Lottoland Privacy Policy

1. INTRODUCTION AND SCOPE OF THIS PRIVACY NOTICE

2. THE DATA WE COLLECT ABOUT YOU

3. HOW YOUR PERSONAL DATA IS COLLECTED

4. HOW WE USE YOUR PERSONAL DATA

5. HOW WE USE PARTICULARLY SENSITIVE INFORMATION

6. DISCLOSURE OF YOUR PERSONAL DATA

7. INTERNATIONAL TRANSFERS

8. AUTOMATED DECISION-MAKING AND THE USE OF AI

9. DATA SECURITY

10. DATA RETENTION

11. YOUR RIGHTS AS A DATA SUBJECT

12. EXCERCISING YOUR RIGHTS

13. CHANGES TO THIS PRIVACY NOTICE

1. INTRODUCTION AND SCOPE OF THIS PRIVACY NOTICE

1.1 We respect the privacy of prospective employees, workers and contractors and are committed to protecting your personal data both during and after the application process, regardless of the outcome. This Privacy Notice is aimed at candidates for prospective employment with us and to those seeking to offer their services as private contractors or workers to us (this “Privacy Notice”) and describes how we collect and use personal information about you during the recruitment process, including in the event your application is unsuccessful.

1.2 The terms “we”, “us”, “our”, refer to Lottoland Holdings Limited, a private company limited by shares incorporated in Gibraltar, and subject to Gibraltar law, having its registered office at Suite A, Ocean Village Promenade, Ocean Village, Gibraltar GX11 1AA (“Lottoland”). The term “Lottoland Group” refers to direct and indirect subsidiary entities of Lottoland itself within its wider corporate group.

1.3 Different rules apply depending on the relevant company in the Lottoland Group responsible for processing your Personal Data. In most cases, Daisy Services Limited (a wholly owned subsidiary of Lottoland), established in Gibraltar, will process Personal Data of our prospective staff in the employment and HR context, as a service company to/for the Lottoland Group.

1.4 The Lottoland Group is made up of different legal entities. If you are applying for a role with Lottoland or other Gibraltar‑based entities, Lottoland Holdings Limited will be the data controller of your Personal Data and the Gibraltar GDPR will apply.
If you are applying for a role with another EEA‑based entity, that company will be the data controller of your Personal Data and the EU GDPR will apply. In both cases, Daisy Services Limited, based in Gibraltar, may process your Personal Data as a service company to the Lottoland Group.

1.5 We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this Privacy Notice. If you have any questions about this Privacy Notice, including any requests to exercise your rights as a Data Subject (as summarised in this Privacy Notice), please contact our DPO using the details set out below.

2. THE DATA WE COLLECT ABOUT YOU

2.1 In an employment application, employment, engagement and/or HR context, we may collect, use, store and transfer different kinds of Personal Data about you which we have grouped together into “categories” of Personal Data as follows:
a) Identity Data includes: first name, last name, title, date of birth, gender, nationality, and photographs
b) Contact Data includes: address, personal email addresses and telephone numbers
c) HR Data includes: current (if applicable) and previous employment / work history, job titles, job titles, employment references, national insurance number (where applicable), tax identification numbers and tax status, location of workplace (for independent contractors or workers only), training records and professional memberships, compensation history / salary details from current employer (if applicable).
d) Additional HR Data is only relevant for considering applications involving relocation packages and more senior management roles, and includes: marital status and dependents, right to work and immigration data, proposed working hours.

Identity Data, Contact Data and HR Data are collected primarily from any application form(s) filled in by you as well as from your curriculum vitae (“CV”) and cover letter(s) (if any), which we collectively refer to as “Application Documentation”.

2.2 We do not intentionally seek to collect special categories of Personal Data or data relating to criminal convictions at this stage unless this is necessary for a specific purpose described in section 5 below (for example, to make reasonable adjustments for an interview or to carry out legally required background checks for certain roles).

2.3 Providing the Personal Data described in this Privacy Notice is generally voluntary, but in some cases, it will be necessary for us to assess your application and, if appropriate, enter into an employment or services contract with you. If you do not provide the information we reasonably request, we may be unable to process your application or consider you for the relevant role.

3. HOW YOUR PERSONAL DATA IS COLLECTED

3.1 We use different methods to collect data from and about you including through:

a) Direct interactions: This includes information you provided to us during the recruitment stage, both in your Application Documentation as well as at interview(s). It also includes further information sourced from you during your correspondence with us during the recruitment exercise, via emails, meetings (including e-Meetings), telephone calls, or similar interactions/communications During these direct interactions, we may also generate information internally (e.g. interview notes, salary expectations, relocation requirements, training requirements, proposed employment contracts/service agreements, or proposed revisions thereto)

b) Third parties or publicly available sources: We may also receive Personal Data about you from various third parties (e.g. your named referees) and publicly available sources (e.g. Facebook, LinkedIn, Twitter, and in some limited cases, Credit Reference Agencies) and utilise this information for things such as minimising fraud risks to the business, or to consider you for certain roles where additional checks and information are required under applicable law and/or regulatory guidance. In addition, we may have collected and continue to process information received from employment agencies used during the recruitment process.

4. HOW WE USE YOUR PERSONAL DATA

4.1 We process your Personal Data only to the extent necessary and on the basis of one or more of the lawful bases set out in Article 6 GDPR / Gibraltar GDPR, in particular our legitimate interests, taking steps to enter into a contract with you, our legal obligations and, where applicable, your consent, for the purposes outlined below.

4.1.1 For the purpose of the recruitment process (filling vacant positions), negotiating the conclusion of an employment or similar relationship

The legal basis for processing your personal data during the recruitment process is primarily our legitimate interest (Article 6(1)(f) GDPR), which enables us to identify and assess candidates for potential employment in an efficient and fair manner. We rely on this basis particularly in the initial stages of the recruitment process (e.g., screening and evaluating applications), where the processing is necessary to manage and improve our recruitment procedures and to select suitable candidates for roles within the Lottoland Group in an efficient and fair manner.

In the later stages of the recruitment process, where the processing of personal data is directly related to negotiating or concluding an employment contract, we rely on Article 6(1)(b) GDPR / Gibraltar GDPR (processing necessary for the performance of a contract or to take steps at the request of the data subject prior to entering into a contract).

If you are not selected for the position, and unless you provide us with your consent for future contact regarding job opportunities, your personal data will be retained for period of no longer than six (6) months from the conclusion of the recruitment process for the position you applied for. This retention period allows us to address potential legal claims related to the recruitment process, such as those concerning equal treatment and non-discrimination, and to ensure the transparency and fairness of the selection process. After this period, your personal data will be securely deleted unless further retention is required by law.

4.1.2 For the purpose of maintaining a record of job applicants and contacting them regarding job opportunities (vacancies) within the Lottoland Group.

We may wish to retain your personal data to contact you in the future with job offers within the Lottoland Group. In such cases, we will ask for your consent (Article 6(1)(a) GDPR / Gibraltar GDPR), either before you submit an official application or after submitting it. The personal data provided in this way will be stored for a maximum period of one (1) year from the granting of consent.

5. HOW WE USE PARTICULARLY SENSITIVE INFORMATION

5.1 In limited cases we may process special categories of Personal Data (such as information about your health or your racial or ethnic origin) during the recruitment process, for example if you choose to volunteer such information in order to request reasonable adjustments for an interview or as part of a background‑check process for certain roles. We will only process such data where this is permitted by law.

5.2 In particular, we may process special categories of Personal Data where the processing is necessary:

a) to carry out our obligations and exercise specific rights in the field of employment and social protection law (Article 9(2)(b) GDPR / Gibraltar GDPR); and/or

b) for the establishment, exercise or defence of legal claims (Article 9(2)(f) GDPR / Gibraltar GDPR); and/or

c) where you have given your explicit consent for a specific purpose (Article 9(2)(a) GDPR / Gibraltar GDPR), which you may withdraw at any time by contacting the DPO.

5.3 For roles that require background or criminal‑records checks, we may process information about criminal convictions and offences only where this is permitted by applicable national law and only to the extent necessary for that purpose.

6. DISCLOSURE OF YOUR PERSONAL DATA

6.1 Your information will be shared internally for the purposes of the recruitment exercise. This includes members of the HR and recruitment team, interviewers involved in the recruitment process, managers in the business area with a vacancy and IT staff if access to the data is necessary for the performance of their roles.

6.2 We may have to share your personal data with the following recipients or categories of recipients set out below:
a) Other companies in the Lottoland Group acting as joint controllers or processors and who provide HR, IT, and system administration services (to a limited extent and subject to them not disclosing this further within the organisation without express authority).
b) Recruitment agencies, job boards and assessment providers that support us in advertising roles, managing applications and running assessments.
c) Background‑check, identification and verification providers, where this is required for certain roles and permitted by law.
d) Professional advisers (such as lawyers or auditors) and regulators or authorities where we are required to do so by law or where it is necessary to protect our rights.
e) IT and software providers (including providers of applicant‑tracking systems, communications tools and cloud services) who host or process Personal Data on our behalf in accordance with our instructions.

Generally, unless you are at final stages of selection, and applying for more senior managerial roles and other controlled functions, we will not need to disclose information regarding your application to third parties outside of the Lottoland Group beyond the categories mentioned above.

7. INTERNATIONAL TRANSFERS

7.1 Due to the global nature of Lottoland operations, from time to time we may need to share your personal data within the Lottoland Group of companies and third-party service providers which may be located in Gibraltar, the UK, the EEA or outside of the EEA. Please note the provisions in section 7 of our Privacy Notice (International Transfers) which apply equally to Personal Data processed in the employment and HR context, and during the recruitment process.

7.2 Where we transfer Personal Data outside Gibraltar, the UK or the EEA, we will ensure that appropriate safeguards are in place, such as an adequacy decision or standard contractual clauses, and you can obtain further information about these safeguards by contacting the DPO

8. AUTOMATED DECISION-MAKING AND THE USE OF Ai

8.1 “Automated decision-making” is the process of making a decision by automated means without any human involvement. A decision is therefore solely automated if there is no meaningful input by a human in the final decision being made about a person. In most cases, we do not use automated decision-making when processing Personal Data as decisions will generally have human involvement. If this changes, we will confirm this to you and provide meaningful information about the logic involved, as well as the significance and the envisaged consequences for you. However, certain third parties (e.g. credit referencing agencies) may use certain automated decision-making tools or software, including artificial intelligence (see below). We are not responsible for any automated decision-making by third parties but may take reasonable steps to bring such automated decision-making to your attention.

8.2 Artificial Intelligence (Ai)
8.2.1 Artificial intelligence (“AI”) refers to when a machine can demonstrate intelligence (i.e. learning, reasoning, understanding of concepts and recognition of patterns etc.) through analysis of inputted data and information. This allows use of machine learning to synthesize, make inferences, and even problem-solve. ‘Generative AI’ typically uses large language models or “LLMs” and some applications create “generative pre-trained transformers” or “GPTs”. Whereas Generative AI turns machine learning inputs into content, ‘Predictive AI’ uses machine learning in an attempt to determine the future and prevent bad outcomes by using data to identify early warning signs.

8.2.2 Where AI makes decisions and there is no human involvement (beyond the inputting stage), then that will be wholly automated decision-making as defined above. However, where the final decision is subject to human intervention or involvement, then this will not be automated decision-making.

8.2.3 From time to time, we may use Ai tools to assist in our recruitment process. These tools may:
- Screen resumes and applications for relevant qualifications and experience
- Analyse assessment responses
- Generate insights from interview recordings
- Recommend candidates based on skills matching

While we may use these tools to improve efficiency, final hiring decisions are always made with human oversight. You have the right to request human intervention, express your point of view, and contest any decision made using automated processing.

9. DATA SECURITY

9.1 The accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data is known as a “data breach”. We have put in place appropriate physical, technical and administrative security measures to prevent data breaches and deal with these when they arise. These measures include internal policies regarding data breach prevention and internal/external reporting, as well as physical and IT security measures to monitor and restrict processing. In addition, we limit access to your Personal Data to those employees and any third parties who have a business need to know. Such persons will only process your Personal Data on our instructions and are subject to duties of confidentiality, and of complying with our data protection procedures.

9.2 During the recruitment process, your Personal Data is generally only processed by HR staff. Such persons will only process your Personal Data on our instructions, and they are subject to a duty of confidentiality as outlined above.

9.3 We undertake to inform you, to the extent we are required to do so, if your personal data is compromised and there is a high risk to your rights and freedoms as a result.

10. DATA RETENTION

10.1 We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including:
a) Considering your application and:
If you are: successful, transferring this information to a personnel / HR file or other equivalent internal record(s) kept for our employees and external contractors/workers, which will be retained during your employment or contractor relationship with us and following its conclusion in line with Lottoland’s Privacy Notice for Employees, Workers & Contractors (Global);
If you are: unsuccessful, retaining this information with your express written consent in order to consider you for future roles for a predetermined period of up to 12 months following conclusion of the recruitment process, and where no such consent is provided, for a period of up to 6 months.
b) maintaining business records for the purposes of satisfying any legal, accounting, or reporting requirements
c) complying with record retention requirements under relevant laws;
d) exercising, establishing, or defending legal claims

10.2 We may retain your Personal Data for longer periods where such retention is necessary for compliance with a legal obligation to which we are subject, or where another lawful basis applies. In the recruitment context, this will only apply in exceptional circumstances. Similarly, we may retain information pursuant to our legitimate interests, but these will also be rare in the recruitment context and generally be limited to defending any legal claims which we reasonably expect may be brought against us, or which we may wish to bring.

11. YOUR RIGHTS AS A DATA SUBJECT

11.1 You have certain rights under the Data Protection Legislation. These rights apply equally in an employment and HR context and in the recruitment context and these are summarised below:

1. Right to information

2. Right to request access

3. Right to rectification

4. Right to erasure (right to be ‘forgotten’)

5. Right to restriction of processing

6. Right to data portability

7. Right to object

8. Right to freedom from automated decision-making (including profiling)

9. Right to lodge a complaint with the Information Commissioner and/or a relevant supervisory authority

10. Right to withdraw consent

If you have any further questions or doubts regarding the exercise of such rights, please contact the DPO in the first instance using the contact details provided below:
[email protected]

11.2 If we have not responded to you within a reasonable time or if you feel that your complaint has not been resolved to your satisfaction, you are entitled to make a complaint to the Information Commissioner under the Data Protection Act, which is presently the Gibraltar Regulatory Authority (“GRA”). You may contact the GRA on the below details:
Address:
Gibraltar Regulatory Authority, 2nd Floor, Eurotowers 4, 1 Europort Road, Gibraltar
Email: [email protected]
Phone: (+350) 200 74636

11.3 If you live or work in the European Economic Area, or your application is for a role with an EEA‑based entity, you may also lodge a complaint with your local supervisory authority. Further information is available on the website of the relevant supervisory authority.

12. EXERCISING YOUR RIGHTS

12.1 If you wish to exercise any of the rights set out above, please contact the DPO using the contact details set out above in this Privacy Notice. We may need to request specific information from you to help us confirm your identity and to ensure your right to access your Personal Data (or to exercise any of your other rights).

12.2 We aim to respond to all legitimate requests within the time periods required by applicable Data Protection Legislation. Occasionally it may take us longer if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

13. CHANGES TO THIS PRIVACY NOTICE

13.1 We may update this Privacy Notice from time to time, but it is unlikely to be amended during a recruitment process. When we make such changes, we will notify you by providing you with a copy of the new notice and will also update the “Last updated” field at the top of this Privacy Notice.