prohealth_logo_iconprohealth_min_logo
Good afternoon, it's Friday 28th August 2026

Recruitment Privacy Notice

Whether you are a candidate interested in sharing your CV with us or applying for a specific job, you should read and understand this document detailing Prohealth’s recruitment process and how all candidates’ data is processed by us.

This Privacy Notice (the “Notice”) explains how Prohealth Limited (the “Company”, “We”, or “Us”) collects and processes candidate’s personal data, who apply for employment or engagement with us.

We are committed to processing personal data in accordance with the Applicable Data Protection Laws as defined in the ‘Applicable Laws’ section below.

1. Scope and Purpose

 This Notice applies to all individuals applying for any roles and/or positions within the Company.

It explains how Prohealth collects, use and processes your personal data, as well as the purposes for which such data are processed. The Notice also outlines your rights under the applicable Data Protection Laws and provides information on the measures we implement to safeguard the confidentiality and security of personal data throughout our recruitment process.

Although our goal is to always be as clear and transparent as possible, we appreciate that legal documents can sometimes be difficult to read. However, we strongly encourage you to read this Notice with care. Please do not hold back from contacting us for any clarification you may need. For example, if you need clarification on a specific legal basis we are relying on to process your Personal Data, we would be happy to provide you with any such information you may need.

2. Definitions 

Unless otherwise defined in this Notice, the terms “Personal Data”, “Automated Decision-Making”, “Data Controller”, “Profiling”, “Processing” and “Special Categories of Personal Data” shall have the meanings assigned to them under the Applicable Data Protection Laws as defined hereunder.

3. Applicable Laws

As an entity established in Malta, EU, the main privacy laws that are applicable to Prohealth Ltd in so far as you are concerned, are as follows:

  • The Maltese Data Protection Act (Chapter 586 of the Laws of Malta) as well as the various subsidiary legislation issued under the same – the ‘Act’;
  • The Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regards to the processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) – the ‘GDPR’.

All the above, as may be amended from time to time, referred to together as the “Applicable Data Protection Laws”

4. Data Controller and Contact Details

 The Data Controller of Your Personal Data is:

PROHEALTH LIMITED (C 18246)
MDINA ROAD,
ZEBBUG
ZBG 9019
MALTA

If you have any questions regarding this notice or the processing of your Personal Data, you may contact the Company’s Data Protection Officer at dpo@prohealth.com.mt.

5. From Where Do We Collect Your Personal Data?

We collect Personal Data relating to you from a variety of sources in the context of our recruitment process, including:

  • Directly from you, for example where you submit an application, provide your CV, and/or communicate with us during the recruitment process;
  • From recruitment agencies or other intermediaries that may have referred your application to us;
  • From publicly available sources, such as professional networking sites (e.g. LinkedIn), to the extent relevant and permitted by applicable law; and
  • From referees, where you have provided us with details of referees and/or authorised us to obtain references.

We will only collect Your personal data from third-party sources where lawful to do so and, where required, we will inform you accordingly.

6. What Personal Data Do We Collect?

In the context of our recruitment process, we may collect and process the following categories of Personal Data relating to you as a prospective employee and/or candidate for any role and/or position within Prohealth Ltd:

  • Identification and contact details: such as your name, surname, date of birth, address, email address, mobile number, and telephone number;
  • Professional and employment information: including your CV, employment history, qualifications, skills, professional memberships, and references;
  • Application-related information: such as cover letters, interview notes, assessments, and communications with you;
  • Eligibility and work documentation: where applicable, including work permits, proof of identity, and eligibility to work;
  • Background or screening information: where relevant and permitted by applicable law; and
  • Any other information: you choose to provide to us during the recruitment process and/or other information available to us from the sources explained in the last preceding Clause above.

In limited circumstances, we may also process Special Categories of Personal Data (such as health-related information) where necessary for the purposes of complying with applicable legal obligations or exercising specific rights in the field of employment law, and always in accordance with Applicable Data Protection Laws.

7. How Do We Use Your Personal Data?

We process Your Personal Data for the following purposes based on the appropriate lawful bases which are outlined together with their respective data categories and purposes in the table below:

Personal Data Category Purpose(s) for Processing Legal Basis
Identification details (name, surname, address, date of birth). Identify you; assess your application; create candidate record; schedule interviews; prepare an offer. Article 6(1)(b): Processing is necessary to take steps prior to entering into a contract.
Contact details (email, mobile, telephone). Communicate about roles, interviews, assessments, outcomes; request information. Article 6(1)(b): Processing is necessary to take steps prior to entering into a contract.
Professional and employment information (CV, employment history, qualifications, skills, professional memberships and references). Evaluate suitability; verify qualifications/experience; determine appropriate role and package. Article 6(1)(b): Processing is necessary to take steps prior to entering into a contract.
Article 6(1)(f): Our legitimate interests to select qualified candidates.
Eligibility and work documentation (work permits, proof of identity and eligibility to work). Right-to-work and identity verification; role-specific eligibility. Article 6(1)(b): Processing is necessary to take steps prior to entering into a contract.
Article 6(1)(c): Compliance with legal obligations (immigration/employment rules).
Article 6(1)(f): Our legitimate interests to ensure candidate eligibility.
Background or screening information. Role-appropriate vetting, e.g. identity, qualifications, adverse media and, where applicable, aviation/security checks. Article 6(1)(f): Our legitimate interests to safeguard the business and safety.
Article 6(1)(c): Compliance with our legal obligations where such processing is mandated at law.
Health-related data. Assess role fitness and competencies; determine fitness for safety-sensitive roles; occupational health clearance, where required. Article 6(1)(f): Our legitimate interests to ensure a fair and effective selection.
Article 9(2)(h): To assess working capacity of the candidate, where special category data are involved.

8. To Whom Do We Disclose Your Personal Data?

We may share your Personal Data with the following categories of recipients, where necessary for the purposes of managing the recruitment process:

  • Internal personnel within the Company: authorised personnel involved in the recruitment process, including HR, Hiring Managers, and relevant administrative staff;
  • Service providers: third party service providers who support our recruitment process, including recruitment agencies, IT service providers (including Cloud Service Providers), Legal Advisors, and HR service providers;
  • Any court, tribunal, law enforcement bodies, regulators or public authorities: where we are required to disclose Your Personal Data to comply with applicable legal or regulatory obligations and/or pursuant to a valid request or order.

Where we engage third-party service providers, we ensure that they process your Personal Data only on our documented instructions and subject to appropriate confidentiality and security obligations.

We will only share your Personal Data where necessary, proportionate, and in accordance with applicable Data Protection Laws.

Your Personal Data will never be shared with third parties for their marketing purposes (unless you give your consent thereto).

9. International Transfers

We do not transfer your personal data outside the European Union (EU) or the European Economic Area (EEA).

Should this position change in the future, we will ensure that any such transfers are carried out in accordance with applicable Data Protection Laws and that appropriate safeguards are implemented to protect your Personal Data.

10. Data Retention

We will retain your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, including managing the recruitment process. If your application is successful and you are offered and accept employment with us, your Personal Data will be retained in accordance with our Employee Privacy Notice, which will be made available to you at the relevant time.

If your application is unsuccessful, we will not retain your Personal Data beyond the conclusion of the recruitment process, unless you have provided your consent for us to retain your personal data for a longer period. Where you provide your consent (by opting in via the tick box below and/or in the appropriate section on our website(s)), we will retain your CV and related application information for a period of up to one (1) year from the date of your application, for the purpose of considering you for future employment opportunities that may be of interest to you.

You may withdraw your consent at any time, in which case we will delete your personal data unless we are required to retain it for legal or regulatory purposes.

Where your Personal Data are no longer required by us, we will either securely delete or anonymise the Personal Data in question.

11. How We Protect Your Personal Data

 The Personal Data we may hold (and/or transfer to any abovementioned recipients as the case may be) will be held securely in accordance with our internal Security Policy and applicable Data Protection Laws.

We use reasonable efforts to safeguard the confidentiality of any and/or all Personal Data that we may process relating to you and regularly review and enhance our technical, physical and managerial procedures so as to ensure that your Personal Data are protected from:

  • Unauthorised access
  • Improper use or disclosure
  • Unauthorised modification
  • Unlawful destruction or accidental loss.

To this end we have implemented security policies, rules and technical and organisational measures to protect the Personal Data that we may have under our control. All our members, staff and data processors (including service providers established within the European Union), who may have access to and are associated with the processing of Personal Data, are further obliged (under contract) to respect the confidentiality of our candidates’ Personal Data as well as other obligations as imposed by the applicable Data Protection Laws.

Despite all the above, we cannot guarantee that a data transmission or a storage system can ever be 100% secure. For more information about our security measures please contact the Company’s Data Protection Officer at dpo@prohealth.com.mt.

Authorised third parties, and external/third party service providers, with permitted access to your information (as explained in this Notice) are specifically required to apply appropriate technical and organisational security measures that may be necessary to safeguard the Personal Data being processed from unauthorised or accidental disclosure, loss or destruction, and from any unlawful forms of processing.

As stated above, the said service providers (our Data Processors) are also bound by a number of other obligations in line with the applicable Data Protection Laws (particularly, Article 28 of the GDPR).

12. Your Rights under the Applicable Data Protection Laws

Before addressing any request you make with us, we may first need to verify your identity. In all cases we will try to act on your requests as soon as reasonably possible.

Your various rights at law include:

Your Right of Access 

You may, at any time request us to confirm whether or not we are processing Personal Data that concerns you and, if we are, you shall have the right to access those Personal Data and to the following information:

  • What Personal Data we have,
  • Why we process them,
  • Who we disclose them to,
  • How long we intend on keeping them for (where possible),
  • Whether we transfer them abroad and the safeguards we take to protect them,
  • What your rights are,
  • How you can make a complaint,
  • Where we got your Personal Data from, and
  • Whether we have carried out any automated decision-making (including profiling) as well as related information.

Upon request, we shall (without adversely affecting the rights and freedoms of others including our own) provide you with a copy of the Personal Data undergoing processing within one month of receipt of the request, which period may be extended by two months where necessary, taking into account the complexity and number of the requests. We shall inform you of any such extension within one month of receipt of the request, together with the reasons for the delay.

Your Right to Rectification

You have the right to ask us to rectify inaccurate Personal Data and to complete incomplete Personal Data concerning you. We may seek to verify the accuracy of the data before rectifying it.

Your Right to Erasure (The Right to be Forgotten)

You have the right to ask us to delete your Personal Data and we shall comply without undue delay but only where:

  • The Personal Data are no longer necessary for the purposes for which they were collected; or
  • You have withdrawn your consent (in those instances where we process on the basis of your consent) and we have no other legal ground to process your Personal Data; or
  • You shall have successfully exercised your right to object (as explained below); or
  • Your Personal Data shall have been processed unlawfully; or
  • There exists a legal obligation to which we are subject.

In any case, we shall not be legally bound to comply with your erasure request if the processing of your Personal Data is necessary:

  • for compliance with a legal obligation to which we are subject (including but not limited to our data retention obligations); or
  • for the establishment, exercise, or defence of legal claims.

There are other legal grounds entitling us to refuse erasure requests although the two instances above are the most likely grounds that may be invoked by us to deny such requests.

Your Right to Data Restriction

You have the right to ask us to restrict (store but not further process) your Personal Data where:

  • The accuracy of your Personal Data is contested (as per data rectification right above), for a period enabling us to verify the accuracy of the Personal Data; or
  • The processing is unlawful and you oppose the erasure of your Personal Data; or
  • We no longer need the Personal Data for the purposes for which they were collected but you need the Personal Data for the establishment, exercise, or defence of legal claims; or
  • You exercised your right to object and verification of our legitimate grounds to override your objection is pending.

Following your request for restriction, except for storing your Personal Data, we may only process your Personal Data:

  • Where we have your consent; or
  • For the establishment, exercise, or defence of legal claims; or
  • For the protection of the rights of another natural or legal person; or
  • For reasons of important public interest.

Your Right to Data Portability

You have the right to ask us to provide your Personal Data (that you shall have provided to us) to you in a structured, commonly used, machine-readable format, or (where technically feasible) to have it ‘ported’ directly to another data controller, provided this does not adversely affect the rights and freedoms of others. This right shall only apply where:

  • The processing is based on your consent or on the performance of a contract with you; and
  • The processing is carried out by automated means.

Your Right to Withdraw Consent (when we rely on consent)

In those cases where we process your Personal Data on the basis of your consent (such as, when you consent to the retention period indicated in the tick box below) ), you have the right to withdraw your consent at any time by writing to us at the physical or email address found in Clause 4, Data Controller and Contact Details, of this Notice.

Your Right to Object to Certain Processing

In those cases where we only process your Personal Data when this is 1) necessary for the performance of a task carried out in the public interest or 2) when processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, you shall have the right to object to processing of your Personal Data by us. Where an objection is entered, the processing of data shall cease, unless we as data controller provide compelling and legitimate grounds requiring the continuation of the data processing which outweigh the objections you may have raised.

For the avoidance of all doubt, when we process your Personal Data when this is necessary for the performance of a contract, when necessary for compliance with a legal obligation to which we are subject or when processing is necessary to protect your vital interests or those of another natural person, this general right to object shall not subsist.

13. Complaints

If you are unsatisfied with the way we have handled your Personal Data or any privacy query or request that you have raised with us, you also have the right to lodge a complaint with the competent Supervisory Authority. The Maltese Information and Data Protection Commissioner (IDPC) is the competent Supervisory Authority in Malta (www.idpc.gov.mt).

We kindly ask that you please attempt to resolve any issues you may have with us first (even though, as stated above, you have a right to contact the competent authority at any time).

14. Failure to Provide Data

Providing Personal Data during the recruitment process is generally voluntary. However, failure to provide information necessary to assess your application may result in the Company being unable to proceed with your application and/or offering you the role/position in question.

15. Automated Decision-Making

Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. The Company does not currently make or rely on any decisions taken solely by automated means (in other words, without significant human intervention) about job applicants.

16. Internet Communications

You will be aware that data sent via the Internet may be transmitted across international borders even where sender and receiver of information are located in the same country. We cannot be held responsible for anything done or omitted to be done by you or any third party in connection with any Personal Data prior to our receiving it including but not limited to any transfers of Personal Data from you to us via a country having a lower level of data protection than that in place in the European Union, and this, by any technological means whatsoever (for example, WhatsApp, Facebook Messenger, LinkedIn, Dropbox etc.).

Moreover, we shall accept no responsibility or liability whatsoever for the security of your data while in transit through the Internet unless our responsibility results explicitly from a law having effect in Malta.

17. Accuracy Of Personal Data 

All reasonable efforts are made to keep any Personal Data we may hold about you up-to-date and as accurate as possible.

You can check the information that we hold about you at any time by contacting us in the manner explained below.

If You find any inaccuracies and/or wish to add new information (for example, to your CV), we will correct them and where required, delete them as necessary. Please see Clause 12, Your Right to Data Restriction, above for a detailed list of your legal rights in terms of any applicable data protection law.

18. Updates to this Notice

We may update this Candidate Privacy Notice from time to time. Where relevant changes occur during the recruitment process involving you, we will take reasonable steps to inform you thereof.

Personal Data Retention Consent:

The candidate hereby consents to PROHEALTH LIMITED storing the candidate’s CV, contact details and related Personal Data as indicated above for a period of 1 year, for the sole purpose of contacting the candidate in the future in the event that the candidate is not recruited at this stage.

LAST UPDATED: 1st July 2026.