Kova Direct Ltd ("Kova", "we", "us") provides workforce engagement, payroll and compliance software to UK recruitment agencies. This policy explains how we process personal data on behalf of our agency customers and the workers they engage.
Who is the controller?
For data relating to a worker engaged through one of our agency customers, the agency is the data controller and Kova is a data processor. For data relating to enquiries made directly to Kova (for example via the demo form), Kova is the controller.
What data we process
Worker identity and Right-to-Work documents, contact details, banking details for pay, tax and NI references, timesheets, assignment and pay history, and compliance evidence (IR35 determinations, AWR tracking). For enquirers: name, work email, agency name and the message you send us.
Lawful bases
We rely on the lawful bases of contract performance (paying workers and operating the platform), legal obligation (HMRC, AWR, RTW), and legitimate interests (responding to enquiries, securing the service).
Sharing
We do not sell personal data. We share data only with sub-processors necessary to operate the service (UK-based hosting, identity verification, payment processing) and with HMRC and other regulators where legally required.
Storage and retention
Data is stored on infrastructure located in the United Kingdom. Worker records are retained for the period required by HMRC and AWR record-keeping rules. Enquiry data is retained for up to 24 months.
Your rights
Under UK GDPR you have the right to access, rectification, erasure, restriction, portability and objection. You can also lodge a complaint with the ICO at ico.org.uk.
Contact
For data protection enquiries or to exercise your rights under UK GDPR, contact dale@kovadirect.co.uk.