Who we are
nQX Talent is an integrated talent management system made by Novargo, a company based in Malta. In this policy, "we", "us" and "our" mean Novargo.
For anything about this policy or your personal data, email connect@novargo.com. We answer every request, and at the latest within one month.
What this policy covers
It covers the personal data we handle when:
- you visit talent.nqxplatform.com (the "website");
- you ask for a demo or contact us;
- you have an account in nQX Talent (the "app"), including the emails the app sends you;
- someone checks a document exported from nQX Talent on our verification page;
- a customer's administrator or employee asks us for support.
It does not replace your employer's privacy notice. If your employer uses nQX Talent, your employer decides what information about you goes into it and why, and its own privacy notice explains that. Section 3 explains how the roles are split.
Our role: controller or processor
Data protection law, the EU General Data Protection Regulation (GDPR) and Malta's Data Protection Act (Chapter 586), gives different duties to a controller, who decides why and how personal data is used, and to a processor, who handles it on a controller's behalf.
- We are the controller for website visits, demo requests and other enquiries, our relationship with customers and their contacts, the security of accounts, and the verification page.
- Our customers are the controllers for the information they and their people put into nQX Talent, such as employee records, KPIs, reviews, ratings, comments, development plans and bonus figures. For that information we are a processor: we handle it only on the customer's instructions, under our Data Processing Terms and the customer's agreement with us.
If you are an employee and want to ask about your information in nQX Talent, please contact your employer first. If you contact us instead, we will pass your request to your employer and help them answer it.
The information we collect
Website visits
The website sets no cookies and runs no analytics, advertising or tracking scripts. Its fonts, images and tour video are part of the website itself, so loading a page does not contact any outside font, video, analytics or advertising service. Like any website, the servers that deliver it keep short technical logs: your IP address, your browser type, the page you asked for and the time. We use these only to run and protect the website.
Demo requests and enquiries
When you book a demo, we receive what you type into the form: your name, work email address and company and, if you give them, your job title, company size, phone number and message. We also note which page you sent it from. If you email us, we receive your email address and what you write.
Customer accounts
When an organisation becomes a customer, we hold the names, email addresses and roles of its administrators and contacts, and the details we need to invoice it.
People who use the app
To let you sign in, we hold your email address, your password (stored only as a one-way hash, never in a readable form), your name and your role in your organisation's workspace. Your browser keeps a sign-in token so you stay signed in; our Cookie Policy explains it. The app records the changes made in it, with who made them and when, in an audit log that your organisation's administrators can see. It also sends you emails about your account and your reviews, such as invitations, password resets, reminders and the notifications your organisation has turned on.
Information customers put into the app
Each customer decides what to record. Depending on the modules and fields it uses, a workspace can hold:
- Work details: name, work email, employee number, job title, position, grade, department, team, manager, legal entity, work location, contract type, working hours, start date, probation and notice period.
- Personal details: date of birth, gender, nationality, marital status, number of dependants, home and postal address, personal email and phone numbers, emergency contacts, a photograph, and identity card, passport, visa, work permit, driving licence, social security and tax numbers.
- Performance: KPIs with their weights, targets and results, self and manager ratings, competencies, comments and chats, final ratings and nine-box placement.
- Reward: bonus targets, bonus splits and the bonus figures worked out from them.
- Growth: development plans, training records, qualifications, certifications, memberships of professional bodies and succession plans.
Some optional fields, such as ethnicity, religion, disability and trade union or collective agreement coverage, can reveal special category data under the GDPR. nQX Talent never requires them. A customer should use them only where it has a lawful basis, such as the person's explicit consent or a duty under employment law.
Document verification
PDF, Excel and CSV files exported from nQX Talent carry a verification code, and PDFs also carry a QR code. Anyone holding a document can check it on our verification page. To someone who is not signed in, the page shows only whether the document is genuine, which organisation issued it, what kind of document it is, when it was produced and the file's fingerprint; it names no person. Signed-in administrators of the issuing organisation see the full record. We count how often a document is checked; we do not record the IP address of whoever checks it. A file you check against its fingerprint is read in your browser and is not uploaded.
Support
When you ask us for help, we receive what you send us. To solve a problem, our staff may need to open a customer's workspace. They do so only to provide support or to keep the service running, and any change they make there is recorded in the workspace's audit log like any other change.
Why we use it, and our legal basis
| Purpose | Information | Legal basis |
|---|---|---|
| Answering your demo request or enquiry, arranging and holding the demo, and following up | Demo request and enquiry details | Steps you asked for before a possible contract (GDPR Art. 6(1)(b)), and our legitimate interest in answering business enquiries (Art. 6(1)(f)) |
| Providing nQX Talent to our customers | Customer accounts; the information customers put into the app, which we handle as their processor | Our contract with the customer (Art. 6(1)(b)); for information in the app, the legal basis the customer relies on as controller |
| Letting you sign in, keeping accounts secure and sending service emails | Sign-in details, audit log, email address | Our legitimate interest, and our customer's, in a secure, working service (Art. 6(1)(f)); our contract with the customer |
| Keeping the website and app secure and working, and preventing misuse | Technical logs, audit log | Legitimate interests (Art. 6(1)(f)); our legal duty to keep personal data secure (Art. 6(1)(c) and Art. 32) |
| Running the verification page | Export records | The legitimate interest of the issuing customer, and of anyone relying on a document, in knowing it is genuine (Art. 6(1)(f)) |
| Invoicing, accounts and other legal duties | Customer contacts and billing details | Legal obligations (Art. 6(1)(c)); our contract with the customer (Art. 6(1)(b)) |
| Improving nQX Talent | Feedback and support requests; statistics that identify no one | Legitimate interests (Art. 6(1)(f)) |
| Establishing, exercising or defending legal claims | Whatever is relevant to the claim | Legitimate interests (Art. 6(1)(f)) |
We do not sell personal data, use it for advertising or use the information customers put into nQX Talent for our own purposes. We do not use it to train artificial intelligence models. Where we rely on legitimate interests, you can object, as section 11 explains.
Ratings, bonuses and automated decisions
nQX Talent works out final ratings, bonus figures and statutory notice periods from the rules, weights and scales each customer sets. These figures support decisions that people make: managers and HR review them, and approvers sign off each review cycle. We do not make decisions about anyone.
Customers remain responsible for how they use the figures, including making sure a person reviews any decision that has legal or similarly significant effects on someone, as Article 22 of the GDPR requires.
Where your data is kept
We keep the information in nQX Talent in data centres in the European Union. Some of our service providers, for example for email delivery or support tools, may handle personal data outside the European Economic Area. When that happens, we make sure the transfer is protected as the GDPR requires: either the European Commission has decided that the country protects personal data adequately (such as the EU-US Data Privacy Framework for certified US companies), or the provider has signed the Commission's Standard Contractual Clauses, with extra safeguards where they are needed. You can ask us for details.
How long we keep it
| Information | How long we keep it |
|---|---|
| Demo requests and enquiries | Up to 12 months after our last contact with you, unless you become a customer. |
| Technical logs | A short time, normally no more than 30 days, unless we need them to look into a security incident. |
| Customer accounts and contacts | As long as the customer agreement lasts, and after that for as long as tax and company law require us to keep business records. |
| The information in a customer's workspace, including its audit log | As long as the customer agreement lasts. Customers can delete records themselves at any time. When the agreement ends we delete the workspace, after returning the data if the customer asks. Unless the agreement says otherwise, we delete it within 90 days, and copies in backups are overwritten in the normal backup cycle. |
| Export records used for document verification | As long as the issuing customer's workspace exists, so that its documents can still be checked. |
| Support requests | As long as we need to resolve them and keep a record, normally no more than 24 months. |
How we protect it
We protect personal data with measures suited to the risk, including:
- encryption in transit (HTTPS) for every page and request, and encryption of stored data;
- a separate workspace for each customer, with access rules enforced by the database itself, so that no customer's people can reach another customer's data;
- roles and permissions that each customer controls, so that people see only what their role allows;
- passwords stored only as one-way hashes, and sign-in sessions that expire;
- an audit log of the changes made in each workspace;
- verification codes on exported documents, so that altered copies can be detected;
- access by our own staff only where their work needs it.
No system is perfectly secure. If a personal data breach happens, we act at once to contain it and tell the customers affected. Where the law requires it, we or the customer notify the Information and Data Protection Commissioner and the people concerned.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy of it;
- correct data that is wrong or incomplete;
- erase data, for example when we no longer need it;
- restrict how we use it while a concern is looked into;
- object to our use of it where we rely on legitimate interests;
- data portability: receive the data you gave us in a common, machine-readable format, or have it sent to another organisation;
- withdraw consent at any time, where we rely on your consent.
To use any of them, email connect@novargo.com. We answer within one month. For a complex request we may extend that by up to two more months, and we will tell you why. It costs nothing, unless a request is clearly unfounded or excessive. We may ask you to confirm who you are before we act.
If your information is in nQX Talent because of your employer, your employer is responsible for answering, and we help it do so (see section 3).
You can also complain to the Information and Data Protection Commissioner (IDPC), Malta's data protection authority, at idpc.org.mt, or to the authority where you live or work in the EU. We would appreciate the chance to deal with your concern first.
Children
The website and nQX Talent are for businesses and their staff. They are not meant for children, and we do not knowingly collect personal data from anyone under 16.
Changes to this policy
We update this policy when the way we handle personal data changes. The date at the top shows when it last changed. If a change matters to our customers or users, we tell them by email or in the app before it takes effect.
Contact us
Novargo, Malta. Email connect@novargo.com about this policy, your personal data or anything else in nQX Talent.
Questions about this page?
Email us and a member of our team will reply.