CANDIDATE PRIVACY NOTICE
Last updated: 5 August 2026
This Notice explains how RedPlay Limited collects and uses personal data about job applicants, prospective contractors and other individuals who take part in our recruitment processes.
Who we are and when this Notice applies
RedPlay Limited ("RedPlay", "we", "us" or "our") is a company incorporated in the Isle of Man, with its registered office at Suite 13B, The Engine House, Alexandra Road, Castletown, Isle of Man, IM9 1TG.
For recruitment by RedPlay, RedPlay is the controller of your personal data. We process personal data in accordance with the Data Protection Act 2018, the Data Protection (Application of GDPR) Order 2018, and the GDPR and LED Implementing Regulations 2018, in each case as amended (together, the "Manx Data Protection Law"). The GDPR as applied in the Isle of Man is referred to in this Notice as the "Applied GDPR". Where the EU GDPR, UK GDPR or another local data protection law also applies, we will comply with those requirements as well.
This Notice applies whether you apply directly, are approached by us, are referred by an employee or contact, or are introduced by a recruitment agency. An agency processes your information under its own privacy notice before sharing it with us. Once RedPlay receives the information, this Notice applies to RedPlay's processing.
If a vacancy is for another group company, or another group company materially participates in deciding your application, we will identify that company and explain whether it acts as a separate or joint controller.
Personal data we collect
Depending on the role, location and stage of recruitment, we may collect:
identity and contact details, including your name, address, email address, telephone number, date of birth, nationality, photograph, and identification-document details;
application and professional information, including your CV, cover letter, employment and education history, qualifications, certifications, skills, professional memberships, portfolio, salary or fee expectations, notice period and professional-profile information;
recruitment and assessment information, including correspondence, interview notes, test results, work samples, feedback, availability, preferred location and the reasons recorded for recruitment decisions;
information needed to enter into an employment or services relationship, including right-to-work or immigration information, tax residence, proposed engagement terms and, at the appropriate stage, payment details;
references and verification information obtained from referees, former employers, educational bodies or professional bodies;
role-specific screening information, which may include identity, employment and education verification, directorships and corporate interests, conflicts of interest, sanctions and politically exposed person screening, adverse media, litigation, insolvency, credit or financial information, criminal-record information and other role-relevant information;
audio or video recordings, transcripts, AI-generated summaries and suggested feedback where we use interview-recording or AI notetaking functionality and you have consented; and
special category data where necessary and lawful, for example health or disability information needed to make reasonable adjustments, or diversity information collected separately for equal-opportunity monitoring.
We do not intentionally collect information about political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation, genetic data, or private family and lifestyle matters for recruitment decisions unless the information is genuinely necessary for a lawful purpose and we have told you why it is needed. If you volunteer information that is not relevant to recruitment, we may delete or disregard it.
How we obtain personal data
We obtain personal data:
directly from you, including through application forms, your CV, interviews, assessments and correspondence;
from recruitment agencies, referral sources and RedPlay personnel involved in recruitment;
from referees, current or former employers, educational institutions and professional bodies, normally after we have informed you;
from screening, identity-verification, credit-reference or due-diligence providers engaged for a particular role;
from publicly accessible sources, including professional networking sites, company and professional registers, court or insolvency records, sanctions and PEP lists, public websites and reputable media sources; and
from recruitment technology, video-conferencing and interview-support providers, including Ashby where used.
When we obtain your personal data from a source other than you, the source may be publicly accessible. We will not seek access to private social-media accounts or use deception to obtain information.
Why we use personal data and our legal bases
We use personal data only where we have a lawful basis. More than one basis may apply to the same activity, depending on the role and circumstances.
| Activity | Legal basis | Purpose and safeguards |
| Manage applications and recruitment | Applied GDPR Art. 6(1)(b); where relevant, Art. 6(1)(f) | To receive applications, communicate with you, arrange interviews, assess suitability, make and document decisions, and take steps at your request before entering an employment or services contract. Our legitimate interests include operating a fair and effective recruitment process and workforce planning. |
| Identify and approach potential candidates | Art. 6(1)(f) | Our legitimate interest in identifying people who may be suitable for genuine vacancies. You may object to further contact. |
| Assessments, references and verification | Art. 6(1)(b) and/or Art. 6(1)(f) | To assess skills and suitability, verify information you provide, protect the integrity of recruitment and reduce the risk of misrepresentation. |
| Identity, right-to-work, sanctions, fit-and-proper and regulatory checks | Art. 6(1)(c) where required; otherwise Art. 6(1)(f) | To comply with employment, immigration, gambling, sanctions, financial-crime and other legal or regulatory duties, and to protect RedPlay, its systems, people, customers and licence. |
| Proportionate background and open-source checks | Art. 6(1)(f) | To verify relevant information and assess role-specific integrity, security, conflict, financial or reputational risks. We balance these interests against your rights and limit the scope to what is relevant to the role. |
| Credit or financial checks | Art. 6(1)(f), and Art. 6(1)(c) where legally required | Used only where proportionate for roles involving material financial authority, assets or regulated responsibilities, and where permitted by applicable law. |
| Interview recording and AI-generated transcripts, summaries or suggested feedback | Art. 6(1)(a) - consent | We ask for active, informed consent before enabling these functions. Declining or withdrawing consent will not disadvantage your application; an alternative without recording or AI notetaking will be available. |
| Reasonable adjustments and employment-law obligations | Art. 6(1)(b) and/or (c); Art. 9(2)(b) where special category data is involved | To arrange necessary adjustments, assess working arrangements and comply with rights or obligations under employment, equality and social-protection law. |
| Equal-opportunity monitoring | Art. 6(1)(f) or consent; Art. 9(2)(g) and Schedule 2 where applicable | Optional information is kept separate from selection decisions and used to monitor or promote equality of opportunity. We will explain the basis and safeguards when collecting it. |
| Recordkeeping, audits, disputes and legal claims | Art. 6(1)(c) and/or Art. 6(1)(f); Art. 9(2)(f) where applicable | To meet legal and regulatory obligations, demonstrate compliance, respond to complaints, and establish, exercise or defend legal claims. |
| Future vacancies | Art. 6(1)(a) - consent | If we want to retain your profile in a talent pool after the relevant recruitment process, we will ask for separate consent and tell you the retention period. |
Special category and criminal-record data
Special category data is processed only when an Article 9 condition applies and any condition required by Manx law is met. Depending on the circumstances, this may include explicit consent; the need to carry out rights or obligations in employment, equality or social-protection law; the establishment, exercise or defence of legal claims; or substantial public-interest grounds supported by Schedule 2 to the GDPR and LED Implementing Regulations 2018.
Personal data relating to criminal convictions, offences or related security measures is not checked routinely. It is processed only where the nature of the role, a legal or regulatory requirement, or a properly assessed risk makes the check necessary and proportionate. In addition to an Article 6 basis, RedPlay will rely on Article 10 of the Applied GDPR and an applicable condition in Part 2 or Part 3 of Schedule 2 to the GDPR and LED Implementing Regulations 2018. Where consent is the applicable Schedule 2 condition, we will request it before the check.
We do not maintain a comprehensive register of criminal convictions. A certificate or full report will be access-restricted and deleted as described in the retention section, unless a longer period is required by law.
Background screening
Background checks are not a standard step for every candidate. Before a check, we will tell you the nature and scope of the screening applicable to the role. The scope is determined by factors such as seniority, regulatory status, decision-making authority, financial responsibility, access to systems or sensitive information, and the security and integrity risks associated with the role.
A specialist provider may conduct the check on our instructions and report relevant findings to RedPlay. Checks may draw on information you provide, public records, professional sources, reputable media, commercial databases and other lawfully accessible sources. Public social-media or online information is reviewed only where it is relevant to professional conduct or a genuine role-related risk. We do not use background screening to investigate private lifestyle matters unrelated to the role.
No adverse decision will be made solely because a provider identifies an unverified concern. RedPlay will review material findings, consider their relevance, reliability and context, and where appropriate give you a reasonable opportunity to explain or correct the information before a final decision is made.
Video interviews and Ashby AI Notetaker
We may use Ashby, Inc. ("Ashby") as our applicant-tracking system and, for some interviews, its recording and AI Notetaker functions. Ashby acts as a processor on RedPlay's instructions and may use approved subprocessors, including third-party AI services, to provide the functionality.
If these functions are proposed:
we will tell you before recording or AI notetaking starts and ask for active consent; where recording and AI processing can be enabled separately, the choices will be presented separately;
you may decline or withdraw consent without any negative effect on your application, and the interview will proceed without the declined functionality, with manual notes used where appropriate;
the recording may be used by authorised members of the recruitment team and relevant hiring managers to review the interview and support a fair and consistent assessment;
the AI Notetaker may create a transcript, summary and suggested feedback, but its output is only decision-support material and must be reviewed by a human;
we do not use the tool for emotion or sentiment analysis, psychometric profiling, biometric identification, or an automated decision about your suitability;
neither RedPlay nor, under the applicable provider terms, Ashby or its third-party AI services may use interview content to train machine-learning models; and
access is restricted, and recordings, transcripts, summaries and suggested feedback are normally deleted within 90 days of the interview unless a legal hold or another stated legal requirement applies.
Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. After a valid withdrawal request, we will stop the consent-based processing and delete the relevant material unless another legal basis requires limited retention.
Automated decision-making
RedPlay does not make recruitment decisions based solely on automated processing that produces legal effects or similarly significantly affects you. Technology may help organise information, generate summaries, compare responses against predefined criteria or flag items for review, but a human recruiter or hiring manager assesses the information and makes the decision. If this changes for a particular process, we will provide the information required by law before using that process.
Who receives personal data
Where necessary for the purposes described above, we may share personal data with:
authorised members of RedPlay's People & Culture, recruitment, legal, compliance, finance, information-security and management teams, and the hiring team for the relevant role;
other group companies involved in recruitment or the proposed engagement, subject to need-to-know access and appropriate arrangements;
recruitment agencies and referral partners, which generally act as independent controllers for their own processing;
processors such as applicant-tracking, hosting, communications, assessment, interview-support, screening, identity-verification and document-management providers;
professional advisers, auditors, insurers and prospective transaction counterparties where disclosure is necessary and appropriately protected; and
the Isle of Man Gambling Supervision Commission, courts, law-enforcement bodies, government authorities or other regulators where required by law, necessary for regulatory cooperation, or necessary to establish, exercise or defend legal rights.
Access is limited to those who need the information for recruitment, legal, regulatory or related business purposes. We do not sell candidate personal data and do not use it for unrelated direct marketing.
International transfers
RedPlay recruits internationally and some group companies, personnel and service providers may process personal data outside the Isle of Man. The laws of a destination country may not provide the same level of protection.
Where Manx Data Protection Law requires a transfer mechanism, we rely on an applicable adequacy decision or put appropriate safeguards in place, such as standard data protection clauses recognised under applicable law, binding corporate rules or another permitted mechanism. We assess transfer risks and use supplementary contractual, technical or organisational measures where appropriate. You may contact the DPO for information about the relevant safeguards and, where available, a copy subject to lawful redactions.
Data security
We use proportionate technical and organisational measures designed to protect candidate personal data against unauthorised or unlawful processing and accidental loss, destruction, alteration or disclosure. These measures include need-to-know access controls, confidentiality obligations, secure systems and transfer methods, logging and monitoring, vendor due diligence, retention controls, and incident-response procedures.
How long we retain personal data
The periods below are our general retention rules. A shorter or longer period may apply where required by local law, a regulator, a legal hold, an investigation or a specific and documented business need.
| Data | General period | Reason |
| Application and interview material - unsuccessful candidates | 12 months after notice of the outcome | Recruitment administration, process review, complaints and the establishment, exercise or defence of legal claims. |
| Successful candidates | Transferred to the relevant personnel or contractor file | Thereafter retained under the applicable workforce privacy notice and retention schedule. Material not needed for the engagement is deleted. |
| Talent-pool records for future vacancies | Up to 24 months from consent, or the shorter period stated when consent is requested | Deleted earlier if consent is withdrawn; renewed consent is sought if RedPlay wishes to retain the profile longer. |
| Full background-screening reports and supporting documents | Until the decision and any verification or review are complete; normally no longer than 90 days after the decision | The minimum outcome record (for example, cleared, not cleared or escalated) may remain with the application file. |
| Criminal-record certificates | Not retained after verification unless retention is legally required | RedPlay normally records only the fact and date of the check and the outcome. |
| Video recordings, transcripts, AI summaries and suggested feedback | 90 days from the interview | Short review period for recruitment assessment and procedural consistency. |
| Consent records | For the processing period and 3 years afterwards | To demonstrate and administer consent, withdrawal and related rights. |
When personal data is no longer required, we delete it or irreversibly anonymise it. We may keep information that has been genuinely anonymised for statistical and recruitment-improvement purposes because it no longer identifies you.
Information you need to provide
You decide whether to apply and whether to provide optional information. Certain information is necessary to assess your application, verify your identity or eligibility, comply with a legal or regulatory duty, or prepare the proposed contract. We will identify mandatory information where practicable. If you do not provide it, we may be unable to assess your application, complete a required check or proceed with an offer. Declining consent to interview recording or AI notetaking will not prevent you from taking part in the recruitment process.
Your rights
Subject to the conditions and exemptions in applicable law, you may have the right to:
ask whether we process your personal data and request access to it;
ask us to correct inaccurate or incomplete personal data;
ask us to delete personal data in certain circumstances;
ask us to restrict processing in certain circumstances;
receive personal data you provided in a structured, commonly used and machine-readable format, and ask us to transmit it to another controller, where the right to portability applies;
object to processing based on our legitimate interests, including candidate sourcing;
withdraw consent at any time where processing is based on consent, without affecting processing carried out before withdrawal;
not be subject to a decision based solely on automated processing where Article 22 applies; and
lodge a complaint with the Isle of Man Information Commissioner or another supervisory authority that is competent under applicable law.
To exercise a right, email dpo@red-play.games and legal@red-play.games in copy of the email. We may request information needed to verify your identity. Rights are not absolute; for example, we may need to protect another person's rights, preserve legally privileged information, or rely on an applicable exemption for confidential references or legal claims. We will explain our decision if we cannot comply in full.
Contact and complaints
Questions, requests and concerns should be sent to:
Data Protection Officer
RedPlay Limited
The Engine House, Alexandra Road, Castletown, Isle of Man, IM9 1TG
Email: dpo@red-play.com
We encourage you to contact us first so that we can try to resolve the issue. You also have the right to complain to:
Isle of Man Information Commissioner
P.O. Box 69, Douglas, Isle of Man, IM99 1EQ
Telephone: +44 1624 693260
Email: ask@inforights.im
Website: www.inforights.im
Changes to this Notice
We may update this Notice to reflect changes in law, our recruitment practices or the services we use. The current version will show its effective date. If a change materially affects processing already under way, we will take reasonable steps to bring it to your attention.