Recruitment privacy policy


Welcome to Lotto Direct’s Career privacy policy (the “Privacy Policy” or “Policy”). Lotto Direct Limited (hereinafter also “Lotto Direct; the “Company”; “we”; “us”; “our”) respects your privacy and is committed to protecting your personal data. This privacy policy will inform you as to how we look after your personal data and tell you about your privacy rights and how the law protects you.

We are committed to protecting your privacy and we will only collect and process any personal information about you in accordance with this Policy.



This Privacy Policy sets out and describes the way in which Lotto Direct collects and processes the personal information and data the Applicant to a vacancy (hereinafter also the “Applicant”; “you”; “your”) provides to us. If you do not agree with the terms of this Policy, please do not provide us with your personal information.


Personal data means any information relating to an identified or identifiable natural person; an identifiable person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity of that natural person.

Processing of personal data  means any operation or set of operations which is taken in regard to personal data, whether or not it occurs by automatic means, and includes the collection, recording, organization, storage, adaptation, alteration, retrieval, gathering, use, disclosure by transmission, dissemination or otherwise making information available, alignment or combination, blocking, erasure or destruction of such data.

Sensitive personal data means personal data that reveals race or ethnic origin, political opinions, religious or philosophical beliefs, membership of a trade union, health, or sex life.


Lotto Direct, referred to as the Company in this privacy policy, is the controller and responsible for your personal data.

We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this privacy policy. If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact the DPO using the details set out below.


Our full details are:
Full name of controller: Lotto Direct Limited
Company registration number: C77583
Postal address: The Bunker, Triq Il Furnar, QRM 3506, Qormi, Malta
Name or title of DPO: Abigail Borg
Email address: [email protected]
Telephone number: +356 2713 4034

You have the right to make a complaint at any time to a data protection supervisory authority. In the case of Malta, the supervisory authority is the Office of the Information and Data Protection Commissioner Floor 2, Airways House, Triq Il-Kbira, Sliema. Tel. 00356-23287100; email: [email protected].

We would, however, appreciate the chance to deal with your concerns before you approach the IDPC, so please contact us in the first instance.


The data we hold include, but are not limited to:


By applying to any of the vacancies advertised by us, whether directly or indirectly (e.g. through a Recruitment Agency) and irrespective of whether the advertisement is published on any of our websites or any third – party websites (e.g. a Recruiter Agency’s or an ADs Aggregator’s website) or by submitting to us any relating contents, whether or not solicited, (e.g. a speculative application) you provide us with a number of personal information (“Application Data”).

Application Data includes, but are not limited to:

  1. your personal and contact details: your name, surname, address, zip code, date of birth, email address, phone number
  2. your employment or education history: employment history, resume, cover letter, references (including on positions held and performance in previous employment) *, salary expectations and other relevant documentation in support of the recruitment process;
  3. Eligibility details: applicable policy period, preferred start date, current and/or future work eligibility status, visa type and visa expiry date
  4. correspondence with or about you, for example the acknowledgement of receipt of your application, a feed-back on its status, an email to the Recruitment Agency that referred you to us notifying the outcome of an interview.

*Please note that with regards to referral details (names and contact details of referees), it is your responsibility to obtain consent from your references prior to providing us with their personal data.

You may also voluntarily provide Us with other information such as your photo, your LinkedIn profile, website/portfolio, and/or details on how you heard about the position.


Some data which may be considered Personal Data, are collected automatically from your device when you access our career Site including:

  • Technical Data includes internet protocol (IP) addresses, type of browser, Internet Service Provider (ISP), date/time stamp, referring/exit pages, clicked pages and any other information your browser may send to us.
  • Usage Data includes information about how you use our Career website, time spent on the site and page interaction information.


To enable the working of certain functions during your visit to our website, we make use of cookies on various pages. Cookies are small text files that are stored on your device. We use two types of cookies: (i) ‘session cookies’ which are stored temporarily during a browsing session in order to allow normal use of the system and are deleted from your device when the browser is closed; (ii) ‘persistent cookies’ which are read only by our website, saved on your computer for a fixed period and are not deleted when the browser is closed. Such cookies are used where we need to know who you are for repeat visits, for example to allow us to store your preferences for the next sign-in.

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly.


For Recruitment purposes, we may collect Personal Information from the following sources:

  • You, as Our candidate;
  • Third parties acting on your behalf such as a recruitment agency;
  • Your referees (for example present and past employers);
  • Third parties carrying out background checks on our behalf; and
  • Publicly available sources such as LinkedIn or Facebook.

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

  • Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
  • Where we need to comply with a legal or regulatory obligation.

Generally, we do not rely on consent as a legal basis for processing your personal data.


As your prospective employer, we need to collect and process information about you for a number of purposes such as the following

  1. to manage your application and the recruitment process;
  2. to verify your information and carrying out reference and background checks (where applicable)
  3. to assess your fitness for the role you have applied for;
  4. Managing recruitment and resourcing activities related to organizational planning; and
  5. to protect our legal position in the event of disputes and / or legal proceedings.

We may also keep your resume in our database for 6 months in order to contact you about any future opportunities at the Company. We may keep this information based on our legitimate interest to find qualified staff and keep you updated about future vacancies if we find that you would be a good candidate for the respective role. You may opt-out from receiving this information.

In the event that you are offered and accept employment with the Company, your personal information collected during the recruitment process will become part of your employment record. Information on how we process Employee personal data is described in the Company’s Employee Privacy Policy that will be provided upon employment.

Automatically collected Personal Data will be used for a number of purposes such as the following:

  1. to support and troubleshoot our Services and to respond to your queries;
  2. to perform research or conduct analytics in order to improve and customize our Site to your needs and interests;
  3. to secure our Career Site

Where we intended to process your personal data for one or more lawful purposes other than which it was originally collected, we will provide you with information on such purposes and any other relevant detail. In the event that any such further purpose requires your consent, we will refrain from the processing until we will have explicitly obtained it.



We are a very structured and articulated Group and therefore we may share your personal data between the parent Companies of the Group when it is necessary to better assess your application, to comply with our legal and regulatory requirements and to facilitate the exercise of your rights as data subject.

Although your Recruitment Data are mainly processed by our Human Resources department, your information may be disclosed, in accordance with the nature of the vacancy and on a strict need-to-know basis, to line managers and to our senior management.


Where your application has been submitted to us by a third-party recruiter acting on your behalf, we might disclose certain data relating to your recruitment process to such recruiter, including the outcome or the value of the offer, as a part of the contractual relationship governing the provision of the recruitment services. If we could not disclose these data, we could not accept any application submitted on your behalf.

For certain purposes relating to legal requirements, for example to comply with Anti-Money Laundering Regulations, we may use third-party service providers to carry out background checks on our behalf.

We will not release your personal data to any third party or international organisations except as stated in this Policy.


We may also disclose your Personal Information if we have a good faith belief that disclosure of such information is helpful or reasonably necessary to (i) comply with any applicable law, regulation, legal process or governmental request; (ii) enforce our policies including investigations of potential violations thereof; (iii) detect, prevent, or otherwise address fraud or security issues; or (iv) protect against harm to the rights, property or safety of the Company, its Employees or the public.

We may e.g. be required to disclose your information to certain Bodies or Organisations, such as the Department of Industrial and Employment Relations, Jobsplus, the Inland Revenue, the Malta Gaming Authority, the Police, or the Financial Intelligence Analysis Unit.


We may share your personal data with other entities within the group and with third party service providers. As our Group also consists of entities established outside the European Union, this may involve transferring your personal data outside of the European Economic Area (EEA).

Whenever we transfer your personal data out of the EEA we will make sure that either an adequacy decision made by the Commission in regard of the relevant country exists or standard contractual clauses governing the transfer and the safeguards relating to your personal data are in place, through specific agreements or that you provided your consent to the transfer.

You can get more information about categories of recipients with which we share your data and safeguards for transfer in third countries that we have in place by contacting our DPO.


We will take all reasonable steps to ensure that your information is kept secure and protected to the highest possible standards. We have appropriate, adequate and effective technical and organizational safeguards as well as trained personnel to protect your personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

As a general principle, we will not transfer your personal data to any third-Country, however as our Group also consists of entities established outside the European Union, where we transferred your personal data in accordance to this policy to such entities and prior to proceeding with the transfer we would make sure that either an adequacy decision made by the Commission in regard of the relevant country exists or standard contractual clauses governing the transfer and the safeguards relating to your personal data are in place, even by means of specific intra-group agreements or that you provided your consent to the transfer.


Application Data are stored and retained only for the time that is strictly necessary to the recruitment process and to the other purposes stated in this Policy, however, where you have given your consent, data pertaining to unsuccessful applications may be retained up to 6 months following the end of the recruitment process and processed in the event that a new, relevant vacancy arises.

Following a successful application, on the other hand, we may still keep some of all Application Data and we will process and retain it in accordance with our Employees’ Privacy Policy.


In respect of any of your personal data collected and processed by us in accordance with this Policy, at any time you have the right to:

  • Access your personal data and periodically obtain a free of charge copy of them;
  • Rectify your personal data.

Where you have given your consent to processing, in addition to the right stated above, at any time you have the right to:

  • Withdraw the consent to processing without affecting the lawfulness of the processing based on consent before withdrawal;
  • Request the erasure of your personal data.

You may obtain further information on how to exercise your rights or to request access to or rectification or erasure of your data by sending an email at: [email protected].


We will periodically review this Policy. If we make any material or substantial changes to this Privacy Policy we will use reasonable endeavours to promptly inform you by the most appropriate mean.