This Privacy Notice sets out the way in which Mediterranean Coastal Airlines Ltd. registered in Malta with registration number C93233 (“MCA”, “we» or «us»), collects and processes Personal data relating to job applicants, as well as the steps we take to protect such information. We take data privacy seriously and are committed to managing your personal data professionally and in compliance with the General Data Protection Regulation 2016/679, the Maltese Data Protection Act (Chapter 586, Laws of Malta) and any subsidiary legislation and guidelines (“Applicable Law”).

1. Introduction
   1. As part of any recruitment process, MCA collects and processes personal data relating to job applicants. MCA is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations.
   2. This privacy notice is based on the following data protection principles:
      • The processing of personal data shall take place in a lawful, fair and transparent way;
      • The collection of personal data shall only be performed for specified, explicit and legitimate purposes and will not be further processed in a manner that is incompatible with those purposes;
      • The collection of personal data shall be adequate, relevant and limited to what is necessary in relation to the purpose for which they are processed;
      • The personal data shall be accurate and where necessary, kept up to date;
      • Every reasonable step shall be taken to ensure that personal data that is inaccurate having regard to the purposes for which they are processed, are erased or rectified without delay;
      • Personal data shall be kept in a form which permits identification of the data subject for no longer than it is necessary for the purpose for which the personal data are processed;
      • All personal data shall be kept confidential and stored in a manner that ensures appropriate security.
   3. By submitting your personal data, you shall:
      • Declare that you have read and understood this Privacy Notice;
      • Declare that the information given is complete and true to the best of your knowledge, and understand that incorrect statements could lead to your application being rejected;
      • Declare that consent was obtained from any third party whose details are included in the information provided;
      • Authorise us to verify statements contained in your application and to make any necessary checks.
2. What information do we collect?
   1. MCA may collect the following information:
      • Your name, date of birth, address and contact details: including email address and phone number and nationality;
      • Your Application forms or Curriculum Vitae including details of your qualifications, skills, experience and employment history;
      • Referral source, names and contact details for references. Please note that it is the applicant’s responsibility to obtain consent from his/her references prior to providing us personal information about them;
      • Photographs if included on CVs or otherwise on supplementary document submitted as part of the recruitment process;
      • Whether or not you have a disability for which MCA needs to make reasonable adjustments during the recruitment process. The legal basis we rely on when processing special category data, is Article 9(2)(b) of the GDPR, which also relates to our obligations in employment and the safeguarding of your fundamental rights, and article 9(2)(h) for assessing your work capacity as an employee and making reasonable adjustments if necessary;
      • Police conduct certificate and information about criminal convictions and offences (where the nature of the job requires this). In particular a police conduct certificate will be needed by law for all flight crew personnel, and also for office personnel that needs to access MCA headquarters, at Malta International Airport;
      • Employment History from Jobsplus
      • Information about your entitlement to work in Malta.
   2. We may collect this information in a variety of ways. From you, from third parties for example internal sources acting as referees or recruitment agencies, or public sources as needed to support the recruitment process, for example when conducting background or reference checks. We shall carry out checks, subject to your consent where required by law. We may refer to your Social Media profiles for recruitment purposes.
   3. The information will be stored in a range of different locations managed by us directly, including human resources management systems and other business applications.
3. Why does MCA process personal data?
   1. The legal basis for processing your personal data is based on Article 6(1)(c) of the Regulation whereby we ensure to comply with our legal obligations in relation to Employment, Anti-discrimination, and Data Protection laws.
   2. MCA has a legitimate interest in processing personal data during the recruitment process and for keeping records of the process as per Article 6(1)(f) of the Regulation. Processing data from job applicants allows us to manage the recruitment process, assess and confirm a candidate’s suitability for employment and decide whom to offer a job. We may also need to process data from job applicants in the exercise and defence of legal claims.
   3. We also may rely on Article 6(1)(b) of the GDPR for processing your personal data which relates to the necessary processing to perform a contract or to take steps at your request, before entering into a contract. This same basis will also be relied upon for any contractual agreement we may have in place with recruitment agencies through which you would have submitted your application.
   4. We also may process your personal data on the basis of Article 6(1)(a) of the GDPR which relates to consent. In certain instances, due to the nature of the processing operations, we shall only process such personal data upon obtaining consent for one or more specific purposes.
4. Who has access to your data?
   1. Your information may be shared internally for the purposes of the recruitment exercise. This includes members of the human resources department, interviewers, head of departments on the respective business areas.
   2. We use Microsoft Office 365, which means that data processed during the use of any of the Microsoft applications, including Outlook (for email), may be backed up ‘in the cloud’. This service is GDPR compliant. Please see the following link for more information:
      
      https://www.microsoft.com/en-us/TrustCenter/Privacy/gdpr/default.aspx
      
      
   3. Most of our IT administration is carried out by SHB Technologie. IT administration do not usually have access to your personal data.
   4. If you directly provide your information to authorised recruitment agencies, they shall technically have access to your personal data in the course of providing their services, however, will be contractually restricted from processing your personal data for other purposes. MCA shall ensure they use appropriate security measures to protect your personal data in accordance with the contractual obligations between us and them.
   5. We may disclose your personal data to third-party entities under the following scenarios:
      • To comply with our legal obligations or contracts, or to respond to a court order, administrative or judicial process, such as a subpoena or search warrant;
      • In response to lawful requests by public authorities (such as national security or law enforcement);
      • As necessary to establish, exercise or defend against potential, threatened or actual litigation;
      • Where necessary to protect MCA’s, your, or those interests of any other person; or
      • In connection with the sale, assignment or other transfer of all or part of our services to the interested party.
   6. We have data processing agreements in place with third parties with whom we share personal data. If we need to send data outside the EEA, we will ensure that we have appropriate legal and security relationships with these parties and have taken steps to ensure that they are complying with the General Data Protection Regulation, including, as necessary, execution of contracts based on the European Union’s Standard Contractual Clauses for cross-border data transfers.
   7.  We shall not share your data with third parties that are unrelated to the recruitment process unless we request and obtain your explicit consent.
5. How does MCA protect data?
   1. We take the security of your data seriously. We have controls and internal policies in place to protect your data against loss, misuse and unauthorised access, alteration, disclosure, or destruction. Moreover, all efforts are being taken to ensure the ongoing confidentiality, integrity, availability, and resilience of systems and services processing personal information.
   2. If we learn of a security systems breach, we will inform you of the occurrence of the breach in accordance with applicable law.
6. For how long does MCA keep data?
   1. If your application for employment is unsuccessful, we will hold your data on file for 6 months after the end of the relevant recruitment process in case we face a legal challenge in respect of a recruitment decision, this in line with the Employment and Industrial Relations Act (Chapter 452 of the Laws of Malta). You are free to withdraw your consent at any time. At the end of that period or once you withdraw your consent (whichever occurs first), your data shall be securely purged.
   2. If your application for employment is successful, the personal data gathered during the recruitment process will be retained throughout the duration of your employment. Once your on-boarding is completed, you will be able to access our Data Retention Policy which defines the retention periods for your data.
7. Your rights
   1. We respect your privacy rights and provide you with reasonable access to the Personal Data that you may have provided during the recruitment process. As a data subject you have the following rights:
      • The right for information;
      • The right to access;
      • The right to rectification;
      • The right to erasure;
      • The right to restrict processing;
      • The right to object;
      • The right to data portability;
      • The right to complain to the Information & Data Protection Commissioner through this link:  https://idpc.org.mt/en/Pages/contact/complaints.aspx
      • The right to withdraw consent.
   2. If you would like to exercise any of these rights such as accessing, amending or requesting deletion of any information about you, please contact MCA. We will respond to these requests within a month, with the possibility to extend this period for particularly complex requests in accordance with Applicable Law.
8. What if you do not provide personal data?
   1. You are under no statutory or contractual obligation to provide data to MCA during the recruitment process. However, if you do not provide the information, we may not be able to process your application properly in part or in full.
9. Contact us
   1. Any matters relating to the recruitment process can be forwarded to the following address: hr@mc-air.eu
10. Changes to this Privacy Notice
    1. Please note that this Privacy Notice may change from time to time. If we change this Notice in ways that affect how we use your personal information, we will advise you of the choices you may have as a result of those changes.