Privacy Policy.
How we collect, use, and protect your personal data. Version 3.1 · Last updated: 19 September 2026.
Controller: MyJob (myjob.mt) is operated by Fusion Core Technologies Malta.
Address: Regus, Tower Business Centre, 2nd floor, Tower Street, Swatar BKR 4013, Malta.
Contact: hello@myjob.mt
Version: 3.1 · Last updated: 19 September 2026
This policy explains what personal data we collect through MyJob, why, who receives it, how long we keep it, and your rights. Please read it together with our Terms & Conditions and our Cookies & Analytics page.
1. Who we are
Fusion Core Technologies Malta (“we”, “us”, “our”) operates the MyJob website at myjob.mt (the “Site”) and is the data controller for the personal data described in this policy, within the meaning of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and Malta's Data Protection Act (Cap. 586). For any question about this policy or your personal data, email hello@myjob.mt.
2. What MyJob does
MyJob is a self-service job board for roles in Malta and Gozo. A Recruiter signs in, submits a listing, and publishes it, normally by paying for it. The listing is then live for 30 days. We also add some listings ourselves (Section 3.3).
Each listing contains either a link to the employer's own application page or a contact email address. These details are shown only when a visitor asks to reveal them and an automated check confirms that the request comes from a real browser. No account is needed to reveal them.
We do not collect CVs, resumes, or job applications, and we take no part in the hiring process. When a Candidate follows an application link or emails a Recruiter, that happens outside our platform and is between the Candidate and the Recruiter (Section 11).
3. The personal data we collect
3.1 Account data
You can create an account with Google sign-in or with an email address and password.
- Google sign-in. We receive and store your name, your email address, the address of your profile picture, if you have one, and the sign-in credentials Google issues for your account.
- Email and password. We store your name, your email address, and a hash of your password, never the password itself. We email you a link to verify your address, and another if you ask to reset your password.
For every account we also store your role, whether your email address is verified, when the account was created and last updated, your answer when we ask whether you want marketing emails from us, any pricing arrangement we have agreed with you, and, if we restrict your account, the restriction and its reason.
3.2 Session and security data
When you sign in, we create a session record containing a session token, your IP address, your browser's user agent string, and the expiry time. A session lasts 7 days and is renewed while you keep using the Site. We also use your IP address for a short time to limit repeated sign-in attempts.
When you reveal a listing's application details or upload a logo, a bot-protection service run by our hosting provider collects technical signals about your browser and device to check that the request comes from a real browser. If the check fails, the request is blocked.
3.3 Listing data
When a Recruiter submits a listing, we collect the company's name, website, and logo, the job title and description, the location, the employment type and work arrangement, whether the Recruiter is a recruitment agency, salary information, and either an application link or a contact email address. We link the listing to the Recruiter's account. We may also ask a Recruiter by email for business details such as a company registration number, a VAT number, a licence, or a work email address.
We also add some listings ourselves, for example at an employer's request.
Listings are about businesses, but they can contain personal data, such as a named contact person or a personal email address. If your details appear in a listing, they were provided by the Recruiter or employer behind it. You can ask us to remove them at any time.
We use an AI model to generate tags and a short summary from each listing's text, and we publish both with the listing.
3.4 Listing records and statistics
For each listing we keep a record of its history (when it was submitted, published, renewed, changed, expired, or removed), of the Recruiter's acceptance of our Terms at submission, and of any restriction we apply, with the reason and the date.
We count how many times each listing is viewed and how many times its application details are revealed, as totals per listing per day. These counts are not linked to you.
3.5 Payment data
Payments are handled by Stripe under its Managed Payments service. When you pay for or renew a listing, you are taken to a checkout page hosted by Stripe. To start the checkout, we send Stripe your email address and references to your account and the listing. Stripe's Link service is the merchant of record, and purchases appear as “Sold through Link”. Stripe collects your card and billing details directly and acts as an independent controller of that data. We never see or store card numbers or security codes.
We keep a record of each payment: the account and listing it relates to, the amount, currency, and date, Stripe's references, the version of our Terms that applied, and any refund.
3.6 Correspondence
If you email us, report a listing, ask us to reconsider a decision, ask for a refund, or exercise your data rights, we keep the message, your contact details, and our reply.
3.7 Newsletter and marketing choices
If you subscribe to our newsletter, we collect your email address together with the date and time, the form you used, your IP address, and your browser's user agent, as our record of your consent. Your email address is also stored with our email delivery provider so that the newsletter can be sent. After you unsubscribe, we and that provider keep your address marked as unsubscribed so that we do not email you again.
If you have an account, we ask whether you want to receive marketing emails from us, and we record your answer and when you gave it.
3.8 Technical data, analytics, and error monitoring
Server logs. Like every website, the Site receives your IP address and basic request information (such as browser type, the page requested, and the time) each time you load a page. Our hosting provider processes this in short-lived server logs to deliver the Site and keep it secure.
Analytics. We use a cookieless analytics service provided by our hosting provider. It gives us aggregated statistics only, such as page views, referrers, country, and browser type, and cannot identify you or follow you across websites.
Error monitoring. We use an error-monitoring service to find and fix faults. It receives technical information only when something goes wrong: the page or action involved, details of the error, and your browser and device type, which can include an internal account or listing reference. It does not collect IP addresses, does not record your screen or what you type, and is not sent names or email addresses. This data is stored in the EU.
Images. Company logos are delivered by an image hosting service, or in a few cases by a host chosen by the employer. Like any image on the web, the host delivering it receives your IP address.
4. Why we use your data, and our legal bases
| Purpose | Data used | Legal basis (GDPR Article 6) |
|---|---|---|
| Creating and managing your account | Account data | Performance of our contract with you, Art. 6(1)(b) |
| Keeping you signed in, limiting sign-in attempts, and blocking automated traffic | Session and security data | Contract, Art. 6(1)(b), and our legitimate interest in security, Art. 6(1)(f) |
| Publishing listings, generating tags and summaries for them, notifying Google of listing addresses, and featuring listings in our newsletter and social channels | Listing data | Contract with the Recruiter, Art. 6(1)(b). For personal data of other people that appears in a listing, and for listings we add ourselves: our legitimate interest in running a job board, Art. 6(1)(f) |
| Counting views and reveals per listing | Listing statistics (not linked to you) | Our legitimate interest in giving Recruiters basic results, Art. 6(1)(f) |
| Sending service emails, such as email verification, password reset, confirmation that a listing is live, or a notice about your account or listing | Name, email address | Contract, Art. 6(1)(b) |
| Verifying Recruiters, moderating listings, preventing fraud, and enforcing our Terms, including suspensions, posting blocks, and bans | Account, listing, session, and security data | Our legitimate interest in keeping the Site genuine and safe, Art. 6(1)(f), and legal obligation where the law requires a step, Art. 6(1)(c) |
| Handling reports about listings and requests from authorities | Correspondence | Legal obligation, Art. 6(1)(c), and legitimate interests, Art. 6(1)(f) |
| Keeping evidence of what was agreed and delivered, and handling refund requests, chargebacks, disputes, and legal claims | Listing records, payment records, correspondence | Our legitimate interest in establishing, exercising, and defending legal claims, Art. 6(1)(f) |
| Keeping accounting and tax records | Payment records | Legal obligation, Art. 6(1)(c), under Maltese company, tax, and VAT law |
| Sending the newsletter and marketing emails, and keeping proof of your consent | Email address, consent record, marketing choice | Consent, Art. 6(1)(a). For the proof of consent and the unsubscribed list: legal obligation and legitimate interests, Art. 6(1)(c) and (f) |
| Answering your emails and requests | Correspondence | Legitimate interests, Art. 6(1)(f), or legal obligation where you exercise a legal right, Art. 6(1)(c) |
| Running, securing, monitoring, and improving the Site | Technical data | Legitimate interests, Art. 6(1)(f) |
Where we rely on legitimate interests, we have weighed them against your rights and concluded that they are not overridden. You can object at any time (Section 8).
You are not legally required to give us any personal data. Without account data we cannot give you an account, and without listing and payment data we cannot publish a listing.
5. Who receives your data
5.1 Service providers acting for us (processors)
We use a small number of specialist companies to run the Site. Each acts on our instructions under a data processing agreement and may use the data only to provide its service to us:
- Hosting provider (United States): hosts the Site, keeps server logs, resizes images (including profile pictures, which our server fetches from Google), and provides the analytics and bot-protection services described in Sections 3.2 and 3.8.
- Database provider (United States company, data stored in the EU): hosts our database.
- Image hosting service (United States): stores company logos and delivers them to visitors.
- Email delivery provider (United States): delivers our emails and holds our newsletter list.
- AI provider (United States): provides the model that tags and summarises listings. We send it a listing's public text only, never account data. If a Recruiter writes contact details into a description, they are included. The provider does not use this data to train its models.
- Error-monitoring service (United States company, data stored in the EU): receives the error reports described in Section 3.8.
- Our mailbox provider: stores the emails sent to hello@myjob.mt.
You can ask us for the current names of these providers by emailing hello@myjob.mt.
5.2 Independent controllers
- Google Ireland Limited: provides Google sign-in and decides how it processes your data during authentication. Google also crawls public listing pages for Google Search and Google Jobs. When a listing is published, renewed, expires, or is removed, we send Google the listing's web address so that Google updates its index. No personal data is included.
- Stripe and Link: process your payment as merchant of record, issue your receipt or invoice, and handle payment support, refunds, and disputes under their own privacy policies (stripe.com/privacy and link.com/privacy). If a payment is disputed, we may send Stripe, the card scheme, and the bank involved our records of your acceptance of the Terms, the publication of the listing, and our correspondence with you.
5.3 The public
Listing content is public: company name, website, and logo, job title, description, location, employment details, salary, tags, and the AI summary. It can be indexed by search engines, including Google Jobs, and we may feature it in our newsletter and on our social channels. Application links and contact email addresses are shown to any visitor who reveals them (Section 2). After a listing expires, its page stays viewable at the same address, marked as closed, without application details, and excluded from search engines, until it is deleted (Section 7).
5.4 Recruiters and Candidates
We do not give Recruiters any personal data about Candidates. Recruiters see only the view and reveal totals for their own listings. Candidates receive nothing about a Recruiter beyond what is in the listing.
5.5 Authorities, advisers, and successors
We may disclose personal data to courts, law enforcement, regulators, and other authorities where the law requires it or where we report suspected fraud, and to our professional advisers under a duty of confidentiality. If MyJob is sold or transferred to another operator, your data may pass to that operator, who must continue to honour this policy.
We do not sell your personal data and do not share it with advertisers.
6. International transfers
Some of our providers process personal data in the United States. Where personal data leaves the European Economic Area, it is protected by an adequacy decision of the European Commission, including the EU-US Data Privacy Framework, or by Standard Contractual Clauses. Email hello@myjob.mt for a copy of the relevant safeguards.
7. How long we keep your data
| Data | How long we keep it |
|---|---|
| Session data, email verification and password reset codes | Until you log out or they expire. Expired entries are deleted daily |
| User accounts | Until you ask us to delete your account |
| Live listings | 30 days from publication or renewal |
| Expired and deleted listings, with their logo and statistics | 12 months after expiry or deletion, then deleted |
| Payment and refund records | Up to 10 years from the transaction, as Maltese company, tax, and VAT law require, even if the account or listing is deleted |
| Correspondence, reports, and verification details | For as long as needed to handle the matter and any dispute or claim that follows |
| Newsletter subscription and consent record | Until you unsubscribe. We then keep your address and consent record marked as unsubscribed, so that we do not email you again and can show that you had subscribed |
| Account restrictions and their reasons | For as long as the restriction is active, or for as long as the related listing record exists |
| Server logs and error reports | For the limited periods set by the providers concerned |
Deleting your account. Email hello@myjob.mt from the address on the account. We then delete your account and your listings. Some data may be kept where the law requires it, for example payment records, and is deleted once that period ends.
8. Your rights
Under the GDPR you have the rights listed below. To use any of them, email hello@myjob.mt. We reply within one month, which can be extended by two months for complex requests. We may ask you to confirm your identity first, for example by writing to us from the email address on your account.
- Access (Art. 15). Ask for a copy of the personal data we hold about you.
- Rectification (Art. 16). Ask us to correct inaccurate or incomplete data.
- Erasure (Art. 17). Ask us to delete your data. We will do so unless we have to keep it by law (for example payment records) or need it for a legal claim.
- Restriction (Art. 18). Ask us to pause our use of your data in certain circumstances.
- Portability (Art. 20). Ask for the data you gave us in a commonly used, machine-readable format, where we process it by automated means under contract or consent.
- Objection (Art. 21). Object to processing based on legitimate interests. If you object to direct marketing, such as our newsletter, we stop.
- Withdrawing consent. Where we rely on consent, you can withdraw it at any time. This does not affect processing that took place before you withdrew it.
Automated decisions. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. Decisions to suspend or remove a listing, or to restrict an account, are taken by a person. An automated bot check can block a request to reveal application details or to upload a logo; if that happens to you, email us and a person will help.
9. Cookies
For the cookies and browser storage we use, see our Cookies & Analytics page.
10. Newsletter
We send the newsletter only to people who have opted in. We never subscribe you automatically or as a condition of using the Site. Every newsletter has an unsubscribe link, and your request takes effect from the next newsletter.
11. Recruiters' responsibility for Candidate data
When a visitor follows an application link or reveals a contact email address, everything that follows, including any CV or personal data the Candidate sends, passes directly between the Candidate and the Recruiter, outside our platform. We do not receive, store, or have access to it. The Recruiter, or the employer it represents, is the sole data controller for that data and is solely responsible for complying with the GDPR and other data protection laws. We encourage Candidates to read an employer's privacy policy before sharing personal information.
12. Children
You must be at least 18 years old to create an account or use the Site. We do not knowingly collect personal data from anyone under 18. If we learn that we have done so, we delete it promptly.
13. Security
We apply appropriate technical and organisational measures to protect personal data, including encrypted connections, hashed passwords, and restricted administrator access. You are responsible for keeping your password and sign-in details confidential and for all activity under your account; tell us at hello@myjob.mt if you think someone else has used it. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security.
14. Changes to this policy
We may update this policy from time to time. When we make material changes, we post a notice on the Site or email you at your registered address. The “Last updated” date at the top shows when the policy was last revised.
15. Your right to complain
If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with a data protection supervisory authority. In Malta this is the Information and Data Protection Commissioner (idpc.org.mt).
16. Contact
Questions about this policy, or requests to use your data rights: hello@myjob.mt.