Candidates Privacy Notice for Wildz Group Career Site and Recruitment
Date of publication: 8th August 2025
Granturo Services Limited (“We”, “Us”), a company belonging to Wildz Group, acts as the data controller in the procedures explained below, and is hereby publishing a copy of this Privacy Notice in relation to individuals who have applied or have otherwise shown interest to work with Us (whether as an employee, worker or contractor). We do so in order to comply with the law, and to provide You with all information relating to how and why Your personal data will be used, during, and for the purpose of, the recruitment exercise.
This Privacy Notice ceases to apply if You are successful in the recruitment process.
This Candidates Privacy Notice outlines how We handle Your personal data if You:
• Visit our Career Site (You are referred to as a “Visitor”)
• Sign up to receive updates on job opportunities (a “Connecting Candidate”)
• Apply for a position via our Career Site or a third-party platform (an “Applying Candidate”)
• Are identified as a potential Candidate from public sources or platforms (a “Sourced Candidate”)
• Are referred to us by one of our employees or partners (a “Referred Candidate”)
• Are listed as a reference by a Candidate (a “Reference”)
We also explain Your data protection rights and how to exercise them.
When We use the term “You”, ”Your” or “Candidate”, We refer to all types listed above unless otherwise specified.
1. About the Processing of Personal Data
Personal data refers to information that can identify a living person, either directly or indirectly, such as name, email address, phone number. The processing of personal data involves any action taken on such data, including collecting, analyzing, sharing, storing, or deleting.
We comply with applicable data protection regulations, specifically the European Union General Data Protection Regulation (2016/679, “GDPR”).
We determine why and how Your personal data is processed. When We use third-party services, these providers act as data processors, processing Your data only under our instructions.
2. Principles of Lawful Processing
We strive to comply with the law and the principles emanating from it. Therefore, Your data will be:
• Used in a lawful, fair and in a transparent way
• Collected only for valid purposes that We have clearly explained to You and not used in any way that is incompatible with those purposes
• Relevant and limited to such purposes
• Accurate up to date
• Retained only for as long as necessary
• Kept securely
3. What Personal Data Do We Process?
Communications: content of emails, messages, interviews, or notes added to and strictly in relation to Your Candidate profile.
Contact Details: full name, email address, phone number, and mailing address.
Application Data: CVs, cover letters, portfolios, references, recommendations and certifications/academic transcripts.
Interview & Assessment Data: Such as interview notes, assessments and evaluation results and any information provided by Yourself during the interview process.
Public Profile Data: Data gathered from sources like LinkedIn or the Website of Your current employer.
Reference Data: Information We receive from the referees who referred You to Us, or by the persons You have listed as Your references.
Sensitive Data: We will not process or request You to provide Us with any sensitive personal information, unless You voluntarily send it in Your covering letter or CV. If We deem that such information is irrelevant to the process, especially where no legal basis for such processing exists, We will inform You accordingly and securely delete that information. There may be instances where We will use information about Your disability status to consider whether We need to provide appropriate adjustments during the recruitment process or upon engagement.
4. Where Do We Receive Personal Data From?
We collect personal data:
• Directly from You: Most of the personal data We process is provided directly by You. For instance, when You apply for a position or choose to connect with us. While You may opt not to share certain information, please note that some personal data is essential for Us to evaluate Your application or respond to Your requests.
• From the Career Site: When You visit our Career Site, We collect technical and statistical data about Your usage, as well as information from the device You use to access the site.
• From public sources: We may obtain personal data about You from publicly available sources, such as LinkedIn or Your current employer’s Website.
• From referrals: We may receive information about You from our employees or trusted partners, such as recruitment service providers, if they believe Your profile may be a good fit for current or future opportunities with Us.
• From Your references: If You provide references, We may gather information about You from the individuals You have listed.
• We may create some data ourselves or together with You during the recruitment process: We may generate data ourselves or in collaboration with You during the recruitment process. This includes information related to Your application and profile, such as interview notes, assessment results, and test outcomes.
5. Why Do We Process Your Personal Data?
Upon receiving Your application or referral information, We will process that information to decide whether You meet the basic requirements to be shortlisted for the role. If You do, We will decide whether to invite You for an interview, in which case We will use the information You provide to Us to decide whether to offer You the role.
In general, We process Your personal data for the following purposes:
• To comply with legal requirements and to protect and uphold legal rights: To safeguard our own rights and interests, as well as those of others, for example, in the context of legal proceedings or claims.
• To share data with relevant third parties: We may share Your personal data with third parties as outlined in Section 7 of this policy.
• To collect usage data through cookies and tracking technologies: To gather information about how the Career Site is used, as detailed in our Cookie Policy.
• To maintain and secure the Career Site: To operate, test, enhance, and secure the functionality and performance of the Career Site.
• To analyse and improve the Career Site: To better understand user behaviour, generate statistics, and improve site performance.
• To provide job updates: To send You updates about current or future job openings, if You've expressed interest.
• To review applications and communicate with Candidates: To evaluate profiles and applications submitted to Us and maintain communication throughout the recruitment process.
• To proactively assess profiles: To identify and assess potential Candidates by reviewing publicly available information or referrals, and to contact You if relevant.
• To reach out regarding future job opportunities: To contact You about roles that may align with Your profile, now or in the future.
• To record interviews (with consent): To keep a record of interviews when appropriate and agreed upon.
• To invite participation in surveys: To request feedback or insights through surveys that support our recruitment and employer branding efforts.
• To collect reference information: To contact and evaluate information provided by individuals listed as references for Candidates.
Failure to provide information when requested or required, where such information is necessary for Us to consider Your application may result in Your application not being able to be processed successfully.
6. Automated Decision Making
We don’t envisage that You will be subject to decisions that will have a significant impact on You based solely on automated decision-making.
7. Who Do We Share Your Data With?
We may share Your data with:
• Service providers: We share Your personal data with trusted suppliers who support our employer branding and recruitment activities. This includes, for example, providers of recruitment services and the platform behind Our Career Site and applicant tracking system.
• Group companies: We may share Your personal data with companies within our group that provide services or systems We use in our recruitment and employer branding process—such as shared access to software or internal platforms.
• Third-party cookie providers: With Your consent, third-party companies may place cookies on the Career Site. These companies process the data collected through cookies in accordance with their own privacy policies. More information is available in our Cookie Policy.
• Authorities and public bodies: We may disclose Your personal data when required by law or when ordered to do so by a competent authority.
• Parties involved in legal matters: To protect or enforce our legal rights, We may share Your personal data with relevant authorities or other parties involved in current or potential legal proceedings—such as in the case of discrimination claims – where such sharing is strictly necessary.
• In case of corporate changes: If our company undergoes a merger, acquisition, restructuring, or sale of assets, Your personal data may be shared with parties involved in the transaction as part of the business transfer process.
8. Legal Basis for Processing
To process Your personal data, We must have a valid legal basis under the GDPR.
For the purposes outlined in this Privacy Policy, our primary legal basis is legitimate interest. We process Your personal data because it is necessary for us to recruit individuals with the skills and experience required for our roles. We have determined that this processing is essential to achieve this objective of recruiting talent and safeguarding our legal interests in that regard.
If You would like more details on how We assess this, please refer to Sections 13 and 14 for our contact information.
9. Transfer of Data Outside the EU/EEA
We strive to process Your personal data within the EU/EEA. However, some of our service providers may process Your personal data outside this area. Additionally, We may work with suppliers whose parent companies, or the parent companies of their subcontractors, are located outside the EU/EEA. In such cases, We acknowledge the risk that Your personal data may be disclosed to countries outside the EU/EEA, such as in response to a legal request.
If Your data is transferred to a recipient outside the EU/EEA (as described in Section 7), We ensure that adequate safeguards are in place to protect it, in line with GDPR requirements.
These safeguards include:
Adequacy decisions by the EU Commission, which confirm that the recipient country offers an adequate level of data protection. For example, We rely on the EU-US Data Privacy Framework and the EU’s adequacy decision for the UK.
Standard contractual clauses set by the EU Commission, ensuring that the recipient continues to protect Your data in accordance with the GDPR.
Technical and organizational safeguards to protect Your personal data during the transfer, based on what is feasible and effective for the specific situation.
For more details about transfers outside the EU/EEA, please contact us as outlined in Sections 13 and 14.
10. How Long Do We Keep Your Data?
Data is kept for a period of one (1) year following the final communication of our decision in relation to Your recruitment. This is to ensure that, in the event of a legal claim, We can demonstrate that We did not discriminate against You on any prohibited grounds and that our hiring process was conducted fairly and transparently. After this period, the data is destroyed in accordance with the law, unless You choose to remain connected with Us, at which point We will seek Your explicit consent for such.
11. Data Security
Appropriate security measures are in place in order to prevent any of Your personal data from being accidentally altered, disclosed, lost or destroyed, used or accessed in an unauthorised way. In addition, We limit access to Your personal information to those employees, agents, contractors and other third parties on a strict need-to-know basis, wherein such processing will be carried out only upon our instructions and subject to observance of the duty of confidentiality.
12. Your Rights Under GDPR
This section outlines Your rights under data protection laws when We process Your personal data. Please note that some rights only apply when We process Your data based on specific legal grounds.
To exercise any of the rights below, You can:
• Visit the Data & Privacy page on our Career Site, where We provide tools to manage Your rights.
• Log in to Your account with us to manage Your data preferences.
• Contact us directly at hr@wildz.group
Right to be informed
You have the right to be informed about how We process Your personal data, including if We plan to use it for purposes other than its original collection. We provide this information through this Privacy Policy, updates on our Career Site, and by responding to any queries You may have.
Right to access Your personal data
You can request to know if We process Your personal data and receive a copy of the data We hold about You. This includes information about how We process Your data.
Right to data portability
You can request a copy of Your personal data relating to You that We process, based on Your consent in a structured commonly used machine-readable format.
Right to erasure ("right to be forgotten")
You have the right to request that We delete Your personal data when it is no longer needed for its original purpose, or if You withdraw Your consent and no other legitimate grounds exist for processing. We may be legally obligated or permitted to retain Your data, particularly when necessary for reasons like compliance with Maltese or EU law, public interest (including public health), archiving, scientific research, or the establishment and defense of legal claims, as explained above.
Right to object to processing
You can object to the processing of Your personal data when it is based on our legitimate interest, by referencing Your specific circumstances, provided that We do not possess an overriding basis upon which the continued processing of Your data may be necessary in accordance with the law.
Right to restrict processing
If You believe Your personal data is inaccurate, or the processing is unlawful or unnecessary for the intended purpose, You can request that We restrict the processing. During this period, We will only process the data with Your consent or to establish, exercise, or defend legal claims.
Right to rectification
You can request that We correct any inaccurate data We hold about You or complete any incomplete information.
Right to withdraw consent
If We process Your data based on Your consent, You have the right to withdraw it at any time. This will stop us from processing Your data for the specific purposes You withdrew consent for. However, withdrawing consent does not affect the lawfulness of any processing that occurred before the withdrawal.
Right to lodge a complaint
If You have concerns about how We process Your personal data, You can lodge a complaint with the data protection authority in Malta.
13. Contact Us
If You have any questions, feedback, or wish to exercise Your data rights, You can contact our Data Protection Officer on dpo@wildz.group
14. Updates to This Policy
We may update this privacy policy as needed, such as when We begin processing Your personal data in new ways, to provide clearer information, or to comply with evolving data protection laws.
We recommend checking this page regularly for updates. The date of the most recent revision is always displayed at the top of the page.
