Legal
Candidate privacy notice
What happens to your application, who reads it, and when it is deleted.
Provisional: this document is not approved yet
Everything below is a draft. It becomes the studio's approved position only when every administrator has signed this exact version in the client area. Until then, read it as an accurate description of what we do and intend, not as a document anybody has signed off.
Written in-house, not reviewed by a lawyer, and no Maltese entity exists yet to be a party to it. What approval means here
This is what happens to an application to the studio behind Getaway Gaming. It is a short document because the process is short: a small studio, no applicant tracking system, no recruitment agency, and the people who read your application are the people you would be working with.
If you want anything in it changed or deleted, one email does it, and you do not have to be in a process with us to ask.
What we hold
| Category | What it is |
|---|---|
| What you send us | Your name, your email address, whatever else you choose to put in the message, your CV or portfolio, and links you include. |
| What the conversation produces | Our notes from a call or an interview, any exercise you did and our assessment of it, and what was discussed about pay and start dates. |
| What we go and look at | Only what you pointed us at: a repository, a showreel, a site. We do not search for you, we do not look at your social media, and we do not buy anything about you from anybody. |
| What we never ask for | Your date of birth, your nationality, your marital status, your health, your photograph, your religion, your politics, your sexuality, your union membership, or a copy of an identity document. If you send one anyway we will ask you to send the message again without it. |
Why, and on what basis
The purpose is deciding whether to offer you a job, and then making the offer. The legal basis is article 6(1)(b) of the GDPR (taking steps at your request before entering a contract) and article 6(1)(f) for keeping a record of our own decision, which is what lets us answer a question about it later.
Where you ask us to keep your application on file after a decision, that is consent under article 6(1)(a) and you can withdraw it at any time by saying so. We will not keep it on file by default and call that consent.
Who sees it
Inside the studio: the people hiring for the role, which today is a very short list and will always be the people you would work with rather than a department.
Outside it: nobody, with two exceptions that have not arisen yet and that we will name when they do. If a recruiter ever introduces you, they are a separate controller for their own process and have their own notice. If a role ever becomes one a gaming regulator must approve personally, the probity information that process needs goes to that regulator. We would tell you before it did, as part of offering you the role.
Your application is held in the studio's own email and file storage in the European Union. It is not uploaded to an applicant tracking system, because we do not run one, and it is not put into any tool that scores or ranks candidates.
Nothing about it is automated
No part of the decision is automated. We do not screen CVs with software, we do not score them with a model, we do not rank applicants, and we do not use an AI tool to filter, shortlist, assess or interview anybody. A person reads what you sent.
That is a deliberate position. Automated recruitment screening is one of the uses Annex III of the EU's AI Act classifies as high-risk, with obligations attached, and a studio that will not use an AI model to pick a paytable is not going to use one to pick people.
How long we keep it
If we do not offer you the job: six months after the decision, and then it is deleted. That covers your CV, our notes, the exercise and the correspondence. Six months because that is long enough for a second role to open and for you to ask us why, and short enough that we are not sitting on files of people who have moved on.
If you ask us to keep it on file for longer, we keep it for a year and then ask you again rather than renewing it silently.
If you join us: what is relevant to employment moves into your employee record and is governed by the employee notice you get on your first day. The rest of the application is deleted on the same six-month clock.
What you can ask for
You can ask what we hold, ask for it to be corrected, ask for it to be deleted, ask for a copy, and object to our keeping a record of the decision. Asking will not count against you in any process, now or later, and we will answer within a month.
One thing we will usually refuse, and the reason: interview notes often say something about another person, such as the interviewer's own view or a comparison with another candidate. In a copy you request we redact what is about somebody else and give you the rest, which is what article 15(4) requires.
There is no HR department to go to
A notice like this normally points at hr@ and an internal process. We are small enough that both would be a fiction: the address below is the studio's one inbox, a person reads it, and for a privacy request about an application that person is the one who read the application.
Contact
Write to hello@getawaygaming.com. You can also complain to Malta's Information and Data Protection Commissioner, or to the authority where you live, without asking us first.
Provisional until every administrator has approved this version. Written in-house, not reviewed by a lawyer, and no Maltese entity exists yet to be a party to it.