Recruitment privacy notice

Navigating this Notice

You can click on the below links to navigate to the relevant section:

1. INTRODUCTION & SCOPE OF THIS PRIVACY NOTICE
2. THE DATA WE COLLECT ABOUT YOU
3. HOW YOUR PERSONAL DATA IS COLLECTED
4. HOW WE USE YOUR PERSONAL DATA
5. HOW WE USE PARTICULARLY SENSITIVE INFORMATION
6. DISCLOSURES OF YOUR PERSONAL DATA
7. INTERNATIONAL TRANSFERS
8. AUTOMATED DECISION-MAKING (INCLUDING PROFILING)
9. DATA SECURITY
10. DATA RETENTION
11. YOUR RIGHTS AS A DATA SUBJECT
12. EXERCISING YOUR RIGHTS
13. YOUR DUTY TO INFORM US OF CHANGES
14. CHANGES TO THIS PRIVACY NOTICE

1. INTRODUCTION & SCOPE OF THIS PRIVACY NOTICE
1. We respect the privacy of prospective employees, workers and contractors and are committed to protecting your personal data both during and after the application process, regardless of the outcome. This Privacy Notice is aimed at candidates for prospective employment with us and to those seeking to offer their services as private contractors or workers to us (this “Privacy Notice”) and describes how we collect and use personal information about you during the recruitment exercise, including in the event your application is unsuccessful. If your application is successful, you will be provided with our separate Privacy Notice for Employees, Workers & Contractors upon commencement of your working relationship with us.
2. This Privacy Notice sets out the personal data we collect and how we process it in the employment and human resources (“HR”) context during our recruitment process, along with information on your rights as a Data Subject. This Privacy Notice is to be distinguished from our general Privacy Policy which remains accessible on our website(s). Our general Privacy Policy applies to all website users, as well as to our customers and users of our services, but remains relevant to you as it includes additional information on your rights, as well as key contact information.
3. Please note that this Privacy Notice is limited to provision of information about processing in the employment and HR context only, and from the perspective of recruitment. Please refer to our Privacy Policy for information on processing outside of this context.
4. It is important that you read and retain this Privacy Notice, together with our general Privacy Policy so that you are aware of how and why we are using such information and what your rights are under the data protection legislation.
5. The terms “we”, “us”, “our”, refer to (i) Lottoland Holdings Limited, a private company limited by shares incorporated in Gibraltar, and subject to Gibraltar law, having its registered office at Suite A, Ocean Village Promenade, Ocean Village, Gibraltar GX11 1AA (“Lottoland”) and, as appropriate (ii) Saber.tech Systems S.L. a private company incorporated and registered in Spain with its registered office address at c/ Hoyo de Esparteros 3 (Edif. La Mundial) 29005 Malaga, Spain (“Saber.tech”). The term “Lottoland Group” refers to direct and indirect subsidiary entities of Lottoland itself within its wider corporate group.
   
   “Personal Data”, “Data Subject”, “processing” (and “process”), “controller” (and “data controller”), “processor” (and “data processor”), “natural person”, “special categories” of Personal Data, Personal Data relating to “criminal convictions and offences”, “EU”, “Data Protection Legislation”, “DPA 2004”, “Gibraltar GDPR”, “EU GDPR”, “EEA”, “the Union”, “EU representative”, “UK representative” and “GRA”) all have the meanings given to them in our general Privacy Policy.
6. Where we use the term “employee” we mean a person who is engaged under an employment contract. Where we use the term “contractor” (which shall include a “consultant”) we mean a person who is not an employee and who is engaged under a general contract for services or other contractual arrangement. These definitions apply subject to the Data Subject definition, which means they apply to natural persons. We also use the expression “employment and HR context” in this Privacy Notice to refer to the context of our processing of Personal Data during the recruitment exercise in order to consider establishing a relationship with you, whether that is a prospective employee relationship or a prospective contractor relationship. References to “staff” also include all employees/contractors, and for avoidance of doubt covers:
   • All permanent and non-permanent workers (employees);
   • All self-employed workers (contractors);
   • All consultancy workers (consultants, who fall within the scope of a contractor in this Privacy Notice);
   • Any individual on unpaid work experience over the age of 18 and on a placement longer than 4 weeks; and
   • Any individual training with Lottoland or Saber.tech under a specialised training contract/arrangement;
7. Different rules apply depending on the relevant company in the Lottoland Group responsible for processing your Personal Data. In most cases, Daisy Services Limited (a wholly owned subsidiary of Lottoland), established in Gibraltar, will process Personal Data of our prospective staff in the employment and HR context, as a service company to/for the Lottoland Group.
8. The Lottoland Group is made up of different legal entities including Saber.tech. To the extent you are applying for a role as a with us, the data controller of your Personal Data will be Lottoland Holdings Limited. Accordingly, the Gibraltar GDPR will apply to such processing.
9. To the extent you are offering your services as an independent (i.e. self-employed) contractor or worker, in the majority of cases you will contract with Daisy Services Limited who will process Personal Data on behalf of Lottoland Holdings Limited, who will remain the data controller. In limited cases you may contract with other entities within the Lottoland Group that are outside of Gibraltar. Prior to establishment of any contract, the recruitment exercise will be managed solely by Daisy Services Limited providing a HR function to Lottoland, and this company shall process and store your personal data in that HR capacity until such time as it may need to be transferred to another Lottoland entity if your application is successful.
10. If you live or work outside of Gibraltar, other laws, including the EU GDPR, may be applicable to your individual circumstances. The EU GDPR applies to the processing of personal data of Data Subjects who are in the EEA by a controller or processor not established in the EEA, where the processing activities are related to:
    • the offering of goods or services, irrespective of whether a payment of the Data Subject is required, to such Data Subjects in the EEA; or
    • the monitoring of their behaviour as far as their behaviour takes place within the EEA.
11. In the employment and HR context, this will affect our employees and contractors based in and outside of the EEA. The EU GDPR will apply in respect of our relationships with employees and contractors within the EEA, where we monitor their behaviour (e.g. performance, working hours etc.). For employees contractors based outside of Gibraltar, the UK and the EEA, local laws will apply together with the Data Protection Legislation.
12. In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes. During the recruitment exercise, we will not track you on the internet, and will not be profiling you using automated processing, but will be assessing your suitability for a particular role or service we require by reference to your experience and qualifications.
13. Importantly and for the avoidance of doubt, this suitability assessment is performed by Daisy Services Limited, based in Gibraltar, and the Gibraltar GDPR will apply regardless of whether processing takes place in Gibraltar or not. This is because Gibraltar GDPR applies to the processing of Personal Data in the context of the activities of an establishment of a controller or a processor in Gibraltar.
14. We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this Privacy Notice and our Privacy Policy. If you have any questions about this Privacy Notice, including any requests to exercise your rights as a Data Subject (as summarised in this Privacy Notice and set out in more detail in our Privacy Policy), please contact our DPO using the details set out at section 2 of our Privacy Policy, or our relevant EU representative or UK representative depending on whether you are living outside of Gibraltar. Details of the EU or UK representative can be found in the Privacy Notice on www.lottoland.com.
15. Please also refer to section 11 of our Privacy Policy for further information on your right to lodge a complaint with the Information Commissioner under the DPA 2004 (presently the GRA) and/or a relevant supervisory authority.
2. THE DATA WE COLLECT ABOUT YOU
1. In an employment application, employment, engagement and/or HR context, we may collect, use, store and transfer different kinds of Personal Data about you which we have grouped together into “categories” of Personal Data as follows:
   • Identity Data includes: first name, last name, title, date of birth, gender, nationality, and photographs.
   • Contact Data includes: address, personal email addresses and telephone numbers.
   • HR Data includes: current (if applicable) and previous employment / work history, job tiles, job titles, employment references, national insurance number (where applicable), tax identification numbers and tax status, location of workplace (for independent contractors or workers only), training records and professional memberships, compensation history / salary details from current employer (if applicable).
   • Additional HR Data is only relevant for considering applications involving relocation packages and more senior management roles, and includes: marital status and dependents, right to work and immigration data, proposed working hours.
   • CCTV footage includes images collected from the use of our CCTV cameras if you enter our premises for an interview
     
     Identity Data, Contact Data and HR Data are collected primarily from any application form(s) filled in by you as well as from your curriculum vitae (“CV”) and cover letter(s) (if any), which we collectively refer to as “Application Documentation”.
2. We may also collect, store, and use the following more sensitive types of personal information including where volunteered by you as part of the recruitment process:
   • Information about your race or ethnicity, religious beliefs, sexual orientation, and political opinions.
   • Trade union membership.
   • Information about your health, including any medical condition, health, and sickness records, to the extent these are disclosed on your Application Documentation.
   • Personal Data relating to criminal convictions and offences. Note this is more relevant for senior managerial roles or controlled functions prescribed under relevant regulatory requirements, where we may need to (or applicable regulators may require that we) run suitable background and general probity checks and identify previous convictions in the media/open sources or using third party providers/services.
3. As noted in our Privacy Policy, we may prepare Aggregated Data from your Personal Data, but this will not be considered Personal Data if you cannot be identified from it.
3. HOW YOUR PERSONAL DATA IS COLLECTED
1. We use different methods to collect data from and about you including through:
   • Direct interactions: This includes information you provided to us during the recruitment stage, both in your Application Documentation as well as at interview(s). It also includes further information sourced from you during your correspondence with us during the recruitment exercise, via emails, meetings (including e-Meetings), telephone calls, or similar interactions/communications. During these direct interactions, we may also generate information internally (e.g. interview notes, salary expectations, relocation requirements, training requirements, proposed employment contracts/service agreements, or proposed revisions thereto)
   • Third parties or publicly available sources: We may also receive Personal Data about you from various third parties (e.g. your named referees) and publicly available sources (e.g. Facebook, LinkedIn, Twitter, and in some limited cases, Credit Reference Agencies) and utilise this information for things such as minimising fraud risks to the business, or to consider you for certain roles where additional checks and information are required under applicable law and / or regulatory guidance. In addition, we may have collected and continue to process information received from employment agencies used during the recruitment process.
4. HOW WE USE YOUR PERSONAL DATA
1. We will only use your personal data when the law allows us to, and the below situations may be relevant in certain cases:
   • where we need to perform services under the employment contract (employees) or applicable service contract (contractors) we are considering entering into with you;
   • where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests;
   • where we need to comply with a legal or regulatory obligation;
   • where necessary to protect your vital interests or those of a third party; or
   • with your consent.

   Each of the above are also referred to individually as a “lawful basis” for processing.

2. Most commonly, we will rely on either legitimate interests or the contractual lawful basis (a) above, as processing is deemed necessary in order to take steps at your request to consider your application and prior to entering into the proposed employment contract or services agreement with you, as the case may be. Generally, we do not rely on consent as a legal basis for processing, but if your application is unsuccessful, we will ask for your written consent to keep your application documentation on file for a certain period so we may consider you for any future roles that may arise during this period. You have the right to withdraw consent at any time by contacting us on the details set out in section 2 of our Privacy Policy or by contacting HR.
3. We do not generally rely on vital interests as a lawful basis which will apply only in rare cases such as when you visit our offices for interview and have special requirements for us to make reasonable adjustments for you during your visit.

Purposes for which we will use your Personal Data

4. We will generally require all information listed at paragraph 2.1 of this Privacy Notice, to allow us to properly consider your application. To this end, we will use the personal information we collect about you to:
   • Making a decision about your recruitment or appointment and determining the terms on which you work for us.
   • Assess your skills, qualifications, and suitability for the proposed role / service, or alternative role or service, together with your individual education, training, and development requirements.
   • Carry out background and reference checks, where applicable.
   • Communicate with you about the recruitment process.
   • Keep records related to our hiring processes.
   • Comply with legal or regulatory requirements (e.g. carrying out additional background checks for certain specified roles).
   • Check that you are legally entitled to work in Gibraltar or any other location where you are applying for a job.
   • Ascertain your fitness to work.
   • Consider a suitable compensation package and other benefits in kind to align with your expectations.
   • Prevent fraud.
   • Conduct data analytics studies to review and better understand employee retention and attrition rates.
   • Comply with equal opportunities monitoring.

If you fail to provide personal information

5. If you fail to provide information when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history, or suitable references), we will not be able to process your application successfully or take your application further.
5. HOW WE USE PARTICULARLY SENSITIVE INFORMATION
1. Special categories of Personal Data are particularly sensitive and require higher levels of protection. In addition to the justification or lawful basis under paragraph 4.1 of this Privacy Notice, we need to have further justifications for collecting, storing, and using this type of personal information.
2. In general, we will not process particularly sensitive personal information about you unless you volunteer it as part of the application process or processing is necessary for the purposes of carrying out the obligations and exercising specific rights of Lottoland or your rights as the Data Subject in the field of employment and social security and social protection law in so far as it is authorised by Gibraltar law. We shorthand this to the “employment justification”. For example, we will use information about your physical or mental health, or disability status, to ensure your health and safety in the workplace and to assess your fitness to work, to provide appropriate workplace adjustments.
3. In addition to the employment justification noted above, we may process special categories of Personal Data during the recruitment process in the following additional circumstances:
   • In limited circumstances, with your explicit consent, such as where you are unsuccessful but ask us to retain your Application Documentation on file. In these rare cases where we do seek your explicit consent, we will provide you with full details of the information that we would require and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of future consideration for a role with us that you agree to any request for consent from us, and your ability to withdraw your consent which is one of your rights as a Data Subject. Processing is necessary to protect your vital interests or those of another natural person physically or legally incapable of giving consent. In practice, this will not generally apply during the recruitment process.
   • Processing is necessary to protect your vital interests or those of another natural person physically or legally incapable of giving consent. In practice, this will not generally apply during the recruitment process.
   • Processing relates to personal data which are manifestly made public by you, in which case they no longer are deemed to be sensitive. In practice, this will not generally apply during the recruitment process.
   • Processing is necessary for the establishment, exercise, or defence of legal claims. In practice, this will not generally apply during the recruitment process.
   • Processing is necessary for reasons of substantial public interest, on the basis of Gibraltar law and on the basis of suitable measures to safeguard your rights and interests (e.g. equal opportunities monitoring and promotion of diversity, preventing or detecting unlawful acts or fraud, providing disability and mental health support and confidential counselling, where necessary for an insurance purpose, or for the purpose of making a determination in connection with eligibility for, or benefits payable under, an occupational pension scheme - see Schedule 1 DPA 2004);

Information about criminal convictions

4. We may only use Personal Data relating to criminal convictions where the law allows us to do so or where you have given us consent to the processing.
5. In general, such processing will only take place where necessary to carry out our legal or regulatory obligations (e.g. background checks for senior management positions and other controlled functions where the specific role requires a high degree of trust and integrity). However, there are various situations where the law allows us to process this sensitive information, including:
   • where necessary for the purpose of, or in connection with, any legal proceedings, including prospective legal proceedings or obtaining legal advice;
   • for insurance purposes; or
   • for protecting the vital interests of an individual where the Data Subject is physically or legally incapable of giving consent.
     
     (See Schedule 1 DPA 2004)
6. DISCLOSURES OF YOUR PERSONAL DATA
1. Your information will be shared internally for the purposes of the recruitment exercise. This includes members of the HR and recruitment team, interviewers involved in the recruitment process, managers in the business area with a vacancy and IT staff if access to the data is necessary for the performance of their roles.
2. Lottoland makes its staff fully aware of the confidentiality associated with the recruitment process, and any unauthorised disclosures of your application (either internally or externally) will be treated in accordance with internal disciplinary procedures.
3. We may have to share your personal data with the following recipients or categories of recipients set out below for the purposes set out in paragraphs 4 and 5 of this Privacy Notice:

   Internal Sharing

   • Other companies in the Lottoland Group acting as joint controllers or processors and who provide HR, IT, and system administration services (to a limited extent and subject to them not disclosing this further within the organisation without express authority).

   External Sharing

   • Identification verification agencies and fraud prevention agencies used to provide employee due diligence including, money laundering, fraud, sanction checks in the context of our AML/CFT/CFP obligations for certain roles and positions within Lottoland.
   • Recruitment or Employment Agencies you may have contracted with.
   • Regulators and other authorities who require reporting of processing activities in certain circumstances.

   Additional External Sharing (in rare cases)

   • Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your Personal Data in the same way as set out in this Privacy Notice.
   • External service providers who provide IT and system administration services or recruitment software.
   • Professional advisers, including lawyers, bankers, auditors, and insurers who provide consultancy, banking, legal, insurance and accounting services to Lottoland.
4. In the same manner as we make it an internal requirement for your application to be dealt with as fully confidential during the recruitment process, we require all third parties to respect the security of your Personal Data and to treat it in accordance with the law. We do not allow our third-party service providers to use your Personal Data for their own purposes and only permit them to process your Personal Data for specified purposes and in accordance with our instructions, as our processors. However, in limited circumstances and with your explicit consent, we may share your Personal Data with specific third parties at your request (e.g. recruitment agencies).
5. Generally, unless you are at final stages of selection, and applying for more senior managerial roles and other controlled functions, we will not generally need to disclose information regarding your application to third parties outside of the Lottoland Group.
7. INTERNATIONAL TRANSFERS
1. Due to the global nature of Lottoland operations, from time to time we may need to share your personal data within the Lottoland Group of companies and third-party service providers which may be located in Gibraltar, the UK, the EEA or outside of the EEA. Please note the provisions in section 7 of our Privacy Policy (International Transfers) which apply equally to Personal Data processed in the employment and HR context, and during the recruitment process.
8. AUTOMATED DECISION-MAKING (INCLUDING PROFILING
1. “Automated decision-making” is the process of making a decision by automated means without any human involvement. We do not use automated decision-making when processing Personal Data during the recruitment process. If this changes, we will confirm this to you and provide meaningful information about the logic involved, as well as the significance and the envisaged consequences for you.
2. “Profiling” means any form of automated processing of Personal Data consisting of the use of Personal Data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements. The context of our profiling activities during the recruitment process is limited to:
   • analysing health records to determine statutory sick pay and any other individual requirements relating to a disability or mental health condition so we can provide you with support you may require;
   • assessing your suitability for a particular role or service we require by reference to your experience and qualifications

Relevant exemptions from Gibraltar GDPR and EU GDPR allow us to undertake such activity without needing to provide further information to you.

9. DATA SECURITY
1. The accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data is known as a “data breach”. We have put in place appropriate physical, technical and administrative security measures to prevent data breaches and deal with these when they arise. These measures include internal policies regarding data breach prevention and internal/external reporting (as may be required), as well as physical and IT security measures to monitor and restrict processing. In addition, we limit access to your Personal Data to those employees, agents, contractors and other third parties who have a business need to know. Such persons will only process your Personal Data on our instructions and are subject to duties of confidentiality, and of complying with our data protection procedures.
2. During the recruitment process, your Personal Data is generally only processed by HR staff and segregated from customer data, employee data and other business sensitive information. Such persons will only process your Personal Data (including special category Personal Data or Personal Data relating criminal convictions and offences) on our instructions and they are subject to a duty of confidentiality as outlined above.
3. We undertake to inform you, to the extent we are required to do so, if your personal data is compromised and there is a high risk to your rights and freedoms as a result.
10. DATA RETENTION
1. We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including:
   • Considering your application and:

   If you are: successful, transferring this information to a personnel / HR file or other equivalent internal record(s) kept for our employees and external contractors/workers, which will be retained during your employment or contractor relationship with us and following its conclusion in line with Lottoland’s Privacy Notice for Employees, Workers & Contractors (Global);

   If your are: unsuccessful, rretaining this information with your express written consent in order to consider you for future roles for a predetermined period of up to 12 months following conclusion of the recruitment process, and where no such consent is provided, for a period of up to 6 months.

   • maintaining business records for the purposes of satisfying any legal, accounting, or reporting requirements;
   • complying with record retention requirements under relevant laws;
   • exercising, establishing, or defending legal claims.
2. If your application is unsuccessful, we will generally destroy your personal information in accordance with applicable laws and regulations after a period of 6 months following conclusion of the recruitment process for that role. If you provide your written consent to allow us to keep your Application Documentation (and other information generated by Lottoland as part of the recruitment process) on file for longer, Lottoland will hold your information on file for a further period of 6 months for consideration for future employment opportunities (or contractor services provision), up to a maximum period of 12 months.
3. If, for technical reasons, we are unable to delete or anonymise such Personal Data (either partially or entirely), we will put in place appropriate measures to prevent further processing, placing this data beyond use, and/or implementing pseudonymisation where possible.
4. We may retain your Personal Data for longer periods where such retention is necessary for compliance with a legal obligation to which we are subject, or where another lawful basis applies. In the recruitment context, this will only apply in exceptional circumstances. Similarly, we may retain information pursuant to our legitimate interests, but these will also be rare in the recruitment context and generally be limited to defending any legal claims which we reasonably expect may be brought against us, or which we may wish to bring.
11. YOUR RIGHTS AS A DATA SUBJECT
1. You have certain rights under the Data Protection Legislation, which are explained in our Privacy Policy (see section 11). These rights apply equally in an employment and HR context and in the recruitment context and will therefore not be restated here. However, for convenience, they are summarised below:
   • Right to information
   • Right to request access
   • Right to rectification
   • Right to erasure (right to be ‘forgotten’)
   • Right to restriction of processing
   • Right to data portability
   • Right to object
   • Right to freedom from automated decision-making (including profiling)
   • Right to lodge a complaint with the Information Commissioner and/or a relevant supervisory authority
   • Right to withdraw consent
2. Depending on your particular circumstances, you may also have additional rights if you live or work outside of Gibraltar. For example, the EU GDPR may apply to you if you are based in the EEA, and in certain cases you may have rights under the EU GDPR. You can find out more about the EU GDPR and your rights (if any) by accessing the European Commission’s website(s) at the following Link:

https://ec.europa.eu/info/law/law-topic/data-protection_en

3. Please note the limits on each of your Data Subject rights as outlined in our Privacy Policy, and if you have any further questions or doubts regarding the exercise of such rights, please contact the DPO in the first instance using the contact details provided in section 2 of our Privacy Policy.
12. EXERCISING YOUR RIGHTS
1. If you wish to exercise any of the rights set out above, please contact the DPO on the details set out in section 2 of our Privacy Policy, which also informs you about:
   • any fees that may be required;
   • how we may refuse to act on your requests;
   • further information we may need from you;
   • time limits for us to respond;
   • electronic format of requests and responses; and
   • the extent of our obligations to communicate restriction, rectification, or erasure to other recipients of your information.
13. YOUR DUTY TO INFORM US OF CHANGES
1. It is important that the Personal Data we hold about you is accurate and current. Please keep us informed if your Personal Data changes during the recruitment process. If any of your personal details are incorrect, you can update them by accessing your application online (where applicable) and in default of this option, contacting our HR team.
14. CHANGES TO THIS PRIVACY NOTICE
1. We may update this Privacy Notice from time to time, but it is unlikely to be amended during a recruitment process. When we make such changes, we will notify you by providing you with a copy of the new notice and will also update the “Last updated” field at the top of this Privacy Notice.
2. The new version of the Privacy Notice will take effect immediately upon its dissemination to our staff.