Introduction
Enemalta plc (“Enemalta” or “We” or “Us” or “Our”) is a Maltese public limited company bearing registration number C 65836 and having its registered address at Triq Belt il-Ħażna, Marsa, MRS 1571, Malta.

We process your personal data as part of Our recruitment process. If you apply for a job with Us, We collect and process your personal data relating to the job application. This personal data may be held by Us on paper or in electronic format. We are committed to being transparent about how We collect and use the data and to meeting Our obligations under the General Data Protection Regulation (GDPR).
The purpose of this privacy notice is to make you aware of how and why We will collect and use your personal information during the recruitment process. This privacy notice applies to all job applicants. Data will be stored in a range of different places, including your application form, IT Systems (including emails), and HR systems.
The information We hold about you follows the GDPR principles as indicated hereunder:
• To process the information in a lawful, fair and transparent manner
• The personal information is solely collected for the legitimate purposes of Enemalta plc that are clearly explained to you in this Privacy Notice
• The personal information is kept up to date where necessary
• The personal information is processed in a way that ensures appropriate security of data.
If you have questions about Our processing of your personal data, you may contact Enemalta at Central Administration Building, Church Wharf, Marsa, MRS 1000, Malta or by email at [email protected] or by telephone on +356 8000 2224.
Enemalta’s Data Protection Officer may be contacted at Central Administration Offices, Church Wharf, Marsa MRS 1000, [email protected] and +356 22980583.
Please read this Privacy Notice carefully to understand Our practices with respect to your personal data as a job applicant.
1. Updates
We may update this Privacy Notice at Our sole discretion including as a result of a change in applicable law or processing activities. Any such changes will be communicated to you prior to the commencement of the relevant processing activity.
2. What amounts to personal data?
The term “personal data” refers to all information through which you can be personally identified, such as your name, surname, address and contact details.
 
3. What personal data do We collect?
We collect, use and process a range of personal data about you during the recruitment process. This includes:
• Your contact details, including the name, address, telephone number, personal mobile number and personal email address;
• Personal data included in a CV, application form, letter of application and covering letter/note/email;
• Details and copies of your qualifications;
• MQRIC Recognition Statement for qualifications if obtained from a foreign academic body or institution (when applicable);
• Third-party references;
• Verification of driving license/s (as required);
• Verification of ID card/passport/residence permit (for selected applicants);
• Copy of professional memberships (as required);
• Warrants pertaining to your profession (as required);
• Notes from meetings/interviews/emails/phone calls with you;
• Any written examination documents or tests related to the interview; and
• Information about your entitlement to work in Malta and related data pertaining to your work permit (if applicant is a non-EU citizen).
When accessing Our premises for the interview, your personal data will also be processed in line with the Privacy Notice for Visitors, available on Our website at the link:
https://www.enemalta.com.mt/uncategorised/privacy-notices/.
More data could be collected for specific situations.
We may also view, collect and/or process Special Categories of personal data which includes:
• Information about disability;
• Verification of information about criminal convictions and offences in the form of Police Conduct (this is requested from selected applicants prior to contract signing); and
• Data pertaining to your health status or other personal health information (applicable only for selected applicants who need to undertake a pre-employment medical examination prior to contract signing), unless these are disclosed by the applicant prior to this stage.

4. How do We collect your personal data?
We collect the personal information about you during the recruitment process directly from you or sometimes through third parties such an employment agency e.g. Jobsplus or recruitment companies. In the latter case, the employment agency or recruitment company may submit your contact details to Us in connection with the vacancy.
Personal data may also be collected from publicly accessible LinkedIn profiles if such a profile is likely to contain information about skills or characteristics that are relevant to any of Our vacant positions. We may also collect information from your past employers if their contact details are provided in the reference letters submitted by yourself along with the application.
 
We may also collect your personal data when We do not have open calls for which you may be eligible, but you decide to express your interest for future available positions through the Careers page on Our website. In such case, We may refer to your CV and contact you should We exhaust all steps in Our recruitment process and do not receive eligible applications. Having said that, you are always invited to keep a lookout for open vacancies which would be posted on Our website.
5. Why do We use your personal data?
Irrespective of the manner that We have collected your personal data, We will only process such data for the purpose of the recruitment process and any other purposes which are inherently related thereto, including the fulfilment of any legal obligation imposed on Us.
Typically, your personal data will be processed for:
• Us to manage the recruitment process and verify your eligibility for the vacant job;
• Us to conduct the necessary due diligence on prospective employees pursuant to the job offered and make Our shortlisting and selection; and
• Us to ensure effective and transparent HR and personnel management.
We will only view, collect and use your special categories of personal data, when the law allows Us to do so. These will typically be processed for:
• Us to assess your suitability for employment;
• Us to ascertain your fitness to work;
• Us to ensure effective and transparent HR and personnel management; and
• Us to ensure that We make reasonable adjustments for candidates who have a disability or limitation.
During the pre-employment and fitness tests by Our company doctor, you may provide your consent to this doctor to disclose to Us any specific medical data that is relevant to the duties outlined in the job description of your prospective employment.
6. What if you fail to provide personal data?
You are under no contractual obligation to provide your personal data to Us during the recruitment process. However, if you do not provide the information requested, We may not be able to process your application properly or at all.
7. Lawfulness of Processing
Irrespective of the manner that We have collected your personal data, We will only process such data for the purpose of the recruitment process and any other purposes which are inherently related thereto, including the fulfilment of any legal obligation imposed on Us.
We process your personal data on the basis of the following bases:
• Entering into and performing a contract – in particular for Us to evaluate your suitability for the job being offered and to make the shortlisting and selection process;
• Our legitimate interests – in particular particular legitimate interests which may arise directly or indirectly in relation to the recruitment process. When We process your personal data on the basis of Our or a third party’s legitimate interests, We ensure that the legitimate interests pursued are not overridden by your interests, rights and freedoms;
• Consent - when you have provided your explicit consent for medical related data or to retain your personal data beyond the legally established retention periods (for unsuccessful applicants); and
• Compliance with legal obligations imposed on Us - in particular obligations imposed on Us as a public sector company.

On the basis of Our legitimate interests or compliance with legal obligations, as applicable, We may also process your personal data for the purposes of establishing, exercising or defending legal proceedings.
8. Recipients of your personal data
The recipients of your personal data may be:
• selected individuals within Our Company, on a need to know basis for the purpose of the recruitment exercise;
• Company’s medical doctors to conduct pre-employment and fitness tests;
• Recruitment agencies when you apply for a job with Us through them; and
• Third parties to whom disclosure may be required as a result of legal obligations imposed on Us.
If your application is not successful, Enemalta plc will not share your personal information with third parties unless it was submitted by your good self, following a notification from Jobsplus or recruitment agency, when applicable.
If your application is successful, We will inform you regarding an offer of employment and at that stage, We may also share your personal information with other third parties including:
• Company’s medical doctors to conduct pre-employment and fitness tests;
• Regulator such as Jobsplus to register employment in case the job offer is accepted;
• Recruitment agencies if they were involved in the process, when applicable;
• Governmental institutions and authorities in case the job offer is accepted, as per public sector directives.
We do not share your personal data with any entity located outside of the European Union (EU) or the European Economic Area (EEA).
9. Automated Decision-Making and Profiling
Your personal data will not be used for any decision solely taken on the basis of automated decision making processes, including profiling.
10. Data Retention
We will only retain your personal information for as long as is necessary to fulfil the purposes for which it was collected and processed. If your application for employment is unsuccessful, We will hold your data on file for one (1) year, in accordance with the validity period of the recruitment selection results. As part of the application, you have the option to provide your explicit consent for Us to retain your personal data for a further two (2) years and We may contact you for future related vacancies. You can withdraw your consent earlier than the established period.
Personal information which is no longer retained will be securely and effectively destroyed or permanently erased from Our systems.
If your application for employment is successful, personal data gathered during the recruitment process will be kept in line with the Employees Privacy Notice that will be provided to you along with the contract and as per Our Human Resources Data Retention Policy.
If you decide to contact Us to express your interest in joining the Company, through Our Careers page on the website, when there are no current open vacancies, We will retain your personal information for two (2) years so that We may contact you if We exhaust all steps in Our recruitment process and do not receive eligible applications.
We may have a legitimate interest to hold your data for longer periods such as when your data is required for exercising or defending legal claims.
11. Your Rights
For as long as We retain your personal data, you have certain rights in relation to your personal data including:
• Right of access – you have the right to ascertain the personal data We hold about you and to receive a copy of such personal data;
• Right to Erasure – in certain circumstances you may request that We delete the personal data that We hold on you, where there is no good reason for Us continuing to process it. You also have the right to ask Us to delete or remove your personal information where you have exercised your right to object to processing (see below);
• Right to Object – you have a right to object and request that We cease the processing of your personal data where We rely on Our, or a third party’s, legitimate interests for processing your personal data and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where We are processing Your personal information for direct marketing purposes;
• Right to Portability – you may request that We provide you with certain personal data which you have provided to Us in a structured, commonly used and machine-readable format. Where technically feasible, you may also request that We transmit such personal data to a third party controller indicated by you;
• Right to Rectification – you have the right to update or correct any inaccurate personal data which We hold about you;
• Right to Restriction – you have the right to request that We stop using your personal data in certain circumstances including if you believe that We are unlawfully processing your personal data or the personal data that We hold about you is inaccurate;
• Right to withdraw your consent – where Our processing is based on your consent, you have the right to withdraw your consent. Withdrawal of your consent shall not affect the lawfulness of the processing based on your consent prior to the withdrawal of your consent; and
• Right to be informed of the source – where the personal data We hold about you was not provided to Us directly by you, you may also have the right to be informed of the source from which your personal data originates.
Your rights in relation to your personal data are not absolute.
If you intend to exercise one or more of your rights, you should approach Enemalta plc’s Data Protection Officer on the contact details abovementioned.
You will not have to pay a fee to access your personal data (or to exercise any of the other rights specified above). However, We may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, We may refuse to comply with your request in these circumstances.
We may need to request specific information from you to help Us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up Our response.
12. How does Enemalta plc protect your personal data?
We take pride in keeping your data secure and will take appropriate technical and organisational measures to protect your data against unauthorised or unlawful processing, including against accidental loss, destruction, storage or access. Your personal data will be stored manually or electronically on Our technology systems or on technology systems of Our IT providers and will also be processed through emails.
13. Complaints
If you have any complaints regarding Our processing of your personal data, please note that you may contact Us or Our Data Protection Officer at the details indicated above. You also have a right to lodge a complaint with the Office of the Information and Data Protection Commissioner in Malta (www.idpc.gov.mt).