/CSV format.
• Right to Withdraw Consent: Revoke consent for optional notifications at any time.

To exercise any of these rights, contact our Data Protection Officer at dpo@novalinkglobal.com. Responses will be provided within 14 calendar days.

9. Office of the Data Protection Commissioner (ODPC) Complaints

If you believe NovaLink has processed your personal data in violation of statutory privacy laws, you have the right to lodge a complaint with the regulatory authority:

Office of the Data Protection Commissioner (ODPC) Kenya Website: [https://www.odpc.go.ke](https://www.odpc.go.ke) Email: info@odpc.go.ke / complaints@odpc.go.ke Head Office: Popo Road, Off Mombasa Road, Nairobi, Kenya.

10. Contact Our Data Protection Officer (DPO)

Data Protection Officer NovaLink Global Solutions Limited Nairobi HQ: Commercial Plaza, 4th Floor, Nairobi, Kenya Email: dpo@novalinkglobal.com Phone: +254 718 728 888 / +254 700 000 000