Privacy Policy

1. Who we are

Kova Direct Limited, trading as Kova, provides workforce administration, onboarding, payroll, compliance and related support services to recruitment agencies and other business clients.

In this policy, "Kova", "we", "us" or "our" means Kova Direct Limited.

This Privacy Policy explains how we collect, use, store and protect personal information.

2. Our data protection role

Kova may act in different data protection roles depending on the circumstances.

Where Kova is data controller

Kova acts as a data controller where we decide why and how personal information is used. This includes personal information relating to:

• visitors to our website;
• people who contact us or submit enquiries;
• prospective clients;
• agency client contacts, including directors, managers, consultants, finance contacts and authorised users;
• suppliers, professional advisers and other business contacts;
• Kova's own business administration, contracts, billing, marketing, service updates and relationship management.

For this information, Kova is responsible for deciding how and why the personal data is used.

Where Kova is data processor

Where Kova provides services to an agency client, Kova will usually act as a data processor for the purposes of performing the agreed Kova services for that agency client.

In this context, the agency client will usually be the data controller. Kova will process worker, assignment, onboarding, payroll, compliance, timesheet, payment and related workforce administration data on behalf of the agency client and in accordance with the client's instructions.

Where Kova acts as processor, the agency client is usually responsible for providing appropriate privacy information to the relevant workers and other individuals, unless otherwise agreed.

3. Personal information we collect as controller

Where Kova acts as controller, we may collect and use:

• name;
• business name;
• job title;
• email address;
• telephone number;
• business address;
• enquiry details;
• correspondence and meeting notes;
• contract and billing information;
• service records;
• website usage information;
• IP address, browser and device information;
• cookie preferences;
• marketing preferences.

We may collect this information directly from you, from your organisation, through our website, through email or telephone communications, through meetings, from referrals, or from publicly available business sources.

4. Personal information we process as processor for agency clients

Where Kova acts as processor for an agency client, we may process personal information such as:

• worker names and contact details;
• date of birth;
• address and residency information;
• right to work information;
• identity documents;
• tax, payroll and payment information;
• assignment information;
• timesheets and payment records;
• onboarding records;
• compliance checks;
• audit trail records;
• employment, engagement or workforce administration information;
• communications relating to worker support and service delivery.

We process this information to perform the Kova services agreed with the agency client. This may include onboarding support, workforce administration, payroll processing support, compliance support, document management, audit trail management, reporting and related operational services.

5. Why we use personal information

Where Kova acts as controller, we use personal information to:

• respond to enquiries;
• provide information about Kova and our services;
• manage prospective client relationships;
• onboard agency clients;
• manage contracts and service delivery;
• manage billing, finance and account administration;
• provide service updates;
• maintain business records;
• manage suppliers and professional advisers;
• improve our website and services;
• protect our business, systems and users;
• comply with legal and regulatory obligations;
• send relevant business communications where permitted.

Where Kova acts as processor, we use personal information only to perform the agreed services for the agency client and in accordance with the client's instructions.

6. Lawful basis for processing

Where Kova acts as controller, we rely on one or more of the following lawful bases:

Contract

Where processing is necessary to enter into or perform a contract with you or your organisation.

Legal obligation

Where processing is necessary to comply with legal, tax, company, regulatory or reporting obligations.

Legitimate interests

Where processing is necessary for Kova's legitimate business interests, provided those interests are not overridden by your rights and freedoms. This may include managing enquiries, developing business relationships, providing service updates, improving services, maintaining records, protecting our business and managing client relationships.

Consent

Where we rely on consent, for example for some non-essential cookies or optional marketing communications. You can withdraw consent at any time.

Where Kova acts as processor for an agency client, the agency client is responsible for identifying the lawful basis for the processing. Kova processes the personal information on the agency client's behalf.

7. Who we share personal information with

Where necessary, we may share personal information with:

• agency clients;
• payroll, HR, onboarding, compliance or workforce management software providers;
• IT, hosting, email and security providers;
• professional advisers, including accountants, lawyers and insurers;
• banks, payment providers and finance providers;
• HMRC, Companies House, regulators, public authorities or law enforcement where required;
• other suppliers and service providers who support our business or services.

We do not sell personal information.

Where Kova acts as processor and uses sub-processors to support service delivery, this will be managed in accordance with our agreement with the relevant agency client.

8. International transfers

Some of our service providers may process personal information outside the UK. Where this happens, we will take appropriate steps to ensure the personal information is protected in accordance with UK data protection law.

9. How long we keep personal information

We only keep personal information for as long as necessary.

Where Kova acts as controller, retention periods may depend on the type of information and the reason we hold it. For example:

• website enquiries may be kept for a reasonable period to manage the enquiry and follow-up;
• client relationship records may be kept during the relationship and for a period afterwards;
• contract, billing and accounting records may be kept for legal, tax and audit purposes;
• marketing preferences may be kept until you unsubscribe or ask us to stop contacting you;
• legal or dispute-related records may be kept for as long as necessary to protect our position.

Where Kova acts as processor, retention will usually be governed by the agreement with the agency client.

10. Security

We take appropriate technical and organisational measures to protect personal information. These may include:

• access controls;
• password and account security;
• secure systems;
• staff confidentiality obligations;
• supplier checks;
• data minimisation;
• audit trails;
• backup procedures;
• internal policies and procedures.

No system is completely secure, but we use proportionate safeguards to protect personal information.

11. Your rights

Where Kova acts as controller, you may have the right to:

• request access to your personal information;
• ask us to correct inaccurate information;
• ask us to delete information;
• object to certain processing;
• ask us to restrict processing;
• ask us to transfer information to another provider;
• withdraw consent where we rely on consent;
• object to direct marketing.

To exercise your rights, contact us at: sarah@kovadirect.co.uk.

Where Kova acts as processor for an agency client, requests relating to worker or service delivery data may need to be handled by the agency client as controller. If we receive such a request, we may refer it to the relevant agency client or assist the client in responding.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

12. Marketing communications

We may send relevant business updates, service information or marketing communications where the law allows us to do so. You can opt out of marketing communications at any time by using the unsubscribe link in our emails or by contacting us directly.

We may still send important service, contract or account communications where necessary.

13. Cookies

Our website uses cookies and similar technologies. Some cookies are necessary for the website to work. Others help us understand website usage or improve our services. For more information, please see our Cookie Policy.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The latest version will always be available on our website.