Privacy Policy

Privacy & Data Handling Statement

Effective Date: 29 July 2026

1. Introduction

Novo Data Services ("Novo", "we", "our" or "us") is committed to protecting the privacy and confidentiality of the personal data entrusted to us.

As a specialist regulatory compliance, data protection and fraud consultancy, we recognise that our clients may entrust us with highly sensitive information. We therefore apply appropriate technical and organisational measures to ensure that personal data is processed securely, lawfully and transparently.

This Privacy & Data Handling Statement explains how we collect, use, retain and protect personal information when you visit our website, contact us or engage our consultancy services.

2. Who We Are

Novo Data Services

Email: info@novodataservices.co.uk

Where required under data protection legislation, Novo Data Services acts as either:

• Data Controller
• Data Processor

depending upon the nature of the services provided.

3. When We Act as a Controller

Novo acts as a Data Controller when we determine the purpose and means of processing personal data, including where we:

• Manage enquiries
• Respond to website contact forms
• Manage supplier relationships
• Issue invoices
• Maintain client records
• Conduct marketing activities where permitted
• Meet legal and regulatory obligations

4. When We Act as a Processor

Many of our consultancy services require us to process personal data solely on behalf of our clients.

Examples include:

• Subject Access Requests (DSARs)
• Data protection audits
• DPIAs
• Compliance reviews
• Regulatory investigations
• Internal investigations
• Complaints handling
• Data breach investigations
• Fraud investigations
• Governance reviews
• Records of Processing Activities
• Retention schedule reviews
• Regulatory applications
• Policy reviews

When acting as a Data Processor we only process information in accordance with our client's documented instructions and applicable data protection legislation.

5. Personal Information We Collect

Depending upon the services provided, we may collect:

Identity Information

• Name
• Job title
• Employer
• Business contact details

Contact Information

• Email address
• Telephone number
• Postal address

Technical Information

• IP address
• Browser type
• Device information
• Website usage information
• Cookies

Business Information

• Regulatory documentation
• Governance documentation
• Policies
• Risk assessments
• Contracts
• Audit information

6. Information We May Process on Behalf of Clients

Depending upon the engagement, we may process:

• Personal data
• Special category personal data
• Criminal offence data
• Financial information
• Employment information
• Identification documents
• Complaints
• Investigation material
• Witness statements
• Regulatory correspondence
• Litigation documentation
• Fraud evidence

The categories of information processed will always depend upon the specific services commissioned by our client.

7. Special Category Personal Data

Where necessary to provide our consultancy services, Novo may process Special Category Personal Data in accordance with Article 9 UK GDPR and Schedule 1 of the Data Protection Act 2018.

This may include information relating to:

• Health
• Trade union membership
• Racial or ethnic origin
• Religious beliefs
• Sexual orientation
• Biometric data
• Other special category information relevant to the engagement

Processing will only take place where an appropriate lawful condition applies.

8. Criminal Offence Data

Where necessary, Novo may process information relating to criminal allegations, offences or convictions where this is required for:

• Fraud investigations
• Regulatory investigations
• Internal investigations
• Legal proceedings
• Compliance reviews

Such information will only be processed where permitted by law.

9. Lawful Bases

Novo Data Services only processes personal data where there is a lawful basis to do so under Article 6 of the UK General Data Protection Regulation ("UK GDPR"). Where Special Category Personal Data or Criminal Offence Data is processed, we also ensure that an appropriate condition under Article 9 UK GDPR and, where applicable, Schedule 1 of the Data Protection Act 2018, is satisfied.

The lawful basis relied upon will depend upon the nature of the services provided.

Processing Activity

Typical Lawful Basis

Responding to enquiries

Legitimate Interests

Providing consultancy services

Contract

Preparing quotations and proposals

Legitimate Interests

Managing client relationships

Contract and Legitimate Interests

Regulatory advice

Contract

Data protection consultancy

Contract

Compliance audits

Contract

Subject Access Request support

Contract (acting on behalf of the client as Data Processor)

Complaint investigations

Contract

Data breach investigations

Contract

Internal investigations

Contract

Fraud prevention and detection

Legitimate Interests and, where applicable, Legal Obligation

AML and financial crime compliance

Legal Obligation and/or Legitimate Interests (depending on the client engagement)

Regulatory applications and submissions

Contract

Invoicing and financial administration

Contract and Legal Obligation

Record keeping

Legal Obligation and Legitimate Interests

Website analytics

Legitimate Interests

Marketing communications

Consent or Legitimate Interests (where permitted by law, including soft opt-in where applicable)

Processing on Behalf of Clients

Where Novo Data Services acts as a Data Processor, we process personal data solely in accordance with our client's documented instructions and the terms of the relevant Data Processing Agreement. In these circumstances, the client determines the lawful basis for processing, and Novo acts only on their behalf.

Legitimate Interests

Where we rely on Legitimate Interests, we will ensure that:

• the processing is necessary for a legitimate business purpose;
• the interests, rights and freedoms of individuals have been carefully considered;
• the processing is proportionate and transparent; and
• appropriate safeguards are implemented to protect personal information.

Where appropriate, a Legitimate Interests Assessment (LIA) will be undertaken.

Special Category Personal Data

Where our consultancy services require the processing of Special Category Personal Data, we will only do so where an additional condition under Article 9 UK GDPR applies.

Depending upon the engagement, these conditions may include:

• explicit consent;
• carrying out obligations and exercising specific rights in the field of employment and social security law;
• the establishment, exercise or defence of legal claims;
• reasons of substantial public interest under Schedule 1 of the Data Protection Act 2018;
• safeguarding individuals at risk; or
• another condition permitted under applicable legislation.

Criminal Offence Data

Where criminal offence data is processed, Novo will ensure that an appropriate condition under Schedule 1 of the Data Protection Act 2018 is met before processing takes place. Such processing may arise during fraud investigations, regulatory investigations, disciplinary matters, litigation support or compliance reviews.

Confidential and Commercially Sensitive Information

Due to the specialist nature of our consultancy services, Novo may also process confidential or commercially sensitive information that does not constitute personal data. Such information is handled in accordance with contractual confidentiality obligations, information security policies and recognised good practice to ensure its confidentiality, integrity and availability.

10. How We Protect Information

We implement appropriate technical and organisational measures including:

• Encryption
• Multi-factor authentication
• Secure cloud storage
• Access controls
• Principle of least privilege
• Confidentiality agreements
• Regular software updates
• Secure disposal procedures
• Supplier due diligence
• Staff training

Access to information is limited to those with a legitimate business need.

11. International Transfers

Where personal information is transferred outside the UK, Novo will ensure appropriate safeguards are implemented.

These may include:

• UK International Data Transfer Agreement (IDTA)
• UK Addendum to the EU Standard Contractual Clauses
• Adequacy Regulations
• Transfer Risk Assessments

12. Automated Decision Making

Novo does not make decisions based solely on automated processing that produce legal or similarly significant effects.

Where technology or artificial intelligence is used to assist document review, fraud detection or compliance activities, all significant decisions remain subject to meaningful human oversight.

13. Retention

Personal information is retained only for as long as necessary to fulfil the purpose for which it was collected, comply with legal obligations, resolve disputes and establish or defend legal claims.

Retention periods vary depending upon the services provided and contractual obligations.

14. Your Rights

Individuals may have the right to:

• Be informed
• Access their information
• Rectify inaccurate information
• Erase information (where applicable)
• Restrict processing
• Object to processing
• Data portability
• Withdraw consent (where consent applies)
• Lodge a complaint with the Information Commissioner's Office (ICO)

Where Novo acts solely as a Data Processor, requests should normally be directed to the relevant Data Controller.

15. Cookies

Our website may use cookies to improve functionality, analyse website usage and enhance the user experience.

Further information is available within our Cookie Policy.

16. Contact

If you have any questions regarding this Privacy & Data Handling Statement or the way we process personal information, please contact:

17. Complaints

Novo Data Services is committed to handling personal information fairly, lawfully and transparently. If you have any concerns about the way we have processed your personal data or believe that we have not complied with applicable data protection legislation, we encourage you to raise your concerns with us in the first instance so that we can investigate the matter and seek to resolve it promptly.

We are committed to operating an accessible, fair and transparent complaints process and will acknowledge, investigate and respond to complaints relating to the processing of personal data in accordance with applicable data protection legislation.

Where appropriate, we may request further information to help us understand your concerns and investigate the matter thoroughly.

Complaints should be submitted to: info@novodataservices.co.uk

We will acknowledge receipt of your complaint as soon as reasonably practicable and aim to provide a substantive response without undue delay. Where additional time is required due to the complexity of the complaint, we will keep you informed of our progress and explain the reasons for any delay.

Following our investigation, we will explain:

• the outcome of our investigation;
• any findings relating to the processing of your personal data;
• any corrective action that has been or will be taken, where appropriate; and
• your right to escalate the matter to the Information Commissioner's Office ("ICO") if you remain dissatisfied.

Where Novo Data Services has acted solely as a Data Processor on behalf of one of our clients, we may be required to refer your complaint to the relevant Data Controller, as they determine the purposes and means of the processing. We will cooperate fully with the Data Controller to assist in the investigation and resolution of your complaint where appropriate.

Nothing in this Privacy & Data Handling Statement affects your statutory rights under the UK General Data Protection Regulation, the Data Protection Act 2018 or the Data (Use and Access) Act 2025.

If you remain dissatisfied following our response, or you believe we have failed to comply with applicable data protection legislation, you have the right to lodge a complaint with the Information Commissioner's Office.

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

Website: https://ico.org.uk/make-a-complaint/

Novo Data Services

Email: info@novodataservices.co.uk