1. Introduction
This Privacy Notice explains how DWEET LTD (“we,” “us,” or “our”) processes personal data in connection with Nova, our AI-powered hiring platform. Nova is a software-as-a-service product owned and operated by DWEET LTD. This notice applies to all users of Nova and individuals whose data is processed through our platform. Data Controller: DWEET LTD Company Number: 12281293 Registered Office: Aston House, Cornwall Avenue, London, England, N3 1LF Email: nova@dweet.com Data Protection Contact: andreas@dweet.com2. Data Controller vs. Data Processor Roles
Nova operates in different capacities depending on the type of data:2.1 When We Act as Data Processor
For Candidate Data (job applicant information), we act as a data processor on behalf of our customers (the data controllers). This includes:- Resume/CV content and personal information
- Application data from ATS integrations
- AI-generated candidate assessments and scores
- Interview questions and evaluation data
- Professional profile information about potential candidates found through Talent Search and other candidate search features
2.2 When We Act as Data Controller
For Account and Platform Data, we act as the data controller:- Customer account information and billing data
- Platform usage analytics and performance metrics
- Support communications and feedback
- Security logs and audit trails
3. Legal Basis for Processing
Sections 3.1 to 3.3 cover processing where we act as controller. Section 3.4 covers candidate data we process on behalf of hiring organisations.3.1 Contract Performance (Article 6(1)(b) GDPR)
- Providing Nova’s AI-powered hiring services to our customers
- Managing customer accounts and billing
3.2 Legitimate Interests (Article 6(1)(f) GDPR)
- Platform improvement and analytics: Usage data (including logs and telemetry, which may include limited identifiers) to enhance Nova’s functionality, using aggregation or pseudonymisation where feasible.
- Security and fraud prevention: Monitoring for unauthorized access and abuse
- Customer support: Resolving technical issues and providing assistance
- Legal compliance: Meeting audit and regulatory requirements
3.3 Legal Obligation (Article 6(1)(c) GDPR)
- Retaining audit logs for regulatory compliance
- Responding to lawful requests from competent authorities
- Meeting tax and financial record-keeping requirements
3.4 Lawful Basis for Candidate Data (Decided by the Hiring Organisation)
For candidate data we process on behalf of hiring organisations (Section 2.1), the hiring organisation is the controller and decides the lawful basis for its processing. For recruitment, this is usually the hiring organisation’s legitimate interests in finding and assessing candidates for roles (Article 6(1)(f) GDPR). If you’re a candidate and want to object to this processing or exercise another right, contact the hiring organisation. You can also emailprivacy@dweet.com. We’ll pass your request to the hiring organisation and help it respond.
4. Categories of Personal Data
4.1 Candidate and Job Data (Processed on Behalf of Customers)
- Professional Information: Employment history, education, skills, qualifications
- Search Profile Data: Role-relevant professional information about potential candidates found through Talent Search, such as current and past roles, employers, education, skills, and profile URLs
- Assessment Data: Nova-generated scores, interview questions, evaluation notes
- Application Content: Resumes, cover letters, portfolio materials
- Job Data: Job descriptions, requirements, and other job-related information
4.2 Customer Account Data (Processed as Controller)
- Account Information: Company name, user names, email addresses, roles
- Billing Information: Payment details, subscription plans, usage records
- Support Data: Communications, technical support requests, feedback
4.3 Platform Usage Data (Processed as Controller)
- Analytics Data: Feature usage, performance metrics, and error logs, which may include limited identifiers and, where reasonably necessary, portions of application content (for example ATS request and response payloads), and are aggregated or pseudonymised where feasible.
- Security Data: Authentication logs, access patterns, security events
- Audit Data: System logs, compliance records, operational metrics
5. Data Sources
We collect personal data from:- Direct provision: Information you provide when using Nova
- ATS integrations: Data synchronized from your applicant tracking system
- Professional networking and developer platforms: Where customers enable enrichment or fraud detection features, we may obtain role-relevant professional information from publicly available profiles on services such as LinkedIn, or GitHub on behalf of the hiring organisation. We do not access personal or entertainment focused social networks such as Facebook, Instagram, or TikTok for recruitment purposes.
- Third-party data providers and public professional sources: Where customers use Talent Search or other candidate search features, we obtain role-relevant professional information about potential candidates from third-party data providers and publicly available professional sources on behalf of the hiring organisation. We do not use customers’ connected LinkedIn accounts as a source for this data.
- Automated collection: Technical information about your use of Nova
- Third parties: Sub-processors and service providers (see Section 8)
6. How We Use Personal Data
6.1 Candidate Data Processing (As Processor)
- Analyzing resumes and application materials using AI
- Generating candidate scores and rankings
- Creating personalized interview questions and guidance
- Enabling talent rediscovery and candidate search
- Providing analytics on candidate quality and pipeline metrics
6.2 Account and Platform Data Processing (As Controller)
- Service Delivery: Account management, authentication, billing
- Platform Operation: Performance monitoring, error detection, optimization
- Customer Support: Responding to inquiries and resolving issues
- Security: Detecting and preventing unauthorized access
- Compliance: Meeting legal and regulatory obligations
7. Data Retention
7.1 Candidate Data
- Active processing: We process candidate data for as long as our customer has an active Nova subscription and uses the platform in line with the applicable agreement.
- Post termination: When a customer terminates their agreement, we provide a default 30 day window for data export, after which production copies of customer data are deleted within 60 days, unless longer retention is required by law or agreed in the customer settings. Backups are overwritten on their normal rotation schedule.
- Anonymised and aggregated data: We may retain de-identified or aggregated data created from candidate data for analytics, benchmarking and platform improvement, including after your account is closed, as described in our Data Processing Agreement and AI Terms. We do not attempt to re-identify this data.
7.2 Account Data
- Billing records: Retained for up to 10 years to meet tax, accounting and legal requirements.
- Account information: Retained for the duration of the customer relationship and up to 30 days after closure, unless longer retention is required by law or reasonably needed to resolve disputes or enforce our agreements.
8. International Transfers and Sub-Processors
We use third-party service providers (“sub-processors”) to host and operate Nova, provide support, and deliver certain features, including AI-based functionality.- Transfers outside the UK/EEA: Where personal data is transferred outside the UK or EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or adequacy decisions.
- Sub-processors: Our current sub-processors and their roles, locations and transfer safeguards are listed on our Sub-Processors and International Data Transfers page.
- More detail: Our Data Processing Agreement describes our use of sub-processors and international transfer mechanisms in more detail.
9. Your Rights Under GDPR
9.1 Data Subject Rights
You have the following rights regarding your personal data:- Access (Article 15): Request copies of your personal data
- Rectification (Article 16): Correct inaccurate or incomplete data
- Erasure (Article 17): Request deletion in certain circumstances
- Restriction (Article 18): Limit processing in certain situations
- Portability (Article 20): Receive your data in a structured format
- Objection (Article 21): Object to processing based on legitimate interests
9.2 How to Exercise Your Rights
To exercise your rights:- Email: privacy@dweet.com (Data Protection Contact)
- Subject line: “Data Subject Request - [Type of Request]”
- Include: Full name, email address, specific request details
- Verification: We may request identity verification
9.3 Response Times
- Standard requests: 30 days maximum
- Complex requests: May be extended by 60 days with notification
- Urgent requests: Prioritized based on circumstances
9.4 Candidate Data Rights
For candidate data processed on behalf of our customers:- Primary contact: The hiring organization (data controller)
- Our assistance: We will cooperate with customer responses
- Direct contact: Available if customer is unresponsive
10. Cookies and Analytics
10.1 Cookie Usage
Nova uses cookies and similar technologies for:- Essential functionality: Authentication, session management, security
- Product analytics: Platform usage analysis (PostHog - first-party only) to help us improve Nova, identify bugs, and understand feature usage
- Performance monitoring: Error tracking and system optimization (Datadog and Sentry)
10.2 Analytics for Authenticated Users
When you log in to Nova, product analytics is enabled as part of the service. This helps us understand how features are used, identify bugs, and improve Nova. We process this data under our legitimate interests in operating and improving the service (Article 6(1)(f) GDPR) and as part of our contract with you. For authenticated users:- We collect usage data such as pages viewed, features used, and interaction patterns
- Data is processed by PostHog in the EU
- We use cookieless tracking to minimise cookie usage
- We do not share this data with third parties for advertising purposes
10.3 Analytics for Visitors (Not Logged In)
For visitors on public pages who are not logged in, we display a consent banner for analytics. You can accept or decline analytics tracking. If you decline, we will not collect analytics data about your visit.10.4 Cookie Controls
- Consent banner: Displayed for non-essential cookies for visitors (not logged-in users)
- Opt-out options: Available through browser settings for essential cookies
- Cookie policy: Detailed information in our Cookie Policy
10.5 Analytics and Telemetry
We use first-party analytics and operational telemetry (including logs) to understand how Nova is used, improve performance and reliability, and support customers.- No advertising cookies: We do not use third-party advertising or cross-site tracking cookies in Nova.
- Content and identifiers in telemetry: Analytics and telemetry may include limited identifiers (for example user IDs or business contact details) and, where reasonably necessary for support, security, or product improvement, portions of application content such as ATS request and response payloads.
- More detail: Our use of analytics and logs is described in more detail in our Data Processing Agreement and on our Sub-Processors and International Data Transfers page.
11. Nova for LinkedIn Browser Extension
Some customers connect LinkedIn Recruiter to Nova through our “Nova for LinkedIn” browser extension.- What it reads: with your permission, your LinkedIn session from your own browser, your browser’s user-agent, your Recruiter contract details, and basic technical details about your browser and LinkedIn tab. It does not read LinkedIn pages, change them, or ask for your LinkedIn password.
- How we use it: to set up your connection through Unipile (Sub-processors) and to check that the connection is safe, using your IP address for abuse prevention. We do not store the raw session cookies.
- Exports: when you add candidates to a LinkedIn Recruiter project, we send Unipile the project details and the information needed to find each selected candidate in LinkedIn Recruiter, such as their name and current company.
- Disconnecting: go to Talent Search, open Integrations, and click Disconnect next to LinkedIn.
12. Security Measures
12.1 Technical Safeguards
- Encryption: Data encrypted in transit (TLS 1.2 or higher, targeting TLS 1.3) and at rest (AES-256)
- Access controls: Role-based access with multi-factor authentication
- Network security: Firewalls, intrusion detection, monitoring
- Secure development: Regular security testing and code reviews
12.2 Organizational Measures
- ISO 27001 alignment: Security management framework
- Staff training: Regular data protection and security training
- Confidentiality agreements: All personnel bound by confidentiality
- Incident response: Documented procedures for security breaches
12.3 Data Breach Response
If we become aware of a personal data breach affecting customer data, we will notify affected customers and, where required, relevant supervisory authorities in line with applicable law and our Data Processing Agreement. We will take appropriate steps to investigate, contain, and remediate the incident and will provide updates as more information becomes available.13. Automated Decision Making and AI Features
Nova includes AI-based features that help analyse recruitment data, generate scores and summaries, and suggest interview questions or similar decision-support outputs.- Decision support: AI features are designed to support human decision making, not to replace it. Customers remain responsible for reviewing AI outputs and deciding how to use them, especially where decisions may have legal or similarly significant effects for individuals.
- Data use and training: We do not use identifiable customer personal data itself to train general models. We may create and use de-identified or aggregated data to operate, secure and improve Nova, including to train and evaluate models, as described in our Data Processing Agreement and AI Terms.
- More detail: Our AI Terms explain how AI features work, how customer data is used with third-party AI providers, and the responsibilities that apply when you enable these features.
14. Children’s Privacy
Nova is not intended for individuals under 16 years of age. We do not knowingly collect personal data from children. If we become aware of such collection, we will delete the data promptly.15. Third-Party Links and Services
Nova may contain links to third-party websites or integrate with external services (such as ATS platforms). This Privacy Notice does not apply to third-party services. Please review their privacy policies separately.16. Changes to This Privacy Notice
16.1 Update Process
We may update this Privacy Notice to reflect:- Changes in applicable law
- New features or services
- Improvements to our privacy practices
16.2 Notification
Material changes will be communicated through:- Email notification: To registered users
- Platform notification: Prominent notice in Nova dashboard
- Website posting: Updated notice with effective date
- 30-day notice period: For significant changes affecting your rights