“The Company” applices to Debono Group Holdings Limited, Michael Debono Limited, Storage Systems Limited, Car Sharing Services Malta Limited & Parts Supply Limited
As part of our recruitment process, the Company’s HR department collects and processes personal data relating to job applicants. The personal data may be held by the Company [and its subsidiaries] in paper or in electronic format. The Company [and its subsidiaries] are committed to being transparent about how it collects and uses that data and to meeting its data protection obligations under the General Data Protection Regulation [GDPR] and the Data Protection Act 2018.
The purpose of this privacy notice is to make you aware of how and why we will collect and use your personal data during the recruitment process. We are required under the GDPR to notify you of the information contained in this privacy notice which applies to all job applicants.
If you have any questions about this privacy notice or about how we handle your personal data please contact [email protected].
What personal data do we collect?
Personal Data is any data that directly or indirectly relates to an identified or identifiable person. The Company collects a range of data, which makes you identifiable, such as but not limited to:
- Your contact details: including your name, surname, email address and telephone number;
- Personal data included in a CV, application form, cover letter or interview notes, such as qualifications, skills, experience and employment history;
- Information about your entitlement to work in Malta [where applicable];
- Driving license [where applicable];
The Company may also collect, use and process the following special categories of your personal data during the recruitment process:
- Whether or not you have a disability [if voluntarily disclosed by you] for which the Company needs to make reasonable adjustments during the recruitment process
- Information about criminal convictions and offences, such as a conduct certificate issued not earlier than six (6) months prior to the date of submission of the application. Provided that the Company shall only verify and will not retain any such certificates, unless required by law.
The Company may collect this data in a variety of ways. For example, data might be contained in application forms, covering letters, CVs, your identity documents or collected through interviews.
We may also collect personal data about you from third parties, such as recruitment agencies or references supplied by current or former employers. Other than recruitment agencies, the Company will only seek personal data from third parties once an offer of employment has been made to you and we will inform you if and when we are doing so.
Data will be stored in a range of different places, including on your application record, in employee files, in HR management systems and on other IT systems [including email].
Who is the Data Controller?
Whether received by e-mail, by post or online, the HR Department is the Data Controller for Job Applications. The Data Controller for Job Applications can be contacted on the following e-mail address: [email protected].
Who has access to data?
Your personal data received for the purposes of recruitment will be mainly processed by the HR Department. The personal data may be shared internally for the purposes of the recruitment exercise. This includes managers in the department which is offering the vacancy and IT staff if access to the data is necessary for the performance of their roles.
We will not share your data with third parties unless your application for employment is successful and we make you an offer of employment. We may then share your data with (i) former employers to obtain references, (ii) employment background checks to obtain necessary background checks and (iii) professional advisors, such as lawyers.
Why does Debono Group process personal data?
We will only collect and use your personal data when the law allows us to. We need to process data prior to entering into an Employment Agreement with you. In some cases, we need to process data to ensure that we are complying with legal obligations. For example, it may be necessary for us to check the applicant’s eligibility to work in Malta before employment starts if the applicant is from a non-EU/EEA country.
The HR Department has a legitimate interest in processing personal data during the recruitment process and for keeping records of the process. Our legitimate interests include: pursuing our business by employing employees; managing the recruitment process; conducting due diligence on prospective staff and performing effective internal administration. Processing data from job applicants allows us to manage the recruitment process, assess and confirm a candidate’s suitability for employment and decide to whom to offer a job. We may also need to process data from job applicants to respond to and defend against legal claims.
Special Categories of Data
How does the Company protect data?
We take the security of your data very seriously. The company has put in place internal policies and controls to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by our employees in the proper performance of their duties.
Where your personal data is shared with third parties, we require all third parties to take appropriate technical and organizational security measures to protect your personal data and to treat it subject to a duty of confidentiality and in accordance with data protection law. We only allow third parties to process your personal data for specific purposes and in accordance with our written instructions.
The Company also has in place procedures to deal with a suspected data security breach and we will notify both the Information and Data Protection Commissioner and yourself of any suspected data breach where we are legally required to do so.
For how long does the Company keep data?
The company will only retain your personal data for as long as necessary, to fulfil the purposes for which it was collected and processed, in this case recruitment. For our Data Retention Policy contact [email protected].
If your application for employment is unsuccessful, the company [for and behalf of its’ subsidiaries] will hold your data on file for 6 [six] months from the date on which the Company shall communicate its decision to engage you or not.
If you agree to allow us to keep your personal data on file, we will do so for consideration for future employment opportunities for a further period of six (6) months. You are also reminded that you are free to withdraw your consent at any time. At the end of that period, or once you withdraw your consent, your data is deleted or destroyed.
In instances of false statements including but not limited to false representations of one’s qualifications or inconsistencies in one’s employment history, we shall retain a record of any necessary details in our legitimate business interest or the possible establishment, exercise or defence of legal claims, as permitted under the Criminal Code (Chapter 9 of the Laws of Malta).
Your Rights as a Data Subject
As a data subject, you have a number of statutory rights. Subject to certain conditions, and in certain circumstances, you have the right to:
- The right to access your personal data
- The right to request rectification of your personal data
- The right to withdraw consent
- The right to be forgotten [erasure]
- The right to portability
- The right to know about profiling
- The right to refuse automated decisions
- The right to object
You have the right to make an enquiry or send a complaint to the Company’s Data Protection Officer at [email protected] You also have the right to lodge a complaint with the Office of the Information and Data Protection Commissioner.
The Company may request specific information from you in order to verify your identity and check your right to access the personal data or to exercise any of your other rights. This is a security measure to ensure that your personal data is not disclosed to any person who has no right to receive this. For more information on our Data Subject Request procedures kindly contact [email protected].
What if you do not provide personal data?
You are under no statutory or contractual obligation to provide data to the Company during the recruitment process. However, if you fail to provide the data when requested, we may not be able to process your application properly, or at all. Changes to this Privacy Notice The Company reserves the right to update or amend this privacy notice at any time. Contact If you have any questions about this privacy notice or how we handle your personal data please feel free to contact us on [email protected].
The Company’s Data Protection Officer may be reached at [email protected].