NOVARIC® Jobs Hub

Candidate Privacy & Profile Consent

Your Professional Identity. Your Data. Your Choice.

Published

NOVARIC^® · Bringing Human To Industry^™

Talent directory · Sign in to record a choice

Policy version: 2026-11-06-candidate-notice-v2
Consent text version: 2026-11-06-candidate-consent-v1
Effective date: 6 November 2026
Last legal review: No separate legal-review date is recorded.
Responsible legal entity: NOVARIC^® Sh.A., as named on the Jobs Hub privacy page in this product.
Privacy contact: contact@novaric.co
Jurisdiction: Candidate profiles in NOVARIC^® Jobs Hub. Law No. 124/2024 is the Albanian personal-data statute. The GDPR may apply to an operation within its territorial scope. The two are not treated as the same rule for every operation.
Published governance page: https://novaric.eu/en/governance/jobs-hub-candidate-privacy-consent/

1. Introduction and privacy commitment

NOVARIC^® Jobs Hub can keep a private professional profile for a person who signs in. A public profile is a separate choice. This page describes the Talent directory: what is stored, which choices are optional, and how to withdraw them.

It is not an employment contract, a placement agreement, or a licence. It does not replace the Jobs Hub privacy page, which remains the general notice for the site.

2. Identity and contact details of the responsible data controller

The Jobs Hub privacy page in this repository names NOVARIC^® Sh.A. as the controller for personal data processed through jobs-hub.novaric.co and gives contact@novaric.co. Those published details are used here.

Pending compliance approval: the postal address, whether a data protection officer has been designated, that officer’s contact details, and any registration number with the Commissioner for the Right to Information and Protection of Personal Data.

3. Categories of candidate personal data

This feature can store: the name and Microsoft account identifier used to sign in; the email address from that sign-in; title, occupation, industry, level, a broad region and country; profile summaries; years of experience; availability; skills; languages; qualifications the person declares and files they upload; experience entries; work preferences, including a gross pay expectation; an optional professional photograph; assessment scores recorded by staff; consent and publication records; introduction requests; and audit records.

Email, phone and exact address are not placed on the public profile. Identity documents, immigration files and Case Hub records are not read by this feature and are not published. A file the person uploads stays a private document. Nationality, gender and similar fields are rejected if they are sent to the profile update.

4. Purposes and lawful bases of processing

Each optional box on the consent form is stored on its own row, with the legal basis “consent”, the notice version, the consent-text version, the time, the collection method and an audit event. Law No. 124/2024, Article 7(1)(a) of the Commissioner’s English text, lists consent as one basis. Article 8 of that text says the controller must be able to demonstrate consent, that a consent request mixed with other matters must be distinguishable, and that consent can be withdrawn. Where the GDPR applies to an operation, Articles 6(1)(a) and 7 are the corresponding consent rules. They are not assumed to be identical to the Albanian articles in every detail.

Creating an account, keeping a private draft, keeping security logs, and answering a request the person submits are not switched on by those boxes. Consent is not required for every recruitment step, and a box does not waive a statutory right.

5. Candidate profile management

The person can review and edit the professional summary and preferences. An edit of a published profile returns it for staff approval and takes it out of the public directory until it is approved again.

Uploading a CV or another file, registering an account, submitting a job application, or the existence of a Case Hub record does not publish a profile. This feature has no connection that publishes from those events.

6. Optional public profile publication

A profile appears in the public directory only when the person has an active authorization for public profile publication, an active authorization for verified employers to find the profile, a member of staff has approved publication, and the profile has not been withdrawn.

Withdrawing the publication authorization immediately stops new public access through the directory, the public profile address, and the Jobs Hub APIs and queries this application controls. The same happens if the person withdraws the authorization for employers to find the profile. This application does not keep a separate candidate search index. Audit records remain. NOVARIC^® cannot delete copies held outside its control.

7. Professional assessments and NOVARIC^® ratings

A professional rating describes one person for one occupation. It is not a league table, and profiles are not sorted on one scale. The dimension weights are a proposal waiting for NOVARIC^® leadership validation. Labels are preliminary.

A score is shown on a public profile only when the person has allowed assessment publication, staff have reviewed the score, and the profile itself is public. Asking for a reassessment hides the published score until a person reviews it. A score is not an offer of work or pay.

8. Salary expectations and remuneration recommendations

A gross pay expectation is shown only when the person has allowed remuneration publication and the profile is public. A NOVARIC^® gross recommendation is shown only after a person has approved it. No net pay is calculated. Employer on-costs are not assumed.

Council of Ministers Decision No. 776 of 19 December 2025 is stored so it can be re-verified. It is not applied as an approved legal minimum until a compliance officer approves it. A figure on a profile is not a salary offer and not a promise of pay.

9. Employer access and candidate introductions

A visitor who is not signed in sees only the public fields of an approved profile. An employer account that is not verified cannot save, shortlist, or request an introduction. A verified employer may request an introduction. The request does not reveal a phone number or an email address.

Contact details are released only after the candidate accepts and staff authorise that release, and only to that employer. A private document is available to an employer only when a separate authorization names that employer and that document. Looking up a profile by an internal identifier is refused.

10. Promotional use of profiles and photographs

Promotion is optional and separate from publication. Each channel is its own authorization: NOVARIC^® websites; direct employer recruitment communications; professional networking channels; paid promotional campaigns.

A channel is refused unless that authorization is active and the profile is public. A photograph is included only when photograph publication is also allowed. Withdrawing a channel stops further use of that channel through the controls in this application. It does not delete material that someone outside NOVARIC^® already holds.

11. Automated matching and human oversight

One optional activity uses consent: comparing the occupation, skills and preferences on the person’s own profile with vacancy criteria, and showing that person a short list of possible vacancies. The list is shown only to that person. It is not sent to employers. It does not publish the profile, accept or reject an application, or decide an introduction. A person reviews any later introduction.

Leaving the box empty does not stop the person from applying for a job, and it does not stop staff from recording a match in their own review tools. Those staff tools are not turned on or off by this box. The box is not a waiver of any right to object to a decision based solely on automated processing. This feature does not make a decision based solely on automated processing that produces a legal effect or a similarly significant effect.

12. International data transfers

Sign-in uses Microsoft Entra ID. Whether Microsoft acts as a processor, and in which countries authentication data is handled, is pending compliance approval. This notice does not list standard contractual clauses or binding corporate rules, because those instruments were not verified in this repository.

The European Commission’s published adequacy decisions, consulted on 6 November 2026, do not include Albania. This notice does not claim an EU adequacy decision for Albania. An Albanian decision of the Commissioner about countries that provide protection is a different instrument and is not treated here as an EU decision. Where the GDPR’s transfer rules apply, counsel must identify the Chapter V ground before that transfer is treated as approved.

13. Data security and retention

Public directory queries and the database view used for a public projection omit email, phone, exact address and document files. Account changes that use the session cookie are rejected when they come from another website. Audit events cannot be updated or deleted through the database trigger on the audit table. Private documents are limited to the person, authorised staff, or an employer named on a document-specific authorization.

A retention period for each category is pending compliance approval. This notice does not state a number of months or years. Withdrawing consent does not delete audit events. How long they are kept must be set in an approved retention schedule.

14. Candidate rights and consent withdrawal

The person may withdraw any optional authorization at any time on the consent management page. Each purpose is withdrawn on its own. No reason is required. Under Article 8(3) of the Commissioner’s English text of Law No. 124/2024, consent may be withdrawn at any time, withdrawal does not affect the lawfulness of processing based on consent before withdrawal, and withdrawal should be as easy as giving consent. Article 12 of that text says the controller informs the person of the outcome of a request as soon as possible and in any case no later than 30 days, with a possible extension of up to 60 days.

Where the GDPR applies, Articles 12 to 22 describe transparency, access, rectification, erasure, restriction, portability and objection, and Article 22 addresses a decision based solely on automated processing. The GDPR’s one-month period, which can be extended by two further months, is not the same as the period in the English text of the Albanian law. This notice does not treat them as one rule for every request.

The management page records a correction request, an access request, or an erasure request for a person to handle. An erasure request removes the profile from public access in this application. It does not delete audit records the product is built to keep, and it does not delete copies outside NOVARIC^® control. The person may also complain to the Commissioner and, where the GDPR applies, to a competent supervisory authority.

15. No employment or salary guarantee

Publication, a rating, a wage figure, an introduction, or a vacancy suggestion is not an offer of employment, a visa, a work permit, a placement, or a salary. NOVARIC^® does not charge the candidate a fee on this page and does not make a licensing claim here. No outcome is guaranteed.

16. Contact, complaints and policy updates

Privacy contact published on Jobs Hub: contact@novaric.co. The supervisory authority for the Albanian law is the Commissioner for the Right to Information and Protection of Personal Data: https://idp.al. Where the GDPR applies, a complaint may be lodged with a competent supervisory authority. This notice does not name one authority as competent for every operation. Guidance from the European Data Protection Board is at https://www.edpb.europa.eu. The GDPR text is at https://eur-lex.europa.eu/eli/reg/2016/679/oj.

If this notice changes, the version identifier changes. A consent row keeps the version that was current when it was granted. A later version does not rewrite that row. Whether a change requires a fresh consent is pending counsel.

Pending compliance approval

The Albanian text is pending language review. It is not a certified translation.
The named controller for Talent profile processing is NOVARIC® Sh.A. The name is taken from the Jobs Hub privacy page in this repository.
Postal address of the controller: not verified in published NOVARIC® materials in this repository.
Data protection officer: not verified. This notice does not invent a name or an address.
Registration or notification number with the Commissioner: not verified.
A dedicated privacy mailbox was not found. The published Jobs Hub contact is contact@novaric.co.
Retention period for each category, including audit records: not set.
Effective date: 6 November 2026.
Last legal review date: none recorded.
Lawful basis for creating an account, keeping security logs, and staff recruitment administration: pending counsel. Optional boxes A–G do not cover those operations.
Microsoft Entra processor terms, and the countries where sign-in data is handled: pending compliance approval.
Where the GDPR transfer rules apply, the Chapter V ground is pending counsel. This notice does not claim an EU adequacy decision for Albania.
Council of Ministers Decision No. 776 of 19 December 2025 is awaiting re-verification before any legal minimum is applied.
Assessment weights and labels are awaiting NOVARIC® leadership validation.
Whether a future change of this notice requires a fresh consent: pending counsel. A new version does not rewrite an old consent row.
Article numbers below follow the Commissioner’s English text of Law No. 124/2024. The Albanian text in the Official Gazette prevails.